Title here
Summary here
Bonus Points
July 21, 20252 minutes
A binary is provided for this challenge
undefined8 main(void)
{
uint __seed;
int iVar1;
char local_1a [10];
int local_10;
uint local_c;
local_c = 0;
__seed = getpid();
srand(__seed);
iVar1 = rand();
local_c = iVar1 % 100;
puts("Hello, here you can get some bonus points for the competition.");
puts("You cannot get more than 100 bonus points.");
puts("If you go above 1000 you win.");
printf("Your score is currently %u\n",(ulong)local_c);
printf("How many bonus points do you want?\n>>> ");
fflush(stdout);
fgets(local_1a,8,stdin);
local_10 = atoi(local_1a);
if (local_10 < 0x65) {
local_c = local_c + local_10;
printf("Your new score is %u\n",(ulong)local_c);
if (local_c < 0x3e9) {
puts("You should try to get more points");
}
else {
puts("Congratulations! Here is your flag:");
fflush(stdout);
system("cat flag.txt");
}
}
else {
puts("Stop cheating!");
}
return 0;
}
First, a random number between 0 and 100 is generated and stored in local_c
__seed = getpid();
srand(__seed);
iVar1 = rand();
local_c = iVar1 % 100;
Then it prints that number and asks the user how many more points they want. The points the user wants are stored in local_10, and local_10 is an unsigned int, which means it does not store negative numbers.
For example, entering -1000 is like entering 4294966296. That passes the first check, whether the user input is < 0x65, and then, after adding the randomly generated number, it no longer meets the condition local_c < 0x3e9, which makes it print the flag
[d3bo@archlinux bonus_points]$ nc localhost 4000
Hello, here you can get some bonus points for the competition.
You cannot get more than 100 bonus points.
If you go above 1000 you win.
Your score is currently 96
How many bonus points do you want?
>>> -1000
Your new score is 4294966392
Congratulations! Here is your flag:
FCSC{XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX}