Midnight Sun CTF 2019 gissa2 — high-level notes

CTF pwnable from Midnight Sun CTF 2019 (gissa2): interactive “guess the flag” style binary with seccomp filtering and modern-ish hardening (NX, PIE, RELRO per the source).

Challenge theme

• Binary reads user guesses, compares against flag material loaded at start
• Seccomp blacklist blocks several process/file syscalls (as enumerated in the original with seccomp-tools)
• Core bug discussion: mismatched integer widths between caller and callee for size/counter state

Vulnerability class / root cause

• Integer truncation / width mismatch: narrower stack fields (e.g. 16-bit) are passed into a wider parameter type; promotion and adjacent stack layout let a crafted size affect neighboring state and produce an oversized read → stack buffer overflow.
• Secondary theme in the source: sandbox bypass ideas around filtered syscalls—treated here only as “seccomp policies need careful design,” without bypass recipes.

Impact (abstract)

Stack corruption can leak code addresses (PIE) and hijack control flow inside the challenge process, defeating the intended guess-only interaction. With weak sandboxing, that can mean reading sensitive files the process already opened or equivalent CTF win conditions.

Mitigations / lessons

• Keep length fields a single consistent unsigned type; bounds-check against the actual buffer capacity before every read.
• Avoid packing unrelated counters next to length fields in ways that widen incorrectly across ABIs.
• Treat seccomp as defense-in-depth; still fix memory bugs. Design filters with deny-by-default and review for incomplete coverage.
• Enable stack canaries and keep PIE/RELRO on for defense-in-depth.

Solve steps and PoC omitted.