Write-up of the challenge “office-program”#

This challenge is part of the “Binary exploitation” category and earns 100 points.

Goal of the challenge#

The objective of this challenge is to feed the program a certain number that will eventually be less than zero.

Program structure#

1
int32_t main(int32_t argc, char** argv, char** envp)
2
{
3
    setvbuf(__TMC_END__, nullptr, 2, 0);
4
    srand(time(nullptr));
5
    puts("Welcome to the Office Program");
6

7
    while (true)
8
    {
9
        puts("\nSelect an action:");
10
        puts("0 - Exit (like leaving the office at 5 PM)");
11
        puts("1 - Print favourite excel column");
12
        puts("2 - Call Rebecca from front desk");
13
        puts("3 - Get secret sauce (only for finance)");
14
        printf("Enter your choice: ");
15
        int32_t var_c;
16
        __isoc99_scanf("%d", &var_c);
17
        important_work_or_attend_a_meeting();
18

19
        if (var_c == 3)
20
            break;
21

22
        if (var_c < 0)
23
        {
24
            puts("\nInput out of range. You confused the system");
25
            var_c = -(var_c);
26
        }
27

28
        var_c += 5;
29

30
        if (var_c >= 0)
31
        {
32
            var_c = 0;
33

34
            if (var_c)
35
            {
36
                puts("\nClocking out... Goodbye!");
37
                return 0;
38
            }
39

40
            if (var_c == 1)
41
                puts("\nDon't forget the TPS reports. Also, the printer is jammed again.");
42
            else if (var_c != 2)
43
                puts("\nThe CEO wants to talk to you");
44
            else
45
                puts("\nAdjusting the CRT monitor's brightness...");
46
        }
47
        else
48
        {
49
            puts("\nInput out of range. You confused the system");
50
            print_flag();
51
        }
52

53
        if (rand() % 3)
54
        {
55
            if (rand() % 3 != 1)
56
                puts("\nUnexpected error, please insert disk");
57
            else
58
                puts("\nRandom action: Rewinding a cassette tape with a pencil...");
59
        }
60
        else
61
            puts("\nRandom action: Faxing a memo to nowhere...");
62
    }
63

64
    puts("\nThe Office Program is not able to process the number 3");
65
    important_work_or_attend_a_meeting();
66
    puts("\nExiting now...");
67
    exit(0);
68
    /* no return */
69
}

Security breach#

Not doing any checks for integer overflow if (var_c >= 0).

Solution#

So my solution was to send the MAX_UNIT for signed integer which is 2**31 or 2147483648 to understand how we got here we need to look at the program’s flow:

The menu choice var_c is read as a signed 32 bit integer
If input is negative, it’s negated: var_c = -(var_c)
Then var_c += 5 is executed
If var_c >= 0, normal menu processing happens
If var_c < 0, print_flag() is called

So when we send 2147483648, this happens:

When negated: -(-2147483648) tries to compute 2147483648
This overflows because 2147483648 > INT_MAX (2147483647)
Signed overflow wraps to -2147483648 again
Then += 5 makes it -2147483643 (still negative)
Since var_c < 0, print_flag() executes