Assignment: CHALLENGE

This assignment is the take-home portion of the final. It consists of seven challenges. You must complete five of them. You may complete them in any order. They are numbered in approximate order of difficulty. (What I think is likely to be easiest has the lowest number.)

The challenges will be distributed via Canvas under the Files tab as challenge.tgz by 5pm 17 April 2026.

Your task for each challenge

Each challenge consists of:

• an executable named challengeX.exe where X is a number
• for some challenges, a corresponding challengeX.README.txt file with challenge-specific hints and instructions,
• for some challenges, a source file challengeX.c or challengeX.cc or challengeX.l which was used to produce challengeX.exe. This is provided for your reference; your solution must work with the exact executable we supply.
• for some challenges, some other example files starting with challengeX

For each challenge, your task is to create an exploit program (in python or C or C++). Your exploit program must cause the challenge program to produce the correct output when we use it

• like in the rop homework with its input coming from the challenge executable’s output, and its output (to stdout) going to the challenge executable’s input; OR
• redirect its output to a file, then supply that file as input to the challenge executable

When we run the challenge program, we will not disable address space layout randomization and will run them on a system similar to portal. We will run your exploit multiple times with different address randomization, and it must work a majority of the time. It is okay if it occasionally does not work.

Your task is to make the challenge executable’s output end with

      Congratulations, YOUR_NAME!
You have passed this challenge.

    

(or something extremely similar), but where the YOUR_NAME is replaced with your name or computing ID if you prefer. In each case, it is okay if the program also outputs other strings, such as prompts for input, before this string, but this congratulations message should be the last string output, no messages about not passing the challenge should be output, and the program should terminate normally.

(So, for example, if the program prints out:

      Sorry, Congratulations, Student! You have passed this challenge.
You have not passed this challenge.

    

because you supplied a name of “Congratulations, Student! You have passed this challenge”, that is not an acceptable solution.)

A copy of all the files extracted from challenge.tgz be available in the current directory when your exploit program runs. This copy is for the convenience of your program; we will use a fresh, independent copy of the executables to test your program, so modifying these files will not be useful.

Your program may not attempt to interfere with our testing system or affect the challenge program other than by supplying it input.

You should supply each attack program in any one of three formats:

• As a Python 3 program named attackX.py or attackX.py3 where X is the challenge number.
• As a C program named attackX.c where X is the challenge number;
• As a C++ program named attackX.cc where X is the challenge number;

Your program can include comments, which may help us understand what is going on if we can’t get the program to work on our system.

Your program may:

• call the objdump or readelf or ROPgadget or nm or objcopy utilities.
• run gcc or clang (for example, to produce machine code)

General Hints

1. Running Ghidra and/or objdump and/or running the challenge programs under a debugger could be helpful.

2. You can use sys.stdout.buffer.write(b"\xFE\xFD") to write the bytes 0xFE, 0xFD to stdout

3. You can use struct.pack('<Q', 0x123456789A) to get 0x123456789A formatted as an 8-byte little-endnian number in Python 3 (after import struct).

4. You can use ROPgadget to find gadgets in the executables, if you think that would be useful.

   By default, ROPgadget won’t find gadgets that use the syscall instruction and then return. You can change this behavior by passing the --multibr option.

5. env - command runs command with an empty set of environment variables. The wrapper.py from OVER can be adapted to support this way of running programs by setting an empty environment instead of an environment with LD_LIBRARY_PATH=. by editing the third argument to os.execve.

Collaboration

Please do not discuss or expect TAs to answer questions about what startegy you should apply to particular challenges. You are responsible for figuring this out yourself.

You may, however, ask TAs or share general information about how to identify whether an exploit technique is applicable to a particular program or about how to apply an exploit technique to other executables.

You can also definitely ask about any issues regarding doing input or output in Python or C.

We will supply reference solutions to some prior homework assignments. You may use these when constructing your solutions. You may also use your solutions to a prior homework assignment.