cool head picture

ＵＮＬＥ⛧ＳＨ　ＴＨＥ　ＢＥＡＳＴ　ト何ゼ

pwnable.kr [Part II] fd

Oct. 2, 2020 // echel0n

Mommy! what is a file descriptor in Linux?

File descriptor is an integer value that defined in uinstd.h. 

  1. /* standard file descriptors. */

  2. #define stdin_fileno 0 /* standard input. */

  3. #define stdout_fileno 1 /* standard output. */

  4. #define stderr_fileno 2 /* standard error output. */

The challenge source code is: 

  1. #include <stdio.h>

  2. #include <stdlib.h>

  3. #include <string.h>

  4. char buf[32];

  5. int main(int argc, char* argv[], char* envp[]){

  6. 	if(argc<2){

  7. 		printf("pass argv[1] a number\n");

  8. 		return 0;

  9. 	}

  10. 	int fd = atoi( argv[1] ) - 0x1234;

  11. 	int len = 0;

  12. 	len = read(fd, buf, 32);

  13. 	if(!strcmp("LETMEWIN\n", buf)){

  14. 		printf("good job :)\n");

  15. 		system("/bin/cat flag");

  16. 		exit(0);

  17. 	}

  18. 	printf("learn about Linux file IO\n");

  19. 	return 0;

  20. 

  21. }


Binary goes like this:
1) gets an integer value
2 substracts with 0x1234 (4460).
3) calls read() function with this integer.
4) calls strcmp() function
5) "LETMEWIN" string is in the buffer, It reads the flag file.
If we would set int fd value to zero, we can give LETMEWIN string as input. (stdin)
To do so, we should pass 4660 number as first argument, then program will wait for stdin.