Pwnable.kr “fd” writeup — pwning a binary (easy).
This is an easy challenge.
If anyone is starting with binary pwning, I will highly recommend him to actually go and start practicing on the website pwnable.kr. There are a lot of beginner challenges present and they are absolutely easy to solve.
Let’s start with the challenge fd :
Upon ssh-ing into the given port :
We get:
This will get us into a remote desktop . Now just check out the files in it using ‘ls’. This will give us:
Always while trying to solve problems based on binary pwning, try to at first read the program file before moving on to the binary. Reading the program file (in this case it is fd.c) , we get — ->
fd@ubuntu:~$ cat fd.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
if(argc<2){
printf(“pass argv[1] a number\n”);
return 0;
}
int fd = atoi( argv[1] ) — 0x1234;
int len = 0;
len = read(fd, buf, 32);
if(!strcmp(“LETMEWIN\n”, buf)){
printf(“good job :)\n”);
setregid(getegid(), getegid());
system(“/bin/cat flag”);
exit(0);
}
printf(“learn about Linux file IO\n”);
return 0;
}
This tells us that the program takes a command line input . Checks it with the command — — — — — — →
int fd = atoi( argv[1] ) — 0x1234;
Get M4D’s stories in your inbox
Join Medium for free to get updates from this writer.
here atoi converts the command line string form of number to their integer value.
int len = 0;
len = read(fd, buf, 32);
In this case it actually takes a file descriptor from the command line, subtracting 0x1234, and reading 32 bytes from that descriptor. This reads 32 bytes from fd and put it into buf. Now buf will read the value of the input given is the integer value of 0x1234 which is 4660.
Upon entering the value , we will find that it actually goes to the next line as if it needs a value to work.
This works because the value of fd will then be 0 according to the logic. This actually is the file descriptor 0 or stdin value. The program is effectively just reading the value from our keyboard.
Now upon going for the stdin value , we get — — →
if(!strcmp(“LETMEWIN\n”, buf)){
printf(“good job :)\n”);
setregid(getegid(), getegid());
system(“/bin/cat flag”);
exit(0);
this logic. Now the strcmp actually compares for a non zero value with the value of buf , which is effectively 0.
The logic here is — — →
compare LETMEWIN with 0 and checks if the values dont match. Since they dont match , it will actually get us the value of the flag.
fd@ubuntu:~$ ./fd 4660
LETMEWIN
good job :)
Mama! Now_I_understand_what_file_descriptors_are!
fd@ubuntu:~$
Mama! Now_I_understand_what_file_descriptors_are! — — → This is the actual flag. Enter it in the flag part and then get authenticated
This is how the binary will get solved.
