basic-file-exploit (picoCTF)

SPOILER ALERT : This is a writeup for the basic-file-exploit (picoCTF). It will show you how to solve the problem; There may not have complete details, But if you want a way to do it, I have it for you.If you want to play picoCTF click here

Description : The program provided allows you to write to a file and read what you wrote from it. Try playing around with it and see if you can break it !Connect to the program with netcat :$ nc saturn.picoctf.net 52681The program's source code with the flag redacted can be downloaded here.

Hint : Try passing in things the program doesn’t expect. Like a string instead of a number.This is the file you will get. Let’s take a look at the file.#include <stdio.h>

#include <stdlib.h>
#include <stdbool.h>
#include <string.h>
#include <stdint.h>
#include <ctype.h>
#include <unistd.h>
#include <sys/time.h>
#include <sys/types.h>

#define WAIT 60

static const char* flag = "[REDACTED]";

static char data[10][100];
static int input_lengths[10];
static int inputs = 0;

int tgetinput(char *input, unsigned int l)
{
fd_set input_set;
struct timeval timeout;
int ready_for_reading = 0;
int read_bytes = 0;

if( l <= 0 )
{
printf("'l' for tgetinput must be greater than 0\n");
return -2;
}

/* Empty the FD Set */
FD_ZERO(&input_set );
/* Listen to the input descriptor */
FD_SET(STDIN_FILENO, &input_set);

/* Waiting for some seconds */
timeout.tv_sec = WAIT; // WAIT seconds
timeout.tv_usec = 0; // 0 milliseconds

/* Listening for input stream for any activity */
ready_for_reading = select(1, &input_set, NULL, NULL, &timeout);
/* Here, first parameter is number of FDs in the set,
* second is our FD set for reading,
* third is the FD set in which any write activity needs to updated,
* which is not required in this case.
* Fourth is timeout
*/

if (ready_for_reading == -1) {
/* Some error has occured in input */
printf("Unable to read your input\n");
return -1;
}

if (ready_for_reading) {
read_bytes = read(0, input, l-1);
if(input[read_bytes-1]=='\n'){
--read_bytes;
input[read_bytes]='\0';
}
if(read_bytes==0){
printf("No data given.\n");
return -4;
} else {
return 0;
}
} else {
printf("Timed out waiting for user input. Press Ctrl-C to disconnect\n");
return -3;
}

return 0;
}

static void data_write() {
char input[100];
char len[4];
long length;
int r;

printf("Please enter your data:\n");
r = tgetinput(input, 100);
// Timeout on user input
if(r == -3)
{
printf("Goodbye!\n");
exit(0);
}

while (true) {
printf("Please enter the length of your data:\n");
r = tgetinput(len, 4);
// Timeout on user input
if(r == -3)
{
printf("Goodbye!\n");
exit(0);
}

if ((length = strtol(len, NULL, 10)) == 0) {
puts("Please put in a valid length");
} else {
break;
}
}

if (inputs > 10) {
inputs = 0;
}

strcpy(data[inputs], input);
input_lengths[inputs] = length;

printf("Your entry number is: %d\n", inputs + 1);
inputs++;
}

static void data_read() {
char entry[4];
long entry_number;
char output[100];
int r;

memset(output, '\0', 100);

printf("Please enter the entry number of your data:\n");
r = tgetinput(entry, 4);
// Timeout on user input
if(r == -3)
{
printf("Goodbye!\n");
exit(0);
}

if ((entry_number = strtol(entry, NULL, 10)) == 0) {
puts(flag);
fseek(stdin, 0, SEEK_END);
exit(0);
}

entry_number--;
strncpy(output, data[entry_number], input_lengths[entry_number]);
puts(output);
}


int main(int argc, char** argv) {
char input[3] = {'\0'};
long command;
int r;

puts("Hi, welcome to my echo chamber!");
puts("Type '1' to enter a phrase into our database");
puts("Type '2' to echo a phrase in our database");
puts("Type '3' to exit the program");

while (true) {
r = tgetinput(input, 3);
// Timeout on user input
if(r == -3)
{
printf("Goodbye!\n");
exit(0);
}

if ((command = strtol(input, NULL, 10)) == 0) {
puts("Please put in a valid number");
} else if (command == 1) {
data_write();
puts("Write successful, would you like to do anything else?");
} else if (command == 2) {
if (inputs == 0) {
puts("No data yet");
continue;
}
data_read();
puts("Read successful, would you like to do anything else?");
} else if (command == 3) {
return 0;
} else {
puts("Please type either 1, 2 or 3");
puts("Maybe breaking boundaries elsewhere will be helpful");
}
}

return 0;
}

If you have experience in programming, You’ll be able to analyze how we need to get the program to show the flags. We need to find a way for the program to run in the data_read() function.

if(r == -3)
{
printf("Goodbye!\n");
exit(0);
}

if ((entry_number = strtol(entry, NULL, 10)) == 0) {
puts(flag);
fseek(stdin, 0, SEEK_END);
exit(0);
}

entry_number--;
strncpy(output, data[entry_number], input_lengths[entry_number]);
puts(output);
}

To get into this function. We’ll need to insert a string instead of a number. And we will get a flag.

First, you need to use data_write()function.

and then use the data_read()function to get the flag.

Good luck :)