picoCTF 2018: in out error

CTF Misc Linux

問題

問題文

Can you utlize stdin, stdout, and stderr to get the flag from this program? You can also find it in /problems/in-out-error_4_c51f68457d8543c835331292b7f332d2 on the shell server

Hints

Maybe you can split the stdout and stderr output?

問題概要

文字列を出力する x64 の ELF ファイルが与えられる.

標準出力と標準エラー出力を分けなさい.

解答例

指針

  • 標準出力を /dev/null にリダイレクトする

解説

与えられたプログラムを実行すると Please may I have the flag? と入力しろと言われる. 入力すると, よくわからないテキストが出力される.

kira924age@pico-2018-shell-2:/problems/in-out-error_4_c51f68457d8543c835331292b7f332d2$ ./in-out-error
Hey There!
If you want the flag you have to ask nicely for it.
Enter the phrase "Please may I have the flag?" into stdin and you shall receive.
Please may I have the flag?
Thank you for asking so nicely!

pWiec'orCeT Fn{op 1spt1rnagn_g1eSr_s4 _t7oh 1lnogv_ef
3Y7ofub 6k7neo}wp itchoeC TrFu{lpe1sp 1anngd_ 1sSo_ 4d_o7 hI1
nAg _ffu3l7lf bc6o7mem}iptimceonCtT'Fs{ pw1hpa1tn gI_'1mS _t4h_i7nhk1inngg_ fo3f7
fYbo6u7 ew}opuilcdonC'TtF {gpe1tp 1tnhgi_s1 Sf_r4o_m7 ha1nnyg _oft3h7efrb 6g7uey}
p
iIc ojCuTsFt{ pw1apn1nnag _t1eSl_l4 _y7ohu1 nhgo_wf 3I7'fmb 6f7eee}lpiincgo
CGToFt{tpa1 pm1ankge_ 1ySo_u4 _u7nhd1enrgs_tfa3n7df

...

Hint からこの出力は標準出力と標準エラー出力が混ざったものであると推測できる.

Linux において標準入出力とは, 標準入力(stdin). 標準出力(stdout), 標準エラー出力(stderr) の 3 つのことを指す. これらは入出力チャンネルと呼ばれ, それぞれ以下のような数値が割り振られている.

Channel Number
stdin 0
stdout 1
stderr 2

今回のように stdin と stderr を分離したいとき, 一方のみを /dev/null にリダイレクトするという手法がよく使われる.

/dev/null というファイルはデバイスファイルと呼ばれる特殊なファイルで書き込まれたデータは保存されず消える.

以下のようにすれば, 標準エラー出力のみを /dev/null にリダイレクトできる.

kira924age@pico-2018-shell-2:/problems/in-out-error_4_c51f68457d8543c835331292b7f332d2$ echo "Please may I have the flag?" | ./in-out-error 2> /dev/null
Hey There!
If you want the flag you have to ask nicely for it.
Enter the phrase "Please may I have the flag?" into stdin and you shall receive.
Thank you for asking so nicely!

We're no strangers to love
You know the rules and so do I
A full commitment's what I'm thinking of
You wouldn't get this from any other guy

I just wanna tell you how I'm feeling
Gotta make you understand

Never gonna give you up
Never gonna let you down
Never gonna run around and desert you
Never gonna make you cry
Never gonna say goodbye
Never gonna tell a lie and hurt you

...

ディスプレイに表示されている stdout には flag は含まれていなかった. 今度は stdout を /dev/null にリダイレクトし, stderr を表示させてみる.

kira924age@pico-2018-shell-2:/problems/in-out-error_4_c51f68457d8543c835331292b7f332d2$ echo "Please may I have the flag?" | ./in-out-error 1> /dev/null
picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}picoCTF{p1pkira924age@pico-2018-shell-2:/problems/in-out-error_4_c51f68457d8543c835331292b7f332d2$

今度は flag が得られた. flag: picoCTF{p1p1ng_1S_4_7h1ng_f37fb67e}

参考文献

  • 新しいLinuxの教科書