CTF on QingKong996

XiDianCTF MoeCTF 2025 PWN Syslock

Sat, 05 Sep 2026 14:45:01 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

Based on the challenge hint, this may be a ret2syscall¹ challenge.

As usual, open the binary in IDA.

int __fastcall main(int argc, const char **argv, const char **envp)
{
 init(argc, argv, envp);
 write(1, "My lock looks strange—can you help me?\n", 0x29uLL);
 write(1, "choose mode\n", 0xCuLL);
 i = input();
 if ( i > 4 )
 lose();
 write(1, "Input your password\n", 0x14uLL);
 read(0, (char *)&s + i, 0xCuLL);
 if ( i != 59 )
 lose();
 cheat();
 return 0;
}

Notice that i is subject to two contradictory checks.

XiDianCTF MoeCTF 2025 PWN Str_check

Sat, 05 Sep 2026 09:24:45 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

Once again, open the binary in IDA.

int __fastcall main(int argc, const char **argv, const char **envp)
{
 char dest[24]; // [rsp+0h] [rbp-20h] BYREF
 size_t n; // [rsp+18h] [rbp-8h] BYREF

 init(argc, argv, envp);
 puts("What can u say?");
 __isoc99_scanf("%255s", str);
 puts("So,what size is it?");
 __isoc99_scanf("%zu", &n);
 len = strlen(str);
 if ( (unsigned __int64)len > 0x18 )
 {
 puts("Oh,too much.");
 exit(1);
 }
 if ( !strncmp(str, "meow", 4uLL) )
 memcpy(dest, str, n);
 else
 strncpy(dest, str, n);
 puts("You're right.");
 return 0;
}

Notice that strlen() is used here to enforce a maximum length of 0x18.

XiDianCTF MoeCTF 2025 PWN Randomlock

Sat, 05 Sep 2026 08:48:03 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

As usual, open the binary in IDA.

int __fastcall main(int argc, const char **argv, const char **envp)
{
 int v4; // [rsp+Ch] [rbp-14h] BYREF
 unsigned int i; // [rsp+10h] [rbp-10h]
 int v6; // [rsp+14h] [rbp-Ch]
 unsigned __int64 v7; // [rsp+18h] [rbp-8h]

 v7 = __readfsqword(0x28u);
 init(argc, argv, envp);
 initseed();
 srand(seed);
 puts("My lock looks strange—can you help me?");
 for ( i = 1; (int)i <= 10; ++i )
 {
 printf("password %d\n>", i);
 v6 = rand() % 10000;
 __isoc99_scanf("%d", &v4);
 if ( v6 != v4 )
 lose();
 }
 win();
 return 0;
}

Examine initseed().

XiDianCTF MoeCTF 2025 PWN Inject

Fri, 04 Sep 2026 20:41:23 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

As usual, open the binary in Interactive Disassembler Professional (IDA Pro).

int __fastcall main(int argc, const char **argv, const char **envp)
{
 int v4; // [rsp+4h] [rbp-2Ch] BYREF
 unsigned __int64 v5; // [rsp+8h] [rbp-28h]

 v5 = __readfsqword(0x28u);
 setbuf(_bss_start, 0LL);
 setbuf(stdin, 0LL);
 puts("Welcome to server maintainance system.");
 while ( 1 )
 {
 _printf_chk(
 1LL,
 "1. List processes\n2. Check disk usage\n3. Check network activity\n4. Test connectivity\n5. Exit\nYour choice: ");
 if ( (int)_isoc99_scanf("%u", &v4) < 0 )
 break;
 getc(stdin);
 switch ( v4 )
 {
 case 1:
 execute("ps aux");
 break;
 case 2:
 execute("df -h");
 break;
 case 3:
 execute("netstat -ant");
 break;
 case 4:
 ping_host();
 break;
 case 5:
 exit(0);
 default:
 puts("Invalid choice!");
 break;
 }
 }
 exit(1);
}

The ping_host() function stands out.

XiDianCTF MoeCTF 2025 PWN Fmt

Fri, 04 Sep 2026 19:00:41 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

IDA, followed by more IDA.

int __fastcall main(int argc, const char **argv, const char **envp)
{
 char *v4; // [rsp+8h] [rbp-88h]
 char s1[16]; // [rsp+10h] [rbp-80h] BYREF
 char s2[16]; // [rsp+20h] [rbp-70h] BYREF
 char s[88]; // [rsp+30h] [rbp-60h] BYREF
 unsigned __int64 v8; // [rsp+88h] [rbp-8h]

 v8 = __readfsqword(0x28u);
 init(argc, argv, envp);
 v4 = (char *)malloc(0x20uLL);
 generate(s2, 5LL);
 generate(v4, 5LL);
 puts("Hey there, little one, what's your name?");
 fgets(s, 80, stdin);
 printf("Nice to meet you,");
 printf(s);
 puts("I buried two treasures on the stack.Can you find them?");
 fgets(s1, 8, stdin);
 if ( strncmp(s1, s2, 5uLL) )
 lose();
 puts("Yeah,another one?");
 fgets(s1, 8, stdin);
 if ( strncmp(s1, v4, 5uLL) )
 lose();
 win();
 return 0;
}

We need to enter the correct values for s1 and v4.

