Pwn on QingKong996

西电CTF MoeCTF 2025 PWN Ezprotection

Wed, 09 Sep 2026 20:49:28 +0800

本文为人工撰写，使用生成式AI校对，AI生成部分已在其域内声明。

题目链接

注意到PIE enabled。

使用IDA反编译。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 setup(argc, argv, envp);
 vuln();
 return 0;
}

int setup()
{
 int result; // eax
 int fd; // [rsp+Ch] [rbp-4h]

 setvbuf(stdin, 0LL, 2, 0LL);
 setvbuf(stdout, 0LL, 2, 0LL);
 setvbuf(stderr, 0LL, 2, 0LL);
 result = open("/dev/urandom", 0);
 fd = result;
 if ( result != -1 )
 {
 read(result, &password, 8uLL);
 return close(fd);
 }
 return result;
}

unsigned __int64 vuln()
{
 char buf[24]; // [rsp+0h] [rbp-20h] BYREF
 unsigned __int64 v2; // [rsp+18h] [rbp-8h]

 v2 = __readfsqword(0x28u);
 puts("This time, I won鈥檛 let you overflow the stack so easily again.");
 puts("Here is a beautiful canary, and it will be watching over you.");
 read(0, buf, 0x2AuLL);
 puts("Go ahead and overflow, anyway I have a canary.");
 puts(buf);
 puts("I will give you a second chance, since you can not do anything anyway.");
 puts("Even if you kill the canary, you still won鈥檛 be able to overflow enough bytes.");
 read(0, buf, 0x2AuLL);
 return v2 - __readfsqword(0x28u);
}

puts()只在读到0x00后停止输出，所以使buf[]全部非0x00即可泄露v2和$RSP。

XiDianCTF MoeCTF 2025 PWN Ezpivot

Tue, 08 Sep 2026 18:28:45 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

IDA。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 unsigned int v4; // [rsp+0h] [rbp-10h] BYREF
 char buf[12]; // [rsp+4h] [rbp-Ch] BYREF

 setvbuf(stdin, 0LL, 2, 0LL);
 setvbuf(stdout, 0LL, 2, 0LL);
 setvbuf(stderr, 0LL, 2, 0LL);
 puts("Welcome to join this pwn party!");
 puts("Please say something to introduce yourself:");
 puts("Before that,you need to tell us the length of your introduction.");
 __isoc99_scanf("%d", &v4);
 if ( (int)v4 > 32 )
 {
 puts("Your introduction is too long, please try again.");
 exit(1);
 }
 introduce(v4);
 puts("Now, please tell us your phone number:");
 read(0, buf, len_of_phonenum);
 return 0;
}

注意到v4的类型为无符号int，在判断v4 > 32的时候强制转换为int类型进行比较，并且read()函数接受长度类型为size_t，所以我们可以输入-1绕过检查。

XiDianCTF MoeCTF 2025 PWN Easylibc

Sun, 06 Sep 2026 10:32:36 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

这次我们改成checksec起手。

RELRO	STACK CANARY	NX	PIE	RPATH	RUNPATH	Symbols	FORTIFY	Fortified	Fortifiable	FILE
Partial RELRO	No canary found	NX enabled	PIE enabled	No RPATH	No RUNPATH	41 Symbols	No	0	2	pwn

注意到PIE开启，并且由题目提示ASLR也一同启用。

XiDianCTF MoeCTF 2025 PWN Xdulaker

Sun, 06 Sep 2026 09:32:57 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

IDA，然后是IDA。

int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
{
 init(argc, argv, envp);
 menu();

 while ( 1 ){
 while ( 1 ){
 putchar(62);
 __isoc99_scanf("%d", &opt);
 if ( opt != 1 )
 break;
 pull();
 }


 if ( opt == 2 ){
 photo();
 }else{
 if ( opt != 3 )
 exit(0);
 laker();
 }
 }
}

int pull()
{
 return printf("Thanks,I'll give you a gift:%p\n", &opt);
}

int photo()
{
 char buf[80]; // [rsp+0h] [rbp-50h] BYREF

 puts("Hey,what's your name?!");
 read(0, buf, 0x40uLL);
 return puts("I will teach you a lesson.");
}

ssize_t laker()
{
 char s1[48]; // [rsp+0h] [rbp-30h] BYREF

 if ( memcmp(s1, "xdulaker", 8uLL) )
 {
 puts("You are not him.");
 exit(0);
 }
 puts("welcome,xdulaker");
 return read(0, s1, 0x100uLL);
}

