Skip to content

Instantly share code, notes, and snippets.

@hhc0null

hhc0null/team.c

Last active August 29, 2015 14:18
Show Gist options
  • Save hhc0null/e59cf31a49322bfa8f92 to your computer and use it in GitHub Desktop.
Save hhc0null/e59cf31a49322bfa8f92 to your computer and use it in GitHub Desktop.
Download ZIP
BackdoorCTF 2015 team-600pts
Raw
team.c
int sub_80486ad(char *arg0, char *arg1)
{
// Local variables.
char *ebp_80h;
char *ebp_7ch;
int ebp_74h;
ebp_7ch = arg0;
ebp_80h = arg1;
ebp_74h = fopen("flag.txt", "r");
if(ebp_74h == NULL) {
return 1;
}
fgets(ebp_74h, 0x64, ebp_70h);
printf(ebp_7ch); // XXX: FSB
if(strcmp(ebp_70h, ebp_80h) == 0) {
puts(" : correct flag!");
} else {
puts(" : incorrect flag. Try again.");
}
fclose(ebp_74h);
return 0;
}
int main(void)
{
// Local variables.
char *esp_18h;
char *esp_1ch;
esp_18h = malloc(0xc8);
esp_1ch = malloc(0x64);
printf("Enter teamname: ");
fflush(stdout);
scanf("%200s", esp_18h);
printf("flag: ", );
fflush(stdout);
scanf("%100s", esp_1ch);
sleep(2);
sub_80486ad(esp_18h, esp_1ch);
free(esp_18h);
free(esp_1ch);
return 0;
}
Raw
team.disasm
team: file format elf32-i386
Disassembly of section .init:
0804849c <.init>:
804849c: 53 push %ebx
804849d: 83 ec 08 sub $0x8,%esp
80484a0: e8 3b 01 00 00 call 80485e0 <__isoc99_scanf@plt+0x40>
80484a5: 81 c3 5b 1b 00 00 add $0x1b5b,%ebx
80484ab: 8b 83 fc ff ff ff mov -0x4(%ebx),%eax
80484b1: 85 c0 test %eax,%eax
80484b3: 74 05 je 80484ba <strcmp@plt-0x16>
80484b5: e8 b6 00 00 00 call 8048570 <__gmon_start__@plt>
80484ba: 83 c4 08 add $0x8,%esp
80484bd: 5b pop %ebx
80484be: c3 ret
Disassembly of section .plt:
080484c0 <strcmp@plt-0x10>:
80484c0: ff 35 04 a0 04 08 pushl 0x804a004
80484c6: ff 25 08 a0 04 08 jmp *0x804a008
80484cc: 00 00 add %al,(%eax)
...
080484d0 <strcmp@plt>:
80484d0: ff 25 0c a0 04 08 jmp *0x804a00c
80484d6: 68 00 00 00 00 push $0x0
80484db: e9 e0 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
080484e0 <printf@plt>:
80484e0: ff 25 10 a0 04 08 jmp *0x804a010
80484e6: 68 08 00 00 00 push $0x8
80484eb: e9 d0 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
080484f0 <fflush@plt>:
80484f0: ff 25 14 a0 04 08 jmp *0x804a014
80484f6: 68 10 00 00 00 push $0x10
80484fb: e9 c0 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
08048500 <free@plt>:
8048500: ff 25 18 a0 04 08 jmp *0x804a018
8048506: 68 18 00 00 00 push $0x18
804850b: e9 b0 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
08048510 <fgets@plt>:
8048510: ff 25 1c a0 04 08 jmp *0x804a01c
8048516: 68 20 00 00 00 push $0x20
804851b: e9 a0 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
08048520 <fclose@plt>:
8048520: ff 25 20 a0 04 08 jmp *0x804a020
8048526: 68 28 00 00 00 push $0x28
804852b: e9 90 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
