NahamCTF22 on Hegzploit

Babiersteps

me (AT) this domain (Yusuf Hegazy) — Sun, 01 May 2022 00:00:00 +0000

Checksec

Canary : ✘
NX : ✓
PIE : ✘
Fortify : ✘
RelRO : Full

We only care about the stack canary as we will be overflowing RIP to control execution flow, and thankfully It’s disabled.

Exploitation

1. RIP Control

We overflow the binary with a cyclic pattern, however, for this being a 64-bit binary we can’t overflow RIP with a non-canonical address.

An address is said to be canonical in the 64-bit world when the upper 16 bits are copies of the 48th bit.

The easiest way to find the RIP offset without overflowing RIP is by breaking at the ret instruction and searching for our pattern in rsp.

Babysteps

me (AT) this domain (Yusuf Hegazy) — Sun, 01 May 2022 00:00:00 +0000

Checksec

It’s an aboslute mess, nothing is turned on fortunately :)

Canary : ✘
NX : ✘
PIE : ✘
Fortify : ✘
RelRO : Partial

Exploitation

1. EIP Control

We obtain our offset very easily in GEF.

2. Exploitation

We start by analyzing the stack at the overflown state.

Looking at the registers, It appears that only two registers point to our stack. eax and esp.

We search for gadgets jumping to any of these registers.

Detour

me (AT) this domain (Yusuf Hegazy) — Sun, 01 May 2022 00:00:00 +0000

Checksec

Canary : ✓
NX : ✓
PIE : ✘
Fortify : ✘
RelRO : ✘

RelRO is completely disabled unlike any other challenge we have encountered, this means that we have write permessions to all the relocations.

Exploitation

Running the binary will let us specify an address and a value and then It will assign that value to the adderss we provided.

hegz@pop-os$ ./detour
What: 1234
Where: 123123123213
Segmentation fault (core dumped)

I confirmed this by analyzing the binary in ghidra, below is the decompilation.

Dweeno

me (AT) this domain (Yusuf Hegazy) — Sun, 01 May 2022 00:00:00 +0000

Serial Output

Wiring Diagram

Arduino Code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


char * flag = "REDACTED";
String curr, first, second;
int in1=29, in2=27, in3=25, in4=23;
int out1=53, out2=51, out3=49, out4=47;
int i;

String get_output(String bits) {
 String output;
 digitalWrite(out1, ((bits[0] == '1')? HIGH : LOW));
 digitalWrite(out2, ((bits[1] == '1')? HIGH : LOW));
 digitalWrite(out3, ((bits[2] == '1')? HIGH : LOW));
 digitalWrite(out4, ((bits[3] == '1')? HIGH : LOW));
 delay(1000);
 output += String(digitalRead(in1));
 output += String(digitalRead(in2));
 output += String(digitalRead(in3));
 output += String(digitalRead(in4));
 return output;
}

//converts a given number into binary
String binary(int number) {
 String r;
 while(number!=0) {
 r = (number % 2 == 0 ? "0" : "1")+r;
 number /= 2;
 }
 while ((int) r.length() < 8) {
 r = "0"+r;
 }
 return r;
}

void setup() {
 i = 0;
 pinMode(out1, OUTPUT);
 pinMode(out2, OUTPUT);
 pinMode(out3, OUTPUT);
 pinMode(out4, OUTPUT);
 pinMode(in1, INPUT);
 pinMode(in2, INPUT);
 pinMode(in3, INPUT);
 pinMode(in4, INPUT);
 Serial.begin(9600);
}

void loop() {
 if (i < strlen(flag)) {
 curr = binary(flag[i]);
 first = curr.substring(0,4);
 second = curr.substring(4,8);
 Serial.print(get_output(first));
 Serial.println(get_output(second));
 delay(1000);
 i++;
 }
}

Looking at the code we can break it down into a couple of steps: