Home
Github
  • 👋Welcome !
  • 🚩CTF Writeups
    • SKR CTF
      • Binary
        • Auth Me 2.0
      • Misc
        • Schrodinger's Cat 2
      • Reverse Engineering
        • Nogard 3
    • osu!gaming CTF 2024
      • pwn
        • betterthanu
    • Crackmes
      • PieIsMyFav
      • Plain Sight
    • WolvCTF 2024
      • pwn
        • babypwn
    • TexSAW CTF 2024
      • rev
        • Catch The White Rabbit
      • Forensics
        • Malicious Threat
        • MalWhere?
    • SwampCTF 2024
      • Misc
        • Lost Some Magic
        • The Time Equations
    • pwnable.kr
      • Toddler's Bottle
        • fd
    • Codegate CTF 2024
      • ai
        • ai_warmup
    • Junior Crypt CTF 2024
      • Misc
        • Terms of Use
      • Forensics
        • Admin Rights
        • Confusion
      • PPC
        • l33t
    • IHack 2024 Qualification
      • DFIR
        • Happy SPLUNKing
      • Malware
        • Confusing Javascript
    • Malcore Challenge
    • Intern Task
      • SQLI
  • 📮Room/Machine
    • HTB - Sherlock
      • DFIR
        • Brutus
        • Unit42
        • Jingle Bell
  • 📚Notes
    • CTF Related
      • pwn
        • pwntools
        • Format String Vulnerability
        • Integer Overflow
        • Executable Properties
        • gdb-gef
        • Template Script
      • b2r/koth
    • Assembly Language
    • x86 Architecture
  • 🛠️Tools
    • DFIR
    • Malware Analysis
    • Essentials
  • 👽Threat Hunting
    • Intro
    • Common Tactics
    • Methodologies
    • Types of threat hunting
  • 😸whoami
    • About Me
    • Other
      • FYP
  • Archives
    • 3108 CTF
      • Kategori
        • Tugasan Utama : Warkah Untuk Perwira
          • Tugasan I : Seruan Perwira
          • Tugasan II : Tali Barut
          • Warkah Akhir
        • Web
          • Lemah
          • Pantun Pantul
          • Wantujus
          • Wantusom
        • Reverse Engineering
          • Pa+rio+ik
          • Sarawak
        • Network
          • Johan
          • Lagi-lagi Johan
        • Misc
          • 3108 CTF Town
          • Mencari Rahsia Si Dia
        • Cryptography
          • 1957bit
          • Nasihat
          • Selamat Malam
        • OSINT
          • Pertemuan Kapisata : Babak I
          • Pertemuan Kapista : Babak II
          • Pertemuan Kapista : Finale
    • Curtin CTF 2023
      • Pwn n Rev
        • Classic Bufferoverflow
        • Intro to Buffer Overflow
        • Don't Go Overboard
        • Don't Go Overboard 2
        • Let The Random Games Begin1
        • Let The Random Games Begin 2
        • Let The Random Games Begin 3
    • 1337UP LIVE CTF
      • Pwn
        • Floor Mat Store
    • HTB University CTF 2023
      • Reverse Engineering
        • Windows Of Opportunity
Powered by GitBook
On this page
  • Solution
  • Flag
  1. CTF Writeups
  2. pwnable.kr
  3. Toddler's Bottle

fd

Last updated 1 year ago


Solution

Given a C file. Let's do some basic checking on it.

fd.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
        if(argc<2){
                printf("pass argv[1] a number\n");
                return 0;
        }
        int fd = atoi( argv[1] ) - 0x1234;
        int len = 0;
        len = read(fd, buf, 32);
        if(!strcmp("LETMEWIN\n", buf)){
                printf("good job :)\n");
                system("/bin/cat flag");
                exit(0);
        }
        printf("learn about Linux file IO\n");
        return 0;

}

Based on the source code given, we can see there are 2 lines that are very interesting.

Line 10
  • atoi() function in C converts a string to an integer

  • it takes argv[1] as its argument and substract it with 0x1234 which is 4660 in decimal

  • the result is stored in variable fd

Line 13
  • it compares a strings in variable buf with "LETMEWIN\n"

  • that's it

Between the lines, we can see there is a read() function which takes file descriptor, some buffer and number of bytes. We need to make the file descriptor equals 0 so that we can write a string to the program and pass the if statement in Line 13.

So we input 4660 which then it will substract with 0x1234 and returns 0. Then write LETMEWIN to the program.


Flag

mommy! I think I know what a file descriptor is!!

Yeah. Nice challenge btw

🚩
👍