Treat Dispenser Writeup

Overview

We get a single Linux program that runs a candy dispenser. It hands out four treats and keeps the good candy locked away. Our job is to get the good candy out of it.

Solution

Let's see what the handout is.‍

$ file dispenser
dispenser: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=88176a0ee5737362b9d9d55e3043efe312d33980, for GNU/Linux 3.2.0, stripped

‍A stripped 64-bit binary. Let's run it and see what it does.

$ ./dispenser
        \\
   .-'```^```'-.
  /   /\ __ /\  \
  |   ^^ \/ ^^  |
  \   \_.__._/  /
   `'-.......-'`

 THE NEIGHBORHOOD TREAT DISPENSER
 Trick or treat! A little something for everyone.
 (The good candy stays locked away.)

 1) Candy corn
 2) Gummy worms
 3) Peanut butter cup
 4) Caramel apple pop
 0) Walk away
> 2
*clunk* a pack of gummy worms drops into the tray.


Four treats, none of them the good candy. Picking a number that is not on the menu gets us nothing either.

> 7
That slot is empty.


So the interesting path is not on the menu. Before digging into the code, let's check whether the flag is simply sitting in the binary as text.‍

$ strings dispenser | grep -i skillbit
$

‍Nothing. The flag is not stored in readable form, so we will have to make the program produce it. The strings output is still worth reading in full, because it shows messages the menu never printed. Let's narrow it down to anything that looks like service text.‍

$ strings dispenser | grep -iE "svc|key"
svc 09/14: slot 3 coil jams on gummy worms, reseat before restock
svc 10/02: restock panel moved off the keypad label, KEY=6767
svc 10/20: coin mech disabled for Halloween night, treats are free
The keypad only takes numbers.
DISPENSER_SVC_LOG

‍Technicians left notes inside the machine. One says the restock panel was moved off the keypad label and gives KEY=6767. That reads like the panel is still on the keypad, it just is not printed on it anymore. The keypad takes numbers, so let's type that one in.

> 6767
*CLUNK* The locked compartment swings open and a full-size bar drops out.
The wrapper reads: SkillBit{fu11_s1z3_tr34t_unl0ck3d}