SCIST on zhi旅程 http://localhost:1313/tags/scist/ Recent content from zhi旅程 Hugo zh-tw ray784523@zhienw.com (Zhi Chen) ray784523@zhienw.com (Zhi Chen) 本部落格所有文章除特別聲明外，均採用 BY-NC-SA 授權協議。轉載請註明出處！ Mon, 08 Jun 2026 21:50:52 +0800 mathter writeup http://localhost:1313/post/mathter/ Mon, 08 Jun 2026 21:10:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/mathter/ mathter writeup

作者：Zhi Chen（ray784523@zhienw.com）

原始碼 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void win1(unsigned int check) {
    if (check == 0xdeadbeef) {
        FILE *fp = fopen("/home/mathter/flag", "r");
        if (fp != NULL) {
            char flag[256];
            if (fgets(flag, sizeof(flag), fp) != NULL) {
                size_t len = strlen(flag);
                if (len > 0 && flag[len - 1] == '\n') {
                    flag[len - 1] = '\0';
                    len--;
                }
                size_t mid = len / 2;
                for (size_t i = 0; i < mid; i++) {
                    putchar(flag[i]);
                }
                putchar('\n');
            }
            fclose(fp);
        } else {
            printf("Failed to open flag file.\n");
        }
    } else {
        printf("Sorry, wrong argument. Try again!\n");
    }
}

void win2(unsigned int check) {
    if (check == 0xcafebabe) {
        FILE *fp = fopen("/home/mathter/flag", "r");
        if (fp != NULL) {
            char flag[256];
            if (fgets(flag, sizeof(flag), fp) != NULL) {
                size_t len = strlen(flag);
                if (len > 0 && flag[len - 1] == '\n') {
                    flag[len - 1] = '\0'; 
                    len--;
                }
                size_t mid = len / 2;
                for (size_t i = mid; i < len; i++) {
                    putchar(flag[i]);
                }
                putchar('\n');
            }
            fclose(fp);
        } else {
            printf("Failed to open flag file.\n");
        }
    } else {
        printf("Sorry, wrong argument. Try again!\n");
    }
}

int goodbye() {
    char response[4];
    printf("Are you sure you want to leave? [Y/n]\n");
    gets(response);
    if (response[0] == 'y' || response[0] == 'Y') {
        printf("Goodbye!\n");
        return 1;
    }
    return 0;
}

void calculator() {
    char input[256]; 
    int x, y, result;
    char op;

    while (1) {
        printf("Enter an operation and two numbers (e.g., 1 + 1) : ");
        fgets(input, sizeof(input), stdin);

        if (input[0] == 'q') {
            printf("Exiting calculator...\n");
            break;
        }

        if (sscanf(input, "%d %c %d", &x, &op, &y) == 3) {
            switch (op) {
                case '+':
                    result = x + y;
                    printf("%d + %d = %d\n", x, y, result);
                    break;
                case '-':
                    result = x - y;
                    printf("%d - %d = %d\n", x, y, result);
                    break;
                case '*':
                    result = x * y;
                    printf("%d * %d = %d\n", x, y, result);
                    break;
                case '/':
                    if (y != 0) {
                        result = x / y;
                        printf("%d / %d = %d\n", x, y, result);
                    } else {
                        printf("Error: Division by zero!\n");
                    }
                    break;
                default:
                    printf("Invalid operation!\n");
            }
        } else {
            printf("Invalid input format. Please use the format: 1 + 1\n");
        }
    }
}


int main() {
    setvbuf(stdin, NULL, _IONBF, 0);
    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);

