1 year ago
#172060

Non
Use send() functions to send numbers to __isoc99_scanf("%d", &number)
I am trying to solve a pwn problem in a ctf platform. The program only uses scanf()
to get index and content of a number array from standard input:
for ( i = 0; i <= 3; ++i )
{
puts("enter index:");
__isoc99_scanf("%d", &index);
if ( index > 3 )
{
puts("index is too big");
exit(0);
}
puts("enter value:");
__isoc99_scanf("%d", &num);
s[index] = num;
}
while ( j <= 3 )
printf("0x%08x\t", s[j++]);
return __readgsdword(0x14u) ^ canary;
However, when I use send()
function to send 4 bytes int number to the program, the scanf functions seem to detect EOF (rather than the 4-bytes int number) and scanf nothing. Moreover, the following scanf()
rejects to get numbers because of the EOF. My send()
statements and executing results are as follow:
r.recv()
r.sendline(p32(0x1))
r.recv()
r.sendline(p32(0x1))
My question is: How to explain this exceptional problem, and how to correctly use send()
to send numbers to __isoc99_scanf("%d", &number)
functions in this program?
python
c
ctf
pwntools
0 Answers
Your Answer