Rps | nightxade

Here’s a program that plays rock, paper, scissors against you. I hear something good happens if you win 5 times in a row.
Connect to the program with netcat:
$ nc saturn.picoctf.net [port #]
The program’s source code with the flag redacted can be downloaded here.

We’re given a C source file to analyze. Taking a look at the play function, I noticed something interesting:

1
bool play () {
2
  char player_turn[100];
3
  srand(time(0));
4
  int r;
5

6
  printf("Please make your selection (rock/paper/scissors):\n");
7
  r = tgetinput(player_turn, 100);
8
  // Timeout on user input
9
  if(r == -3)
10
  {
11
    printf("Goodbye!\n");
12
    exit(0);
13
  }
14

15
  int computer_turn = rand() % 3;
16
  printf("You played: %s\n", player_turn);
17
  printf("The computer played: %s\n", hands[computer_turn]);
18

19
  if (strstr(player_turn, loses[computer_turn])) {
20
    puts("You win! Play again?");
21
    return true;
22
  } else {
23
    puts("Seems like you didn't win this time. Play again?");
24
    return false;
25
  }
26
}

But, here’s what the strstr function does according to documentation:

1
strstr
2
const char * strstr ( const char * str1, const char * str2 );      char * strstr (       char * str1, const char * str2 );
3
Locate substring
4
Returns a pointer to the first occurrence of str2 in str1, or a null pointer if str2 is not part of str1.
5

6
The matching process does not include the terminating null-characters, but it stops there.

So strstr isn’t checking if the strings are equal. Rather, it’s checking if str2 is in str1! In other words, it’s checking if loses[computer_turn] is contained within player_turn. If it is, then we win that round.
We are also given the following:

1
char* loses[3] = {"paper", "scissors", "rock"};

Hence, the value of loses[computer_turn] can only ever be one of these. Well, what if we just input paperscissorsrock? Then, the value of loses[computer_turn] will always be a substring of the player input, and we will win every time!
Connect to the service and input paperscissorsrock 5 times in a row to get the flag!

1
picoCTF{50M3_3X7R3M3_1UCK_C85AF58A}