Project Mangoo

The brief

A network gateway is listening for operators. Authenticate to the console and recover the flag.

• project-mangoo.zip, 66 KB

In short

A Windows gateway console checked its channel number only from above. Negative channels leaked the telemetry buffer, the root key and the program base, and channel -2 called a pointer the user could write. Two stack pivots into the buffer printed the root key.

A gateway console under Wine

The gateway is a Windows program served under Wine. Its login answer can be worked out from the challenge it prints. Past the login it offers six options, and three of them matter.

A channel number with no floor

Query and Sync read the channel into a signed 16 bit number and reject only values above 15. Negative channels pass the check and reach memory below the console's channel records.

Three channels, three addresses

Query prints the values it finds at a channel. Channel 0 gave the telemetry buffer at 0x7e0000, channel -1 the copy of the root key at 0x7f0000 and channel -3 the program base at 0x140000000.

Channel -2 makes a call

Sync follows the same number and then calls a code pointer it finds there. On channel -2 that pointer comes from memory any user fills through Ingest, so the lab chose where the program jumps.

The stack, moved deep into the buffer

The lab wrote a return chain from the program's own instructions into the 16 KB telemetry buffer. Two pivots move the stack 0x2af8 bytes in, so every call that follows has mapped memory under it.

The root key, printed

The chain calls puts on the root key, flushes the output and exits cleanly. It needed no shellcode. Three runs against the live gateway printed the same flag.

The insight

A channel number checked only from above let negative values read memory and reach a call through a pointer the user controls.

The flag

hiCTF{n0_g4dg3ts_n0_sh3llc0d3_jusT_p1v0t_d33p3r_7a6304a476}