Pwnable.kr 解题笔记

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
    if(argc<2){
        printf("pass argv[1] a numbern");
        return 0;
    }
    int fd = atoi( argv[1] ) - 0x1234;
    int len = 0;
    len = read(fd, buf, 32);
    if(!strcmp("LETMEWINn", buf)){
        printf("good job :)n");
        system("/bin/cat flag");
        exit(0);
    }
    printf("learn about Linux file IOn");
    return 0;

}

fd = atoi(input) - 0x1234

len = read(fd, buf, 32)
需要 buf == "LETMEWINn"

注意：
fd = 0 时，是stdin，标准输入流。这是可以用户控制

#include <stdio.h>
#include <string.h>
unsigned long hashcode = 0x21DD09EC;
unsigned long check_password(const char* p){
    int* ip = (int*)p;
    int i;
    int res=0;
    for(i=0; i<5; i++){
        res += ip[i];
    }
    return res;
}

int main(int argc, char* argv[]){
    if(argc<2){
        printf("usage : %s [passcode]n", argv[0]);
        return 0;
    }
    if(strlen(argv[1]) != 20){
        printf("passcode length should be 20 bytesn");
        return 0;
    }

    if(hashcode == check_password( argv[1] )){
        system("/bin/cat flag");
        return 0;
    }
    else
        printf("wrong passcode.n");
    return 0;
}

chat* x = input
strlen(x) = 20
int tmp = (int*) x
x += 4
result += x
result = 0x21DD09EC

得出，5个长度为4的数相加值为result

4X + Y = result

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void func(int key){
    char overflowme[32];
    printf("overflow me : ");
    gets(overflowme);// smash me!
    if(key == 0xcafebabe){
        system("/bin/sh");
    }
    else{
        printf("Nah..n");
    }
}
int main(int argc, char* argv[]){
    func(0xdeadbeef);
    return 0;
}

#include <stdio.h>
#include <stdlib.h>

void login(){
    int passcode1;
    int passcode2;

    printf("enter passcode1 : ");
    scanf("%d", passcode1);
    fflush(stdin);

    // ha! mommy told me that 32bit is vulnerable to bruteforcing :)
    printf("enter passcode2 : ");
        scanf("%d", passcode2);

    printf("checking...n");
    if(passcode1==338150 && passcode2==13371337){
                printf("Login OK!n");
                system("/bin/cat flag");
        }
        else{
                printf("Login Failed!n");
        exit(0);
        }
}

void welcome(){
    char name[100];
    printf("enter you name : ");
    scanf("%100s", name);
    printf("Welcome %s!n", name);
}

int main(){
    printf("Toddler's Secure Login System 1.0 beta.n");

    welcome();
    login();

    // something after login...
    printf("Now I can safely trust you that you have credential :)n");
    return 0;
}

#include <stdio.h>

int main() {
    int x;
    printf("Enter X:n");
    
    scanf("%d", &x);
    
    printf("You entered %d...n", x);
    
    return 0;
}

int scanf(const char *format, ...);

int passcode1;
int passcode2;

scanf("%d", passcode1);
scanf("%d", passcode2);

char name[100];
scanf("%100s", name);

ebp ------->
           |
           |
ebp - 0x10 | *passcode1
           |
           |
           ...
           |
           |
ebp - 0x70 | name[100]

int main(){
    unsigned int random;
    random = rand();// random value!

    unsigned int key=0;
    scanf("%d", &key);

    if( (key ^ random) == 0xdeadbeef ){
        printf("Good!n");
        system("/bin/cat flag");
        return 0;
    }

    printf("Wrong, maybe you should try 2^32 cases.n");
    return 0;
}