Hack The Box / Cyber Apocalypse CTF 2026 / 2026-07-29

RINg the Bell (pwn)

Exploit a buffer overflow vulnerability to call the `bell` function and spawn a shell.

We are given a binary ring_the_bell:

file ring_the_bell

ring_the_bell: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=be56d5213e9b1294097e8ed137db3c8d7f86d0c6, for GNU/Linux 3.2.0, not stripped

Let’s load the binary in Ghidra. This is the decompiled code of the main function:

undefined8 main(void)

{
  undefined8 local_28;
  undefined8 local_20;
  undefined8 local_18;
  undefined8 local_10;

  puts(&DAT_00402070);
  info("Rin! Ring the bell to call for reinforcements!\n\n[Rin]: ");
  fflush(stdout);
  local_28 = 0;
  local_20 = 0;
  local_18 = 0;
  local_10 = 0;
  read(0,&local_28,0x60);
  info("D-d-did they hear us..?\n");
  return 0;
}

There is a buffer overflow vulnerability. The buffer is only 32 bytes long, but we are reading 96 bytes into it.

Let's check the security features of the binary:

checksec ring_the_bell

    Arch:       amd64-64-little
    RELRO:      Full RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No

The binary has no stack canary, and it is not position independent, therefore we can call any function in the binary by overflowing the buffer and overwriting the return address.

There is a function called bell in the binary, which spawns a shell. Thus we can exploit the buffer overflow to call this function and get a shell.

See the script sol.py for the solution.