Challenge 5: Last Call

ChallengesChallenge 5 of 5240 minutesChallenge

Last Call

The after-hours desk keeps slips on a pad and takes a night note at the counter. A slip is read back as it was filed, and the note is read back one line at a time, where a line is eighty characters. The desk also has a strongroom that nothing opens.

Your goal is to get the strongroom’s contents printed.

Hands-on lab

There are no milestones on this page and no hints. Read How These Challenges Work first.

Finish Stack Smashing, Mitigations and The Heap first. You will also need python3-ropgadget, which is already on the VM.

Work inside the Ubuntu Desktop 24.04.4 LTS x86-64 course VM with GCC 13.x, GNU binutils 2.42 and GDB 15.x. Address randomization must stay at its default.

Get the files

Download last-call-v1.0.0.tar into ~/underdunn-course/downloads and verify the release digest:

cd ~/underdunn-course/downloads
sha256sum last-call-v1.0.0.tar

55e3eafa5f1c9766ccf5f230ff37325d36d8454ffa95fcb68e34090f758b7a00  last-call-v1.0.0.tar

Don’t continue if it differs. Download a fresh copy and verify it again.

mkdir -p ~/underdunn-course/labs/last-call
tar -xf last-call-v1.0.0.tar -C ~/underdunn-course/labs/last-call
cd ~/underdunn-course/labs/last-call/last-call-v1.0.0
sha256sum -c CHECKSUMS.sha256
sh build.sh

Every listed file has to report OK. Read build.sh before you run it. Every other build in this course has taken something off that line. This one takes nothing off.

Safety note

Scope, and what you are not going to need

Build and run only the program you build from this archive, inside the isolated course VM. The result is one line on standard output.

Do not brute force anything. Two of the values you need are different on every run, but both of them can be read. Do not guess the value the compiler put on the stack to catch you, and do not guess where the program was loaded.

Leave address randomization alone. Turning it off replaces this challenge with a much smaller one.

Everything the last step needs is inside this binary, so you will not need to find anything in the C library. Reaching execution here means borrowing instructions that are already there. Nothing in this challenge needs a shell, and nothing should leave the process.

Whatever you build has to do all of its work inside one conversation with one process, because one of the values you recover stops being true the moment that process exits.

The flag

Paste exactly what the strongroom held, with no surrounding whitespace:

Check your flag

Enter the complete flag, including UNDERDUNN{ and the closing brace. The check happens in your browser; the flag is not sent anywhere.

Check flag

Reset and cleanup

The desk keeps no state between runs, and a run that ends badly ends the process. For a full reset of the files:

cd ~/underdunn-course/labs/last-call
rm -rf -- last-call-v1.0.0
tar -xf ~/underdunn-course/downloads/last-call-v1.0.0.tar -C .
cd last-call-v1.0.0
sha256sum -c CHECKSUMS.sha256
sh build.sh

Keep the verified archive and any solver or modified source you want to revisit. Before a reset, copy those files outside the directory being replaced.