# fd

## File descriptors

File descriptors is a frequent subject in the ctf world and I wrote about them in the past:

{% embed url="<https://0xten.gitbook.io/public/privesc/linux/fd-file-descriptors>" %}

```
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
        if(argc<2){
                printf("pass argv[1] a number\n");
                return 0;
        }
        int fd = atoi( argv[1] ) - 0x1234;
        int len = 0;
        len = read(fd, buf, 32);
        if(!strcmp("LETMEWIN\n", buf)){
                printf("good job :)\n");
                system("/bin/cat flag");
                exit(0);
        }
        printf("learn about Linux file IO\n");
        return 0;

}
```

As we can see in the source code of the vulnerable program, 0x1234 is subtracted from the first command line argument and saved as the fd variable. Then, the fd variable is used as the file descriptor used by a read() function. If the read function returns "LETMEWIN\n", then it cats the flag and we win the challenge.

If we simply input something that will make the fd number be 0 we'll be able to make the read() function actually read from stdin and we can can make that value be "LETMEWIN\n".

0x1234 is decimal 4660, so if we input 4660 the fd variable will be 0, since 4660 - 4660 = 0.

![](/files/-MZhuiGfyTAtERjKm8fX)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://0xten.gitbook.io/public/pwnable/toddlers-bottle/fd.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.