注意到laker()检查了s1的值，所以我们需要在photo()中构建其要求的值。

XiDianCTF MoeCTF 2025 PWN Syslock

Sat, 05 Sep 2026 14:45:01 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

根据题目提示，本题可能为ret2syscall¹。

依旧是IDA。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 init(argc, argv, envp);
 write(1, "My lock looks strange鈥攃an you help me?\n", 0x29uLL);
 write(1, "choose mode\n", 0xCuLL);
 i = input();
 if ( i > 4 )
 lose();
 write(1, "Input your password\n", 0x14uLL);
 read(0, (char *)&s + i, 0xCuLL);
 if ( i != 59 )
 lose();
 cheat();
 return 0;
}

注意到，这里的i有两个相悖的检查。

西电CTF MoeCTF 2025 PWN Str_check

Sat, 05 Sep 2026 09:24:45 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

还是IDA。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 char dest[24]; // [rsp+0h] [rbp-20h] BYREF
 size_t n; // [rsp+18h] [rbp-8h] BYREF

 init(argc, argv, envp);
 puts("What can u say?");
 __isoc99_scanf("%255s", str);
 puts("So,what size is it?");
 __isoc99_scanf("%zu", &n);
 len = strlen(str);
 if ( (unsigned __int64)len > 0x18 )
 {
 puts("Oh,too much.");
 exit(1);
 }
 if ( !strncmp(str, "meow", 4uLL) )
 memcpy(dest, str, n);
 else
 strncpy(dest, str, n);
 puts("You're right.");
 return 0;
}

注意到这里使用strlen()来限制长度小于等于0x18。

西电CTF MoeCTF 2025 PWN Randomlock

Sat, 05 Sep 2026 08:48:03 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

依旧是IDA。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 int v4; // [rsp+Ch] [rbp-14h] BYREF
 unsigned int i; // [rsp+10h] [rbp-10h]
 int v6; // [rsp+14h] [rbp-Ch]
 unsigned __int64 v7; // [rsp+18h] [rbp-8h]

 v7 = __readfsqword(0x28u);
 init(argc, argv, envp);
 initseed();
 srand(seed);
 puts("My lock looks strange鈥攃an you help me?");
 for ( i = 1; (int)i <= 10; ++i )
 {
 printf("password %d\n>", i);
 v6 = rand() % 10000;
 __isoc99_scanf("%d", &v4);
 if ( v6 != v4 )
 lose();
 }
 win();
 return 0;
}

查看initseed()。

西电CTF MoeCTF 2025 PWN Inject

Fri, 04 Sep 2026 20:41:23 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

依旧是丢到interactive Disassembler Professional(IDA Pro)里面。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 int v4; // [rsp+4h] [rbp-2Ch] BYREF
 unsigned __int64 v5; // [rsp+8h] [rbp-28h]

 v5 = __readfsqword(0x28u);
 setbuf(_bss_start, 0LL);
 setbuf(stdin, 0LL);
 puts("Welcome to server maintainance system.");
 while ( 1 )
 {
 _printf_chk(
 1LL,
 "1. List processes\n2. Check disk usage\n3. Check network activity\n4. Test connectivity\n5. Exit\nYour choice: ");
 if ( (int)_isoc99_scanf("%u", &v4) < 0 )
 break;
 getc(stdin);
 switch ( v4 )
 {
 case 1:
 execute("ps aux");
 break;
 case 2:
 execute("df -h");
 break;
 case 3:
 execute("netstat -ant");
 break;
 case 4:
 ping_host();
 break;
 case 5:
 exit(0);
 default:
 puts("Invalid choice!");
 break;
 }
 }
 exit(1);
}

注意到ping_host()。

西电CTF MoeCTF 2025 PWN Fmt

Fri, 04 Sep 2026 19:00:41 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

IDA，然后IDA。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 char *v4; // [rsp+8h] [rbp-88h]
 char s1[16]; // [rsp+10h] [rbp-80h] BYREF
 char s2[16]; // [rsp+20h] [rbp-70h] BYREF
 char s[88]; // [rsp+30h] [rbp-60h] BYREF
 unsigned __int64 v8; // [rsp+88h] [rbp-8h]

 v8 = __readfsqword(0x28u);
 init(argc, argv, envp);
 v4 = (char *)malloc(0x20uLL);
 generate(s2, 5LL);
 generate(v4, 5LL);
 puts("Hey there, little one, what's your name?");
 fgets(s, 80, stdin);
 printf("Nice to meet you,");
 printf(s);
 puts("I buried two treasures on the stack.Can you find them?");
 fgets(s1, 8, stdin);
 if ( strncmp(s1, s2, 5uLL) )
 lose();
 puts("Yeah,another one?");
 fgets(s1, 8, stdin);
 if ( strncmp(s1, v4, 5uLL) )
 lose();
 win();
 return 0;
}

