: By placing a magic_gadget address at a specific offset ( +0x60 ), the program was forced to execute the desired shellcode or function when it attempted to traverse to the "next" turtle. Execution & Debugging
For a deep dive into the specific assembly and memory offsets used in this exploit, you can view the full technical breakdown on nickcano.com . LetsSplitTurtles.part02.rar
The core of this stage involved crafting a precision payload that aligned with the program's expectations of the turtle structure while redirecting the instruction pointer. : By placing a magic_gadget address at a
The exploit was verified using to step through the turtle traversal logic. A critical finding during this phase was that the RBP (Base Pointer) register did not land at the expected offset, requiring a slight adjustment to the slack space to ensure the magic gadget was reached successfully. The exploit was verified using to step through
: The payload specifically targeted RDX and RAX to set up the final call.
The "Turtles" challenge involved a program that processed nested structures (turtles). Each "turtle" contained pointers to other turtles, creating a complex chain. The objective for Part 2 was to transition from the initial memory leak (achieved in Part 01) to a controlled "magic gadget" execution. Technical Analysis
This write-up covers the second part of the challenge from CSAW CTF, focusing on the exploitation of a recursive data structure to achieve code execution. Challenge Overview