added training

training/srdnlenctf-2025/pwn_kinderheim_511/.gdb_history

@@ -0,0 +1,92 @@
+checksec
+entry
+i f
+heap
+ni
+ni
+ni
+ni
+ni
+ni
+ni
+ni
+ni
+ni
+ni
+up 7
+l
+b
+r
+heap
+heap --help
+heap -v
+heap -s
+heap
+dprintf malloc, "malloc(%p)\n", (void*)$rdi
+help functions
+checkse
+help function
+start
+start
+
+p &main_arena
+ni
+p &main_arena
+show debuginfod urls
+start
+stack
+bt
+heap
+start
+start
+start
+start
+p &main_arena 
+heap
+ni
+ni
+ni
+ni
+ni
+ni
+ni
+in
+ni
+ni
+ni
+ni
+ni
+ni
+ni
+heap
+malloc-chunk
+malloc-chunk 0x555555559090
+heap
+heap chunks
+heap -v
+heap -s
+set exception-verbose on
+heap
+ls
+python print(pwndbg.aglib.heap.current.version)
+python print(pwndbg.aglib.heap.current.version)
+python print(pwndbg.aglib.heap)
+python print(pwndbg.aglib.heap.current)
+python print(pwndbg.aglib.heap)
+start
+ni
+ni
+heap
+python print(pwndbg.aglib.heap.current.version)
+python print(pwndbg.aglib.heap)
+start
+p (struct malloc_state)main_arena
+vis
+heap
+ni
+ni
+heap
+vis
+vmmap heap
+telescope heap 50
+telescope 0x555555559000 50

training/srdnlenctf-2025/pwn_kinderheim_511/solve.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+
+from pwn import *
+
+exe = ELF("./k511.elf_patched")
+
+context.binary = exe
+
+
+def conn():
+    if args.LOCAL:
+        r = process([exe.path])
+        if args.GDB:
+            gdb.attach(r)
+    else:
+        r = remote("addr", 1337)
+
+    return r
+
+
+def main():
+    r = conn()
+
+    # good luck pwning :)
+
+    r.interactive()
+
+
+if __name__ == "__main__":
+    main()