The Plague has tried to make things easy for you in this service, but not too easy. He’s called The Plague, not The Nice Guy. The service should be running at 220.127.116.11:9999.
Tenement is a remote pwnable – it’s a normal x86 binary.
Upon initialization it loads a json file, using libjansson, which contains the flag and an array with memory addresses. The flow goes like this:
Kappa is a network service that is a very basic text-based pokemon game. In the end we found multiple bugs in the service, but the one we used was so cleanly exploitable that we think this was probably the intended solution.
When you connect, you get this menu: