diff --git a/inaccessible/Dockerfile b/inaccessible/Dockerfile new file mode 100644 index 0000000..af791c9 --- /dev/null +++ b/inaccessible/Dockerfile @@ -0,0 +1,3 @@ +FROM gcc:4.9 +COPY inaccessible.c . +RUN gcc -o chall inaccessible.c -std=c99 diff --git a/inaccessible/chall.yaml b/inaccessible/chall.yaml new file mode 100644 index 0000000..1ee4b35 --- /dev/null +++ b/inaccessible/chall.yaml @@ -0,0 +1,24 @@ +name: Inaccessible +categories: + - binex +value: 25 +flag: bcactf{W0w_Y0u_m4d3_iT_b810c453a9ac9} +description: |- + I wrote a function to generate the flag, but don't + worry, I bet you can't access it! +hints: + - you could reverse engineer the function, but it's + not necessary + - see if you can use any debugging tools to just + call the function +files: + - src: /chall + dest: inaccessible + container: static +deploy: + static: + build: . +authors: + - Marvin +visible: true +# TODO: verify deployment diff --git a/inaccessible/inaccessible.c b/inaccessible/inaccessible.c new file mode 100644 index 0000000..23a8dfb --- /dev/null +++ b/inaccessible/inaccessible.c @@ -0,0 +1,41 @@ +#include + +int c(int n) { + if (n == 0) { + return 1; + } else { + return ((2.0 * ((2 * n) - 1)) / (n + 1)) * (c(n - 1)); + } +} + +int f(int n) +{ + int a = 0, b = 1, c, i; + if (n == 0) + return a; + for (i = 2; i <= n; i++) { + c = a + b; + a = b; + b = c; + } + return b; +} +long b[37] = {-1,-82,-16,-6,-50,-264,-169,-378,-476,-550,-6586,-9792,-6524,-2639,-45140,-39480,-49507,-7752,-142154,-588555,-963248,-1133504,-2235246,-3616704,-3601200,-1820895,-2749852,-9534330,-15941099,-60738920,-57889567,-174264720,-140983120,-45623096,-719742270,-537492672,-676418876}; +char i2[37] = {12,13,9,12,12,12,12,12,11,12,13,13,13,12,13,12,13,12,13,13,13,13,13,13,13,11,11,12,13,13,13,13,13,9,13,13,12}; +char i4[37] = {4,3,6,4,3,5,0,5,6,2,0,1,2,1,0,5,1,4,3,4,3,2,3,2,4,6,6,5,1,5,4,3,3,6,1,0,4}; + +int win() { + char out[40]; + memset(out, 0, 40); + + for(int i = 0; i < 37; i++) { + long k = b[i]/(f(i+1)); + out[i] = k + f(i2[i]) + c(i4[i]); + out[i] ^= 0xff; + } + printf("%s\n", out); +} +int main() { + printf("No flag for you >:(\n"); + return 0; +} \ No newline at end of file diff --git a/inaccessible/solve.txt b/inaccessible/solve.txt new file mode 100644 index 0000000..5da4920 --- /dev/null +++ b/inaccessible/solve.txt @@ -0,0 +1,14 @@ +The function win() will print the flag, +but the program just doesn't call it. + +You can use a program like gdb to debug +and call the function. + +Example: + +(gdb) break main + (set a breakpoint so that the + program doesn't immediately end) +(gdb) run +(gdb) call (int)win() + (cast win() function to int because gdb doesn't understand its return type) \ No newline at end of file