SCIST Pwn on zhi旅程 http://localhost:1313/categories/scist-pwn/ Recent content from zhi旅程 Hugo zh-tw ray784523@zhienw.com (Zhi Chen) ray784523@zhienw.com (Zhi Chen) 本部落格所有文章除特別聲明外，均採用 BY-NC-SA 授權協議。轉載請註明出處！ Mon, 08 Jun 2026 21:50:52 +0800 mathter writeup http://localhost:1313/post/mathter/ Mon, 08 Jun 2026 21:10:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/mathter/ mathter writeup

作者：Zhi Chen（ray784523@zhienw.com）

原始碼 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void win1(unsigned int check) {
    if (check == 0xdeadbeef) {
        FILE *fp = fopen("/home/mathter/flag", "r");
        if (fp != NULL) {
            char flag[256];
            if (fgets(flag, sizeof(flag), fp) != NULL) {
                size_t len = strlen(flag);
                if (len > 0 && flag[len - 1] == '\n') {
                    flag[len - 1] = '\0';
                    len--;
                }
                size_t mid = len / 2;
                for (size_t i = 0; i < mid; i++) {
                    putchar(flag[i]);
                }
                putchar('\n');
            }
            fclose(fp);
        } else {
            printf("Failed to open flag file.\n");
        }
    } else {
        printf("Sorry, wrong argument. Try again!\n");
    }
}

void win2(unsigned int check) {
    if (check == 0xcafebabe) {
        FILE *fp = fopen("/home/mathter/flag", "r");
        if (fp != NULL) {
            char flag[256];
            if (fgets(flag, sizeof(flag), fp) != NULL) {
                size_t len = strlen(flag);
                if (len > 0 && flag[len - 1] == '\n') {
                    flag[len - 1] = '\0'; 
                    len--;
                }
                size_t mid = len / 2;
                for (size_t i = mid; i < len; i++) {
                    putchar(flag[i]);
                }
                putchar('\n');
            }
            fclose(fp);
        } else {
            printf("Failed to open flag file.\n");
        }
    } else {
        printf("Sorry, wrong argument. Try again!\n");
    }
}

int goodbye() {
    char response[4];
    printf("Are you sure you want to leave? [Y/n]\n");
    gets(response);
    if (response[0] == 'y' || response[0] == 'Y') {
        printf("Goodbye!\n");
        return 1;
    }
    return 0;
}

void calculator() {
    char input[256]; 
    int x, y, result;
    char op;

    while (1) {
        printf("Enter an operation and two numbers (e.g., 1 + 1) : ");
        fgets(input, sizeof(input), stdin);

        if (input[0] == 'q') {
            printf("Exiting calculator...\n");
            break;
        }

        if (sscanf(input, "%d %c %d", &x, &op, &y) == 3) {
            switch (op) {
                case '+':
                    result = x + y;
                    printf("%d + %d = %d\n", x, y, result);
                    break;
                case '-':
                    result = x - y;
                    printf("%d - %d = %d\n", x, y, result);
                    break;
                case '*':
                    result = x * y;
                    printf("%d * %d = %d\n", x, y, result);
                    break;
                case '/':
                    if (y != 0) {
                        result = x / y;
                        printf("%d / %d = %d\n", x, y, result);
                    } else {
                        printf("Error: Division by zero!\n");
                    }
                    break;
                default:
                    printf("Invalid operation!\n");
            }
        } else {
            printf("Invalid input format. Please use the format: 1 + 1\n");
        }
    }
}


int main() {
    setvbuf(stdin, NULL, _IONBF, 0);
    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);

    

    printf(" __        __   _                            _          __  __       _   _     _            \n");
    printf(" \\ \\      / /__| | ___ ___  _ __ ___   ___  | |_ ___   |  \\/  | __ _| |_| |__ | |_ ___ _ __ \n");
    printf("  \\ \\ /\\ / / _ \\ |/ __/ _ \\| '_ ` _ \\ / _ \\ | __/ _ \\  | |\\/| |/ _` | __| '_ \\| __/ _ \\ '__|\n");
    printf("   \\ V  V /  __/ | (_| (_) | | | | | |  __/ | || (_) | | |  | | (_| | |_| | | | ||  __/ |   \n");
    printf("    \\_/\\_/ \\___|_|\\___\\___/|_| |_| |_|\\___|  \\__\\___/  |_|  |_|\\__,_|\\__|_| |_|\\__\\___|_|\n\n");

    
    while (1) {
        calculator();
	if (goodbye()){
	    break;
	}
    }
    return 0;
}
//gcc -static -o mathter -no-pie -fno-stack-protector -z now -z relro mathter.c

解題

解題思路

在goodbye function有用get函數可以進行overflow,並且利用pop rdi設定參數,分別跳到win1、win2 funtion取得2段flag
PS : 這題要注意的是在取overflow起點時會碰到rax-4,要用該位置+4設為起點
PS : 要覆蓋的位置不要找成main函數的return

