ELF>Ð@@˜+@8 @@@@@@øø88@8@@@<< ```€ ((`(`ÐÐTT@T@DDPåtd@@44QåtdRåtd``ðð/lib64/ld-linux-x86-64.so.2GNU GNU ¸; /ž Ù³ÔÞå‡8:^ƒ  € )ŒgUaH8R*Yk M 1p `$€ `libc.so.6exit__isoc99_scanfputsstdinprintfstdout__isoc99_fscanflocaltimesetbuf__libc_start_main__gmon_start__GLIBC_2.7GLIBC_2.2.5ii zui „ø`p ` € `  ` `( `0 `8 `@ `H `P ` X ` HƒìH‹õ H…Àtè³HƒÄÃÿ5â ÿ%ä @ÿ%â héàÿÿÿÿ%Ú héÐÿÿÿÿ%Ò héÀÿÿÿÿ%Ê hé°ÿÿÿÿ% hé ÿÿÿÿ%º héÿÿÿÿ%² hé€ÿÿÿÿ%ª hépÿÿÿÿ%¢ hé`ÿÿÿÿ%2 f1íI‰Ñ^H‰âHƒäðPTIÇÀÀ @HÇÁP @HÇÇÆ@è‡ÿÿÿôfD¸w `UH-p `HƒøH‰åv¸H…Àt]¿p `ÿàf„]Ã@f.„¾p `UHîp `HÁþH‰åH‰ðHÁè?HÆHÑþt¸H…Àt ]¿p `ÿà]ÃfD€= uUH‰åènÿÿÿ]Æî óÃ@¿ `Hƒ?u듸H…ÀtñUH‰åÿÐ]ézÿÿÿUH‰åHì¿èµþÿÿH‰…@ÿÿÿH…@ÿÿÿH‰Çè?þÿÿH‹H‰•ÿÿÿH‹PH‰•ÿÿÿH‹PH‰•ÿÿÿH‹PH‰•ÿÿÿH‹P H‰• ÿÿÿH‹P(H‰•(ÿÿÿH‹@0H‰…0ÿÿÿ¿Ø @è þÿÿ¿ @èÿýÿÿ‹•ÿÿÿD‹…ÿÿÿ‹ÿÿÿ‹… ÿÿÿ‹µÿÿÿ~‹µÿÿÿÆlHƒìRE‰ÁA‰È‰Á‰ú¿( @¸èÓýÿÿHƒÄ¿H @¸èÀýÿÿH…LÿÿÿH‰Æ¿–@¸è×ýÿÿ…Àt ‹…Lÿÿÿ=Ót¿ @¸è‡ýÿÿ¿è½ýÿÿH‹v ¾H‰ÇèYýÿÿ¿@¸èZýÿÿH‹c H•Pÿÿÿ¾ @H‰Ç¸è ýÿÿ…Àu ¿èlýÿÿ¸ÉÃDAWAVA‰ÿAUATL%® UH-® SI‰öI‰ÕL)åHƒìHÁýèwüÿÿH…ít 1Û„L‰êL‰öD‰ÿAÿÜHƒÃH9ëuêHƒÄ[]A\A]A^A_Ãf.„óÃHƒìHƒÄÃWelcome to the NOP Certification Exam-------------------------------------%04d-%02d-%02d %02d:%02d:%02d ------------------------------------- The clock starts now, the rules are simple. You have 25m to root this box. If you happen to have spare 0day on the linux kernel and are willing to spend it here, I would be happy to broker it for a small fee. The total payout is much larger than the prize for the fastest time. If instead you'd rather solve the challenge as intended, note that this binary is running on port 9999 as root. ------------------------------------- Prove your pwnage by doing "cat /root/flag" or "rm -f /", hackers choice. ------------------------------------- ------------------------------------- Binary Ninja has a built in shellcode compiler that can compile this payload: ------------------------------------- int main (uint64_t a) { interactive_bash(); } ------------------------------------- The environment: gcc -o chal1 chal1.c -ldl -std=gnu99 -z execstack -fno-stack-protector \ -D_FORTIFY_SOURCE=0 -Wall -Wextra -Wshadow Also, kernel.randomize_va_space is 0 ------------------------------------- Prove yourself worthy. What year did the DailyDave list start? Year: %d _____ ___ ___ ___ _____ _____ _ _ ___________ | __ \ / _ \ | \/ || ___| | _ || | | | ___| ___ \ | | \// /_\ \| . . || |__ | | | || | | | |__ | |_/ / | | __ | _ || |\/| || __| | | | || | | | __|| / | |_\ \| | | || | | || |___ \ \_/ /\ \_/ / |___| |\ \ \____/\_| |_/\_| |_/\____/ \___/ \___/\____/\_| \_| glhf: %250s;4öÿÿ€ÀöÿÿP¶÷ÿÿ¨@ùÿÿȰùÿÿzRx höÿÿ*zRx $ˆõÿÿ FJ w€?;*3$"D÷ÿÿ…A†C € DdpøÿÿeBBŽE B(ŒH0†H8ƒM@r8A0A(B BBB¬˜øÿÿ @€@ ø@ Ä @``õþÿo˜@ø@À@  `Ø @Ø@H þÿÿo¨@ÿÿÿoðÿÿoˆ@(`6@F@V@f@v@†@–@¦@¶@GCC: (Ubuntu 5.4.0-6ubuntu1~16.04.4) 5.4.0 201606098@T@t@˜@À@ø@ˆ@¨@ Ø@ @ ø@ @ À@Ð@Ä @Ð @@H@`` `(`ø` `` `p `ñÿ  `@@@.€@Dˆ `S`z @†`¥ñÿñÿ­8@» `ñÿÇ`Ø(`á`ô@ `À @-D `p ` ` `t¡€ `´p `'Ä @»Ïã` ` h `+Ð @2:P @eÓ `Ð@*Jp `VÆ@…[ o‰›p `§ D ø@crtstuff.c__JCR_LIST__deregister_tm_clones__do_global_dtors_auxcompleted.7585__do_global_dtors_aux_fini_array_entryframe_dummy__frame_dummy_init_array_entrychal1.c__FRAME_END____JCR_END____init_array_end_DYNAMIC__init_array_start__GNU_EH_FRAME_HDR_GLOBAL_OFFSET_TABLE___libc_csu_finilocaltime@@GLIBC_2.2.5_ITM_deregisterTMCloneTablestdout@@GLIBC_2.2.5__isoc99_fscanf@@GLIBC_2.7puts@@GLIBC_2.2.5stdin@@GLIBC_2.2.5_edatasetbuf@@GLIBC_2.2.5printf@@GLIBC_2.2.5__libc_start_main@@GLIBC_2.2.5__data_start__gmon_start____dso_handle_IO_stdin_used__libc_csu_init__bss_startmain_Jv_RegisterClasses__isoc99_scanf@@GLIBC_2.7exit@@GLIBC_2.2.5__TMC_END___ITM_registerTMCloneTable.symtab.strtab.shstrtab.interp.note.ABI-tag.note.gnu.build-id.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.jcr.dynamic.got.plt.data.bss.comment8@8#T@T 1t@t$Döÿÿo˜@˜(N À@À8Vø@ø^ÿÿÿoˆ@ˆkþÿÿo¨@¨0zØ@ØH„B @ ØŽø@ø‰ @  ”À@ÀÐ@Ðò£Ä @Ä ©Ð @Ð ?±@4¿H@HôÉ`Õ`á ` æ(`(Иø`øï ` `ø` `` þp `p 0p 4‰* ¨ / È'Á