ECSC 25 Polish Qualifications - Caller - Misc challange

Caller

(51 solves)

The description of the challange:

Naming things is hard.

Additionally a netcat service is provided, that runs the following:

1
import os
2
import uuid
3

4

5
def main():
6
    FLAG = open("flag.txt", 'r').read().encode()
7
    arg = input("> ")
8
    blacklist = ['{', '}', ';', '\n']
9
    if len(arg) > 10 or any([c in arg for c in blacklist]):
10
        print("Bad input!")
11
        return
12
    template = f"""
13
#include <stdio.h>
14
#include <string.h>
15

16
char* f(){{
17
    char* flag = "{FLAG}";
18
    printf("%s",flag);
19
    return flag;
20
}}
21

22
void g(char* {arg}){{}}
23

24
int main(){{
25
    g(NULL);
26
    return 0;
27
}}
28
"""
29
    name = "test"
30
    source = f"/tmp/{name}.c"
31
    outfile = f"/tmp/{name}"
32
    open(source, 'w').write(template)
33
    os.system(f"export PATH=$PATH:/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin && gcc {source} -o {outfile}")
34
    os.system(f"{outfile}")
35
    os.remove(source)
36
    os.remove(outfile)
37

38

39
main()

Vulnerability Analysis

Input injection

The vulnerability lies in how the user input is inserted directly into a C function declaration as the name of a parameter:

1
void g(char* {arg}){{}}

Although there is a blacklist in place to filter characters like {, }, ;, and \n, the application does not validate whether the input is a valid C identifier. This leads to the possibility of injecting arbitrary expressions in place of the parameter name, as long as the input stays within 10 characters and avoids the blacklisted characters.

Flag function

The flag is stored in the f() function:

1
char* f(){
2
    char* flag = "{FLAG}";
3
    printf("%s",flag);
4
    return flag;
5
}

We need to find a way to call this function during runtime.

Exploit

Since the user input is inserted directly as a parameter name (without quotes or escaping), we can exploit C’s allowance of function calls or expressions inside brackets for array indexing or pointer operations.

For example, this input:

1
f[!f()]

Gets injected like this:

1
void g(char* f[!f()]) { }

This results in:

1. A call to f() during array indexing expression evaluation - which prints the flag (printf("%s",flag);).
2. The result of !f() is used as an array index. But we don’t care about its value - we just need the side effect of calling f().

> f[!f()]
b'ecsc25{thats_some_weird_variable_name}'

Why does it work?

• The code compiles because C allows expressions like type name[expression] in parameter declarations.
• f[!f()] looks like an array of pointers named f with size !f() - but f() is called as part of evaluating that.
• The expression !f() coerces the return value of f() (a non-null pointer) into a boolean, then negates it. Crucially, evaluating !f() calls f()as part of that process.
• Because f() contains printf("%s", flag);, each evaluation of !f() triggers the flag to be printed, even though the boolean result (0 or 1) is irrelevant to the program’s logic.
• Blacklist bypass: Since f[!f()] contains no braces {}, semicolons ;, or newlines, and is under 10 characters, it bypasses the simple input filter while fully leveraging C’s type and expression rules.