farazsth98

#!/usr/bin/env python3

from pwn import *

elf = ELF("./chall")
libc = ELF("./libc.so.6")
#p = process("./chall", env = {"LD_PRELOAD": "./libc.so.6"})
p = remote("pwn.ctf.zer0pts.com", 9002)

format_str = 0x602100

farazsth98

#!/usr/bin/env python3

from pwn import *

#p = process("./chall")
p = remote("pwn.ctf.zer0pts.com", 9011)

#gdb.attach(p)

# Overwrite rbp with return address array + some offset

farazsth98

Vulnerabilities

This was a two part challenge, and I have to cover the vulnerability for the web version as well because its used in the final exploit for RCE.

Files can be found here.

Bug 1: Bypass validate_path() checks

The create() function is as follows:

farazsth98

The challenge - 2 solves

You can find the challenge files here.

Hackers always love base64.

nc 185.14.184.242 9990

This challenge provided a binary that took some input from the user, and either base64 encoded or base64 decoded it.

farazsth98

TL;DR

All challenge files + exploit can be found here: https://github.com/farazsth98/CTF/tree/master/realworldctf-2024/safebridge

The setup of the challenge is as follows:

1. Two bridge contracts deployed on L1 and L2.
2. WETH is deployed on L2 at hardcoded address L2_WETH.
3. The deployer has already transferred 2 WETH from L1 to L2, so the L1 bridge has 2 WETH in it.
4. The objective is to drain the L1 bridge.