[pwn]simple_fmt finish

Author: voidzhakul

..gitattributes.un~

@@ -13,3 +13,6 @@
 *.7z filter=lfs diff=lfs merge=lfs -text
 pwn/race/docker/bin/race filter=lfs diff=lfs merge=lfs -text
 pwn/race/challenge filter=lfs diff=lfs merge=lfs -text
+
+pwn/simple_fmt/challenge  filter=lfs diff=lfs merge=lfs -text
+pwn/simple_fmt/docker/bin/fmt filter=lfs diff=lfs merge=lfs -text

.gitattributes

@@ -10,7 +10,7 @@ race
 
 ## 分数
 
-50
+75
 
 ## flag
 

pwn/race/README.md

@@ -0,0 +1,34 @@
+# Race
+
+## 题目名称
+
+simple_fmt
+
+## 分类
+
+* pwn
+
+## 分数
+
+50
+
+## flag
+
+```txt
+zsctf{fmt_gogogo_2020}
+```
+
+## develop
+
+```bash
+# 测试环境
+无
+```
+
+## 题目搭建
+
+```bash
+cd pwn/simple_fmt/docker && docker-compose up -d
+```
+
+> 修改 docker-compose.yml 环境变量可改变 flag。

pwn/simple_fmt/README.md

@@ -0,0 +1,39 @@
+FROM ubuntu:18.04
+
+RUN sed -i "s/http:\/\/archive.ubuntu.com/http:\/\/mirrors.tuna.tsinghua.edu.cn/g" /etc/apt/sources.list && \
+    apt-get update && apt-get -y dist-upgrade && \
+    apt-get install -y lib32z1 xinetd
+
+RUN useradd -m ctf
+
+WORKDIR /home/ctf
+
+RUN cp -R /lib* /home/ctf && \
+    cp -R /usr/lib* /home/ctf
+
+RUN mkdir /home/ctf/dev && \
+    mknod /home/ctf/dev/null c 1 3 && \
+    mknod /home/ctf/dev/zero c 1 5 && \
+    mknod /home/ctf/dev/random c 1 8 && \
+    mknod /home/ctf/dev/urandom c 1 9 && \
+    chmod 666 /home/ctf/dev/*
+
+RUN mkdir /home/ctf/bin && \
+    cp /bin/sh /home/ctf/bin && \
+    cp /bin/ls /home/ctf/bin && \
+    cp /bin/cat /home/ctf/bin
+
+COPY ./ctf.xinetd /etc/xinetd.d/ctf
+COPY ./start.sh /start.sh
+RUN echo "Blocked by ctf_xinetd" > /etc/banner_fail
+
+RUN chmod +x /start.sh
+
+COPY ./bin/ /home/ctf/
+RUN chown -R root:ctf /home/ctf && \
+    chmod -R 750 /home/ctf && \
+    chmod 740 /home/ctf/flag
+
+CMD ["/start.sh"]
+
+EXPOSE 9999

pwn/simple_fmt/challenge/fmt

@@ -0,0 +1 @@
+zsctf{}

pwn/simple_fmt/docker/Dockerfile

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:18223164a91d6047f0362f00d5f19595427b06e7cc129f66c01aceb96549c991
+size 13608

pwn/simple_fmt/docker/bin/flag

@@ -0,0 +1,19 @@
+service ctf
+{
+    disable = no
+    socket_type = stream
+    protocol    = tcp
+    wait        = no
+    user        = root
+    type        = UNLISTED
+    port        = 9999
+    bind        = 0.0.0.0
+    server      = /usr/sbin/chroot
+    server_args = --userspec=1000:1000 /home/ctf ./fmt
+    banner_fail = /etc/banner_fail
+    # safety options
+    per_source	= 10 # the maximum instances of this service per source IP address
+    rlimit_cpu	= 20 # the maximum number of CPU seconds that the service may use
+    #rlimit_as  = 1024M # the Address Space resource limit for the service
+    #access_times = 2:00-9:00 12:00-24:00
+}

pwn/simple_fmt/docker/bin/fmt

@@ -0,0 +1,10 @@
+version: '3'
+services:
+    race:
+        build:
+            context: ./
+            dockerfile: Dockerfile
+        ports:
+            - "1001:9999"
+        environment:
+            - FLAG=zsctf{fmt_gogogo_2020}