2 years ago
#172060

Non
Use send() functions to send numbers to __isoc99_scanf("%d", &number)
I am trying to solve a pwn problem in a ctf platform. The program only uses scanf() to get index and content of a number array from standard input:
for ( i = 0; i <= 3; ++i )                    
{
  puts("enter index:");
  __isoc99_scanf("%d", &index);
  if ( index > 3 )
  {
    puts("index is too big");
    exit(0);
  }
  puts("enter value:");
  __isoc99_scanf("%d", &num);
  s[index] = num;
}
while ( j <= 3 )
  printf("0x%08x\t", s[j++]);
return __readgsdword(0x14u) ^ canary;
However, when I use send() function to send 4 bytes int number to the program, the scanf functions seem to detect EOF (rather than the 4-bytes int number) and scanf nothing. Moreover, the following scanf() rejects to get numbers because of the EOF. My send() statements and executing results are as follow:
r.recv()
r.sendline(p32(0x1))
r.recv()
r.sendline(p32(0x1))
My question is: How to explain this exceptional problem, and how to correctly use send() to send numbers to __isoc99_scanf("%d", &number) functions in this program?
python
c
ctf
pwntools
0 Answers
Your Answer