cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

changed repo structure

Browse Source
This commit is contained in:
cato447
2025-06-06 02:50:04 +02:00
parent e887de976a
commit 6e6ee357b8
8848 changed files with 2089898 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
training/h4tum/IntroZ3/tasks/chall2_dreamer/README.md Normal file
View File

@@ -0,0 +1,14 @@
This pwn/misc challenge was part of GPN CTF 2024
The challenge:
- We can execute 4 bytes of arbitrary shellcode followed by 100 bytes of shellcode generated by a weird RNG, which we can seed
- We already figured out a short sequence (9 bytes) of shellcode that we want to execute.
This means we need to find a seed which will generate 5 specific bytes.
The RNG is already re-implemented in python for you in `test.py` and `exploit.py`.
Implement the function `get_seed_for_sequence` to finish the exploit. `test.py` allows you to verify your implementation is correct.
The RNG function `custom_random` takes a current state variable (initially the seed) and will return a tuple of (next byte, next state)
To get the flag from the finished exploit, run: `./exploit.py courses.sec.in.tum.de 13372`
Note, the shellcode and exploit succeeds only with a probability of 50%, you may need to run it multiple times.