Thread: Vulnerability in c functions

I am quite new to C programming, having only really been introduced to it in the context of software vulnerabilities. I am taking part in a CTF challenge, and have the following C program running on linux. There are numerous inboxes, but I am only allowed to use user Alice, who is not privileged, to find the flag, which is found in someone elses inbox. I am thinking there is an issue with how the program reads and writes to files, but I cant quite find it. I am hoping someone on here might be able to find the vulnerability in the C code? The entire program can be found at c program - Pastebin.com

There doesn't seem to be any possible buffer overruns since all inputs use fgets calls and they are all properly limited. The strcats don't seem to be able to overflow either.


Something strange is that the username is not validated, so it could contain a colon (':'), which would be problematic. I'm not sure how to leverage that, though (since the username is limited to 19 chars).


What is the result of ls -l /ctf/message
What is the result of cat /ctf/message/passwd
What is the result of ls -l on the executable of this program?

John here is the output, I am only user alice, with no sudo.
The flag is either in admin, bruce, dave, eve, bob, the rest are accounts that I have made to try and get past it

Thanks for the info. I took another look but still can't find the vulnerability. I'll probably take another look at it later today. Definitely let us know when you figure it out or are told. I wonder what it could be?

From reading your posts, I get the impression that the ultimate goal is to gain access to this "flag" hidden in one of those accounts. If that's the case perhaps there is no vulnerability -in a traditional manner- in the code itself. But there are certainly weaknesses, weaknesses you can exploit to gain access to the accounts.

1. You already have the salt.
2. The encryption is DES which is very, very broken.
3. Password length is at most 19 bytes. This isn't exactly a weakness as this is a decent length, but is useful information you can use.

Knowing all of this you can mount a successful attack. Search the web for breaking DES encryption and you'll get plenty of leads. If this is the way to go, I'm sure the creators of this exercise used a short password, possibly even shared between accounts.

By the way, where did you get this, was it at school or some hacking website? it'd be interesting to take a look.

PS: (Read the man for crypt to see how the key is obtained)

@Exosomes, in glibc, if the "salt" starts with "$6$" then SHA-512 is used (and the salt is the letters from the second $ to the next $).