본문 바로가기

Write-Up/pwnable.kr

 (17)
[pwnable.kr] mistake 풀이 #include #include #define PW_LEN 10 #define XORKEY 1 void xor(char* s, int len){ int i; for(i=0; i 0)){ printf("read error\n"); close(fd); return 0; } char pw_buf2[PW_LEN+1]; printf("input password : "); scanf("%10s", pw_buf2); // xor your input xor(pw_buf2, 10); if(!strncmp(pw_buf, pw_buf2, PW_LEN)){ printf("Password OK\n"); system("/bin/cat flag\n"); } else{ printf("Wrong Password\n"); } close..
[pwnable.kr] input 풀이 #include #include #include #include #include int main(int argc, char* argv[], char* envp[]){ printf("Welcome to pwnable.kr\n"); printf("Let's see if you know how to give input to program\n"); printf("Just give me correct inputs then you will get the flag :)\n"); // argv if(argc != 100) return 0; if(strcmp(argv['A'],"\x00")) return 0; if(strcmp(argv['B'],"\x20\x0a\x0d")) return 0; printf("Stage 1..
[pwnable.kr] random 풀이 #include int main(){ unsigned int random; random = rand();// random value! unsigned int key=0; scanf("%d", &key); if( (key ^ random) == 0xdeadbeef ){ printf("Good!\n"); system("/bin/cat flag"); return 0; } printf("Wrong, maybe you should try 2^32 cases.\n"); return 0; } key값을 입력받고 random값과 비트연산(xor)을해서 0xdeadbeef가 나오면 문제가 풀린다. 구글링을 하면서 찾아보니 rand함수에는 취약점이 존재한다. seed값을 알면 rand함수의 리턴값을 예측 할 수 있다는 것..
[pwnable.kr] passcode 풀이 #include #include void login(){ int passcode1; int passcode2; printf("enter passcode1 : "); scanf("%d", passcode1); fflush(stdin); // ha! mommy told me that 32bit is vulnerable to bruteforcing :) printf("enter passcode2 : "); scanf("%d", passcode2); printf("checking...\n"); if(passcode1==338150 && passcode2==13371337){ printf("Login OK!\n"); system("/bin/cat flag"); } else{ printf("Login Failed!..
[pwnable.kr] blukat 풀이 #include #include #include #include char flag[100]; char password[100]; char* key = "3\rG[S/%\x1c\x1d#0?\rIS\x0f\x1c\x1d\x18;,4\x1b\x00\x1bp;5\x0b\x1b\x08\x45+"; void calc_flag(char* s){ int i; for(i=0; i
[pwnable.kr] memcpy 풀이 보호되어 있는 글입니다.
[pwnable.kr] cmd2 풀이 #include #include int filter(char* cmd){ int r=0; r += strstr(cmd, "=")!=0; r += strstr(cmd, "PATH")!=0; r += strstr(cmd, "export")!=0; r += strstr(cmd, "/")!=0; r += strstr(cmd, "`")!=0; r += strstr(cmd, "flag")!=0; return r; } extern char** environ; void delete_env(){ char** p; for(p=environ; *p; p++)memset(*p, 0, strlen(*p)); } int main(int argc, char* argv[], char** envp){ delete_env(); pute..
[pwnable.kr] cmd1 풀이 #include #include int filter(char* cmd){ int r=0; r += strstr(cmd, "flag")!=0; r += strstr(cmd, "sh")!=0; r += strstr(cmd, "tmp")!=0; return r; } int main(int argc, char* argv[], char** envp){ putenv("PATH=/thankyouverymuch"); if(filter(argv[1])) return 0; system( argv[1] ); return 0; } putenv = 환경변수를 PATH=/thankyouvermuch 로 설정 filter함수로 들어온 인자가 flag, sh, tmp 일때 !=0 (0이 아닌값)을 리턴한다. if(filter(arg..

티스토리툴바