> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/quizploit.md). # Quizploit e.picoctf.net closed by remote host. Connection to dolphin-cove.picoctf.net closed. alhamrizvi\@alhams-fedora:\~/Downloads$ nc lonely-island.picoctf.net 65162 ## ========================================================================================================= ELF BINARY ANALYSIS QUIZ ◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉ ◉ ◉ ◉ This is a simple questionnaire to analyze the binary characteristics. ◉ ◉ ◉ ◉ When compiling C/C++ source code in Linux, an ELF (Executable and Linkable Format) file is ◉ ◉ created. The flags added when compiling can affect the binary in various ways, like the ◉ ◉ protections. ◉ ◉ ◉ ◉ Dynamic Linking: ◉ ◉ Dynamic linking is a process where a program uses external code libraries (called shared ◉ ◉ libraries or dynamic link libraries) that are loaded into memory at runtime, rather than ◉ ◉ being built directly into the executable file. ◉ ◉ ◉ ◉ Static Linking: ◉ ◉ The code for all the routines called by your program becomes part of the executable file. ◉ ◉ ◉ ◉ Stripped: ◉ ◉ The binary does not contain debugging information which can be used with debuggers ◉ ◉ like GDB. ◉ ◉ ◉ ◉ Non Stripped: ◉ ◉ The binary contains no debuggig information which makes it difficult for analysis. ◉ ◉ ◉ ◉ Canary: A random/specific value which is stored on the stack for protection against ◉ ◉ buffer overflow. ◉ ◉ ◉ ◉ Run 'file' and 'checksec' commands on the binary to answer the questions. ◉ ◉ ◉ ◉ Find out what are 'pwntools' and how can this library be used for exploit creation. ◉ ◉ ◉ ◉ To run the binary: chmod +x ./vuln , followed by ./vuln ◉ ◉ ◉ ◉ Analyze the provided C program and the corresponding binary to answer the questions. ◉ ◉ ◉ ◉ Answer the questions about this binary to get the flag. ◉ ◉ ◉ ◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉◉ \[\*] Question number 0x1: Is this a '32-bit' or '64-bit' ELF? (e.g. 100-bit) 💡 Hint: Check if the system is x86\_64 or x86. No compilation flag specified means default. > > 64-bit ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0x2: What's the linking of the binary? (e.g. static, dynamic) 💡 Hint: The program uses standard library functions like fprintf, fgets, and system. > > dynamic ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0x3: Is the binary 'stripped' or 'not stripped'? 💡 Hint: By default, binaries compiled without the -s flag contain debugging symbols. > > not stripped ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0x4: Looking at the vuln() function, what is the size of the buffer in bytes? (e.g. 0x10) 💡 Hint: Check the declaration in the function and answer in either hex or decimal > > 0x15 ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0x5: How many bytes are read into the buffer? (e.g. 0x10) 💡 Hint: Check the fgets > > 0x90 ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0x6: Is there a buffer overflow vulnerability? (yes/no) 💡 Hint: Compare buffer size and input size > > yes ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0x7: Name a standard C function that could cause a buffer overflow in the provided C code. 💡 Hint: (e.g. fprintf) > > fgets ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0x8: What is the name of function which is not called any where in the program? 💡 Hint: Analyze the source > > win ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0x9: What type of attack could exploit this vulnerability? (e.g. format string, buffer overflow, etc.) 💡 Hint: Try interpreting the information gathered so far > > buffer overflow ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0xa: How many bytes of overflow are possible? (e.g. 0x10) 💡 Hint: Subtract values > > 0x7b ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0xb: What protection is enabled in this binary? 💡 Hint: Learn to use checksec > > NX ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0xc: What exploitation technique could bypass NX? (e.g. shellcode, ROP, format string) 💡 Hint: Choose from the options > > ROP ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ \[\*] Question number 0xd: What is the address of 'win()' in hex? (e.g. 0x4011eb) 💡 Hint: Use gdb/objdump to find the address > > 0x401176 ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ Correct! ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ## ========================================================================================================= QUIZ COMPLETE! 🎉 PERFECT SCORE! 🎉 You got 13/13 questions correct! Flag: picoCTF{my\_bIn\@4y\_3xpl0it\_fL\@g\_58c7b379} \========================================================================================================= --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/quizploit.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.