本文2026-06-08首發於zhi旅程，最後修改於2026-06-08

]]> SCIST pwn got writeup http://localhost:1313/post/got/ Sat, 06 Jun 2026 04:19:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/got/ got writeup

作者：Zhi Chen（ray784523@zhienw.com）

原始碼

本題無提供原始碼

解題

解題思路

利用更改got表的方式,跳到admin_shell()的function

確認保護機制 

checksec --file=share/got

image

嘗試執行 

User ID: 1
Nickname: 1
PIN: 1
Logging as [1] ... Failed
Incorrect PIN code!

User ID: ^C

image

本文2026-06-06首發於zhi旅程，最後修改於2026-06-06

]]> SCIST pwn SCIST2026 PWN Class - GOT Hijack http://localhost:1313/post/scist2026/got_hijack/ Thu, 04 Jun 2026 19:12:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/scist2026/got_hijack/ SCIST2026 PWN Class - GOT Hijack

作者：Zhi Chen（ray784523@zhienw.com）

原始碼 

#include <stdio.h>
#include <stdlib.h>

// gcc chal.c -o chal -z lazy

unsigned long long array[0x100];

void init()
{
    setvbuf(stdin, 0, _IONBF, 0);
    setvbuf(stdout, 0, _IONBF, 0);
}

void menu()
{
    printf("1: set\n");
    printf("2: get\n");
}

int main()
{
    char buf[0x100] = { 0 };
    int choice;
    int idx;
    unsigned long long value;

    init();

    while (1) {
        menu();
        scanf("%256s", buf);
        choice = atoi(buf);

        printf("idx:\n");
        scanf("%d", &idx);

        if (choice == 1) {
            printf("value:\n");
            scanf("%llu", &value);
            array[idx] = value;
        } else if (choice == 2) {
            printf("%#llx\n", array[idx]);
        }
    }

    exit(1);
}

解題

解題思路

這題可以發現他對陣列的越位讀寫沒有限制,可透過更改GOT表紀錄的地址,調用system got,取得shell

本文2026-06-04首發於zhi旅程，最後修改於2026-06-04

]]> SCIST PWN SCIST2026 PWN Class - ret2plt http://localhost:1313/post/scist2026/ret2plt/ Thu, 04 Jun 2026 07:00:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/scist2026/ret2plt/ SCIST2026 PWN Class - ret2plt

作者：Zhi Chen（ray784523@zhienw.com）

原始碼 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

//  gcc chal.c -o chal -fno-stack-protector -no-pie 

void gadget() {
    __asm__(
        "pop %rdi;" 
        "ret;"      
    );
}

void init_IOBUF(){
    setvbuf(stdin, 0, _IONBF, 0);
    setvbuf(stdout, 0, _IONBF, 0);    
}

int main() {
    init_IOBUF();
    char buffer[8];
    system("echo ret2plt!");

    gets(buffer);

    return 0;
}

解題

解題思路

這題檔案是動態連結,可以調用程式內plt，取得shell

本文2026-06-04首發於zhi旅程，最後修改於2026-06-04

]]> SCIST PWN SCIST2026 PWN Class - One gadget http://localhost:1313/post/scist2026/one_gadget/ Thu, 04 Jun 2026 05:40:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/scist2026/one_gadget/ SCIST2026 PWN Class - One gadget

作者：Zhi Chen（ray784523@zhienw.com）

原始碼 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// gcc chal.c -o chal -fno-stack-protector -no-pie

void gadget() {
    __asm__(
        "pop %r10;" 
        "ret;"      
        "pop %rdx;"
        "ret;"
    );
}

int main(){
    setvbuf(stdin, 0, _IONBF, 0);
    setvbuf(stdout, 0, _IONBF, 0);
    
    char buffer[0x30];
    printf("GIFT: %p \n>", &printf);
    gets(buffer);

    return 0;
}

解題

解題思路

這題檔案是動態連結,可以對libc.so.6 使用One_gadget查看取得shell的條件,並達成條件取得shell
PS : 此題有些條件會用到rbp,所以在overflow時不能在rdp中放垃圾值

本文2026-06-04首發於zhi旅程，最後修改於2026-06-04

]]> SCIST PWN SCIST2026 PWN Class - ret2libc http://localhost:1313/post/scist2026/ret2libc/ Thu, 04 Jun 2026 04:40:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/scist2026/ret2libc/ SCIST2026 PWN Class - ret2libc

