Phoenix - Net Zero

1 minute read

#include <err.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/random.h>
#include <sys/types.h>
#include <unistd.h>

#define BANNER \
  "Welcome to " LEVELNAME ", brought to you by https://exploit.education"

int main(int argc, char **argv) {
  uint32_t i, j;

  setvbuf(stdout, NULL, _IONBF, 0);
  setvbuf(stderr, NULL, _IONBF, 0);
  printf("%s\n", BANNER);

  if (getrandom((void *)&i, sizeof(i), 0) != sizeof(i)) {
    errx(1, "unable to getrandom(%d bytes)", sizeof(i));
  }

  printf("Please send '%u' as a little endian, 32bit integer.\n", i);

  if (read(0, (void *)&j, sizeof(j)) != sizeof(j)) {
    errx(1, "unable to read %d bytes from stdin", sizeof(j));
  }

  if (i == j) {
    printf("You have successfully passed this level, well done!\n");
  } else {
    printf("Close - you sent %u instead\n", j);
  }

  return 0;
}

The goal of this level is to read a random number from a server (localhost in this case) and send it back in little endian, nothing to explain here.

Solution:

# solve.py

from pwn import *

con = remote("localhost", 64000)		# connect to localhost on port 64000
print(con.recvline())				# receive the greeting message

line = con.recvline()				# receive the line containing the number
num = int(line.split("\'")[1])			# ['Please send ', '1948481594', ' as a little endian, 32bit integer.\n']

con.send(p64(num))				# convert to little endian

print(con.recv())				# receive the final message

$ python solve.py 
[+] Opening connection to localhost on port 64000: Done
Welcome to phoenix/net-zero, brought to you by https://exploit.education

You have successfully passed this level, well done!
[*] Closed connection to localhost port 64000

Abdallah Elshinbary

Solution: