Tokyohot | N0541

user_t users[10]; int logged_in = 0;

if __name__ == "__main__": main() Running the script locally prints:

$ ./n0541 1) Register > 1 Name: AAAAA... Password: BBBBB... [debug] pwd ptr = 0x603090 The global logged_in lives at 0x603200 . The distance is: tokyohot n0541

def get_flag(s): menu(s) s.sendall(b'3\n') flag = recvuntil(s, b'\n') print(flag.decode())

The challenge is a 64‑bit ELF binary that runs locally on the provided Docker image. It listens on a TCP port (or can be run interactively) and offers a simple menu‑driven interface. The goal is to gain a remote shell (or read the flag) by exploiting a vulnerability in the program. user_t users[10]; int logged_in = 0; if __name__

def recvuntil(s, delim=b'\n'): data = b'' while not data.endswith(delim): chunk = s.recv(1) if not chunk: break data += chunk return data

typedef struct char *name; char *pwd; user_t; The distance is: def get_flag(s): menu(s) s

heap: 0x603010 -> name buffer (0x80) 0x603090 -> pwd buffer (0x80)