zacheller@home:~/blog$ - fd


Mommy! what is a file descriptor in Linux? ssh -p2222 (pw:guest)


We are given 3 files: fd, fd.c, and flag. We cannot open flag, but can read fd.c and run the executable.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
                printf("pass argv[1] a number\n");
                return 0;
        int fd = atoi( argv[1] ) - 0x1234;
        int len = 0;
        len = read(fd, buf, 32);
        if(!strcmp("LETMEWIN\n", buf)){
                printf("good job :)\n");
                system("/bin/cat flag");
        printf("learn about Linux file IO\n");
        return 0;


We need to pass in a string that will be converted into an integer and subtracted by 0x1234. The difference will be used as a file descriptor to be read from. The easiest to work with would be fd=0, which is for stdin. Then we can submit the string to be compared to LETMEWIN\n by typing LETMEWIN into stdin and pressing enter–which appends \n.

fd@pwnable:~$ echo $((16#1234))
fd@pwnable:~$ echo $((4660 - 16#1234))
fd@pwnable:~$ ./fd 4660
good job :)
{flag censored}