CSAW 2019 traveller — high-level notes

CTF challenge from CSAW 2019: a trip-management ELF (add / change / delete / check trips) used as a pwnable.

Challenge theme

• Menu-driven allocator around a small trip structure (destination buffer + distance)
• Fixed-size trip slots; change path takes a user-supplied index
• Common CTF protections in the original binary notes: NX on, canary/PIE off or weak, partial RELRO (as reported in the source)

Vulnerability class / root cause

• Signed integer / bounds check weakness on the trip index in the change path: a signed type can accept negative values that still pass a “too large” check, so the index arithmetic can point outside the intended trip array.
• Conceptually this is an out-of-bounds write through a structure pointer table, not a novel bug class.

Impact (abstract)

In the challenge setting, corrupting adjacent or unintended pointers could hijack control flow and yield arbitrary code execution in the process. Outside CTF, the same pattern in production software is memory corruption with RCE risk if reachable.

Mitigations / lessons

• Use unsigned indices and reject any value >= slot count (and == sentinel) before pointer math.
• Prefer safe abstractions (bounds-checked slices) over raw C arrays of pointers.
• Enable modern hardening (PIE, full RELRO, canary, fortify) as defense-in-depth—not a substitute for correct bounds checks.

Solve steps and PoC omitted.