vee1e/Cryptonite-Taskphase
1
0
Fork 0
mirror of https://github.com/vee1e/Cryptonite-Taskphase.git synced 2026-09-01 11:08:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Remove babygame01

Browse source
This commit is contained in:
lucky-vers 2023-11-05 02:38:37 +05:30
parent af6e84b543
commit 28e6e7b250
1 changed files with 0 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

39
Phase 2/02 Binary Exploitation.md
View file

@ -127,45 +127,6 @@ picoCTF{I_l05t_4ll_my_m0n3y_0a853e52
# babygame01
We're given a connection command to a game with `nc saturn.picoctf.net 55729` and its binary file `game`.
We know we can move the player with the keys 'w', 'a', 's' and 'd'. So we disassemble `game` and look for how a command such as `w` is interpreted.
```
~/Downloads $ objdump -D game | less
```
Searching for the hexadecimal value of 'w' (`0x77`), we find the following instruction
```
80495bd: 80 7d f4 77 cmpb $0x77,-0xc(%ebp)
```
So every keybind in this game is checked using the format `cmp $0xXX,-0xc(%ebp)`, where `XX` is the hexadecimal representation of the key being pressed.
Performing a search for every instruction with the structure above, we get
```
~/Downloads $ objdump -D game | grep 'cmpb.*-0xc(%ebp)'
804957d: 80 7d f4 6c cmpb $0x6c,-0xc(%ebp)
804958e: 80 7d f4 70 cmpb $0x70,-0xc(%ebp)
80495bd: 80 7d f4 77 cmpb $0x77,-0xc(%ebp)
80495d2: 80 7d f4 73 cmpb $0x73,-0xc(%ebp)
80495e7: 80 7d f4 61 cmpb $0x61,-0xc(%ebp)
80495fe: 80 7d f4 64 cmpb $0x64,-0xc(%ebp)
```
So we get the hex values for the possible keybinds as `0x6c`, `0x70`, `0x77`, `0x73`, `0x61` and `0x64`. Converting them to ASCII leads to the following possible keybinds being discovered
| Hex | ASCII |
|--------|-------|
| `0x6c` | l |
| `0x70` | p |
| `0x77` | w |
| `0x73` | s |
| `0x61` | a |
| `0x64` | d |
# buffer overflow 0
**Flag:** `picoCTF{ov3rfl0ws_ar3nt_that_bad_9f2364bc}`