注意到需要我们输入正确的s1和v4的值。

西电CTF MoeCTF 2025 PWN Boom_revenge

Fri, 04 Sep 2026 13:46:02 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

还是IDA。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 char s[124]; // [rsp+0h] [rbp-90h] BYREF
 int v5; // [rsp+7Ch] [rbp-14h]
 int v6; // [rsp+8Ch] [rbp-4h]

 init(argc, argv, envp);
 puts("Welcome to Secret Message Book!");
 puts("Do you want to brute-force this system? (y/n)");
 fgets(&brute_choice, 8, stdin);
 v6 = 0;
 if ( brute_choice == 121 || brute_choice == 89 )
 {
 v6 = 1;
 canary = (int)random() % 114514;
 v5 = canary;
 puts("waiting...");
 sleep(1u);
 puts("boom!");
 puts("Brute-force mode enabled! Security on.");
 }
 else
 {
 puts("Normal mode. No overflow allowed.");
 }
 printf("Enter your message: ");
 if ( v6 )
 {
 gets(s);
 if ( v5 != canary )
 {
 puts("Security check failed!");
 exit(1);
 }
 }
 else
 {
 fgets(s, 128, stdin);
 }
 puts("Message received.");
 return 0;
}

可以看到这里是boom的升级版，要求v6非0并且v5==canary。

西电CTF MoeCTF 2025 PWN Boom

Fri, 04 Sep 2026 11:33:13 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

依旧是丢进IDA。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 char s[124]; // [rsp+0h] [rbp-90h] BYREF
 int v5; // [rsp+7Ch] [rbp-14h]
 int v6; // [rsp+8Ch] [rbp-4h]

 init(argc, argv, envp);
 puts("Welcome to Secret Message Book!");
 puts("Do you want to brute-force this system? (y/n)");
 fgets(&brute_choice, 8, stdin);
 v6 = 0;
 if ( brute_choice == 121 || brute_choice == 89 )
 {
 v6 = 1;
 canary = (int)random() % 114514;
 v5 = canary;
 puts("waiting...");
 sleep(1u);
 puts("boom!");
 puts("Brute-force mode enabled! Security on.");
 }
 else
 {
 puts("Normal mode. No overflow allowed.");
 }
 printf("Enter your message: ");
 if ( v6 )
 gets(s);
 else
 fgets(s, 128, stdin);
 if ( v6 && v5 != canary )
 {
 puts("Security check failed!");
 exit(1);
 }
 puts("Message received.");
 return 0;
}

注意到如果选择n只能够额外溢出4字节，显然是不够的。

西电CTF MoeCTF 2025 PWN 3 认识libc

Thu, 03 Sep 2026 21:06:05 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

根据题目提示，本题是ret2libc¹

依旧还是塞进IDA。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 setup(argc, argv, envp);
 puts("The Oracle speaks...");
 puts("There is no system function in the .text segment.");
 printf("A gift of forbidden knowledge, the location of 'printf': %p\n", &printf);
 vuln();
 return 0;
}

ssize_t vuln()
{
 char buf[64]; // [rsp+0h] [rbp-40h] BYREF

 puts("\nNow, show me what you can do with this knowledge:");
 printf("> ");
 return read(0, buf, 0x100uLL);
}

这里给定了printf的地址，并且给了我们libc.so.6，可以算出libc的基址然后再次偏移。

西电CTF MoeCTF 2025 PWN 2 Ezshellcode

Thu, 03 Sep 2026 17:59:54 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

根据题目提示，本题是ret2shellcode¹

按照惯例丢到IDA里。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 int v4; // [rsp+0h] [rbp-20h] BYREF
 int prot; // [rsp+4h] [rbp-1Ch]
 int v6; // [rsp+8h] [rbp-18h]
 int v7; // [rsp+Ch] [rbp-14h]
 void *s; // [rsp+10h] [rbp-10h]
 unsigned __int64 v9; // [rsp+18h] [rbp-8h]

