Pwnable fd, pwnable

Pwnable fd, pwnable

Address: http://www.pwnable.kr

 

After ssh:

The flag file is unreadable. The fd program can be executed and the source code is provided. Let's take a look at what the source code shows:

The code is very simple. The first parameter minus 0x1234 is used as the first parameter of read, and then the read reads a maximum of 32 bytes into the buf after fd. It is compared with LETMEWIN, and the output flag is the same. We are all back to the file descriptor is 0 when the standard input, 1 is the standard output, 2 when the error, the new open file from 3 plus, details refer to: http://blog.csdn.net/cywosp/article/details/38965239

So we can set the fd value to 0, so input 0x1234, and then input LETMEWIN. here we need to convert: