pwntools-level-3.0

SangharshaSangharsha
1 min read

Objective:

Here i see some text like chinese , i directly moved to source code for understanding the objective by which i made below table , we have to create/edit notebooks to match this exact pattern.

NotebookContentStatus
0"hello "CREATED (0x12345)
1"world,"ABANDONED (0x67890)
3"magic "CREATED (0x12345)
5"notebook"ABANDONED (0x67890)

Solution Code:

from pwn import *

context.binary = '/challenge/pwntools-tutorials-level3.0'
context.log_level = 'debug'   
r = process()  

def b(x): return str(x).encode()

def create(idx, content):
    r.sendlineafter(b'Choice >> ', b'1')
    r.sendlineafter(b'index:', b(idx))
    r.sendafter(b'content:', content)

def edit(idx):
    r.sendlineafter(b'Choice >> ', b'2')
    r.sendlineafter(b'index:', b(idx))

def bypass():
    r.sendlineafter(b'Choice >> ', b'5')

create(0, b'hello ')
create(1, b'world,')
create(3, b'magic ')
create(5, b'notebook')

edit(1)
edit(5)

bypass()
r.interactive()

What happened?:

  • Created notebooks at indexes 0, 1, 3, 5 with correct content.

  • Edited notebooks 1 and 5 to flip status from CREATEDABANDONED.

  • Call Gift for option 5 to pop /flag.

Flag:

pwn.college{kLDc7d9_bI31bzw8bjiz6UdKkYO.dlDN5QDL0UDNzQzW}

0
Subscribe to my newsletter

Read articles from Sangharsha directly inside your inbox. Subscribe to the newsletter, and don't miss out.

Written by

Sangharsha
Sangharsha

Aspiring developer and security enthusiast.