BlogMemesGitHubAbout

SiberSiaga 2023: Password Generator

Generate strong & secure passwords for all your online accounts with our random password generator.

TL;DR

Abuse Format String Vulnerability to leak canary, LIBC and PIE addresses, then ret2libc.

Challenge Overview

This is a continuation of Backdoor or Frontdoor? challenge from the qualifier round. Similarly, running the binary prompts the user for a name, which is echoed back to us. Then, it asks for the password length instead of the actual password.

┌──(kali💀JesusCries)-[~/…/SiberSiaga2023 (Finals)/Pwn/Password Generator/bin]
└─$ ./main
  ,---------------------------,
  |  /---------------------   |
  | |                       | |
  | |     Pwn Challenge     | |
  | |    passwd generator   | |
  | |      SiberSiaga23     | |
  | |                       | |
  | |                       | |
  |  _____________________ /  |
  |___________________________|
  ,---_____     []     _______/------,
 /         /______________           /|
/___________________________________ /  | ___
|                                   |   |    )
|  _ _ _                 [-------]  |   |   (
|  o o o                 [-------]  |  /    _)_
|__________________________________ |/     /  /
/-------------------------------------/|      ( )/
/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/ /
/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/ /
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Enter name : test
Hello Mr/Ms
test
Enter length of the password = 12
        ************
        4+KX$0%ANh:q
        ************

Analysis

Initial Analysis

Preliminary checks on the binary protection shows that NX is enabled, leaving us with a ROP-based attack. Since canary is also in place, we need a READ PRIMITIVE to leak it and overwrite it back in order to keep it intact.

With PIE enabled, the base address for the binary, as well as any ROP Gadgets will be randomized each time we execute it. This can be verified by checking the LIBC import address on different runtime instances.

Static Code Analysis

The binary is susceptible to 2 vulnerabilities:

  1. Format String Vulnerability - In Line 13, printf() is used to print our user-controlled input without a format specifier. Using this, it provides us a READ PRIMITIVE to defeat canary and PIE.

  2. Buffer Overflow - In Line 15, fgets() is used to allocate a large number of characters, exceeding the size of the destination buffer. This is where we can control the EIP and construct a ROP Chain.

Also, note that the canary check is performed at Line 18. Since our canary local_10 is situated just below our buffer local_38, any Buffer Overflow attempt will trigger the binary to terminate immediately.

Exploit

Format String Vulnerability

To leak addresses out from the stack, we can use the %p specifier. We can use this in our advantage to leak all LIBC, PIE and canary addresses at different offset of the stack. However, due to the size limitation of our input, we can only leak so much data before the binary is terminated due to stack smashing.

Fuzzing

Instead of sending consecutive %p in a row, we can fuzz each offset separately with %1$p until %99$p to defeat the size limitation.

Addresses that ends with the same 3 bytes after executing the fuzzing script iteratively are our point of interest. We can determine these addresses by following the general Rule of Thumb:

  1. Offset 3: LIBC address usually starts with 0x7f

  2. Offset 11: Canary address are very random, and usually ends with 00 as it's trailing bytes

  3. Offset 13: PIE address usually starts with 0x5

Calculating Offset

Each time we execute the binary, the address at the 3rd offset that we leak will be different due to ASLR, along with the base address of LIBC, however, the leaked address will always be 0xf80e0 bytes away from the base of LIBC. With the knowledge of this offset value, we have just defeated ASLR!

Proof-of-Concept

As a Proof-of-Concept, we will attempt to rewrite the canary back with the leaked value, then redirect EIP back to the main function, so we get to see the challenge banner for a second time.

Solution

Local

To receive an interactive shell, instead of returning to main, we can construct a ROP chain to perform a ret2libc attack.

Local Solve Script

Remote

Typically for a remote instance, the LIBC version in used will vary based on the setup, which leads to the need of recalculating the offset. As the docker files were provided, we can build the image and extract the LIBC in use.

Now use pwninit to patch the binary, so that it uses the exact LIBC file we carved from the remote instance.

Recalculate the LIBC offset by repeating the steps above. We now have a different offset value.

Run the final solve script.

Remote Solve Script

Flag: sibersiaga{c8db7933bd3abc5f854d5b0139e8e3ccca9f67b8}

PreviousWargames.MY 2023: Pak Mat BurgerNextNahamCON CTF 2023: nahmnahmnahm

Last updated