08048530 <sleep@plt>:
8048530: ff 25 24 a0 04 08 jmp *0x804a024
8048536: 68 30 00 00 00 push $0x30
804853b: e9 80 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
08048540 <__stack_chk_fail@plt>:
8048540: ff 25 28 a0 04 08 jmp *0x804a028
8048546: 68 38 00 00 00 push $0x38
804854b: e9 70 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
08048550 <malloc@plt>:
8048550: ff 25 2c a0 04 08 jmp *0x804a02c
8048556: 68 40 00 00 00 push $0x40
804855b: e9 60 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
08048560 <puts@plt>:
8048560: ff 25 30 a0 04 08 jmp *0x804a030
8048566: 68 48 00 00 00 push $0x48
804856b: e9 50 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
08048570 <__gmon_start__@plt>:
8048570: ff 25 34 a0 04 08 jmp *0x804a034
8048576: 68 50 00 00 00 push $0x50
804857b: e9 40 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
08048580 <__libc_start_main@plt>:
8048580: ff 25 38 a0 04 08 jmp *0x804a038
8048586: 68 58 00 00 00 push $0x58
804858b: e9 30 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
08048590 <fopen@plt>:
8048590: ff 25 3c a0 04 08 jmp *0x804a03c
8048596: 68 60 00 00 00 push $0x60
804859b: e9 20 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
080485a0 <__isoc99_scanf@plt>:
80485a0: ff 25 40 a0 04 08 jmp *0x804a040
80485a6: 68 68 00 00 00 push $0x68
80485ab: e9 10 ff ff ff jmp 80484c0 <strcmp@plt-0x10>
Disassembly of section .text:
080485b0 <.text>:
80485b0: 31 ed xor %ebp,%ebp
80485b2: 5e pop %esi
80485b3: 89 e1 mov %esp,%ecx
80485b5: 83 e4 f0 and $0xfffffff0,%esp
80485b8: 50 push %eax
80485b9: 54 push %esp
80485ba: 52 push %edx
80485bb: 68 a0 88 04 08 push $0x80488a0
80485c0: 68 30 88 04 08 push $0x8048830
80485c5: 51 push %ecx
80485c6: 56 push %esi
80485c7: 68 69 87 04 08 push $0x8048769
80485cc: e8 af ff ff ff call 8048580 <__libc_start_main@plt>
80485d1: f4 hlt
80485d2: 66 90 xchg %ax,%ax
80485d4: 66 90 xchg %ax,%ax
80485d6: 66 90 xchg %ax,%ax
80485d8: 66 90 xchg %ax,%ax
80485da: 66 90 xchg %ax,%ax
80485dc: 66 90 xchg %ax,%ax
80485de: 66 90 xchg %ax,%ax
80485e0: 8b 1c 24 mov (%esp),%ebx
80485e3: c3 ret
80485e4: 66 90 xchg %ax,%ax
80485e6: 66 90 xchg %ax,%ax
80485e8: 66 90 xchg %ax,%ax
80485ea: 66 90 xchg %ax,%ax
80485ec: 66 90 xchg %ax,%ax
80485ee: 66 90 xchg %ax,%ax
80485f0: b8 4f a0 04 08 mov $0x804a04f,%eax
80485f5: 2d 4c a0 04 08 sub $0x804a04c,%eax
80485fa: 83 f8 06 cmp $0x6,%eax
80485fd: 77 01 ja 8048600 <__isoc99_scanf@plt+0x60>
80485ff: c3 ret
8048600: b8 00 00 00 00 mov $0x0,%eax
8048605: 85 c0 test %eax,%eax
8048607: 74 f6 je 80485ff <__isoc99_scanf@plt+0x5f>
8048609: 55 push %ebp
804860a: 89 e5 mov %esp,%ebp
804860c: 83 ec 18 sub $0x18,%esp
804860f: c7 04 24 4c a0 04 08 movl $0x804a04c,(%esp)
8048616: ff d0 call *%eax
