ReplaceMe

Technical Walkthrough

Writeup

Challenge

• Name: ReplaceMe
• Category: Pwn
• Difficulty: Medium
• Mode: hybrid

Summary

ReplaceMe is a fork-per-connection Linux pwn challenge around a sed-like s/old/new/ replacement utility. The binary reads an input string and a replacement expression into adjacent global buffers, then expands the result into a fixed stack buffer without checking the combined output length.

The exploit uses that unchecked expansion to overwrite the saved return address. Because the program prints the expanded stack buffer before returning, the first stage performs a one-byte saved-RIP overwrite back to main and leaks the high bytes of the PIE return address in the same process. A second stage uses a pop rdi; ret gadget to leak puts from the GOT and loop again. The final stage calls system("/bin/sh") from the provided libc and reads flag.txt.

Artifact Inventory

Reference analysis/artifact-inventory.json and summarize the relevant files or remote surface.

• files/extracted/replaceme: 64-bit PIE ELF, dynamically linked, not stripped.
• files/extracted/libc.so.6: matching libc used for ret2libc offsets.
• files/extracted/Dockerfile: service runs the binary through socat ... EXEC:./replaceme.
• Remote instance: <TARGET>:30149.

Analysis

Validated local evidence:

• analysis/source-audit.md records the unchecked stack-copy primitive in do_replacement.
• analysis/objdump-replaceme.txt shows input at 0x4040, replacement at 0x40c0, the local output area beginning at rbp-0xc0, and leave; ret at the end of do_replacement.
• analysis/remote/partial-return-onebyte-probe.bin proves that changing only the saved return address low byte loops execution back to main.
• analysis/remote/partial-return-leak-probe.bin proves the same loop can leak PIE address bytes before returning.
• analysis/remote/libc-leak-probe.bin proves a ROP stage can leak libc through puts(puts@got) and loop again.

Important implementation details:

• A two-byte partial overwrite failed because PIE base randomization affects the second byte. The reliable loop changes only the low byte from the return site at main+0x70 back to main.
• The overflow crosses stack locals used after the memcpy. The payload sets the overwritten tail_len local to -1 so the post-overflow tail copy is skipped.
• The final chain must call system("/bin/sh") without an extra alignment ret; the extra ret variant crashed, while the no-ret variant produced shell output.

Solve

Run:

python3 solve/solve.py --host <TARGET> --port 30149

The solver:

1. Leaks PIE and loops to main.
2. Leaks libc through puts@got and loops to main.
3. Calls system("/bin/sh"), sends cat flag.txt, and writes the flag candidate to loot/flag-candidate.txt.
4. Writes only a redacted transcript to analysis/remote/solve-transcript-redacted.bin.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• For PIE binaries, a one-byte partial overwrite is often more reliable than two bytes when the target and original return site are on the same page.
• Print-before-return stack overflows can provide an information leak even when the primary bug is a write primitive.
• When an overflow corrupts locals that are still used, the exploit must neutralize or preserve those locals before focusing on the saved return address.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: ReplaceMe
• Category: Pwn
• Difficulty: Medium
• Mode: hybrid
• Remote instance: none
• Start time: 2026-06-11T23:14:10Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• do_replacement expands s/old/new/ into a stack output area without a bounds check.
• PIE/NX/full RELRO are enabled, but no stack canary was observed.
• The reliable control primitive is a one-byte saved-RIP overwrite back to main, not a two-byte overwrite.
• Payloads must neutralize overwritten stack locals, especially tail_len, before the function reaches fputs and leave; ret.
• Final solve chain: PIE leak -> libc leak through puts@got -> system("/bin/sh") without an extra alignment ret -> read flag.txt.
• Raw flag is stored only in loot/flag.txt.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Pwn
• Challenge: ReplaceMe
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches