reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/examples/ctf-demo/report/report.md

@@ -0,0 +1,77 @@
+# ctf-demo — Final Report (示例)
+
+> 报告结构参考 `skills/docs-generator/references/security-report-templates.md`。
+
+## 1. 概述
+
+| 项 | 值 |
+|----|----|
+| 目标 | pwn1 (https://ctf.example.com/challenges/pwn1) |
+| 类型 | CTF pwn（栈溢出） |
+| 结果 | ✅ flag captured |
+| 耗时 | ~1.5h |
+
+## 2. 执行摘要
+
+pwn1 为无 PIE/无 canary 的 64 位 ELF，main 使用 `gets()` 读取 0x40 缓冲区。
+通过 0x48 偏移覆盖返回地址，调用程序内 win 函数获取 flag。远程验证成功。
+
+## 3. 时间线
+
+见 `timeline.md`（5 个阶段：init → recon → static → exploit → wrap）。
+
+## 4. 发现
+
+### F-01
+
+- title: gets() stack overflow in main (ret2win)
+- severity: high
+- status: validated
+- confidence: high
+- evidence_ids: [E-001, E-002, E-003]
+- location: pwn1:main — gets() into buf[0x40], return offset 0x48, no canary
+- impact: Remote code execution as the pwn1 process user; flag disclosure in CTF context.
+- repro_steps:
+  1. Triage the binary (E-001)
+  2. Confirm the overflow offset with a cyclic/crash test (E-002)
+  3. Send the ret2win payload against the remote service (E-003)
+- remediation: Replace gets() with fgets/read; enable canary, PIE and full RELRO; rely on ASLR.
+
+## 5. 攻击路径（Evidence → Finding → Path）
+
+### P-01
+
+- title: pwn1 ret2win solve path
+- path_type: solve
+- start: challenge binary download
+- goal: flag capture
+- steps:
+  1. action: download and triage pwn1 — evidence: E-001 — finding: F-01 | none
+  2. action: decompile main and confirm gets() overflow — evidence: E-002 — finding: F-01
+  3. action: craft ret2win payload and verify remotely — evidence: E-003 — finding: F-01
+- residual_risks: none (isolated CTF lab)
+
+```mermaid
+graph LR
+  A[下载 pwn1] --> B[checksec 侦察]
+  B --> C[Ghidra 反编译 main]
+  C --> D[定位 gets 溢出 偏移0x48]
+  D --> E[构造 payload ret2win]
+  E --> F[远程验证 获取 flag]
+```
+
+## 6. 复现
+
+```bash
+python3 exploit.py REMOTE
+```
+
+## 7. 修复建议（若为真实应用）
+
+- 使用 `fgets`/`read` 替代 `gets`
+- 开启 canary + PIE + full RELRO
+- 部署 ASLR（服务器侧）
+
+## 8. 附注
+
+- field-journal 已脱敏沉淀（无真实目标信息）