Midv-075

Introduction

In the ever-evolving world of [Field/Industry], new technologies, standards, and innovations emerge regularly. One such development that has been garnering attention is [MIDV-075]. Whether it's a newly introduced standard, a software update, or a groundbreaking research project, understanding [MIDV-075] can provide valuable insights into [specific area of interest].

What is MIDV-075?

At its core, [MIDV-075] is [a brief description of what MIDV-075 is]. This could represent a significant shift in [industry/field] by [briefly describe the impact or purpose]. For instance, if MIDV-075 pertains to a technical specification, it might aim to improve [specific aspect] through enhanced [features/technology].

Key Features and Benefits

Applications and Implications

The introduction of [MIDV-075] has far-reaching implications across [specific sectors or industries]. For example, in [industry/field], this development could lead to [expected outcomes or improvements]. It's not just about [specific aspect] but also about how it integrates with existing frameworks and systems, potentially paving the way for [future advancements]. MIDV-075

Challenges and Considerations

While [MIDV-075] presents numerous opportunities, there are also challenges to consider. These might include [list of challenges, such as implementation hurdles, cost factors, compatibility issues, etc.]. Addressing these challenges will be crucial for the successful adoption and integration of [MIDV-075].

Looking Forward

As [MIDV-075] continues to evolve and mature, we can expect [predictions for future developments or impacts]. Whether it's through enhanced performance, broader application, or further innovation, staying informed about [MIDV-075] will be key for professionals and enthusiasts alike in [industry/field].

Conclusion

[MIDV-075] stands as a testament to the ongoing advancements in [industry/field]. By understanding its intricacies, implications, and potential, we can better navigate the landscape of [specific area of interest] and leverage this knowledge to drive future success. “The flag is hidden behind a little‑old‑binary that

Category – Binary Exploitation / Reverse Engineering
Points – 350 (Hard)
Platform – Midpoint Village (MIDV) CTF – 2024 edition

“The flag is hidden behind a little‑old‑binary that thinks it’s a simple calculator.”

Using GDB we printed the stack at the entry of calculate:

(gdb) disas calculate
...
(gdb) info frame
Stack level 0, frame at 0x7fffffffe0b0:
 rip = 0x4006a3  ; calculate
 saved rip = 0x40073f  ; return to print_result
 args = a = 0x7fffffffffffffff, b = 0x1, op = 0x2b ('+')

The saved RIP (0x40073f) is stored at [rbp+8]. Because print_result prints the 64‑bit result as a signed integer with printf("%ld\n", result), we can force the function to return a value that is exactly the saved RIP.

The trick: supply values a and b such that a + b == saved_rip (mod 2^64). Since saved_rip is a known constant (the address of print_result after the call), we can compute the required operands offline.

Important: The saved return address is different each run because of PIE. However, the offset between the saved return address and the base of the binary is constant (0x73f - base). If we leak the saved RIP we can compute the base, then compute the address of system@plt (or any other PLT entry) relative to that base. In infected Vero cells

Hence the attack proceeds in two phases:

Because NX is enabled, we cannot inject shellcode on the stack. The ROP approach is the only viable path.

In infected Vero cells, quantitative RT‑PCR revealed upregulation of IFN‑β, CXCL10, and IL‑6, indicative of an innate antiviral response. However, the viral NS1 protein was shown to bind complement component C4, impairing the classical pathway—a strategy reminiscent of dengue NS1.

The binary runs on Ubuntu 22.04 (kernel 5.15). The following Dockerfile reproduces the exact environment used for development and testing:

FROM ubuntu:22.04
# Install required packages
RUN apt-get update && \
    DEBIAN_FRONTEND=noninteractive apt-get install -y \
        build-essential \
        gdb \
        python3-pip \
        python3-dev \
        python3-setuptools \
        python3-wheel \
        pwntools \
        qemu-user \
        strace \
        ltrace \
        libc6-dev-i386 \
        && rm -rf /var/lib/apt/lists/*
# Add the challenge binary (replace with actual copy step)
ADD midv075 /home/ctf/midv075
RUN chmod +xs /home/ctf/midv075 && \
    chown root:root /home/ctf/midv075
WORKDIR /home/ctf
CMD ["/bin/bash"]

Build & run:

docker build -t midv075 .
docker run -it --rm --cap-add=SYS_PTRACE midv075

Inside the container we have pwntools (python3 -c "import pwn" works) and a non‑root user ctf with permission to execute the set‑uid binary.