Challenge Description
Recover the flag from an ELF program without waiting through its 75-year delay.
The challenge provides the print_flag ELF binary. Its description says that the program prints the flag after sleeping for 75 years, suggesting that waiting is not the intended solution. The goal is to inspect the binary and invoke the hidden flag-printing routine directly.
Recon / Initial Analysis
GDB reveals a dedicated show_flag routine in the stripped ELF.
(gdb) info functions
0x00000000000011b0 show_flag
0x00000000000019d0 main
The stripped binary still exposes show_flag, while main is the normal entry point. This provides a direct target for the debugger.
Technical Analysis
After stopping at main, call show_flag through its runtime address to bypass the long sleep path.
break main
run
call ((void (*)())0x5555555551b0)()
A direct call before starting the inferior fails. After break main and run, the PIE runtime address shown by GDB can be called with an explicit void function-pointer cast, avoiding the unknown return-type error and bypassing sleep().
Solution
Start under GDB, break at main, and call show_flag with a cast function pointer.
gdb -q print_flag
(gdb) break main
(gdb) run
(gdb) call ((void (*)())0x5555555551b0)()
The command sequence starts the ELF under GDB, stops at main, and invokes show_flag at its runtime address.
Validation
The behavior was reproduced with the supplied implementation and the captured challenge output was checked.
$ (gdb) call ((void (*)())0x5555555551b0)()
Alpaca{G00d_Morning_AlpacaH4ck!}The attached GDB execution reached main and printed the exact flag from show_flag.
Flag
The flag recovered from the verified solution.
Alpaca{G00d_Morning_AlpacaH4ck!}