DEFCON Writeup incest

sis.c

int main(int argc, char *argv[]) {
    int p;
    int netfd;
    int filefd;

    signal(SIGALRM, quitter);
    alarm(0x0F);

    netfd = atoi(argv[2]);
    filefd = atoi(argv[1]);

    p = fork;
    if (p == 0) {
        int flag = 0;
        int *buf;
        void (*code)(void);
        struct stat stat_buf;
        char *flagdata;

        close(filefd);

        buf = mmap(0, 0x1000, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON | MAP_CONTIG, -1, 0);
        recv(netfd, buf, 0x200, 0);
        code = buf;

        if (flag == -1) perror("PTFAIL");
        code();
    }

    close(netfd);
    fstat(filefd, &stat_buf);

    flagdata = calloc(1, stat_buf.st_blksize);
    read(filefd, flagdata,stat_buf.st_blksize);

    printf("Got flagdata: %s\n", flagdata);

    while (1) {
        sched_yield();
    }
}