作者：Zhi Chen（ray784523@zhienw.com）

原始碼 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// gcc chal.c -o chal -fno-stack-protector -no-pie
void init_IOBUF(){
    setvbuf(stdin, 0, _IONBF, 0);
    setvbuf(stdout, 0, _IONBF, 0);    
}

int main(){
    init_IOBUF();
    char buffer[0x30];
    printf("GIFT: %p \n>", &printf);
    gets(buffer);

    return 0;
}

解題

解題思路

這題檔案是動態連結,可以算一下offset,調用libc.so.6的內容取得shell

本文2026-06-04首發於zhi旅程，最後修改於2026-06-04

]]> SCIST PWN SCIST2026 PWN Class - ROP http://localhost:1313/post/scist2026/rop/ Thu, 04 Jun 2026 03:37:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/scist2026/rop/ SCIST2026 PWN Class - ROP

作者：Zhi Chen（ray784523@zhienw.com）

原始碼 

#include <stdio.h>

// gcc  chal.c -o chal -fno-stack-protector -no-pie --static

void init_IOBUF(){
    setvbuf(stdin, 0, _IONBF, 0);
    setvbuf(stdout, 0, _IONBF, 0);    
}

int main(){
	init_IOBUF();
	char buffer[8];
	printf("Go!!!! ");
	gets(buffer);
	return 0;
}

解題

解題思路

使用ROP的方法獲得shell,繞過NX保護

確認保護機制 

checksec --file=chal

image

尋找需要的資訊

尋找pop rax ret

本文2026-06-04首發於zhi旅程，最後修改於2026-06-04

]]> SCIST PWN SCIST2026 PWN Class - ret2shellcode http://localhost:1313/post/scist2026/ret2shellcode/ Wed, 03 Jun 2026 16:38:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/scist2026/ret2shellcode/ SCIST2026 PWN Class - ret2shellcode

作者：Zhi Chen（ray784523@zhienw.com）

原始碼 

#include <stdio.h>
#include <sys/mman.h>

// gcc -o chal chal.c -fno-stack-protector -no-pie -z execstack

void init_IOBUF(){
    setvbuf(stdin, 0, _IONBF, 0);
    setvbuf(stdout, 0, _IONBF, 0);    
}

char message[50];

int main() {
    init_IOBUF();
    
    void *mem = (void *)0x00404000;
    size_t size = 0x1000;
    mprotect(mem, size, PROT_READ | PROT_WRITE | PROT_EXEC);


    puts("> ");
    read(0, message, 50);

    puts("> ");
    char buffer[100];
    gets(buffer);
    return 0;
}

解題

解題思路

目標要輸入我們自己的shellcode,之後利用overflow的方法跳到我們shellcode儲存的地方

本文2026-06-03首發於zhi旅程，最後修改於2026-06-03

]]> SCIST PWN SCIST2026 PWN Class - OOB http://localhost:1313/post/scist2026/oob/ Wed, 03 Jun 2026 16:00:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/scist2026/oob/ SCIST2026 PWN Class - OOB

作者：Zhi Chen（ray784523@zhienw.com）

原始碼 

#include <stdio.h>
#include <stdlib.h>

// gcc chal.c -o chal -fno-stack-protector -no-pie

void win() {
    system("/bin/sh");
}

int main() {
    setvbuf(stdin, 0, _IONBF, 0);
    setvbuf(stdout, 0, _IONBF, 0);

    printf("Welcome to the 8-byte OOB PWN challenge!\n");
    long arr[5] = {80,60,70,90,100}; 
    printf("Enter an index to write: ");
    
    int index;
    scanf("%d", &index);

    printf("Enter a value to write (hex): ");
    long value;
    scanf("%lx", &value);

    arr[index] = value;

    printf("Done! Array[%d] = 0x%lx\n", index, value);
    printf("Goodbye!\n");
    
    return 0;
}

解題

解題思路

目標要跳到win()這個function,可利用OOB的方法,將index設定超過4,使其可以到別的位置修改值,有陷阱要注意run到接近ret位置在看stack,不要輸入完馬上看

本文2026-06-03首發於zhi旅程，最後修改於2026-06-03

]]> SCIST PWN SCIST2026 PWN Class - ret2func http://localhost:1313/post/scist2026/ret2func/ Wed, 03 Jun 2026 14:46:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/scist2026/ret2func/ SCIST2026 PWN Class - ret2func

作者：Zhi Chen（ray784523@zhienw.com）

原始碼 

#include <stdio.h>
int shell(){
	system("/bin/sh");
}

void init_IOBUF(){
    setvbuf(stdin, 0, _IONBF, 0);
    setvbuf(stdout, 0, _IONBF, 0);    
}

int main(){
	init_IOBUF();
	char buffer[8];
	gets(buffer);
	return 0;
}

解題

解題思路

目標要跳到shell()這個function,且因為我們要用overflow之後直接跳過去,所以需要補一個ret,去讓記憶體對齊

本文2026-06-03首發於zhi旅程，最後修改於2026-06-03

]]> SCIST PWN