fd

fd is the 1st challenge of Toddler's Bottle at pwnable.kr

File descriptors

File descriptors is a frequent subject in the ctf world and I wrote about them in the past:

fd - File descriptors0xTen

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
        if(argc<2){
                printf("pass argv[1] a number\n");
                return 0;
        }
        int fd = atoi( argv[1] ) - 0x1234;
        int len = 0;
        len = read(fd, buf, 32);
        if(!strcmp("LETMEWIN\n", buf)){
                printf("good job :)\n");
                system("/bin/cat flag");
                exit(0);
        }
        printf("learn about Linux file IO\n");
        return 0;

}

As we can see in the source code of the vulnerable program, 0x1234 is subtracted from the first command line argument and saved as the fd variable. Then, the fd variable is used as the file descriptor used by a read() function. If the read function returns "LETMEWIN\n", then it cats the flag and we win the challenge.

If we simply input something that will make the fd number be 0 we'll be able to make the read() function actually read from stdin and we can can make that value be "LETMEWIN\n".

0x1234 is decimal 4660, so if we input 4660 the fd variable will be 0, since 4660 - 4660 = 0.