8048618: c9 leave
8048619: c3 ret
804861a: 8d b6 00 00 00 00 lea 0x0(%esi),%esi
8048620: b8 4c a0 04 08 mov $0x804a04c,%eax
8048625: 2d 4c a0 04 08 sub $0x804a04c,%eax
804862a: c1 f8 02 sar $0x2,%eax
804862d: 89 c2 mov %eax,%edx
804862f: c1 ea 1f shr $0x1f,%edx
8048632: 01 d0 add %edx,%eax
8048634: d1 f8 sar %eax
8048636: 75 01 jne 8048639 <__isoc99_scanf@plt+0x99>
8048638: c3 ret
8048639: ba 00 00 00 00 mov $0x0,%edx
804863e: 85 d2 test %edx,%edx
8048640: 74 f6 je 8048638 <__isoc99_scanf@plt+0x98>
8048642: 55 push %ebp
8048643: 89 e5 mov %esp,%ebp
8048645: 83 ec 18 sub $0x18,%esp
8048648: 89 44 24 04 mov %eax,0x4(%esp)
804864c: c7 04 24 4c a0 04 08 movl $0x804a04c,(%esp)
8048653: ff d2 call *%edx
8048655: c9 leave
8048656: c3 ret
8048657: 89 f6 mov %esi,%esi
8048659: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi
8048660: 80 3d 64 a0 04 08 00 cmpb $0x0,0x804a064
8048667: 75 13 jne 804867c <__isoc99_scanf@plt+0xdc>
8048669: 55 push %ebp
804866a: 89 e5 mov %esp,%ebp
804866c: 83 ec 08 sub $0x8,%esp
804866f: e8 7c ff ff ff call 80485f0 <__isoc99_scanf@plt+0x50>
8048674: c6 05 64 a0 04 08 01 movb $0x1,0x804a064
804867b: c9 leave
804867c: f3 c3 repz ret
804867e: 66 90 xchg %ax,%ax
8048680: a1 10 9f 04 08 mov 0x8049f10,%eax
8048685: 85 c0 test %eax,%eax
8048687: 74 1f je 80486a8 <__isoc99_scanf@plt+0x108>
8048689: b8 00 00 00 00 mov $0x0,%eax
804868e: 85 c0 test %eax,%eax
8048690: 74 16 je 80486a8 <__isoc99_scanf@plt+0x108>
8048692: 55 push %ebp
8048693: 89 e5 mov %esp,%ebp
8048695: 83 ec 18 sub $0x18,%esp
8048698: c7 04 24 10 9f 04 08 movl $0x8049f10,(%esp)
804869f: ff d0 call *%eax
80486a1: c9 leave
80486a2: e9 79 ff ff ff jmp 8048620 <__isoc99_scanf@plt+0x80>
80486a7: 90 nop
80486a8: e9 73 ff ff ff jmp 8048620 <__isoc99_scanf@plt+0x80>
int sub_80486ad(char *arg0, char *arg1)
{
80486ad: 55 push %ebp
80486ae: 89 e5 mov %esp,%ebp
80486b0: 81 ec 98 00 00 00 sub $0x98,%esp
// Local variables.
char *ebp_80h;
char *ebp_7ch;
int ebp_74h;
80486b6: 8b 45 08 mov 0x8(%ebp),%eax
80486b9: 89 45 84 mov %eax,-0x7c(%ebp)
ebp_7ch = arg0;
80486bc: 8b 45 0c mov 0xc(%ebp),%eax
80486bf: 89 45 80 mov %eax,-0x80(%ebp)
ebp_80h = arg1;
80486c2: 65 a1 14 00 00 00 mov %gs:0x14,%eax
80486c8: 89 45 f4 mov %eax,-0xc(%ebp)
80486cb: 31 c0 xor %eax,%eax
80486cd: c7 44 24 04 c0 88 04 movl $0x80488c0,0x4(%esp)
80486d4: 08
80486d5: c7 04 24 c2 88 04 08 movl $0x80488c2,(%esp)
80486dc: e8 af fe ff ff call 8048590 <fopen@plt>
80486e1: 89 45 8c mov %eax,-0x74(%ebp)
ebp_74h = fopen("flag.txt", "r");
80486e4: 83 7d 8c 00 cmpl $0x0,-0x74(%ebp)
80486e8: 75 07 jne 80486f1 <__isoc99_scanf@plt+0x151>
if(ebp_74h == NULL) {
80486ea: b8 01 00 00 00 mov $0x1,%eax
80486ef: eb 65 jmp 8048756 <__isoc99_scanf@plt+0x1b6>
return 1;
}
80486f1: 8b 45 8c mov -0x74(%ebp),%eax