XiDianCTF MoeCTF 2025 PWN Boom_revenge

Fri, 04 Sep 2026 13:46:02 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

Once again, open the binary in IDA.

int __fastcall main(int argc, const char **argv, const char **envp)
{
 char s[124]; // [rsp+0h] [rbp-90h] BYREF
 int v5; // [rsp+7Ch] [rbp-14h]
 int v6; // [rsp+8Ch] [rbp-4h]

 init(argc, argv, envp);
 puts("Welcome to Secret Message Book!");
 puts("Do you want to brute-force this system? (y/n)");
 fgets(&brute_choice, 8, stdin);
 v6 = 0;
 if ( brute_choice == 121 || brute_choice == 89 )
 {
 v6 = 1;
 canary = (int)random() % 114514;
 v5 = canary;
 puts("waiting...");
 sleep(1u);
 puts("boom!");
 puts("Brute-force mode enabled! Security on.");
 }
 else
 {
 puts("Normal mode. No overflow allowed.");
 }
 printf("Enter your message: ");
 if ( v6 )
 {
 gets(s);
 if ( v5 != canary )
 {
 puts("Security check failed!");
 exit(1);
 }
 }
 else
 {
 fgets(s, 128, stdin);
 }
 puts("Message received.");
 return 0;
}

This is an upgraded version of boom: it requires v6 to be nonzero and v5 == canary.

XiDianCTF MoeCTF 2025 PWN Boom

Fri, 04 Sep 2026 11:33:13 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

As usual, open the binary in IDA.

int __fastcall main(int argc, const char **argv, const char **envp)
{
 char s[124]; // [rsp+0h] [rbp-90h] BYREF
 int v5; // [rsp+7Ch] [rbp-14h]
 int v6; // [rsp+8Ch] [rbp-4h]

 init(argc, argv, envp);
 puts("Welcome to Secret Message Book!");
 puts("Do you want to brute-force this system? (y/n)");
 fgets(&brute_choice, 8, stdin);
 v6 = 0;
 if ( brute_choice == 121 || brute_choice == 89 )
 {
 v6 = 1;
 canary = (int)random() % 114514;
 v5 = canary;
 puts("waiting...");
 sleep(1u);
 puts("boom!");
 puts("Brute-force mode enabled! Security on.");
 }
 else
 {
 puts("Normal mode. No overflow allowed.");
 }
 printf("Enter your message: ");
 if ( v6 )
 gets(s);
 else
 fgets(s, 128, stdin);
 if ( v6 && v5 != canary )
 {
 puts("Security check failed!");
 exit(1);
 }
 puts("Message received.");
 return 0;
}

If we choose n, we can overflow by only four additional bytes, which is clearly insufficient.

XiDianCTF MoeCTF 2025 PWN 3 Recognizing libc

Thu, 03 Sep 2026 21:06:05 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

According to the challenge hint, this is a ret2libc challenge.¹

Once again, open the binary in IDA.

int __fastcall main(int argc, const char **argv, const char **envp)
{
 setup(argc, argv, envp);
 puts("The Oracle speaks...");
 puts("There is no system function in the .text segment.");
 printf("A gift of forbidden knowledge, the location of 'printf': %p\n", &printf);
 vuln();
 return 0;
}

ssize_t vuln()
{
 char buf[64]; // [rsp+0h] [rbp-40h] BYREF

 puts("\nNow, show me what you can do with this knowledge:");
 printf("> ");
 return read(0, buf, 0x100uLL);
}

The program leaks the address of printf, and we are also given libc.so.6. This allows us to calculate the base address of libc and then add the required offsets.

XiDianCTF MoeCTF 2025 PWN 2 Ezshellcode

Thu, 03 Sep 2026 17:59:54 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

According to the hint, this challenge uses ret2shellcode.¹

As usual, open the binary in IDA.

int __fastcall main(int argc, const char **argv, const char **envp)
{
 int v4; // [rsp+0h] [rbp-20h] BYREF
 int prot; // [rsp+4h] [rbp-1Ch]
 int v6; // [rsp+8h] [rbp-18h]
 int v7; // [rsp+Ch] [rbp-14h]
 void *s; // [rsp+10h] [rbp-10h]
 unsigned __int64 v9; // [rsp+18h] [rbp-8h]

