w_hat_documentary

풀이 $ pwn checksec chall [*] '/home/user/바탕화면/zer0ptf/safe_vector/chall' Arch: amd64-64-little RELRO: Full RELRO Stack: No canary found NX: NX enabled PIE: PIE enabled #include #include template class safe_vector: public std::vector { public: void wipe() { std::vector::resize(0); std::vector::shrink_to_fit(); } T& operator[](int index) { int size = std::vector::size(); if (size == 0) { throw "ind..

풀이 Welcome, {{name}}! {% if name == 'admin' %} zer0pts{*****CENSORED*****} {% else %} No flag for you :( {% endif %} 해당 페이지에 admin 으로 로그인을 하면 flag를 알려준다. @app.route('/login', methods=['post']) def auth(): username = flask.request.form.get('username', default='', type=str) password = flask.request.form.get('password', default='', type=str) if len(username) > 32 or len(password) > 32: flask.sessio..

풀이 /* Create a symbolic link */ @symlink($target, $this->root.$name); /* This check ensures $target points to inside user-space */ try { $this->validate_filepath(@readlink($this->root.$name)); } catch(Exception $e) { /* Revert changes */ @unlink($this->root.$name); throw $e; } } } function validate_filepath($path) { if (strpos($path, "/") === 0) { throw new Exception('invalid filepath (absolute ..

파일 정보 $ file chall chall: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=7cf51550bee6566a6972d12ba047bbebef778f7e, not stripped $ pwn checksec chall [*] '/home/user/바탕화면/zer0ptf/oneshot/chall' Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000)..

파일정보 $ file chall chall: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=671697b357d39525a86658e92e5aa52b783012ff, not stripped $ pwn checksec chall [*] '/root/stopwatch/chall' Arch: amd64-64-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x400000) 코드 #include #includ..

파일 정보 $ file chall chall: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped $ pwn checksec chall Arch: amd64-64-little RELRO: No RELRO Stack: No canary found NX: NX disabled PIE: No PIE (0x400000) RWX: Has RWX segments 코드 global _start section .text %macro call 1 ;; __stack_shadow[__stack_depth++] = return_address; mov ecx, [__stack_depth] mov qword [__stack_sh..