Tokyohot N0541 May 2026

The challenge is a 64‑bit ELF binary that runs locally on the provided Docker image. It listens on a TCP port (or can be run interactively) and offers a simple menu‑driven interface. The goal is to gain a remote shell (or read the flag) by exploiting a vulnerability in the program.

def main(): s = socket.create_connection((HOST, PORT)) register(s) login_overwrite(s) get_flag(s) s.close() tokyohot n0541

FLAGt0ky0_h0t_4nd_0v3rf1w_succ3ss The same script works against the remote service (replace HOST and PORT with the challenge endpoint). The challenge is a 64‑bit ELF binary that

The interesting functions are register_user , login , and show_secret . void register_user() char *name = malloc(0x80); char *pwd = malloc(0x80); printf("Name: "); gets(name); // <--- vulnerable printf("Password: "); gets(pwd); // store pointers in a global struct (userlist) char *pwd = malloc(0x80)