Challenge Description

Mommy! what is a file descriptor in Linux?

* try to play the wargame your self but if you are ABSOLUTE beginner, follow this tutorial link:
https://youtu.be/971eZhMHQQw

ssh fd@pwnable.kr -p2222 (pw:guest)

Solution

Log in to the shell and list the current directory.

fd@ubuntu:~$ ls
fd  fd.c  flag  readme

Try to cat the flag, we get “Permission denied”.

So, we inspect the source code of fd.c

fd.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
        if(argc<2){
                printf("pass argv[1] a number\n");
                return 0;
        }
        int fd = atoi( argv[1] ) - 0x1234;
        int len = 0;
        len = read(fd, buf, 32);
        if(!strcmp("LETMEWIN\n", buf)){
                printf("good job :)\n");
                setregid(getegid(), getegid());
                system("/bin/cat flag");
                exit(0);
        }
        printf("learn about Linux file IO\n");
        return 0;

}

For reference, atoi converts a string to an integer.

We need to pass in an argument, and the program will subtract it by 0x1234, which is 4660 in decimal.
Next, it treats this value as the file descriptor, then read from that file descriptor.
We know there are three default file descriptors: 0 for standard input (stdin), 1 for standard output (stdout), and 2 for standard error (stderr). The only one whose input we can control is stdin, so we use ./fd 4660 to make fd equal to 0, then enter LETMEWIN.
Here is the output:

fd@ubuntu:~$ ./fd 4660
LETMEWIN
good job :)
Mama! Now_I_understand_what_file_descriptors_are!

Flag: Mama! Now_I_understand_what_file_descriptors_are!