 v9 = __readfsqword(0x28u);
 init(argc, argv, envp);
 s = mmap(0LL, 0x1000uLL, 3, 34, -1, 0LL);
 if ( s == (void *)-1LL )
 {
 perror("mmap");
 return 1;
 }
 memset(s, 0, 0x1000uLL);
 v6 = 0;
 prot = 0;
 puts("In a ret2text exploit, we can use code in the .text segment.");
 puts("But now, there is no 'system' function available there.");
 puts("How can you get the flag now? Perhaps you should use shellcode.");
 puts("But what is shellcode? What can you do with it? And how can you use it?");
 puts("I will give you some choices. Choose wisely!");
 __isoc99_scanf("%d", &v4);
 do
 v7 = getchar();//
 while ( v7 != 10 && v7 != -1 );
 if ( v4 == 4 )
 {
 if ( v6 == 1 )
 puts("You can only make one change!");
 prot = 7;
 v6 = 1;
 }
 else
 {
 if ( v4 > 4 )
 goto LABEL_24;
 switch ( v4 )
 {
 case 3:
 if ( v6 == 1 )
 puts("You can only make one change!");
 prot = 4;
 v6 = 1;
 break;
 case 1:
 if ( v6 == 1 )
 puts("You can only make one change!");
 prot = 1;
 v6 = 1;
 break;
 case 2:
 if ( v6 == 1 )
 puts("You can only make one change!");
 prot = 3;
 v6 = 1;
 break;
 default:
LABEL_24:
 puts("Invalid choice. The space remains in its chaotic state.");
 exit(1);
 }
 }
 if ( mprotect(s, 0x1000uLL, prot) == -1 )
 {
 perror("mprotect");
 exit(1);
 }
 puts("\nYou have now changed the permissions of the shellcode area.");
 puts("If you can't input your shellcode, think about the permissions you just set.");
 read(0, s, 0x1000uLL);
 ((void (*)(void))s)();
 return 0;
}

int mprotect(const void *start, size_t len, int prot);²

西电CTF MoeCTF 2025 PWN 2_EZtext

Thu, 03 Sep 2026 12:34:44 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

根据题目提示，本题是ret2text(Return-to-text)

依旧是IDA大法。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 int v4; // [rsp+Ch] [rbp-4h] BYREF

 init(argc, argv, envp);
 puts("Stack overflow is a powerful art!");
 puts("In this MoeCTF,I will show you the charm of PWN!");
 puts("You need to understand the structure of the stack first.");
 puts("Then how many bytes do you need to overflow the stack?");
 __isoc99_scanf("%d", &v4);
 overflow(v4);
 return 0;
}

int __fastcall overflow(int a1)
{
 char buf[8]; // [rsp+18h] [rbp-8h] BYREF

 if ( a1 <= 7 )
 return puts("Come on, you can't even fill up this array?");
 read(0, buf, a1);
 return puts("OK,I receive your byte.and then?");
}

注意到。

西电CTF MoeCTF 2025 PWN 1 Find_it

Wed, 02 Sep 2026 16:42:29 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

照例拖进IDA。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 int v3; // eax
 char file[40]; // [rsp+0h] [rbp-30h] BYREF
 unsigned __int64 v6; // [rsp+28h] [rbp-8h]

 v6 = __readfsqword(0x28u);
 init(argc, argv, envp);
 v3 = dup(1);
 write(v3, "I've hidden the fd of stdout. Can you find it?\n", 0x2FuLL);
 close(1);
 __isoc99_scanf("%d", &fd1);
 write(fd1, "You are right.What would you like to see?\n", 0x2AuLL);
 __isoc99_scanf("%s%*c", file);
 open(file, 0);
 write(fd1, "What is its fd?\n", 0x10uLL);
 __isoc99_scanf("%d", &fd2);
 read(fd2, &buf, 0x50uLL);
 write(fd1, &buf, 0x50uLL);
 return 0;
}

fd(file descriptor) 是Unix及类Unix操作系统中，进程用于引用已打开文件或其他 I/O 对象的非负整数。¹

西电CTF MoeCTF 2025 PWN 1 Ez_u64

Wed, 02 Sep 2026 16:03:10 +0800

本文为人工撰写，仅使用生成式AI校对。

题目链接

拖进IDA。

int __fastcall main(int argc, const char **argv, const char **envp)
{
 init(argc, argv, envp);
 vuln();
 return 0;
}

int init()
{
 int fd; // [rsp+Ch] [rbp-4h]
 ...
 fd = open("/dev/urandom", 0, 0LL);
 ...
 read(fd, &num, 8uLL);
 return close(fd);
}

注意到num为随机数。

unsigned __int64 vuln()
{
 __int64 v1; // [rsp+0h] [rbp-10h] BYREF
 unsigned __int64 v2; // [rsp+8h] [rbp-8h]

 v2 = __readfsqword(0x28u);
 puts("Ya hello! Let's play a game.");
 printf("Guess which number I'm thinking of.");
 printf("Here is the hint.");
 write(1, &num, 8uLL);
 printf("\n>");
 __isoc99_scanf("%zu", &v1);
 if ( v1 != num )
 {
 puts("Wrong answer!");
 puts("Try pwntools u64?");
 exit(1);
 }
 puts("Win!");
 system("/bin/sh");
 return v2 - __readfsqword(0x28u);
}

使用write直接按内存原样输出num。