# RedPwn Bread Making Write Up
## Details:
Jeopardy style CTF
Category: Reverse Engineering
## Write up:
Looking at the main function I saw:
```c__int64 __fastcall main(int a1, char **a2, char **a3){  __int64 v3;  __int64 v4;  __int64 v5;   __int64 v6;   int v7;   char v9[136];  unsigned __int64 v10;
  v10 = __readfsqword(0x28u);  setbuf(stdin, 0LL);  setbuf(stdout, 0LL);  setbuf(stderr, 0LL);  signal(14, handler);  v3 = 0LL;  qword_6440 = 0LL;  do  {    alarm(*(_DWORD *)*(&off_6020 + v3));    puts(*((const char **)*(&off_6020 + qword_6440) + 1));    do    {      if ( fgets(v9, 128, stdin) )      {        v9[strcspn(v9, "\n")] = 0;        v4 = (__int64)*(&off_6020 + qword_6440);        v5 = *(_QWORD *)(v4 + 24);        if ( v5 )        {          v6 = 0LL;          while ( strcmp(v9, *(const char **)(v4 + 16 * v6 + 32)) )          {            if ( v5 == ++v6 )              goto LABEL_17;          }          v7 = (*(__int64 (**)(void))(v4 + 16 * v6 + 40))();          if ( v7 != -1 )            continue;        }      }LABEL_17:      sub_24A0();    }    while ( v7 );    ++qword_6440;    puts("");    v3 = qword_6440;  }  while ( (unsigned __int64)qword_6440 <= 0xA );  alarm(0);  puts("it's the next morning");  if ( dword_641C )  {    if ( dword_6418 )    {      if ( dword_6414 )      {        if ( dword_6410 )        {          if ( dword_640C )            sub_25C0();          else            puts("mom finds the fire alarm in the laundry room and accuses you of making bread");        }        else        {          puts("mom finds the window opened and accuses you of making bread");        }      }      else      {        puts("mom finds burnt bread on the counter and accuses you of making bread");      }    }    else    {      puts("mom finds flour on the counter and accuses you of making bread");    }  }  else  {    puts("mom finds flour in the sink and accuses you of making bread");  }  return 0LL;}```
From this I could see that we had to enter several strings in order to pass the "tests" and make bread.
The first thing I did here was look to see all the possible strings I could input and I found the following:
```strings bread       
/lib64/ld-linux-x86-64.so.2mfUalibc.so.6exitfopensignalputs__stack_chk_failstdinfgetsstrcspnstdoutstderralarm__cxa_finalizesetbufstrcmp__libc_start_mainGLIBC_2.4GLIBC_2.2.5_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTableATUSH[]A\A]A^A_u+UHATUSHtOE1[]A\A][]A\A]A^A_flag.txtit's the next morningmom doesn't suspect a thing, but asks about some white dots on the bathroom floorcouldn't open/read flag file, contact an admin if running on servermom finds flour in the sink and accuses you of making breadmom finds flour on the counter and accuses you of making breadmom finds burnt bread on the counter and accuses you of making breadmom finds the window opened and accuses you of making breadmom finds the fire alarm in the laundry room and accuses you of making breadthe tray burns you and you drop the pan on the floor, waking up the entire housethe flaming loaf sizzles in the sinkthe flaming loaf sets the kitchen on fire, setting off the fire alarm and waking up the entire housepull the tray out with a towelthere's no time to wastepull the tray outthe window is closedthe fire alarm is replacedyou sleep very welltime to go to sleepclose the windowreplace the fire alarmbrush teeth and go to bedyou've taken too long and fall asleepthe dough has risen, but mom is still awakethe dough has been forgotten, making an awful smell the next morningthe dough has risenthe bread needs to risewait 2 hourswait 3 hoursthe oven makes too much noise, waking up the entire housethe oven glows a soft red-orangethe dough is done, and needs to be bakedthe dough wants to be bakedpreheat the ovenpreheat the toaster ovenmom comes home and finds the bowlmom comes home and brings you food, then sees the bowlthe ingredients are added and stirred into a lumpy doughmom comes