Writeups on Hegzploit

Babiersteps

me (AT) this domain (Yusuf Hegazy) — Sun, 01 May 2022 00:00:00 +0000

Checksec

Canary : ✘
NX : ✓
PIE : ✘
Fortify : ✘
RelRO : Full

We only care about the stack canary as we will be overflowing RIP to control execution flow, and thankfully It’s disabled.

Exploitation

1. RIP Control

We overflow the binary with a cyclic pattern, however, for this being a 64-bit binary we can’t overflow RIP with a non-canonical address.

An address is said to be canonical in the 64-bit world when the upper 16 bits are copies of the 48th bit.

The easiest way to find the RIP offset without overflowing RIP is by breaking at the ret instruction and searching for our pattern in rsp.

Babysteps

me (AT) this domain (Yusuf Hegazy) — Sun, 01 May 2022 00:00:00 +0000

Checksec

It’s an aboslute mess, nothing is turned on fortunately :)

Canary : ✘
NX : ✘
PIE : ✘
Fortify : ✘
RelRO : Partial

Exploitation

1. EIP Control

We obtain our offset very easily in GEF.

2. Exploitation

We start by analyzing the stack at the overflown state.

Looking at the registers, It appears that only two registers point to our stack. eax and esp.

We search for gadgets jumping to any of these registers.

Detour

me (AT) this domain (Yusuf Hegazy) — Sun, 01 May 2022 00:00:00 +0000

Checksec

Canary : ✓
NX : ✓
PIE : ✘
Fortify : ✘
RelRO : ✘

RelRO is completely disabled unlike any other challenge we have encountered, this means that we have write permessions to all the relocations.

Exploitation

Running the binary will let us specify an address and a value and then It will assign that value to the adderss we provided.

hegz@pop-os$ ./detour
What: 1234
Where: 123123123213
Segmentation fault (core dumped)

I confirmed this by analyzing the binary in ghidra, below is the decompilation.

Dweeno

me (AT) this domain (Yusuf Hegazy) — Sun, 01 May 2022 00:00:00 +0000

Serial Output

Wiring Diagram

Arduino Code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


char * flag = "REDACTED";
String curr, first, second;
int in1=29, in2=27, in3=25, in4=23;
int out1=53, out2=51, out3=49, out4=47;
int i;

String get_output(String bits) {
 String output;
 digitalWrite(out1, ((bits[0] == '1')? HIGH : LOW));
 digitalWrite(out2, ((bits[1] == '1')? HIGH : LOW));
 digitalWrite(out3, ((bits[2] == '1')? HIGH : LOW));
 digitalWrite(out4, ((bits[3] == '1')? HIGH : LOW));
 delay(1000);
 output += String(digitalRead(in1));
 output += String(digitalRead(in2));
 output += String(digitalRead(in3));
 output += String(digitalRead(in4));
 return output;
}

//converts a given number into binary
String binary(int number) {
 String r;
 while(number!=0) {
 r = (number % 2 == 0 ? "0" : "1")+r;
 number /= 2;
 }
 while ((int) r.length() < 8) {
 r = "0"+r;
 }
 return r;
}

void setup() {
 i = 0;
 pinMode(out1, OUTPUT);
 pinMode(out2, OUTPUT);
 pinMode(out3, OUTPUT);
 pinMode(out4, OUTPUT);
 pinMode(in1, INPUT);
 pinMode(in2, INPUT);
 pinMode(in3, INPUT);
 pinMode(in4, INPUT);
 Serial.begin(9600);
}

void loop() {
 if (i < strlen(flag)) {
 curr = binary(flag[i]);
 first = curr.substring(0,4);
 second = curr.substring(4,8);
 Serial.print(get_output(first));
 Serial.println(get_output(second));
 delay(1000);
 i++;
 }
}

Looking at the code we can break it down into a couple of steps:

Leaky Pipe - 0xL4ugh CTF

me (AT) this domain (Yusuf Hegazy) — Sun, 17 Jan 2021 19:07:42 +0200

In this challenge we recieved a binary in which we are asked to exploit and somehow retrieve the flag.
you can find the binary for this challenge here

Initial Analysis

We start by running the binary and checking it behavior.

./leaky_pipe
We have just fixed the plumbing systm, let's hope there's no leaks!
>.> aaaaah shiiit wtf is dat address doin here... 0x7ffde7760410
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA <--- our input
Segmentation fault (core dumped)

And as we see, we can already get a segfault by spamming some A’s in the input.

Trigger Happy - 0xL4ugh CTF

me (AT) this domain (Yusuf Hegazy) — Sat, 16 Jan 2021 16:33:49 +0200

It was the first ever pwn challenge I solve in a CTF and I really liked it hence I wanted to bring it to this CTF (you can even check my poorly written writeup for that challenge which I refuse to remove as It’s pretty awesome to look back and see how much did we grow).

You can check my video on format string vulnerabilies as a refresher for these types of attacks (It’s in arabic tho).

Not Really AI - RA CTF

me (AT) this domain (Yusuf Hegazy) — Mon, 08 Jun 2020 07:22:58 +0000

Misusage of the libc printf() function can lead to serious information leakage and even code execution.
when we pass one argument (for example printf(foo)) we can:
- leak stack addresses using %x or %p format specifiers.
- overwrite any pointer’s value using %n specifier (note that we can’t overwrite plain stack addresses as the %n format specifier can only overwrite by reference and not by value)

For more information on format strings please check this awesome resource