1 year ago

#172060

test-img

Non

Use send() functions to send numbers to __isoc99_scanf("%d", &number)

I am trying to solve a pwn problem in a ctf platform. The program only uses scanf() to get index and content of a number array from standard input:

for ( i = 0; i <= 3; ++i )                    
{
  puts("enter index:");
  __isoc99_scanf("%d", &index);
  if ( index > 3 )
  {
    puts("index is too big");
    exit(0);
  }
  puts("enter value:");
  __isoc99_scanf("%d", &num);
  s[index] = num;
}

while ( j <= 3 )
  printf("0x%08x\t", s[j++]);

return __readgsdword(0x14u) ^ canary;

However, when I use send() function to send 4 bytes int number to the program, the scanf functions seem to detect EOF (rather than the 4-bytes int number) and scanf nothing. Moreover, the following scanf() rejects to get numbers because of the EOF. My send() statements and executing results are as follow:

r.recv()
r.sendline(p32(0x1))
r.recv()
r.sendline(p32(0x1))

exceptional executing results

My question is: How to explain this exceptional problem, and how to correctly use send() to send numbers to __isoc99_scanf("%d", &number) functions in this program?

python

c

ctf

pwntools

0 Answers

Your Answer

Accepted video resources