80486f4: 89 44 24 08 mov %eax,0x8(%esp)
80486f8: c7 44 24 04 64 00 00 movl $0x64,0x4(%esp)
80486ff: 00
8048700: 8d 45 90 lea -0x70(%ebp),%eax
8048703: 89 04 24 mov %eax,(%esp)
8048706: e8 05 fe ff ff call 8048510 <fgets@plt>
fgets(ebp_74h, 0x64, ebp_70h);
804870b: 8b 45 84 mov -0x7c(%ebp),%eax
804870e: 89 04 24 mov %eax,(%esp)
8048711: e8 ca fd ff ff call 80484e0 <printf@plt>
printf(ebp_7ch);
8048716: 8b 45 80 mov -0x80(%ebp),%eax
8048719: 89 44 24 04 mov %eax,0x4(%esp)
804871d: 8d 45 90 lea -0x70(%ebp),%eax
8048720: 89 04 24 mov %eax,(%esp)
8048723: e8 a8 fd ff ff call 80484d0 <strcmp@plt>
8048728: 85 c0 test %eax,%eax
804872a: 75 0e jne 804873a <__isoc99_scanf@plt+0x19a>
if(strcmp(ebp_70h, ebp_80h) == 0) {
804872c: c7 04 24 cb 88 04 08 movl $0x80488cb,(%esp)
8048733: e8 28 fe ff ff call 8048560 <puts@plt>
puts(" : correct flag!");
8048738: eb 0c jmp 8048746 <__isoc99_scanf@plt+0x1a6>
} else {
804873a: c7 04 24 dc 88 04 08 movl $0x80488dc,(%esp)
8048741: e8 1a fe ff ff call 8048560 <puts@plt>
puts(" : incorrect flag. Try again.");
}
8048746: 8b 45 8c mov -0x74(%ebp),%eax
8048749: 89 04 24 mov %eax,(%esp)
804874c: e8 cf fd ff ff call 8048520 <fclose@plt>
fclose(ebp_74h);
8048751: b8 00 00 00 00 mov $0x0,%eax
8048756: 8b 55 f4 mov -0xc(%ebp),%edx
8048759: 65 33 15 14 00 00 00 xor %gs:0x14,%edx
8048760: 74 05 je 8048767 <__isoc99_scanf@plt+0x1c7>
8048762: e8 d9 fd ff ff call 8048540 <__stack_chk_fail@plt>
8048767: c9 leave
8048768: c3 ret
return 0;
}
int main(void)
{
8048769: 55 push %ebp
804876a: 89 e5 mov %esp,%ebp
804876c: 83 e4 f0 and $0xfffffff0,%esp
804876f: 83 ec 20 sub $0x20,%esp
// Local variables.
char *esp_18h;
char *esp_1ch;
8048772: c7 04 24 c8 00 00 00 movl $0xc8,(%esp)
8048779: e8 d2 fd ff ff call 8048550 <malloc@plt>
804877e: 89 44 24 18 mov %eax,0x18(%esp)
esp_18h = malloc(0xc8);
8048782: c7 04 24 64 00 00 00 movl $0x64,(%esp)
8048789: e8 c2 fd ff ff call 8048550 <malloc@plt>
804878e: 89 44 24 1c mov %eax,0x1c(%esp)
esp_1ch = malloc(0x64);
8048792: c7 04 24 fa 88 04 08 movl $0x80488fa,(%esp)
8048799: e8 42 fd ff ff call 80484e0 <printf@plt>
printf("Enter teamname: ");
804879e: a1 60 a0 04 08 mov 0x804a060,%eax
80487a3: 89 04 24 mov %eax,(%esp)
80487a6: e8 45 fd ff ff call 80484f0 <fflush@plt>
fflush(stdout);
80487ab: 8b 44 24 18 mov 0x18(%esp),%eax
80487af: 89 44 24 04 mov %eax,0x4(%esp)
80487b3: c7 04 24 0b 89 04 08 movl $0x804890b,(%esp)
80487ba: e8 e1 fd ff ff call 80485a0 <__isoc99_scanf@plt>
scanf("%200s", esp_18h);
80487bf: c7 04 24 11 89 04 08 movl $0x8048911,(%esp)
80487c6: e8 15 fd ff ff call 80484e0 <printf@plt>
printf("flag: ", );
80487cb: a1 60 a0 04 08 mov 0x804a060,%eax
80487d0: 89 04 24 mov %eax,(%esp)
80487d3: e8 18 fd ff ff call 80484f0 <fflush@plt>
fflush(stdout);
