pwnable.kr wp blackjack

题目

Hey! check out this C implementation of blackjack game!
I found it online
* http://cboard.cprogramming.com/c-programming/114023-simple-blackjack-program.html

I like to give my flags to millionares.
how much money you got?


Running at : nc pwnable.kr 9009

题解

大概是一个poker game, 要cash大于一个值能得到flag

https://cboard.cprogramming.com/c-programming/114023-simple-blackjack-program.html

源码审计, 把一些功能函数都看一遍
源码比较长, 就不全贴了, 看一下关键部分

int betting() //Asks user amount to bet
{
 printf("\n\nEnter Bet: $");
 scanf("%d", &bet);
 
 if (bet > cash) //If player tries to bet more money than player has
 {
        printf("\nYou cannot bet more money than you have.");
        printf("\nEnter Bet: ");
        scanf("%d", &bet);
        return bet;
 }
 else return bet;
} // End Function

这里有个逻辑漏洞, 第一次如果bet大于cash, 再次输入bet就不检查了, 所以输入两次bet > cash来下注大于已有资金的赌注, 此外bet是有符号数类型, 所以这个检测也没有判断bet是否是负数, 相当于一个无限金钱bug

void stay() //Function for when user selects 'Stay'
{
     dealer(); //If stay selected, dealer continues going
     if(dealer_total>=17)
     {
      if(player_total>=dealer_total) //If player's total is more than dealer's total, win
      {
         printf("\nUnbelievable! You Win!\n");
         won = won+1;
         cash = cash+bet;
         printf("\nYou have %d Wins and %d Losses. Awesome!\n", won, loss);
         dealer_total=0;
         askover();
      }
      if(player_total<dealer_total) //If player's total is less than dealer's total, loss
      {
         printf("\nDealer Has the Better Hand. You Lose.\n");
         loss = loss+1;
         cash = cash - bet;
         printf("\nYou have %d Wins and %d Losses. Awesome!\n", won, loss);
         dealer_total=0;
         askover();
      }
      if(dealer_total>21) //If dealer's total is more than 21, win
      {
         printf("\nUnbelievable! You Win!\n");
         won = won+1;
         cash = cash+bet;
         printf("\nYou have %d Wins and %d Losses. Awesome!\n", won, loss);
         dealer_total=0;
         askover();
      }
     }
     else
     {
         stay();
     }
      
} // End Function

判断输赢的函数, loss时执行cash = cash - bet;, 所以可以想办法输掉赌局, 然后每次输入bet是负数, cash就可以一直增加了

Enter 1 to Begin the Greatest Game Ever Played.
Enter 2 to See a Complete Listing of Rules.
Enter 3 to Exit Game. (Not Recommended)
Choice: 1

Cash: $500
-------
|C    |
|  A  |
|    C|
-------

Your Total is 11

The Dealer Has a Total of 6

Enter Bet: $-1000000


Would You Like to Hit or Stay?
Please Enter H to Hit or S to Stay.
S

You Have Chosen to Stay at 11. Wise Decision!

The Dealer Has a Total of 8
The Dealer Has a Total of 10
The Dealer Has a Total of 12
The Dealer Has a Total of 14
The Dealer Has a Total of 16
The Dealer Has a Total of 18
Dealer Has the Better Hand. You Lose.

You have 0 Wins and 1 Losses. Awesome!

Would You Like To Play Again?
Please Enter Y for Yes or N for No
Y
YaY_I_AM_A_MILLIONARE_LOL


Cash: $1000500