# Ticket Storage - Aero CTF 2020 (pwn, 366p, 30 solved)## Introduction
Ticket Storage is a pwn/reverse task.
An archive containing a binary, a libc and its corresponding loader (`ld.so`).
The binary exits instantly when run.
## Reverse engineering
As stated in the introduction, the binary exists as soon as is it started.
`strace` is a quick way to figure out what a program does in order to understandwhy it does not work.
```% strace ./ticket_storageexecve("./ticket_storage", ["./ticket_storage"], 0x775998d1d9e0 /* 47 vars */) = 0[...]openat(AT_FDCWD, "/tmp/flag.txt", O_RDONLY) = -1 ENOENT (No such file or directory)exit_group(-1)                          = ?+++ exited with 255 +++```
It looks like the program tries to open `/tmp/flag.txt` which does not exists onthe local system, and then exits.
The program lets a user create, view and delete flight tickets. The user canonly see tickets they own. The user can change its name.
The program reads information from `/tmp/flag.txt` and adds it to the ticketlist. This part of the program is somewhat hidden in `_INIT-1`, a functiondeclared as a constructor, which gets called before `main`.
## Exploitation
The vulnerability lies in the way the user's name is compared to each entry'sowner in the function that displays tickets.
```cif(0 == memcmp(t->ticket->owner, name, nameLen))	ticket_print(t->ticket);```
With `name` and `nameLen` defined during initialisation to user-specified input.
It is possible to have a name of size 0 by sending no name.
This will transform the check in `0 == memcmp(t->ticket->owner, "", 0)` which isalways satisfied. Every tickets will be printed, including the one that containsthe flag.
```{?} Enter name:-------- Ticket Storage --------1. Reserve a ticket2. View ticket3. View ticket list4. Delete ticket5. Change name6. Exit> 3---- Ticket qW3Kto$a ----From: flag_isTo: Aero{4af2aea9b7dea9aabbc1c9a423e4957fd4c615821f4ded0f618b629651a9d67c}Date: 13371337Cost: 31337Owner: sup3rs3cr3tus3rn4m3$4lted```
**Flag**: `Aero{4af2aea9b7dea9aabbc1c9a423e4957fd4c615821f4ded0f618b629651a9d67c}`