Oob on bitfriends' blog

htaas - UofT CTF 2025

Wed, 15 Jan 2025 19:58:53 +0100

While playing UofTCTF I solved hash table as a service (htaas). We were given a simple heap menu, which lets us create, get and set hash table entries:

1. New Hash Table
2. Set
3. Get
4. Exit
>

Upon inspecting the source, we spot some interesting things. There is an array that contains hashTables, i.e. it contains the number of entries in the hash table and its start address:

0x5c1e1caad040 <hashTables>:	0x0000000000000010	0x00005c1e4f4072a0
0x5c1e1caad050 <hashTables+16>:	0x0000000000000000	0x0000000000000000
...

Each hashTable consits of n entries, which look like this:

TLN - snakeCTF 2024

Mon, 09 Sep 2024 08:46:34 +0200

This weekend I played snakeCTF for fun and managed to solve a few pwns. One of them was TLN. The challenge code was pretty simple, introducing a classical OOB index vulnerability:

case OPT_SET:
 print("Index: ");
 index = get_int();

 print("Content: ");
 read_exact(&(notes[index].content), sizeof(item_t) - 1);
 notes[index].content[sizeof(item_t) - 1] = 0;
 break;

As you can see, no bounds checks at all. The notes array consists of elements of item_t, which is defined like the following:

typedef struct {
 char content[8];
} item_t;

To sum it up: we can write 7 bytes at a time relative to the starting address of notes. The declaration of the array is what’s particulary interesting. The keyword thread_local is used here:

valorn't - PlaidCTF 2024

Tue, 23 Apr 2024 20:00:41 +0200

I solved the easy pwn chall “valorn’t” during PlaidCTF while playing with Friendly Maltese Citizens.

As usual, the goal was to win the game and read the flag

Link to heading

 int ret = play_pew_pew_game();

	if (ret == 0) {
		read_flage();
	}

Link to heading

In order to win, is_cheater had to be set and the enemy team win-counter has to be 0