Challenge 3: Gate House

ChallengesChallenge 3 of 5150 minutesChallenge

Gate House

The gate house logs passes. The night warden writes each pass onto one form, every record arrives with its own length, and each one is read back as it was filed. The shift runs until the warden closes it. The gate house also has a night vault that nothing calls.

Your goal is to get the vault to print.

Hands-on lab

There are no milestones on this page and no hints. Read How These Challenges Work first.

Finish Stack Smashing and Mitigations first.

Work inside the Ubuntu Desktop 24.04.4 LTS x86-64 course VM with GCC 13.x, GNU binutils 2.42 and GDB 15.x. Address randomization can stay at its default.

Get the files

Download gate-house-v1.0.0.tar into ~/underdunn-course/downloads and verify the release digest:

cd ~/underdunn-course/downloads
sha256sum gate-house-v1.0.0.tar

5dee7e8bded8fcf462382cd77fc75e4b28a9d362552982912579610c228dae5e  gate-house-v1.0.0.tar

Don’t continue if it differs. Download a fresh copy and verify it again.

mkdir -p ~/underdunn-course/labs/gate-house
tar -xf gate-house-v1.0.0.tar -C ~/underdunn-course/labs/gate-house
cd ~/underdunn-course/labs/gate-house/gate-house-v1.0.0
sha256sum -c CHECKSUMS.sha256
sh build.sh

Every listed file has to report OK. Read build.sh before you run it, because one of its flags tells you something about what you are not going to have to do.

Safety note

Scope, and one attempt in forty

Build and run only the program you build from this archive, inside the isolated course VM. The result is one line on standard output.

Do not brute force anything. In particular, do not guess the value the compiler put on the stack to catch you. It can be read, and reading it is the challenge.

About one attempt in forty fails for a reason outside your control. If a payload that worked stops working, run it again before you change it, and compare what changed.

Reaching execution here means reaching a function that already exists and prints a line. Nothing in this challenge needs a shell, and nothing should leave the process.

The flag

Paste exactly what the vault printed, with no surrounding whitespace:

Check your flag

Enter the complete flag, including UNDERDUNN{ and the closing brace. The check happens in your browser; the flag is not sent anywhere.

Check flag

Reset and cleanup

The gate house keeps nothing between runs. For a full reset of the files:

cd ~/underdunn-course/labs/gate-house
rm -rf -- gate-house-v1.0.0
tar -xf ~/underdunn-course/downloads/gate-house-v1.0.0.tar -C .
cd gate-house-v1.0.0
sha256sum -c CHECKSUMS.sha256
sh build.sh

Keep the verified archive and any solver or modified source you want to revisit. Before a reset, copy those files outside the directory being replaced.