Baity5 — Binary Exploitation
Binary exploitation challenge from Territoriale 2025. Static analysis and attack strategy — no full exploit solved during competition.
Rop
Split — ret2win with ROP pop rdi Gadget
Classic x86-64 ret2win: overflow the return address, use a pop rdi gadget to pass the /bin/cat flag.txt string as argument, jump to system.
Doge Ransom 2 — ROP ret2puts Leak then ADMIN re-login
Overflow the IBAN field to leak the binary’s own password via puts, then re-login as ADMIN using the leaked credential and repeat the overflow to reach the flag path.
Emergency Call — ROP Syscall Chain for execve
Write /bin/sh into a known writable address, then build a ROP chain that sets rax=59, rdi=/bin/sh, rsi=0, rdx=0 using dedicated pop gadgets and a syscall instruction to get a shell.
Guess the Number 2 — ROP Chain GOT Overwrite via gets
Build a ROP chain that calls gets twice to plant arbitrary data in the GOT, redirect strcspn to a shellcode stub, then trigger the win print path.
Terminator — Canary Leak + Full ret2libc
Overwrite the canary’s null byte to leak the full 8-byte cookie over printf, simultaneously leak a saved RBP to base the stack, then use puts@got to find libc base and call system(’/bin/sh’) — all in two trips through the same vulnerable function.