Piratesay

When connecting, you enter a kind of bash shell, where you can use basic commands to navigate and read/write files. You also get a random identity every session, but that is only important to the second vulnerability.

commands:

The Official Pirate Codex:
  scout [destination] - Search current or desired destination for items
  sail [destination] - Set sail for a new destination
  bury - bury treasure for others to find at your destination
  loot [item] - Grab the contents of an item at your destination
  identity - manage your pirate identity 
  codex - Display this pirate codex
  dock - Dock your ship and leave Pirate Say

• ls -> scout
• cd -> sail
• help -> codex
• exit -> dock
• help -> codex
• read -> loot
• write -> bury

Vulnerability one

If you input a wrong password when looting treasure the password you gave get’s read back to you: ![[Pasted image 20260710230455.png]] This Clean_from_formatstrings function that checks on format strings, but not for ‘o’ (used for octal), so we can use that to leak memory (and the password)