captchahell

Walkthrough

The Challenge

The binary generates a 50-character random captcha and asks you to type it backwards in 2 seconds. The srand seed combines time(NULL) with 0xCAFEBABE:

srand(time(NULL) ^ 0xCAFEBABE);

Strategy

Since time(NULL) gives seconds precision, we can predict the seed by running our solver at the same second. We replicate the PRNG to generate the same captcha, reverse it, and send it back — all within 2 seconds.

from ctypes import CDLL
libc = CDLL("libc.so.6")
seed = int(time.time()) ^ 0xCAFEBABE
libc.srand(seed)
pool = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
captcha = ''.join(pool[libc.rand() % 36] for _ in range(50))
answer = captcha[::-1]

Result

CAPTCHA FROM HELL
Type these 50 characters BACKWARDS in 2 seconds!
K3F7R...
→ Your answer: [auto-sent reversed captcha]
Holy shit. You're not human.
Securinets_fst{pwnt00ls_1s_th3_0nly_w4y_t0_b34t_th3_hum4n_l1m1t}

Reference solver

The reference solver supplied with the writeup:

from pwn import *

p = remote('localhost', 7003)

for _ in range(4):
    p.recvline()
p.recvline()
captcha = p.recvline().decode().strip()
p.sendline(captcha[::-1].encode())

p.interactive()

Flag

Securinets_fst{pwnt00ls_1s_th3_0nly_w4y_t0_b34t_th3_hum4n_l1m1t}