Question

Bad system call
[    5.004037] reboot: Power down```
When I try to boot up the box using my machine it seems seccomp filter is executed and hence the box crashes. I have failed to find A way to bypass this. Any hint on setup will be appreciated. Thanks in advance.

#pwnable

Answer 1

If the program is executed by the loader, various system calls are used for reasons such as loading libc from the loader

-nostdlib and --static options may be useful

ref: https://gcc.gnu.org/onlinedocs/gcc-4.4.2/gcc/Link-Options.html

> strace ./test     
execve("./test", ["./test"], 0x7fffffffda60 /* 73 vars */) = 0
brk(NULL)                               = 0x555555559000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=275847, ...}) = 0
mmap(NULL, 275847, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7f7c000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffff7f7a000
openat(AT_FDCWD, "/usr/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`v\2\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 840, 64) = 840
fstat(3, {st_mode=S_IFREG|0755, st_size=2014520, ...}) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 840, 64) = 840
mmap(NULL, 2038904, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ffff7d88000
mmap(0x7ffff7dac000, 1511424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x24000) = 0x7ffff7dac000
mmap(0x7ffff7f1d000, 323584, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x195000) = 0x7ffff7f1d000
mmap(0x7ffff7f6c000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e3000) = 0x7ffff7f6c000
mmap(0x7ffff7f72000, 31864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ffff7f72000
close(3)                                = 0
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffff7d85000
arch_prctl(ARCH_SET_FS, 0x7ffff7d85740) = 0
set_tid_address(0x7ffff7d85a10)         = 305755
set_robust_list(0x7ffff7d85a20, 24)     = 0
rseq(0x7ffff7d85680, 0x20, 0, 0x53053053) = 0
mprotect(0x7ffff7f6c000, 16384, PROT_READ) = 0
mprotect(0x555555557000, 4096, PROT_READ) = 0
mprotect(0x7ffff7ffb000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
munmap(0x7ffff7f7c000, 275847)          = 0
exit_group(0)                           = ?
+++ exited with 0 +++

2025.04.21. 15:51