CTF随笔（二）

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
        //接收参数，当参数不存在时，返回请输入参数
        if(argc<2){
                printf("pass argv[1] a number\n");
                return 0;
        }
        //将参数从char*转换为int值减去0x1234
        int fd = atoi( argv[1] ) - 0x1234;
        int len = 0;
        //从fb指针开始往后读32个字节的字符并存于buf中
        len = read(fd, buf, 32);
        //拷贝字符，当buf中的字符与LETMEWIN\n相同时，输出flag并退出程序
        if(!strcmp("LETMEWIN\n", buf)){
                printf("good job :)\n");
                system("/bin/cat flag");
                exit(0);
        }
        printf("learn about Linux file IO\n");
        return 0;

}

./fd 4660

ssh col@pwnable.kr -p2222 (pw:guest)

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <iostream>

unsigned long hashcode = 0x21DD09EC;

unsigned long check_password(const char *p) {
    int *ip = (int *) p;
    int i;
    int res = 0;
    for (i = 0; i < 5; i++) {
        std::cout<<ip[i]<<std::endl;
        res += ip[i];
    }
    return res;
}

int main(int argc, char *argv[]) {
    if (argc < 2) {
        printf("usage : %s [passcode]\n", argv[0]);
        return 0;
    }
    std::cout<<argv[1]<<std::endl;
    if (strlen(argv[1]) != 20) {
        printf("passcode length should be 20 bytes\n");
        return 0;
    }

    if (hashcode == check_password(argv[1])) {
        system("/bin/cat flag");
        return 0;
    } else
        printf("wrong passcode.\n");
    return 0;
}

11111111111111111111

21DD09EC

568134124

\x01\x01\x01\x01 + \x01\x01\x01\x01 + \x01\x01\x01\x01 + \x01\x01\x01\x01 + \x1D\xD9\x05\xE8

./col $(python -c 'print "\xE8\x05\xD9\x1D" + 16*"\x01"') #调用python执行输入到./col中