Project Sekai - ✅-pwn-scooteradmin1

ScooterAdmin1 - 500 points

Category: Pwn Description: Nobody can mess with my beauties because I wrote the authentication routines myself! The source, binary, and libc are hidden in a directory from ScooterWeb, with the directory name equal to unused secret message :) nc byuctf.xyz 40012 Files: No files. Tags: Easy

Sutx pinned a message to this channel. 05/19/2023 12:52 PM

@Legoclones wants to collaborate

12:56

@rubiya wants to collaborate

http://byuctf.xyz:40013/75bdfbbe1c2e465af490e8d68c6b48ebbca2b8ef68216140cd52ee4e5aac8ff5b86ddf5da5d66c28fb775b8240a72ee5ed48dd04e89900475abae5ef0b2d17bd03ed3e081ac58b70be29aab80e84b44be5d659deb4443823dc35cf34ea437b4e/

1

@snwo wants to collaborate

    f = fopen ("flag1.txt", "rb");
    if (!f || !fgets(flag1, 64, f)) {
        printf("Error reading flag1\n");
        exit(1);
    }
    fclose(f);

    f = fopen ("flag2.txt", "rb");
    if (!f || !fgets(flag2, 64, f)) {
        printf("Error reading flag1\n"); [1]
        exit(1);
    }

typo in [1]

17:16

struct con_data_t {
    char *error;
    char creds[32];
    char userinput[32];
    int pwfile;
    int acc;
};
...
    ret = read(0, con->userinput, 0x32 );
    if (ret == 0) { 
        con->error = error; 
        return -1;
    } 
    con->userinput[strcspn(con->userinput, "\r\n")] = 0;
    ret = read(con->pwfile, con->creds, 0x32);
    if (ret == 0) { 
        con->error = error; 
        return -1;
    }

overflow in read size

snwo

used /ctf solve

✅ Challenge solved.

1

17:24

Well done, you got first blood!

it was bug

nice