sucker punch mindgames

Solved by : grb

This is what the challenge looks like, there's a single binary file attached to it.

Like usual, we open up the binary under IDA.

Essentially, the target binary runs 100 rounds of a game. Each round it chooses v6 = rand() % 2 and asks the player to press 1 (attack) or 2 (wait). If the player chooses the same move as the randomly-chosen losing move in that round they die and the program exits. The binary calls srand(0) before the loop, which seeds rand() with a fixed, known seed (0). Because rand() is deterministic given its seed and implementation, we can reproduce the exact sequence of rand() % 2 values locally and submit the opposite move each round to guarantee survival for all 100 rounds. After surviving 100 rounds, the binary calls flag() and prints the flag. You can check the script that will produce the rand() % 2 values locally and submit the opposite move here.

At last, running the script and piping the output to the target machine will give us...

PO- PO- PO- PWNED!!! Moral of the story, dont use static rand() seed.