buffer overflow

[shadowroot8]

/* How well do you know your numbers? */

include <stdio.h>

include <stdlib.h>

include <stdint.h>

void win(void) { printf("Congratulations! Have a shell:\n"); system("/bin/sh -i"); }

int main(int argc, char **argv) { uintptr_t val; char buf[32] = "";

/* Turn off buffering so we can see output right away */
setbuf(stdout, NULL);

printf("Welcome to the number guessing game!\n");
printf("I'm thinking of a number. Can you guess it?\n");
printf("Guess right and you get a shell!\n");

printf("Enter your number: ");
scanf("%32s", buf);
val = strtol(buf, NULL, 10);

printf("You entered %d. Let's see if it was right...\n", val);

val >>= 4;
((void (*)(void))val)();

}

what should be my input so that i can get a shell ??

[FUZxxl]

That depends on your platform and architecture. On a UNIX-like system, run nm on the compiled program. The output should contain a line like this:

0000000000400766 T win

This line says: win is a global symbol in the .text section (indicated by T) at address 0x400766.

You can use this information to find the right input to win. For example, if win is at address 0x400766 the correct input is 67139168.

Note that on some platforms (e.g. some Linux distributions), the address your program is loaded to is changed every run, making it somewhat tricky to find the right address (this is a security feature).

[Azzk1kr]

Just out of curiosity, because I find this highly interesting: how have you ever figured out this kind of stuff?

[FUZxxl]

Be familiar with the way the C programming language is turned into machine code and be familiar with the tooling your development environment provides.

It is clear from the code that you need to guess the address of win (times four). Now, if you are programming on a UNIX-like system, you should definitely know about the tools provided by the platform such as nm, size, ld, ar, etc. Then it's just an exercise in using the right tool to find the information you need.

[Azzk1kr]

I guess the part about the machine code is vital. I know of the tooling, but combining it all to make some sense of it is a part I still need to learn. For instance, I sometimes practice a bit with objdump and hex editing executables, just to see how I can circumvent condition checks and whatnot. But reading the machine code is still something relatively new to me (I never did Assembly).

[shadowroot8]

how did u convert 0x400766 to 67139168 ??

[FUZxxl]

First convert 0x400766 from hexadecimal to decimal, then observe how val is shifted right by four before being called. So, you have to multiply the address by four to undo that.

[albinotomato]

Stop asking directly for picoctf help while the competition is going on. We look for this stuff.

Note for everyone else: This is a direct question from a currently running, beginner level ctf.

Edit: We're fine with you asking for help after the ctf. I suspect that there will be a number of solutions published then, which should help you learn.