Casino

We are given a c source file

/*
Compile options:
    gcc casino.c -o casino
*/

#include <stdio.h>
#include <stdlib.h>

void print_flag()
{
    system("cat flag");
}

void print_options()
{
    puts("\n1. gamble");
    puts("2. buy flag (costs $13371337)");
    puts("3. leave\n");
}

int gamble(int balance)
{
    int input;

    puts("How much would you like to gamble: ");

    // if user provides invalid input
    if(scanf("%d", &input) == 0) {
        puts("Invalid input, please input an integer next time.");
        exit(0);
    }

    // check that the user has enough funds to gamble
    if (balance >= input) {
        int guess;

        puts("Guess an integer from 1-100:");

        // if user provides invalid input
        if (scanf("%d", &guess)==0) {
            puts("Invalid input, please input an integer next time.");
            exit(0);
        }

        // shh, the casino is actually rigged.
        printf("Oops, your guess of %d is wrong. $%d will be deducted from your balance.\n",guess,input);

        // i'm sure no one can exploit this ;)
        balance -= abs(input);
    }
    else {
        printf("Too little funds to gamble $%d\n",input);
    }
    return balance;
}

void buy_flag(int balance)
{
    if (balance > 13371337) {
        printf("You bought the flag! ");
        print_flag();
    }
    else {
        puts("You lack sufficient funds to buy the flag, which costs $13371337.\n");
    }
}

int main()
{
    int balance = 100;
    int menu;

    puts("Welcome to the casino.");

    while(1) {
        print_options();
        printf("Current balance: $%d\n",balance);
        printf("What would you like to do (input an integer from 1-3): ");
        scanf("%d", &menu);

        if (menu == 1) {
            balance = gamble(balance);
        }
        else if (menu == 2) {
            buy_flag(balance);
        }
        else if (menu == 3) {
            puts("Bye!");
            break;
        }
        else {
            puts("Invalid option");
            break;
        }
    }
    return 0;
}

There are a few functions and points of interest in this code

Firstly, we have a function print_flag() which prints the flag

Next, we have this part of the code, which shows how the guessing mechanism works]

[...]
    int guess;
    
    puts("Guess an integer from 1-100:");
    
    // if user provides invalid input
    if (scanf("%d", &guess)==0) {
        puts("Invalid input, please input an integer next time.");
        exit(0);
    }
    
    // shh, the casino is actually rigged.
    printf("Oops, your guess of %d is wrong. $%d will be deducted from your balance.\n",guess,input);
    
    // i'm sure no one can exploit this ;)
    balance -= abs(input);
[...]

Our guess will never be correct.

Finally, we have the buy_flag() function, which calls the print_flag() function if we manage to buy the flag

void buy_flag(int balance)
{
    if (balance > 13371337) {
        printf("You bought the flag! ");
        print_flag();
    }
    else {
        puts("You lack sufficient funds to buy the flag, which costs $13371337.\n");
    }
}

Lets try performing an integer overflow attack on the casino by inputting a huge number when asked how much we would like to gamble

Very Responsible Gambling

└─# nc challs.sieberr.live 1002
Welcome to the casino.

1. gamble
2. buy flag (costs $13371337)
3. leave

Current balance: $100
What would you like to do (input an integer from 1-3): 1
How much would you like to gamble:
999999999999999
Guess an integer from 1-100:
69
Oops, your guess of 69 is wrong. $-1530494977 will be deducted from your balance.

1. gamble
2. buy flag (costs $13371337)
3. leave

Current balance: $-1530494877
What would you like to do (input an integer from 1-3): 1
How much would you like to gamble:
999999999999999
Guess an integer from 1-100:
42
Oops, your guess of 42 is wrong. $-1530494977 will be deducted from your balance.

1. gamble
2. buy flag (costs $13371337)
3. leave

Current balance: $1233977442
What would you like to do (input an integer from 1-3): 2
You bought the flag! sctf{g4mbl1n9_15_b4d_9uy5}

flag:

sctf{g4mbl1n9_15_b4d_9uy5}

Fun fact: 100% of gamblers quit before they hit big