 v9 = __readfsqword(0x28u);
 init(argc, argv, envp);
 s = mmap(0LL, 0x1000uLL, 3, 34, -1, 0LL);
 if ( s == (void *)-1LL )
 {
 perror("mmap");
 return 1;
 }
 memset(s, 0, 0x1000uLL);
 v6 = 0;
 prot = 0;
 puts("In a ret2text exploit, we can use code in the .text segment.");
 puts("But now, there is no 'system' function available there.");
 puts("How can you get the flag now? Perhaps you should use shellcode.");
 puts("But what is shellcode? What can you do with it? And how can you use it?");
 puts("I will give you some choices. Choose wisely!");
 __isoc99_scanf("%d", &v4);
 do
 v7 = getchar();//
 while ( v7 != 10 && v7 != -1 );
 if ( v4 == 4 )
 {
 if ( v6 == 1 )
 puts("You can only make one change!");
 prot = 7;
 v6 = 1;
 }
 else
 {
 if ( v4 > 4 )
 goto LABEL_24;
 switch ( v4 )
 {
 case 3:
 if ( v6 == 1 )
 puts("You can only make one change!");
 prot = 4;
 v6 = 1;
 break;
 case 1:
 if ( v6 == 1 )
 puts("You can only make one change!");
 prot = 1;
 v6 = 1;
 break;
 case 2:
 if ( v6 == 1 )
 puts("You can only make one change!");
 prot = 3;
 v6 = 1;
 break;
 default:
LABEL_24:
 puts("Invalid choice. The space remains in its chaotic state.");
 exit(1);
 }
 }
 if ( mprotect(s, 0x1000uLL, prot) == -1 )
 {
 perror("mprotect");
 exit(1);
 }
 puts("\nYou have now changed the permissions of the shellcode area.");
 puts("If you can't input your shellcode, think about the permissions you just set.");
 read(0, s, 0x1000uLL);
 ((void (*)(void))s)();
 return 0;
}

int mprotect(const void *start, size_t len, int prot);²

XiDianCTF MoeCTF 2025 PWN 2_EZtext

Thu, 03 Sep 2026 12:34:44 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

According to the hint, this challenge uses ret2text (return-to-text).

Once again, open the binary in IDA.

int __fastcall main(int argc, const char **argv, const char **envp)
{
 int v4; // [rsp+Ch] [rbp-4h] BYREF

 init(argc, argv, envp);
 puts("Stack overflow is a powerful art!");
 puts("In this MoeCTF,I will show you the charm of PWN!");
 puts("You need to understand the structure of the stack first.");
 puts("Then how many bytes do you need to overflow the stack?");
 __isoc99_scanf("%d", &v4);
 overflow(v4);
 return 0;
}

int __fastcall overflow(int a1)
{
 char buf[8]; // [rsp+18h] [rbp-8h] BYREF

 if ( a1 <= 7 )
 return puts("Come on, you can't even fill up this array?");
 read(0, buf, a1);
 return puts("OK,I receive your byte.and then?");
}

Notice the following code:

XiDianCTF MoeCTF 2025 PWN 1 Find_it

Wed, 02 Sep 2026 16:42:29 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

As usual, open the binary in IDA.

int __fastcall main(int argc, const char **argv, const char **envp)
{
 int v3; // eax
 char file[40]; // [rsp+0h] [rbp-30h] BYREF
 unsigned __int64 v6; // [rsp+28h] [rbp-8h]

 v6 = __readfsqword(0x28u);
 init(argc, argv, envp);
 v3 = dup(1);
 write(v3, "I've hidden the fd of stdout. Can you find it?\n", 0x2FuLL);
 close(1);
 __isoc99_scanf("%d", &fd1);
 write(fd1, "You are right.What would you like to see?\n", 0x2AuLL);
 __isoc99_scanf("%s%*c", file);
 open(file, 0);
 write(fd1, "What is its fd?\n", 0x10uLL);
 __isoc99_scanf("%d", &fd2);
 read(fd2, &buf, 0x50uLL);
 write(fd1, &buf, 0x50uLL);
 return 0;
}

An fd (file descriptor) is a non-negative integer that a process uses to refer to an open file or another I/O object on Unix and Unix-like systems.¹

XiDianCTF MoeCTF 2025 PWN 1 Ez_u64

Wed, 02 Sep 2026 16:03:10 +0800

The original Chinese article was written by a human and only proofread with generative AI. This English version was translated with AI.

Challenge link

Open the binary in IDA.

int __fastcall main(int argc, const char **argv, const char **envp)
{
 init(argc, argv, envp);
 vuln();
 return 0;
}

int init()
{
 int fd; // [rsp+Ch] [rbp-4h]
 ...
 fd = open("/dev/urandom", 0, 0LL);
 ...
 read(fd, &num, 8uLL);
 return close(fd);
}

Notice that num is a random number.

unsigned __int64 vuln()
{
 __int64 v1; // [rsp+0h] [rbp-10h] BYREF
 unsigned __int64 v2; // [rsp+8h] [rbp-8h]

 v2 = __readfsqword(0x28u);
 puts("Ya hello! Let's play a game.");
 printf("Guess which number I'm thinking of.");
 printf("Here is the hint.");
 write(1, &num, 8uLL);
 printf("\n>");
 __isoc99_scanf("%zu", &v1);
 if ( v1 != num )
 {
 puts("Wrong answer!");
 puts("Try pwntools u64?");
 exit(1);
 }
 puts("Win!");
 system("/bin/sh");
 return v2 - __readfsqword(0x28u);
}

write outputs the raw in-memory representation of num directly.