N.B. please do not try to bruteforce the flag. Attempts at doing so will be taken as an attack on server infrastructure, and will leave you liable for disqualification.

Hint 1: https://ctf101.org/binary-exploitation/buffer-overflow/

Hint 2: https://en.wikipedia.org/wiki/Null-terminated_string

malloc

Points: 400 Solves: 2 Author: chowgz

Flag:

Description

Can you somehow get the flag? Have fun!

nc challs.sieberrsec.tech 1470

<div class="highlight highlight-source-c position-relative overflow-auto" data-snippet-clipboard-copy-content="#include

#include
#include

// cc malloc.c -o malloc -fstack-protector-all
int main(void)
{
// Variables
int *arr; // int pointer to an array
char *msg; // C-string to store your message
size_t length = 0;

// Welcome message
puts(” welcome to sieberrsec ctf!”); allocates 123456 bytes of memory arr=”(int” *)malloc(123456); sets first element 1 arr[0]=”1;” leaks the address printf(“leak: %p\n”, arr); gets length your message printf(“length message: “); scanf(“%lu”, &length); store as a c-string +1 is null-byte that ends string msg=”malloc(length” + 1); reads input into printf(“enter read(0, msg, length); end msg[length]=”0;” write from write(1, goal: somehow make 0 if (arr[0]=”=” 0) { system(“cat flag”); } return 0; }”>

#include <unistd.h>

#include <stdio.h>
#include <stdlib.h>

// cc malloc.c -o malloc -fstack-protector-all
int main(void)
{
	// Variables
	int *arr; // int pointer to an array
	char *msg; // C-string to store your message
	size_t length = 0;
	
	// Welcome message
	puts("Welcome to Sieberrsec CTF!");
	
	// Allocates 123456 bytes of memory
	arr = (int *)malloc(123456);
	
	// Sets first element of arr to 1
	arr[0] = 1;
	
	// Leaks the memory address of arr
	printf("Leak: %p\n", arr);
	
	// Gets length of your message
	printf("Length of your message: ");
	scanf("%lu", &length);
	
	// Allocates memory to store your message as a C-string
	// +1 is to store the null-byte that ends the string
	msg = malloc(length + 1);
	
	// Reads length bytes of input into msg
	printf("Enter your message: ");
	read(0, msg, length);
	
	// Null-byte to end the string
	msg[length] = 0;
	
	// Write length bytes from msg
	write(1, msg, length);
	
	// Your goal: somehow make arr[0] == 0
	if (arr[0] == 0) {
		system("cat flag");
	}
	return 0;
}