Local Target

pwn

August 10, 20252 minutes

#include <stdio.h>
#include <stdlib.h>



int main(){
  FILE *fptr;
  char c;

  char input[16];
  int num = 64;

  printf("Enter a string: ");
  fflush(stdout);
  gets(input);
  printf("\n");

  printf("num is %d\n", num);
  fflush(stdout);

  if( num == 65 ){
    printf("You win!\n");
    fflush(stdout);
    // Open file
    fptr = fopen("flag.txt", "r");
    if (fptr == NULL)
    {
        printf("Cannot open file.\n");
        fflush(stdout);
        exit(0);
    }

    // Read contents from file
    c = fgetc(fptr);
    while (c != EOF)
    {
        printf ("%c", c);
        c = fgetc(fptr);
    }
    fflush(stdout);

    printf("\n");
    fflush(stdout);
    fclose(fptr);
    exit(0);
  }

  printf("Bye!\n");
  fflush(stdout);
}

There is a clear buffer overflow, since the gets function is used, and then there is an int initialized to 64; if we manage to change it to 65, the program gives the flag. The goal is to overflow from input and overwrite num

I tried sending 17 “A"s and setting a breakpoint right where gets() runs

pwndbg> b *0x0000000000401275
Breakpoint 1 at 0x401275
pwndbg>

In pwndbg I saw this instruction

0x4012a9 <main+115>    cmp    dword ptr [rbp - 8], 0x41         0x40 - 0x41     EFLAGS => 0x297 [ CF PF AF zf SF IF df of ac ]

It is comparing the first 32 bits of rbp-8 with 0x41; in C this instruction would be equivalent to:

  if( num == 65 ){

So the value we have to modify is at rbp-8

From telescope we can work out that we need 25 “A"s

The 0x40 (64) has changed to 0x41 (65)!

CVE-XXXX-XXXXX

hash-only-2

Ctf

d3bo

Title here

Local Target