    

    printf(" __        __   _                            _          __  __       _   _     _            \n");
    printf(" \\ \\      / /__| | ___ ___  _ __ ___   ___  | |_ ___   |  \\/  | __ _| |_| |__ | |_ ___ _ __ \n");
    printf("  \\ \\ /\\ / / _ \\ |/ __/ _ \\| '_ ` _ \\ / _ \\ | __/ _ \\  | |\\/| |/ _` | __| '_ \\| __/ _ \\ '__|\n");
    printf("   \\ V  V /  __/ | (_| (_) | | | | | |  __/ | || (_) | | |  | | (_| | |_| | | | ||  __/ |   \n");
    printf("    \\_/\\_/ \\___|_|\\___\\___/|_| |_| |_|\\___|  \\__\\___/  |_|  |_|\\__,_|\\__|_| |_|\\__\\___|_|\n\n");

    
    while (1) {
        calculator();
	if (goodbye()){
	    break;
	}
    }
    return 0;
}
//gcc -static -o mathter -no-pie -fno-stack-protector -z now -z relro mathter.c

解題

解題思路

在goodbye function有用get函數可以進行overflow,並且利用pop rdi設定參數,分別跳到win1、win2 funtion取得2段flag
PS : 這題要注意的是在取overflow起點時會碰到rax-4,要用該位置+4設為起點
PS : 要覆蓋的位置不要找成main函數的return

本文2026-06-08首發於zhi旅程，最後修改於2026-06-08

]]> SCIST pwn got writeup http://localhost:1313/post/got/ Sat, 06 Jun 2026 04:19:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/got/ got writeup

作者：Zhi Chen（ray784523@zhienw.com）

原始碼

本題無提供原始碼

解題

解題思路

利用更改got表的方式,跳到admin_shell()的function

確認保護機制 

checksec --file=share/got

image

嘗試執行 

User ID: 1
Nickname: 1
PIN: 1
Logging as [1] ... Failed
Incorrect PIN code!

User ID: ^C

image

本文2026-06-06首發於zhi旅程，最後修改於2026-06-06

]]> SCIST pwn ret2plt writeup http://localhost:1313/post/ret2plt/ Fri, 22 May 2026 13:21:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/ret2plt/ ret2plt writeup

作者：Zhi Chen（ray784523@zhienw.com）

題目原始碼 

#include<stdio.h>
#include<stdlib.h>

void init(){
    setvbuf(stdout,0,2,0);
    setvbuf(stdin,0,2,0);
    setvbuf(stderr,0,2,0);
}

int main(){

    init();

    system( "echo 'Say hello to stack :D'" );

    char buf[0x30];
    gets( buf );

    return 0;
}

What is GOT(Global Offset Table)?

GOT 是 Linux ELF 執行檔中一個重要的資料結構,主要用來實現動態連結（Dynamic Linking） 當程式呼叫外部函式庫的函式時(例如 printf、malloc),這些函式位於共享函式庫(如 libc.so)中。問題是:

本文2026-05-22首發於zhi旅程，最後修改於2026-05-22

]]> SCIST pwn rop writeup http://localhost:1313/post/rop/ Fri, 22 May 2026 12:24:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/rop/ rop writeup

作者：Zhi Chen（ray784523@zhienw.com）

題目原始碼 

#include<stdio.h>
#include<stdlib.h>

void init(){
    setvbuf(stdout,0,2,0);
    setvbuf(stdin,0,2,0);
    setvbuf(stderr,0,2,0);
}

int main(){

    init();

    puts( "Say hello to stack :D" );

    char buf[0x30];
    gets( buf );

    return 0;
}

What is ROP?

ROP 是一種利用程式漏洞執行惡意程式碼的攻擊手法。它主要用來繞過現代作業系統的防禦機制，特別是 DEP（Data Execution Prevention，資料執行保護）。 image

本文2026-05-22首發於zhi旅程，最後修改於2026-05-22

]]> SCIST pwn orw writeup http://localhost:1313/post/orw/ Thu, 21 May 2026 21:34:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/orw/ orw writeup

作者：Zhi Chen（ray784523@zhienw.com）

題目原始碼 

// gcc -fno-stack-protector -no-pie chal.c -o chal

#include <stdio.h>
#include <sys/mman.h>
#include <unistd.h>

#include "seccomp-bpf.h"

#define username_len 0x400

char username[username_len];

void apply_seccomp() {
  struct sock_filter filter[] = {
      VALIDATE_ARCHITECTURE,
      EXAMINE_SYSCALL,
      ALLOW_SYSCALL(read),
      ALLOW_SYSCALL(write),
      ALLOW_SYSCALL(open),
      ALLOW_SYSCALL(close),
      ALLOW_SYSCALL(openat),
      ALLOW_SYSCALL(exit),
      ALLOW_SYSCALL(exit_group),
      ALLOW_SYSCALL(getdents),
      ALLOW_SYSCALL(getrandom),
      ALLOW_SYSCALL(brk),
      ALLOW_SYSCALL(readlink),
      ALLOW_SYSCALL(rt_sigreturn),
      KILL_PROCESS,
  };

  struct sock_fprog prog = {
      .len = (unsigned short)(sizeof(filter) / sizeof(struct sock_filter)),
      .filter = filter,
  };

  if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
    perror("Seccomp Error");
    exit(1);
  };
  if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
    perror("Seccomp Error");
    exit(1);
  };
}

int main() {
  setvbuf(stdin, 0, _IONBF, 0);
  setvbuf(stdout, 0, _IONBF, 0);
  unsigned long addr = (unsigned long)&username & ~0xfff;
  mprotect((void *)addr, 0x1000, PROT_EXEC | PROT_READ | PROT_WRITE);
  /* apply_seccomp(); */
  char password[40];
  printf("Username: ");
  read(0, username, username_len);
  printf("Password: ");
  read(0, password, 0x40);
  puts("Wrong username/password! Please try again.");
  return 0;
}

解題

解題思路

題目只允許用部分syscall,我們用open,read,write,在username構建我們的payload,在password用overflow跳到username,將flag寫在終端機

本文2026-05-21首發於zhi旅程，最後修改於2026-05-21

]]> SCIST pwn ret2sc writeup http://localhost:1313/post/ret2sc/ Thu, 21 May 2026 20:46:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/ret2sc/ ret2sc writeup

作者：Zhi Chen（ray784523@zhienw.com）

題目原始碼 

#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>

char username[0x20];

int main() {
    setvbuf(stdin, NULL, _IONBF, 0);
    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);

    unsigned long addr = (unsigned long)&username & ~0xfff;
    mprotect((void *)addr, 0x1000, PROT_EXEC | PROT_READ | PROT_WRITE);

    char password[40];

    puts("=== Welcome to ret2sc challenge ===");
    puts("Please enter your username and password.");
    puts("Hint: Maybe the username buffer is... *too powerful*? 🤔");

    printf("Username: ");
    fflush(stdout);
    read(0, username, 0x20);

    printf("Password: ");
    fflush(stdout);
    read(0, password, 0x40);

    puts("Wrong username/password! Please try again.");
    return 0;
}

解題

解題思路

在username構建我們的payload,在password用overflow跳到username

本文2026-05-21首發於zhi旅程，最後修改於2026-05-21

]]> SCIST pwn greet writeup http://localhost:1313/post/greet/ Thu, 21 May 2026 19:25:52 +0800 ray784523@zhienw.com (Zhi Chen) http://localhost:1313/post/greet/ greet writeup

作者：Zhi Chen（ray784523@zhienw.com）

題目原始碼 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

void win() {
    system("/bin/sh");
}

void vuln() {
    char name[10];
    printf("What's your name? ");
    gets(name);
    printf("Hello, %s!\n", name);
}

int main() {
    setbuf(stdout, NULL);
    vuln();
}

解題

解題思路

因爲gets()這個function是可以取得使用者輸入無限長度的字串,因此我們可以用overflow的方法將return的位置覆蓋成win function的位置取得shell

本文2026-05-21首發於zhi旅程，最後修改於2026-05-21

]]> SCIST pwn