Https- Bit.ly Crackfire May 2026

Challenge type: Binary exploitation (pwn) – 64‑bit Linux Difficulty: Medium / Hard (depends on the exact variant) Points: 500 (CTF typical) TL;DR – The binary is a simple “crack‑the‑code” game that reads a user‑supplied string, checks it against a secret flag stored in the binary, and then prints “Access granted!” on success. The binary contains a classic format‑string vulnerability that lets us leak the address of the secret and later overwrite the check function’s return address to jump to win . By combining an info‑leak with a one‑shot ret2win payload we obtain the flag. Below is a step‑by‑step walkthrough that shows the thought process, the tools used, and the final exploit script (Python + pwntools). Feel free to copy the script and adapt it for the exact binary you downloaded from the short link. 1. Getting the binary The challenge link ( https://bit.ly/crackfire ) resolves to a zip file containing:

chmod +x crackfire file crackfire # crackfire: ELF 64-bit LSB executable, x86‑64, dynamically linked, ... The binary is – symbols are present, making static analysis easier. 2. Quick run‑through Running the binary locally shows the intended user interaction: https- bit.ly crackfire

0x7ffff7a5e000 0x4006f0 0x7ffff7dd18b0 0x4008b0 0x0 0x1 The first pointer ( 0x7ffff7a5e000 ) is a ; the second ( 0x4006f0 ) is _start – an address inside the binary, which is enough to compute the base. Challenge type: Binary exploitation (pwn) – 64‑bit Linux

We’ll use the syntax to reference the n‑th argument directly. 7. Crafting the write payload We want to write the address of win (e.g., 0x5555555552f0 ) into the saved RIP located at stack position 3 (the third argument after the format string). Below is a step‑by‑step walkthrough that shows the

[payload] = <addr_of_ret> <addr_of_ret+4> <format string> We must pad the number of bytes printed so that %n writes the correct value.

# Remote host (if the challenge runs on a remote server) HOST = "challenge.example.com" PORT = 31337

The classic technique is to write the lower 2 bytes, then the upper 2 bytes, then the upper 4 bytes, etc. Since we have a full 64‑bit address we’ll do it in (lower and higher dword) using %n twice. 7.1. Compute split values win_addr = 0x5555555552f0 low = win_addr & 0xffffffff # 0x5552f0 high = win_addr >> 32 # 0x5555 We need to place the low dword at the saved RIP, then the high dword at saved RIP+4. 7.2. Choose where to write the two addresses We’ll prepend the two addresses to the format string; they’ll become the first two arguments ( %1$ , %2$ ). Then we’ll use %3$n and %4$n to write to those addresses.