Description:

Here's another pwn challenge! Let's see if you can run your own assembly!

`nc <ip> <port>`

[pwn2.zip]

This challenge involves using shellcode to pop a shell. A stack leak (the exact address of the input buffer actually) is given, and then an overflow allows you to set $rip to the start of the shellcode. The shellcode must fit in 64 bytes, which is enough for most online snippets. The solve is automated in solve.py.

Flag - byuctf{$10_says_this_one_is_harder_than_pwn3}

pwn2 was compiled with the command gcc -fno-stack-protector -z execstack -o src/pwn2 pwn2.c.

This challenge should be a Docker container that runs the binary pwn2 on port 40000 each time someone connects. All the proper files are included in here. The command to build and run the docker container is (when located inside of this directory):

docker compose up -d

To stop the challenge:

docker compose down