Challenge 4: Closedown

ChallengesChallenge 4 of 5150 minutesChallenge

Closedown

The transfer depot files dockets into numbered slots and pins the current draft to the board. At the end of the day it copies its day-end line out, closes the books, and reads the line back to whoever is still standing at the counter.

Your goal is to get the depot to read back more than it meant to.

Hands-on lab

There are no milestones on this page and no hints. Read How These Challenges Work first.

Finish Bug Classes and Primitives and The Heap first.

Work inside the Ubuntu Desktop 24.04.4 LTS x86-64 course VM with GCC 13.x, GNU binutils 2.42 and GDB 15.x. Address randomization can stay at its default and makes no difference here.

Get the files

Download closedown-v1.0.0.tar into ~/underdunn-course/downloads and verify the release digest:

cd ~/underdunn-course/downloads
sha256sum closedown-v1.0.0.tar

ca749f7f46fd03506283aec5d50f686df5f89d9979e65c588bffe6410a31a237  closedown-v1.0.0.tar

Don’t continue if it differs. Download a fresh copy and verify it again.

mkdir -p ~/underdunn-course/labs/closedown
tar -xf closedown-v1.0.0.tar -C ~/underdunn-course/labs/closedown
cd ~/underdunn-course/labs/closedown/closedown-v1.0.0
sha256sum -c CHECKSUMS.sha256
sh build.sh

Every listed file has to report OK. Build it with -Wall -Wextra as well, and notice what you get back. Compare that result with the normal path.

Safety note

Scope, and the aborts

Build and run only the program you build from this archive, inside the isolated course VM. The result is one line on standard output.

Do not brute force anything. Every offset here can be derived, and nothing changes between runs. If a payload works once it will work every time.

Some attempts will end with the C library printing a line and killing the process. That is not the approach failing. The message names which of the allocator’s assumptions you broke, and it is more specific than it first looks, so read it before you change anything.

Nothing in this challenge needs a shell, nothing should leave the process, and no code of your own should run.

The flag

Paste exactly what the depot read back, with no surrounding whitespace:

Check your flag

Enter the complete flag, including UNDERDUNN{ and the closing brace. The check happens in your browser; the flag is not sent anywhere.

Check flag

Reset and cleanup

The depot keeps no state between runs, and a run that ends badly ends the process. For a full reset of the files:

cd ~/underdunn-course/labs/closedown
rm -rf -- closedown-v1.0.0
tar -xf ~/underdunn-course/downloads/closedown-v1.0.0.tar -C .
cd closedown-v1.0.0
sha256sum -c CHECKSUMS.sha256
sh build.sh

Keep the verified archive and any solver or modified source you want to revisit. Before a reset, copy those files outside the directory being replaced.