# passcode (incomplete)

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-fac84bc0b36e68faf2f81e1476440d1f1c7e87a9%2Fimage.png?alt=media)

**passcode.c**:

```c
#include <stdio.h>
#include <stdlib.h>

void login(){
	int passcode1;
	int passcode2;

	printf("enter passcode1 : ");
	scanf("%d", passcode1);
	fflush(stdin);

	// ha! mommy told me that 32bit is vulnerable to bruteforcing :)
	printf("enter passcode2 : ");
        scanf("%d", passcode2);

	printf("checking...\n");
	if(passcode1==338150 && passcode2==13371337){
                printf("Login OK!\n");
                system("/bin/cat flag");
        }
        else{
                printf("Login Failed!\n");
		exit(0);
        }
}

void welcome(){
	char name[100];
	printf("enter you name : ");
	scanf("%100s", name);
	printf("Welcome %s!\n", name);
}

int main(){
	printf("Toddler's Secure Login System 1.0 beta.\n");

	welcome();
	login();

	// something after login...
	printf("Now I can safely trust you that you have credential :)\n");
	return 0;	
}
```

We can see the passwords in plain text in the code: `338150` and `13371337`. I tried entering those and ended up getting a segmentation fault:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-b367a7e73ddb74ebd4c91a65259b706d502af4a5%2Fimage.png?alt=media)

I ran **checksec** on the program just to see what was there:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-f3faa95fac0bcf5530eff6eda3dada3f8938a6a5%2Fimage.png?alt=media)

There was nothing too out of the ordinary for me here. I went back at the prompt for the question and noticed they mentioned something about a compiler warning. I compiled the code again to focus on the compiler warnings:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-8008899909e27df59eccd15258abe84e242e4de2%2Fimage.png?alt=media)

I learned online that scanf takes in a pointer to an input instead of the input itself. I think we might able to manipulate this by writing our passcodes in the name string. We can then point scanf to look for the pointer where that passcode is located. I fired up gdb with the pwndebug add-on to it. I made the first break in main. This was just to get the program going to see where the updated memory locations were of the functions and variables. I then disassembled the welcome function because that is where our input goes to:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-601fe6f5f5286cc3eba85647c5dfa7d94443e437%2Fimage.png?alt=media)

I will break after scanf just to see what register is holding our data in it:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-40a1c4308236f0470eb6795b2b506267298c7be1%2Fimage.png?alt=media)

There seems to be 3 registers that are currently holding our information: rax, r9, and rsp. I tried multiple things after this but was unable to get anywhere. I then found this write-up of the same challenge which made me understand this a bit more: [https://jaimelightfoot.com/blog/pwnable-kr-passcode-walkthrough/](https://jaimelightfoot.com/blog/pwnable-kr-passcode-walkthrough/). The first thing I had learned from this write-up was that the lea instruction and registers were a way to figure out what the variable is in a given context. In our case, we have the following:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-240348d9cea907e06f9de2b0c005bd0172b05b18%2Fimage.png?alt=media)

After the data gets scanned, we can make a good guess that the value that just got scanned in will be moved to another register.

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-59e1179f3d8191f273cbf5566fdd4b64a8e99d27%2Fimage.png?alt=media)

Now we have verified that this is the location of our variable's data. However, it is only temporary, since it gets moved due to the code still being run:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-213134c557edb355264fa638aec4b726285d0718%2Fimage.png?alt=media)

{% hint style="info" %}
This write-up is incomplete.
{% endhint %}
