pwnable.kr wp fd

题目

Mommy! what is a file descriptor in Linux?

* try to play the wargame your self but if you are ABSOLUTE beginner, follow this tutorial link:
https://youtu.be/971eZhMHQQw

ssh fd@pwnable.kr -p2222 (pw:guest)

ssh fd@pwnable.kr -p2222
# passwd: guest

解题过程

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
	if(argc<2){
		printf("pass argv[1] a number\n");
		return 0;
	}
	int fd = atoi( argv[1] ) - 0x1234;
	int len = 0;
	len = read(fd, buf, 32);
	if(!strcmp("LETMEWIN\n", buf)){
		printf("good job :)\n");
		system("/bin/cat flag");
		exit(0);
	}
	printf("learn about Linux file IO\n");
	return 0;

}

逻辑很简单, 控制fd(file descriptior)使得程序读入"LETMEWIN", 执行system("/bin/cat flag")读出flag.

碰到不懂的函数, 一定记得看文档man read

wiki file descriptor

fd == 0, read()会从stdin读入字符串到buf. 所以控制fd == 0. 即输入第一个参数是0x1234, atoi()只识别10进制, 所以转换为10进制得到4660.

mommy! I think I know what a file descriptor is!!