From 28e6e7b25055cd1e8bda6c6390055399b89467db Mon Sep 17 00:00:00 2001 From: lucky-vers Date: Sun, 5 Nov 2023 02:38:37 +0530 Subject: [PATCH] Remove babygame01 --- Phase 2/02 Binary Exploitation.md | 39 ------------------------------- 1 file changed, 39 deletions(-) diff --git a/Phase 2/02 Binary Exploitation.md b/Phase 2/02 Binary Exploitation.md index f78ac58..1f6ce53 100644 --- a/Phase 2/02 Binary Exploitation.md +++ b/Phase 2/02 Binary Exploitation.md @@ -127,45 +127,6 @@ picoCTF{I_l05t_4ll_my_m0n3y_0a853e52 # babygame01 -We're given a connection command to a game with `nc saturn.picoctf.net 55729` and its binary file `game`. - -We know we can move the player with the keys 'w', 'a', 's' and 'd'. So we disassemble `game` and look for how a command such as `w` is interpreted. - -``` -~/Downloads $ objdump -D game | less -``` - -Searching for the hexadecimal value of 'w' (`0x77`), we find the following instruction - -``` - 80495bd: 80 7d f4 77 cmpb $0x77,-0xc(%ebp) -``` - -So every keybind in this game is checked using the format `cmp $0xXX,-0xc(%ebp)`, where `XX` is the hexadecimal representation of the key being pressed. - -Performing a search for every instruction with the structure above, we get - -``` -~/Downloads $ objdump -D game | grep 'cmpb.*-0xc(%ebp)' - 804957d: 80 7d f4 6c cmpb $0x6c,-0xc(%ebp) - 804958e: 80 7d f4 70 cmpb $0x70,-0xc(%ebp) - 80495bd: 80 7d f4 77 cmpb $0x77,-0xc(%ebp) - 80495d2: 80 7d f4 73 cmpb $0x73,-0xc(%ebp) - 80495e7: 80 7d f4 61 cmpb $0x61,-0xc(%ebp) - 80495fe: 80 7d f4 64 cmpb $0x64,-0xc(%ebp) -``` - -So we get the hex values for the possible keybinds as `0x6c`, `0x70`, `0x77`, `0x73`, `0x61` and `0x64`. Converting them to ASCII leads to the following possible keybinds being discovered - -| Hex | ASCII | -|--------|-------| -| `0x6c` | l | -| `0x70` | p | -| `0x77` | w | -| `0x73` | s | -| `0x61` | a | -| `0x64` | d | - # buffer overflow 0 **Flag:** `picoCTF{ov3rfl0ws_ar3nt_that_bad_9f2364bc}`