Back to writeups
FlagYardpwnhas-solver

Logger

23 Jun 2025 · by 0xIDA

Solvers

Logger

Author: 0xIDA
Platform: FlagYard · Category: pwn · Difficulty: N/A

Solvers

Summary

Heap exploitation challenge on FlagYard (tcp.flagyard.com:14808). The binary has a logger service with write/tofile/delete/print operations. Uses a patched binary with pwntools for local testing.

Structure

  • Category: PWN
  • Challenge Name: Logger
  • Path: ctf/flagyard/pwn/logger/
  • Target: Get a shell on the remote server

Analysis

  • Binary: x86-64 PIE ELF, dynamically linked, not stripped
  • Patched binary available for local testing
  • Exploit: Heap exploitation with libc leak via unsorted bin
  • Technique: Overwrite heap metadata → unsorted bin attack → one_gadget

Solvers

FileStatus
solvers/exploit.pyRemote exploit with pwntools

Connection

tcp.flagyard.com:14808

Files

FilePurpose
files/loggerOriginal binary
files/logger_patchedPatched for local testing
files/libc.so.6Remote libc
files/ld-2.39.soDynamic linker

Tools

  • pwntools
  • patchelf
  • one_gadget
  • gdb / pwndbg

Status

Has solver — Exploit script exists but needs verification against live instance.