SunshineCTF 2024 writeup-by.naup96321
Author: 堇姬NaupWAN - r.k.10
This is myself some solve script and easy writeup. Just record some questions
My solve list
My team score board
ScriptingThis catagory challenge give you one git bundleUse
1git clone <git bundle> <folder path>
can get git.
2024-10-022.8k words15 mins
Pwnable.tw-BookWriter
Pwnable.tw-BookWriter
Author: 堇姬Naup
libcglibc all in one 中沒有 2.23-0ubuntu5所以去網路上找libchttps://launchpad.net/ubuntu/xenial/amd64/libc6/2.23-0ubuntu5
把amd64載下來
1dpkg -X libc6_2.23-0ubuntu5_amd64.deb .
在libs裡面就有ld跟libc了
patchelf直接patch上去
12patchelf --set-interpreter ld-2.23.so bookwriterpatchelf --rep
2024-09-252.2k words12 mins
Pwnable.tw-Secret Of My Heart
Pwnable.tw-Secret Of My Heart
Author: 堇姬Naup
libcglibc all in one 中沒有 2.23-0ubuntu5所以去網路上找libchttps://launchpad.net/ubuntu/xenial/amd64/libc6/2.23-0ubuntu5
把i386載下來
1dpkg -X libc6_2.23-0ubuntu5_amd64.deb .
在libs裡面就有ld跟libc了
patchelf直接patch上去
12patchelf --set-interpreter ld-2.23.so secret_of_my_hear
2024-09-231k words5 mins
Pwnable.tw-Dubblesort
Pwnable.tw-Dubblesort
Author: 堇姬Naup
libcglibc all in one 中沒有 2.23-0ubuntu5所以去網路上找libchttps://launchpad.net/ubuntu/xenial/i386/libc6/2.23-0ubuntu5
把i386載下來
1dpkg -X libc6_2.23-0ubuntu5_i386.deb .
在libs裡面就有ld跟libc了
patchelf直接patch上去
12patchelf --set-interpreter ld-2.23.so dubblesortpatchelf --replac
Pwnable.tw-Secret Garden
Author
libcglibc all in one 中沒有 2.23-0ubuntu5所以去網路上找libchttps://launchpad.net/ubuntu/xenial/amd64/libc6/2.23-0ubuntu5
把i386載下來
1dpkg -X libc6_2.23-0ubuntu5_amd64.deb .
在libs裡面就有ld跟libc了
patchelf直接patch上去
12patchelf --set-interpreter ld-2.23.so seethefilepatchelf --replace-n
2024-09-202.3k words13 mins
Pwnable.tw-seethefile
Pwnable.tw-seethefile
Author: 堇姬Naup
libcglibc all in one 中沒有 2.23-0ubuntu5所以去網路上找libchttps://launchpad.net/ubuntu/xenial/i386/libc6/2.23-0ubuntu5
把i386載下來
1dpkg -X libc6_2.23-0ubuntu5_i386.deb .
在libs裡面就有ld跟libc了
patchelf直接patch上去
12patchelf --set-interpreter ld-2.23.so seethefilepatchelf --replac
2024-09-161.6k words8 mins
Pwnable.tw-3x17
Pwnable.tw-3x17
Author: 堇姬Naup
分析一樣IDA開逆這題把debug symbol全部拔掉,我們先定位main在哪裡
start12345678910111213141516171819// positive sp value has been detected, the output may be wrong!void __fastcall __noreturn start(__int64 a1, __int64 a2, __int64 a3){ __int64 v3; // rax unsigned int v4; // esi __int64