# Bomb removal

## Source file:

```c
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>

unsigned int size = 0x20;

void alarm_handler() {
    exit(-1);
}

void initialize() {
    setvbuf(stdin, NULL, _IONBF, 0);
    setvbuf(stdout, NULL, _IONBF, 0);
    signal(SIGALRM, alarm_handler);
    alarm(60);
}

int main() {
    int idx;
    char *bomb = NULL;

    initialize();
    printf("stdout: %p\n", stdout);

    printf("Oops! Ji-yong faces Bomb!!\n\n");
    bomb = malloc(0x20);

    while(1){
        printf("----------------------------\n");
        printf("1. Drop the extra Bomb\n");
        printf("2. Attempt to remove the bomb\n");
        printf("3. Print the Bomb name\n");
        printf("4. Modify the Bomb name\n");
        printf(">> ");
        scanf("%d", &idx);

        switch(idx){
            case 1:
                bomb = malloc(size);
                printf("Bomb name: ");
                read(0, bomb, size - 1);
                break;
            case 2:
                free(bomb);
                break;
            case 3:
                printf("Bomb name: %s", bomb);
                break;
            case 4:
                printf("Modify the Bomb name: ");
                read(0, bomb, size - 1);
                break;
            default:
                break;
        }
    }

    return 0;
}
```

{% file src="<https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2FGlnRTvbzqv6d4hgQLN20%2Fbomb_removal?alt=media&token=3ee006fe-61bb-430d-939e-21646e3e1c0a>" %}
elf file
{% endfile %}

### Checksec:

<figure><img src="https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2FmkOc7vpTl6PKwSR1qK50%2Fimage.png?alt=media&#x26;token=02267d8f-47fa-43dd-88f9-dc87ec2073ca" alt=""><figcaption></figcaption></figure>

## Analysis

Theo như file source của bài này thì tôi đoán rằng bài này sẽ sử dụng lỗi <mark style="color:red;">**`double free`**</mark> hoặc <mark style="color:red;">**`uaf`**</mark> để khai thác.

<figure><img src="https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2FNvJ8yKPB7a3c2GcELR2b%2Fimage.png?alt=media&#x26;token=68c2c849-39f2-42c9-8db6-741150c05ea5" alt=""><figcaption><p>Khả năng cao là UAF</p></figcaption></figure>

set 4 break point tại đây:

<figure><img src="https://874207988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh6QOMVWOJ0e4ORVhGo50%2Fuploads%2FIq0Am1ajRzrZNa2O0zCc%2Fimage.png?alt=media&#x26;token=91d90ba0-3a8f-4fe3-a1aa-03e0db282f67" alt=""><figcaption></figcaption></figure>