Fd

Pass the correct Input/Output value.


Link

Room Link

Process


Can we find the right value to get the flag? Let's find out. Review the source code for the program to see what we are dealing with. Looks like there are some filters and PATH restriction we have to get around.
fd.c 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char buf[32];

int main(int argc, char* argv[], char* envp[]){
	if(argc<2){
		printf("pass argv[1] a number\n");
		return 0;
	}

	int fd = atoi( argv[1] ) - 0x1234;
	int len = 0;
	len = read(fd, buf, 32);

	if(!strcmp("LETMEWIN\n", buf)){
		printf("good job :)\n");
		setregid(getegid(), getegid());
		system("/bin/cat flag");
		exit(0);
	}

	printf("learn about Linux file IO\n");
	return 0;
}
fd.c 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char buf[32];

int main(int argc, char* argv[], char* envp[]){
	if(argc<2){
		printf("pass argv[1] a number\n");
		return 0;
	}

	int fd = atoi( argv[1] ) - 0x1234;
	int len = 0;
	len = read(fd, buf, 32);

	if(!strcmp("LETMEWIN\n", buf)){
		printf("good job :)\n");
		setregid(getegid(), getegid());
		system("/bin/cat flag");
		exit(0);
	}

	printf("learn about Linux file IO\n");
	return 0;
}

Check the strcmp, which is string compare, if statement to get our win token.
fd.c 

<snip>

if(!strcmp("LETMEWIN\n", buf)){

<snip>
fd.c 

<snip>

if(!strcmp("LETMEWIN\n", buf)){

<snip>

The line above that call reads the function to store a value in buf. So, we will need the fd variable to be 1, which is the file descriptor for stdin.
fd.c 

<snip>

len = read(fd, buf, 32);

<snip>
fd.c 

<snip>

len = read(fd, buf, 32);

<snip>

Read the fd assignment statement. We need to solve some algebra. x - 0x1234 = 1.
fd.c 

<snip>

int fd = atoi( argv[1] ) - 0x1234;

<snip>
fd.c 

<snip>

int fd = atoi( argv[1] ) - 0x1234;

<snip>

Put it into calc, programmer mode.

Take the decimal number and pass it into the program as an argument.
bash 
fd@ubuntu:~$ ./fd 4661

<snip>
bash 
fd@ubuntu:~$ ./fd 4661

<snip>

In the prompt, enter `LETMEWIN`. Grab the flag. Get 1 point.
bash 

<snip>

LETMEWIN
good job :)
<Redacted>
bash 

<snip>

LETMEWIN
good job :)
<Redacted>

So...can we find the right value to get the flag? Yes, yes we can. See you on the next one.