Overview
The binary shuffles a local array using rand() seeded by time(0), then bitwise ORs the flag with the shuffled array before printing it. We can overflow the stack to nullify the array.
Reconnaissance
Analyzing the main function disassembly:
- The flag is loaded onto the stack at
rbp-0x30. - A 16-byte key string
s2is loaded atrbp-0x50. - A buffer at
rbp-0x51is read using the vulnerablegets()function.
Exploitation Strategy
Instead of syncing local time to reverse the random shuffle, we exploit the stack buffer overflow via gets().
By sending 48 null bytes (\x00), we completely overwrite the s2 key buffer with null bytes before the shuffle runs.
Shuffling an array of null bytes results in null bytes. The bitwise OR operation (flag[i] | 0) leaves the flag characters unchanged, forcing the binary to print the flag in plain text!
Solution Code
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('20.197.42.57', 2225))
# Overflow the key buffer with 48 null bytes
s.send(b'\x00' * 48 + b'\n')
print(s.recv(1024).decode())
# Flag: CrackOn{1amflAg}Flag
CrackOn{1amflAg}