80487d8: 8b 44 24 1c mov 0x1c(%esp),%eax
80487dc: 89 44 24 04 mov %eax,0x4(%esp)
80487e0: c7 04 24 1e 89 04 08 movl $0x804891e,(%esp)
80487e7: e8 b4 fd ff ff call 80485a0 <__isoc99_scanf@plt>
scanf("%100s", esp_1ch);
80487ec: c7 04 24 02 00 00 00 movl $0x2,(%esp)
80487f3: e8 38 fd ff ff call 8048530 <sleep@plt>
sleep(2);
80487f8: 8b 44 24 1c mov 0x1c(%esp),%eax
80487fc: 89 44 24 04 mov %eax,0x4(%esp)
8048800: 8b 44 24 18 mov 0x18(%esp),%eax
8048804: 89 04 24 mov %eax,(%esp)
8048807: e8 a1 fe ff ff call 80486ad <__isoc99_scanf@plt+0x10d>
sub_80486ad(esp_18h, esp_1ch);
804880c: 8b 44 24 18 mov 0x18(%esp),%eax
8048810: 89 04 24 mov %eax,(%esp)
8048813: e8 e8 fc ff ff call 8048500 <free@plt>
free(esp_18h);
8048818: 8b 44 24 1c mov 0x1c(%esp),%eax
804881c: 89 04 24 mov %eax,(%esp)
804881f: e8 dc fc ff ff call 8048500 <free@plt>
free(esp_1ch);
8048824: b8 00 00 00 00 mov $0x0,%eax
8048829: c9 leave
804882a: c3 ret
return 0;
}
804882b: 66 90 xchg %ax,%ax
804882d: 66 90 xchg %ax,%ax
804882f: 90 nop
8048830: 55 push %ebp
8048831: 57 push %edi
8048832: 31 ff xor %edi,%edi
8048834: 56 push %esi
8048835: 53 push %ebx
8048836: e8 a5 fd ff ff call 80485e0 <__isoc99_scanf@plt+0x40>
804883b: 81 c3 c5 17 00 00 add $0x17c5,%ebx
8048841: 83 ec 1c sub $0x1c,%esp
8048844: 8b 6c 24 30 mov 0x30(%esp),%ebp
8048848: 8d b3 0c ff ff ff lea -0xf4(%ebx),%esi
804884e: e8 49 fc ff ff call 804849c <strcmp@plt-0x34>
8048853: 8d 83 08 ff ff ff lea -0xf8(%ebx),%eax
8048859: 29 c6 sub %eax,%esi
804885b: c1 fe 02 sar $0x2,%esi
804885e: 85 f6 test %esi,%esi
8048860: 74 27 je 8048889 <__isoc99_scanf@plt+0x2e9>
8048862: 8d b6 00 00 00 00 lea 0x0(%esi),%esi
8048868: 8b 44 24 38 mov 0x38(%esp),%eax
804886c: 89 2c 24 mov %ebp,(%esp)
804886f: 89 44 24 08 mov %eax,0x8(%esp)
8048873: 8b 44 24 34 mov 0x34(%esp),%eax
8048877: 89 44 24 04 mov %eax,0x4(%esp)
804887b: ff 94 bb 08 ff ff ff call *-0xf8(%ebx,%edi,4)
8048882: 83 c7 01 add $0x1,%edi
8048885: 39 f7 cmp %esi,%edi
8048887: 75 df jne 8048868 <__isoc99_scanf@plt+0x2c8>
8048889: 83 c4 1c add $0x1c,%esp
804888c: 5b pop %ebx
804888d: 5e pop %esi
804888e: 5f pop %edi
804888f: 5d pop %ebp
8048890: c3 ret
8048891: eb 0d jmp 80488a0 <__isoc99_scanf@plt+0x300>
8048893: 90 nop
8048894: 90 nop
8048895: 90 nop
8048896: 90 nop
8048897: 90 nop
8048898: 90 nop
8048899: 90 nop
804889a: 90 nop
804889b: 90 nop
804889c: 90 nop
804889d: 90 nop
804889e: 90 nop
804889f: 90 nop
80488a0: f3 c3 repz ret
Disassembly of section .fini:
080488a4 <.fini>:
80488a4: 53 push %ebx
80488a5: 83 ec 08 sub $0x8,%esp
80488a8: e8 33 fd ff ff call 80485e0 <__isoc99_scanf@plt+0x40>
80488ad: 81 c3 53 17 00 00 add $0x1753,%ebx
80488b3: 83 c4 08 add $0x8,%esp
80488b6: 5b pop %ebx
80488b7: c3 ret
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment