PicoCTF Writeup - heap 0#

1
004011c0    int check_win()
2

3
004011c0    {
4
004011c0        if (!strcmp(safe_var, "bico"))
5
004011da        {
6
00401210            printf("Looks like everything is still secure!");
7
004011ef            printf("\nNo flage for you :(");
8
00401208            return fflush(stdout);
9
004011da        }
10
004011da
11
00401210        printf("\nYOU WIN");
12
00401236        char flag[64]; /* 0x40 => 64 */
13
00401236        fgets(&flag, 64, fopen("flag.txt", "r"));
14
0040123e        printf(&flag);
15
0040124d        fflush(stdout);
16
00401254        exit(0);
17
00401254        /* no return */
18
004011c0    }
19

20
/* ... */
21

22
004013c0    int main()
23
004013c0    /* int32_t argc => Not used */
24
004013c0    /* char** argv => Not used */
25
004013c0    /* char** envp => Not used */
26

27
004013c0    {
28
004013ca        int input_buffer;
29
004013d2        printf("\nWelcome to heap0!");
30
004013de        printf("I put my data on the heap so it should be safe from any tampering.");
31
004013ea        printf("Since my data isn't on the stack I'll even let you write whatever info you want to the heap, I already took care of using malloc for you.\n");
32
004013fa        fflush(stdout);
33

34
00401409        input_data = malloc(5);
35
00401410        strncpy(buffer, "pico", 5);
36
0040142b        safe_var = malloc(5);
37
0040142b        strncpy(buffer2, "bico", 5);
38

39
0040143c        printf("Heap State:");
40
0040144b        printf("+-------------+----------------+");
41
00401457        printf("[*] Address   ->   Heap Data   ");
42
0040145f        printf("+-------------+----------------+");
43
0040147a        printf("[*]   %p  ->   %s\n", input_data);
44
00401482        printf("+-------------+----------------+");
45
00401496        printf("[*]   %p  ->   %s\n", safe_var);
46
0040149e        printf("+-------------+----------------+");
47
004014a7        fflush(stdout);
48
004014a7
49
004014d5        while (true)
50
004014d5        {
51
004014d5            printf("
52
                        \n1. Print Heap:\t\t(print the current state of the heap)
53
                        \n2. Write to buffer:\t(write to your own personal block of data on the heap)
54
                        \n3. Print safe_var:\t(I'll even let you look at my variable on the heap, I'm confident it can't be modified)
55
                        \n4. Print Flag:\t\t(Try to print the flag, good luck)
56
                        \n5. Exit
57
                        \n
58
                        \nEnter your choice: ");
59
004014de            fflush(stdout);
60

61
004014de
62
004014f3            if (scanf("%d", &input_buffer) != 1)
63
004014f3            {
64
00401602                exit(0);
65
00401602                /* no return */
66
004014f3            }
67
004014f3
68
004014fd            int choice_int = input_buffer - 1;
69
00401503            char const* const str;
70
00401503
71
00401503            if (choice_int > 4)
72
00401503            {
73
0040158a                str = "Invalid choice";
74
00401591                label_401591:
75
00401591                printf(str);
76
004015e2                fflush(stdout);
77
00401503            }
78
00401503            else
79
00401510                switch (choice_int)
80
00401510                {
81
00401519                    case 0:
82
00401519                    {
83
00401519                        printf("Heap State:");
84
00401528                        printf("+-------------+----------------+");
85
00401534                        printf("[*] Address   ->   Heap Data   ");
86
0040153c                        printf("+-------------+----------------+");
87
0040155a                        printf("[*]   %p  ->   %s\n", input_data);
88
00401562                        printf("+-------------+----------------+");
89
00401579                        printf("[*]   %p  ->   %s\n", safe_var);
90
0040157e                        str = "+-------------+----------------+";
91
00401588                        goto label_401591;
92
00401519                    }
93
004015a1                    case 1:
94
004015a1                    {
95
004015a1                        printf("Data for buffer: ");
96
004015aa                        fflush(stdout);
97
004015bf                        scanf("%s", &input_data);
98
004015c4                        continue;
99
004015a1                    }
100
004015d9                    case 2:
101
004015d9                    {
102
004015d9                        printf("\n\nTake a look at my variable: safe_var = %s\n\n", safe_var);
103
004015e2                        fflush(stdout);
104
004015e7                        continue;
105
004015d9                    }
106
004014c8                    case 3:
107
004014c8                    {
108
004014c8                        check_win();
109
004014cd                        continue;
110
004014c8                    }
111
00401510                    case 4:
112
00401510                    {
113
00401510                        break;
114
00401510                        break;
115
00401510                    }
116
00401510                }
117
004014d5        }
118
004014d5
119
004015fc        return 0;
120
004013c0    }

1
int check_win()
2
{
3
    if (!strcmp(safe_var, "bico"))
4
    {
5
        printf("Looks like everything is still secure!");
6
        printf("\nNo flage for you :(");
7
        return fflush(stdout);
8
    }
9

10
    printf("\nYOU WIN");
11

12
    char flag[64];
13
    fgets(&flag, 64, fopen("flag.txt", "r"));
14
    printf(&flag);
15
    fflush(stdout);
16

17
    exit(0);
18
}
19

20
void print_heap_state() {
21
    printf("Heap State:");
22
    printf("+-------------+----------------+");
23
    printf("[*] Address   ->   Heap Data   ");
24
    printf("+-------------+----------------+");
25
    printf("[*]   %p  ->   %s\n", input_data);
26
    printf("+-------------+----------------+");
27
    printf("[*]   %p  ->   %s\n", safe_var);
28
    printf("+-------------+----------------+");
29
    fflush(stdout);
30
}
31

32
int main()
33
{
34
    int choice;
35

36
    printf("\nWelcome to heap0!");
37
    printf("I put my data on the heap so it should be safe from any tampering.");
38
    printf("Since my data isn't on the stack I'll even let you write whatever info you want to the heap, I already took care of using malloc for you.\n");
39
    fflush(stdout);
40

41
    input_data = malloc(5);
42
    strncpy(buffer, "pico", 5);
43

44
    safe_var = malloc(5);
45
    strncpy(buffer2, "bico", 5);
46

47
    print_heap_state();
48

49
    while (true)
50
    {
51
        printf("
52
        \n1. Print Heap:\t\t(print the current state of the heap)
53
        \n2. Write to buffer:\t(write to your own personal block of data on the heap)
54
        \n3. Print safe_var:\t(I'll even let you look at my variable on the heap, I'm confident it can't be modified)
55
        \n4. Print Flag:\t\t(Try to print the flag, good luck)
56
        \n5. Exit\n
57
        \nEnter your choice: ");
58
        fflush(stdout);
59

60
        if (scanf("%d", &choice) != 1)
61
        {
62
            exit(0);
63
        }
64

65

66
        if (choice > 5)
67
        {
68
            printf("Invalid choice");
69
            fflush(stdout);
70
        }
71
        else
72
            switch (choice)
73
            {
74
                case 1:
75
                {
76
                    print_heap_state();
77
                    continue;
78
                }
79
                case 2:
80
                {
81
                    printf("Data for buffer: ");
82
                    fflush(stdout);
83
                    scanf("%s", &input_data);
84
                    continue;
85
                }
86
                case 3:
87
                {
88
                    printf("\n\nTake a look at my variable: safe_var = %s\n\n", safe_var);
89
                    fflush(stdout);
90
                    continue;
91
                }
92
                case 4:
93
                {
94
                    check_win();
95
                    continue;
96
                }
97
                case 5:
98
                {
99
                    break;
100
                    break;
101
                }
102
            }
103
    }
104

105
    return 0;
106
}