home before you find a place to put the bowlthe box is nice and warmleave the bowl on the counterput the bowl on the bookshelfhide the bowl inside a boxthe kitchen catches fire, setting off the fire alarm and waking up the entire housethe bread has risen, touching the top of the oven and catching fire45 minutes is an awfully long timeyou've moved around too much and mom wakes up, seeing you bake breadreturn upstairswatch the bread bakethe sink is cleanedthe counters are cleanedeverything appears to be okaythe kitchen is a messwash the sinkclean the countersget ready to sleepthe half-baked bread is disposed offlush the bread down the toiletthe oven shuts offcold air rushes inthere's smoke in the airunplug the ovenunplug the fire alarmopen the windowyou put the fire alarm in another roomone of the fire alarms in the house triggers, waking up the entire housebrother is still awake, and sees you making breadyou bring a bottle of oil and a trayit is time to finish the doughyou've shuffled around too long, mom wakes up and sees you making breadwork in the kitchenwork in the basementflour has been addedyeast has been addedsalt has been addedwater has been addedadd ingredients to the bowladd flouradd yeastadd saltadd waterwe don't have that ingredient at home!the timer makes too much noise, waking up the entire housethe bread is in the oven, and bakes for 45 minutesyou've forgotten how long the bread bakesthe timer ticks downuse the oven timerset a timer on your phone:*3$"GCC: (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0.shstrtab.interp.note.gnu.property.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.plt.sec.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.dynamic.data.bss.comment```
From here I then stated debugging and each time before inputting a string I was able to see which choices were possible for each item, I then got the following list:
```add flouradd yeastadd saltadd waterhide the bowl inside a boxwait 3 hourswork in the basementpreheat the toaster ovenset a timer on your phonewatch the bread bakepull the tray out with a towelunplug the fire alarmopen the windowunplug the ovenclean the countersflush the bread down the toiletwash the sinkget ready to sleepclose the windowreplace the fire alarmbrush teeth and go to bed```
I then pasted this into the netcat and the program ran successfully:
```nc mc.ax 31796   
add ingredients to the bowladd flouradd yeastadd saltadd waterhide the bowl inside a boxwait 3 hourswork in the basementpreheat the toaster ovenset a timer on your phonewatch the bread bakepull the tray out with a towelunplug the fire alarmopen the windowunplug the ovenclean the countersflush the bread down the toiletwash the sinkget ready to sleepclose the windowreplace the fire alarmbrush teeth and go to bedflour has been addedyeast has been addedsalt has been addedwater has been added
the ingredients are added and stirred into a lumpy doughthe box is nice and warm
the bread needs to risethe dough has risen
it is time to finish the doughyou bring a bottle of oil and a tray
the dough is done, and needs to be bakedthe oven glows a soft red-orange
the bread is in the oven, and bakes for 45 minutesthe timer ticks down
45 minutes is an awfully long timethe bread has risen, touching the top of the oven and catching fire
there's no time to wastethe flaming loaf sizzles in the sink
there's smoke in the airyou put the fire alarm in another roomcold air rushes inthe oven shuts off
the kitchen is a messthe counters are cleanedthe half-baked bread is disposed ofthe sink is cleanedeverything appears to be okay
time to go to sleepthe window is closedthe fire alarm is replaced
you sleep very well
it's the next morningmom doesn't suspect a thing, but asks about some white dots on the bathroom floorflag{m4yb3_try_f0ccac1a_n3xt_t1m3???0r_dont_b4k3_br3ad_at_m1dnight}```
The flag was:
```flag{m4yb3_try_f0ccac1a_n3xt_t1m3???0r_dont_b4k3_br3ad_at_m1dnight}```