> For the complete documentation index, see [llms.txt](https://nickbhe.gitbook.io/shikata-ga-nai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nickbhe.gitbook.io/shikata-ga-nai/pwnable.kr/07-input.md).

# 07 - input

## The Challenge

Mom? how can I pass my input to a computer program?

ssh <input2@pwnable.kr> -p2222 (pw:guest)

## The Solution

To solve this one we need to run the binary under very specific circumstances, divided into five categories.

### 1 - argv

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MH10To2xxL1ctIm58Q1%2F-MH1aXb3nQEjt5z91utg%2Fimage.png?alt=media\&token=75fd8974-4ea1-4109-806e-ff4cd9a2845f)

To get through this stage we need to provide **input** with 99 arguments. The arguments indexed **A** \[65] and **B** \[66] need to equal to the values specified above.

```
./input A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A $'\0' $' \n\r' A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A
```

### 2 - stdio

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MH6AUElKrqZhNFwj5WP%2F-MH6BUTaTjmymtwbZCa4%2Fimage.png?alt=media\&token=02e025ce-09dc-4621-ac04-fcd1c8d4a291)

The program reads four bytes from **stdin** and the four bytes from **stderr**. To make stderr read data, bind it to stdin with 2<&0 and send the buffer.

```
printf '\x00\x0a\x00\xff\x00\x0a\x02\xff' | ./input A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A $'\0' $' \n\r' A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A 2<&0
```

### 3 - env

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MH6AUElKrqZhNFwj5WP%2F-MH6D-uZ_ygVdTzfEsYw%2Fimage.png?alt=media\&token=ad21b118-2a45-4b4e-9f1d-6714550488de)

This section requires us to set an environment variable with unreadble name and value. **Export** does not support this, so we used **env** instead.

```
printf '\x00\x0a\x00\xff\x00\x0a\x02\xff' | env $'\xde\xad\xbe\xef'=$'\xca\xfe\xba\xbe' ./input A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A $'\0' $' \n\r' A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A 2<&0
```

### 4- file

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MH6GRqYCdcYuJvi_U4Q%2F-MH6GWGA3OID3oncz6CM%2Fimage.png?alt=media\&token=b650896e-e52e-4c7a-8e54-4758e0490c3a)

To clear this stage we need to execute the binary from a directory that contains a file named **\n** that contains four bytes of **\0**. Also, we need to create a symlink to the flag, so once we clear all the stages the flag will be printed.

Inside your  writable directory:

```
printf '\x00\x00\x00\x00' > $'\n'
ln -s ~/flag flag
printf '\x00\x0a\x00\xff\x00\x0a\x02\xff' | env $'\xde\xad\xbe\xef'=$'\xca\xfe\xba\xbe' ~/input A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A $'\0' $' \n\r' A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A 2<&0
```

### 5 - network

![](https://3609409146-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MFKoejdbAjmSQIWMVBk%2F-MH6JUCG_g7J9koqUY6q%2F-MH6lMoMWeTaUnYWfCPJ%2Fimage.png?alt=media\&token=58f07650-8384-46e2-9b99-bf11e9d4fd4a)

The binary will wait for connection on the port specified on the argument indexed **C** \[67]. If the data sent to the connection equals to **0xdeadbeef** we will pass the stage and recieve the flag :)

The final one-liner \[after the prerequisites of stage 4]:

```
(sleep 1 && printf '\xde\xad\xbe\xef' | nc localhost 55555 &); printf '\x00\x0a\x00\xff\x00\x0a\x02\xff' | env $'\xde\xad\xbe\xef'=$'\xca\xfe\xba\xbe' ~/input A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A $'\0' $' \n\r' 55555 A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A 2<&0
```