[tctt2022] pwnable 01

3 min readOct 1, 2022

This series is for the Thailand Cyber Top Talent 2022 competitions which focus on the writeup for all pwnable challenges.

For the first one, the challenge gives us a binary file. When run, it will ask for the number of menu to use:

./challenge              
Welcome to the KEEP: What we SHOW is what you GIVE
Type '1' to give something
Type '2' to show what you give
Type '3' to DELETE your something
Type '4' to LEAVE the KEEP world

For 1 and 2, the binary will ask for the data and the length to be read/stored:

./challenge              
Welcome to the KEEP: What we SHOW is what you GIVE
Type '1' to give something
Type '2' to show what you give
Type '3' to DELETE your something
Type '4' to LEAVE the KEEP world
1
Please GIVE something to KEEP
AAAA
Please give the LENGTH of your something to be KEPT
1
KEEP your something somewherePress ENTER to continue ...Welcome to the m1rr0r: What we show is what you give
Type '1' to give something
Type '2' to show what you give
Type '3' to DELETE your something
Type '4' to LEAVE the m1rr0r world2
Please give the LENGTH to show your something
1
this is WHAT you give
APress ENTER to continue ...

Using rabin2 , I can extract the string which look like it will be used with system to print the flag:

rabin2 -zzz challenge
040 0x000021a6 0x000021a6  14  15 (.rodata) ascii cat SECRET.txt

Let’s decompile the code to understand it flows (I use Ghidra for decompiling the code). The interesting part is:

iVar1 = strcmp(local_fc,"1");
    if (iVar1 == 0) {
      puts("Please GIVE something to KEEP");
      fgets((char *)&local_e8,100,stdin);
      sVar2 = strcspn((char *)&local_e8,"\n");
      *(undefined *)((long)&local_e8 + sVar2) = 0;
      puts("Please give the LENGTH of your something to be KEPT");
      while (pcVar3 = fgets((char *)&local_f2,10,stdin), pcVar3 != (char *)0x0) {
        sVar2 = strcspn((char *)&local_f2,"\n");
        *(undefined *)((long)&local_f2 + sVar2) = 0;
        local_10 = strtol((char *)&local_f2,(char **)0x0,10);
        if (local_10 != 0) {
          if (((long)local_10 < 0) || (100 < local_10)) {
            local_10 = 100;
          }
          puts("KEEP your something somewhere");
          memcpy(&local_78,&local_e8,local_10);
          break;
        }
        puts("Please GIVE in a valid length");
      }
    }
    else {
      iVar1 = strcmp(local_fc,"2");
      if (iVar1 == 0) {
        if ((char)local_78 == '\0') {
          puts("Nothing is GIVEN yet");
        }
        else {
          puts("Please give the LENGTH to show your something");
          fgets((char *)&local_f2,10,stdin);
          sVar2 = strcspn((char *)&local_f2,"\n");
          *(undefined *)((long)&local_f2 + sVar2) = 0;
          local_10 = strtol((char *)&local_f2,(char **)0x0,10);
          if (local_10 == 0) {
            system("cat SECRET.txt");
            puts("this is WHAT you give");
            puts((char *)&local_78);
          }
          else {
            if (((long)local_10 < 0) || (100 < local_10)) {
              local_10 = 100;
            }
            memcpy(&local_e8,&local_78,local_10);
            puts("this is WHAT you give");
            puts((char *)&local_e8);
          }
        }
      }

That means, to get to cat SECRET.txt we need:
- Call menu 1 to store something first but we need to supply valid length
- Call menu 2 to load the data into long
- To get to system , the loaded data need to be 0

Get Fnnnr’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

By looking at the fgets((char *)&local_f2,10,stdin);, it does not have a restriction on the number of length, unlike the menu 1.
So, we can store anything but when we load it using menu 2, we can just supply length of 0 which will make the local_10 to be 0.
Let’s try:

./challenge                           
Welcome to the KEEP: What we SHOW is what you GIVE
Type '1' to give something
Type '2' to show what you give
Type '3' to DELETE your something
Type '4' to LEAVE the KEEP world1
Please GIVE something to KEEP
AAAA
Please give the LENGTH of your something to be KEPT
4
KEEP your something somewherePress ENTER to continue ...Welcome to the m1rr0r: What we show is what you give
Type '1' to give something
Type '2' to show what you give
Type '3' to DELETE your something
Type '4' to LEAVE the m1rr0r world2
Please give the LENGTH to show your something
0
tctt2022{REDACTED}
this is WHAT you give
AAAA