Official Format Discussion

HTB Content Challenges
1

Official discussion thread for Format. Please do not post any spoilers or big hints.

2

Any nudges for this one? I have figured out a method to write to memory addresses in the stack but can’t really figure out where/how to get to the flag.

3

anyone know if its possible to write less than2 bytes / 4 digit?
%hn seems to be the smallest

4

I could use a nudge too. I‘ve an idea but fail on writing anything

5

Hi guys. I think i miss something in this challenge. I leak anything in binary and can write anything anywhere, but i can’t found a solution to manipulate/stop the infinite loop.

ROP failed due to infinite loop.
GOT Rewrite failed too due to Full-Relro.

I have leak the PIE, the canary and the libc base address.
This binary seem to be easy …

Can someone help me ?

Thanks in advance

6

Feel free to dm me for any doubts.

7

Done and Dusted! Thx @ollypwn for fun challenge.

8

If anyone is interested in exchanging and discussing solutions, please feel free to PM me.

9

Hello, I managed to “solve the challenge locally”, but when I try to connect to the server it raises an error about a file:
“/home/ctf/run_challenge.sh: line 3: 28 Segmentation fault ./format”

I don’t really believe this is due to my script, has someone experienced the same issue?

10

I have a payload that makes the binary generate a reverse shell that works on the one I downloaded, but it doesnt work against the remote.
Anyone able to help?

11

Type your comment> @AlexZander said:

Feel free to dm me for any doubts.

Please contact me on discord for quicker response :- Alex Zander#0764
:slight_smile:

12

This challenge already took 5 evenings of my life. :slight_smile: I have it successfully working pretty much every time, like other people, but it fails to spawn a shell remotely. Could anyone, who successfully solved it, send an MD5 of libc used? I suspect that the one I figured out is just wrong - I checked all matching versions I found on https://libc.rip/ and still all I get are segfaults.

13

Maybe a bit late. ROP is possible in this challenge u just have to be creative:D

14

Spam it. The intended way may not be very reliable.