Add files via upload

ctf/docker/pwn/bof-basic/Dockerfile

@@ -0,0 +1,32 @@
+# T3MP3ST CTF Challenge: Buffer Overflow - ret2win
+# Difficulty: Easy (1)
+# Category: Binary Exploitation
+
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y \
+    gcc \
+    socat \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /challenge
+
+# Create vulnerable binary source
+COPY vuln.c /challenge/
+COPY flag.txt /challenge/
+
+# Compile with vulnerabilities enabled
+RUN gcc -o vuln vuln.c \
+    -fno-stack-protector \
+    -no-pie \
+    -z execstack \
+    -m64
+
+# Set permissions
+RUN chmod 755 /challenge/vuln && \
+    chmod 444 /challenge/flag.txt
+
+EXPOSE 9001
+
+# Run with socat
+CMD ["socat", "TCP-LISTEN:9001,reuseaddr,fork", "EXEC:/challenge/vuln"]

ctf/docker/pwn/bof-basic/flag.txt

@@ -0,0 +1 @@
+T3MP3ST{b4s1c_buff3r_0v3rfl0w}

ctf/docker/pwn/bof-basic/vuln.c

@@ -0,0 +1,65 @@
+/*
+ * T3MP3ST CTF - Buffer Overflow Challenge
+ *
+ * Vulnerability: Stack buffer overflow in vuln()
+ * Protections: None (no canary, no PIE, NX disabled)
+ * Objective: Redirect execution to win() function
+ *
+ * DO NOT USE IN PRODUCTION - Intentionally vulnerable
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+// Disable buffering
+void setup() {
+    setvbuf(stdin, NULL, _IONBF, 0);
+    setvbuf(stdout, NULL, _IONBF, 0);
+    setvbuf(stderr, NULL, _IONBF, 0);
+}
+
+// Win function - prints the flag
+void win() {
+    FILE *f = fopen("/challenge/flag.txt", "r");
+    if (f == NULL) {
+        printf("Error: Could not open flag file\n");
+        return;
+    }
+
+    char flag[128];
+    if (fgets(flag, sizeof(flag), f) != NULL) {
+        printf("\n[+] ACCESS GRANTED\n");
+        printf("[+] FLAG: %s\n", flag);
+    }
+    fclose(f);
+    exit(0);
+}
+
+// Vulnerable function
+void vuln() {
+    char buffer[64];
+
+    printf("╔════════════════════════════════════════╗\n");
+    printf("║     SECURE TERMINAL ACCESS SYSTEM      ║\n");
+    printf("╚════════════════════════════════════════╝\n");
+    printf("\nEnter access code: ");
+
+    // VULNERABLE: gets() does not check buffer bounds
+    gets(buffer);
+
+    printf("\nAccess code received: %s\n", buffer);
+    printf("[-] ACCESS DENIED\n");
+}
+
+int main() {
+    setup();
+
+    printf("\n[*] Terminal initialized\n");
+    printf("[*] win() function at: %p\n", win);  // Hint for players
+
+    vuln();
+
+    return 0;
+}