August 31, 2017

pwnable.kr lotto solution


Mommy! I made a lotto program for my homework.
do you want to play?

It is south korea's lotto game. The rule is simple.
1. Select 6 numbers from 1~45.
2. Match with the random result value(You can get the first prize if you match all six numbers).



At the source code above, There is something strange.

The variable "lotto[6]" is character type not integer. This can make unintended situation. The number 33 of character type means "!" and 32 is [SPACE]. You can check it in ASCII code table(Link).

And below that, There is a mistake at the "for" statement. The "match" will be 6, even if only one number is correct.

FYI.
The variable "match" and "argv" is in same address from stack(=rbp-0x20). But This information is meaningless because the variable "match" is initialized by 0.





So I inputed ######(=35) and got the key after five input.