Tenable CTF 2022 Writeup ‘Olden Ring’[pwn] #

fgets((char *)&local_418, 0x400, stdin);

memset(&local_418, 0, 0x400);

// local_418が利用されている！
defeat_frog_guys(&local_418, local_14);

// ブレークポイントを設置する
(gdb) break 0x400000

// 現在のスタックtopから40x8バイト分のデータを表示する．
(gdb) x/40gx $rsp 

undefined8 main(void)
{
    long lVar1;
    undefined8 *puVar2;
    char local_420[8];
    undefined8 local_418;
    undefined8 local_410;
    undefined8 local_408[126];
    uint local_14;
    ulong local_10;

    local_10 = 0;
    local_418 = 0;
    local_410 = 0;
    puVar2 = local_408;
    for (lVar1 = 0x7e; lVar1 != 0; lVar1 = lVar1 + -1)
    {
        *puVar2 = 0;
        puVar2 = puVar2 + 1;
    }
    memset(&local_418, 0, 0x400);
    printf("\x1b[0;33m");
    printf(&DAT_00402488);
    printf("\x1b[0m");
    putchar(10);
    puts(
        "\n\nYou are on your way to becoming the Olden Lord, but first you must collect rings by defea ting many (many many) frog-guys!");
    printf("The rings will let you become powerful enough to face the final boss!");
    printf("\n\nFirst things first: What\'s your name?\n> ");
    fgets((char *)&local_418, 0x400, stdin);
    puts(&DAT_00402ca0);
    puts("--------------------\nFig a. A Frog-guy\n--------------------");
    while (local_10 < 5000)
    {
        printf("\n\n=============================================================================");
        puts(
            "\n\nFrom atop a hill, overlooking a lake of red, you see a field of 250 frog-guys just kind a hanging out, not bothering anyone.");
        printf("How many do you defeat to gather their rings?\n\n> ");
        fgets(local_420, 8, stdin);
        local_14 = atoi(local_420);
        if ((int)local_14 < 0)
        {
            printf("\nYou...create? frog-guys? Don\'t do that");
        }
        else if (local_14 == 0)
        {
            puts("\nYou spare all the frog-guys. Admirable.");
        }
        else if ((int)local_14 < 0xfb)
        {
            printf("\nYou set about your noble work of defeating %d nearly-defenseless, chillin\' frog-guy s\n\n", (ulong)local_14);
            defeat_frog_guys(&local_418, local_14);
            puts("\n\nYou rest to allow some frog-guys to reconvene.");
            local_10 = local_10 + (long)(int)local_14;
        }
        else if (0xfa < (int)local_14)
        {
            puts("\nWhoa now, we know you\'re excited, but there aren\'t that many in this field.");
        }
    }
    boss_fight();
    return 0;
}

void defeat_frog_guys(void *param_1, int param_2)

{
    void *__src;
    int iVar1;
    size_t sVar2;
    long lVar3;
    undefined **ppuVar4;
    undefined8 *puVar5;
    void **ppvVar6;
    byte bVar7;
    void *local_b48[100];
    undefined8 local_828;
    undefined8 local_820;
    undefined8 local_818[255];
    int local_1c;

    bVar7 = 0;
    local_828 = 0;
    local_820 = 0;
    puVar5 = local_818;
    for (lVar3 = 0xfe; lVar3 != 0; lVar3 = lVar3 + -1)
    {
        *puVar5 = 0;
        puVar5 = puVar5 + 1;
    }
    memset(&local_828, 0, 0x400);
    ppuVar4 = &PTR_DAT_0040d0a0;
    ppvVar6 = local_b48;
    for (lVar3 = 100; lVar3 != 0; lVar3 = lVar3 + -1)
    {
        *ppvVar6 = *ppuVar4;
        ppuVar4 = ppuVar4 + (ulong)bVar7 * -2 + 1;
        ppvVar6 = ppvVar6 + (ulong)bVar7 * -2 + 1;
    }
    sVar2 = strlen((char *)&local_828);
    memcpy((void *)((long)&local_828 + sVar2), "You defeat the following frog-guys:", 0x24);
    for (local_1c = 0; local_1c < param_2; local_1c = local_1c + 1)
    {
        iVar1 = rand();
        __src = local_b48[iVar1 % 99];
        sVar2 = strlen((char *)&local_828);
        memcpy((void *)((long)&local_828 + sVar2), __src, 5);
        sVar2 = strlen((char *)&local_828);
        memcpy((void *)((long)&local_828 + sVar2), &DAT_00402444, 2);
    }
    sVar2 = strlen((char *)&local_828);
    memcpy((void *)((long)&local_828 + sVar2), "\n\nFrog-guys across the land will fear the name ", 0x32);
    sVar2 = strlen((char *)&local_828);
    memcpy((void *)((long)&local_828 + sVar2), param_1, 0x400);
    printf("%s", &local_828);
    return;
}

void boss_fight(void)

{
    puts("\nDang, you must be like...really really powerful. Ok, you uh...how\'d you get here?");
    puts(
        "You try to fight the boss, but your build has been nerfed in a patch, and you get one-shotted  almost instantly.");
    printf("You die. Enjoy fighting your way here again.");
    /* WARNING: Subroutine does not return */
    exit(0);
}

// zip_to_end関数の先頭アドレス：0x00000000004012b6
void zip_to_end(void)

{
    int iVar1;
    char local_128[272];
    FILE *local_18;
    char local_9;

    puts("\nYou do some weird thing by blocking and timing frames!!!\n");
    puts(
        "\nYou arrive at the secret final boss!\nQuick! Choose your tactic to defeat it before being o ne-shotted!\n");
    puts("\n1) FROSTY STOMP!!!\n2) FROSTY STOMP!!!\n3) FROSTY STOMP!!!\n>\n");
    fgets(local_128, 0x102, stdin);
    puts("\nGood Strategy!!! You win! You\'re now the Olden Lord!\n");
    local_18 = fopen("/home/ctf/flag.txt", "r");
    if (local_18 != (FILE *)0x0)
    {
        while (local_9 != -1)
        {
            putchar((int)local_9);
            iVar1 = fgetc(local_18);
            local_9 = (char)iVar1;
        }
        fclose(local_18);
    }
    /* WARNING: Subroutine does not return */
    exit(0);
}