6 ms·
I once wrote an ELF by hand for a CTF challenge. The challenge was to have an shared library such that when it is passed to LD_PRELOAD it spawns a shell by exec
by pgo 6y ago
I once wrote an ELF by hand for a CTF challenge. The challenge was to have an shared library such that when it is passed to LD_PRELOAD it spawns a shell by execve
LD_PRELOAD=<ELF> /bin/true
The constraint being the ELF needed to be less than 196 bytes so obviously it could not be created by gcc. In the end I could not believe it ran, considering the amount of hacks that I had to do to trim it to 193 bytes.
https://github.com/TeamGreyFang/CTF-Writeups/tree/master/PlaidCTF2020/golf.so https://github.com/TeamGreyFang/CTF-Writeups/tree/master/Pla...
- DavidBuchanan 6y agoHere's my writeup/solution for the same challenge, represented as a diagram: https://twitter.com/David3141593/status/1253122980525334529 https://twitter.com/David3141593/status/1253122980525334529
- pgo 6y agoCool diagram. Putting the shellcode in headers is very innovative. I didn't have too much assembly knowledge to trim it further during the competition.
- mayankkaizen 6y agoYour pinned tweet is quite fascinating.
- saagarjha 6y agoYep, it’s fun to see what things glibc will let you get away with ;)