Skip to content

Latest commit

 

History

History
47 lines (34 loc) · 1.57 KB

README_part3.md

File metadata and controls

47 lines (34 loc) · 1.57 KB

Flag Market 3

Buffer Overflow leads to RCE

Description:

Thank you for purchasing the last flag, they are currently sold out now!
Wait, what do you mean?
I...I definitely not hiding another flag...

Tag: pwn!

Solves: 0/584

Vulnerability

In flag_market.c card_status() function (line 84), it failed to provide atrBuf's size to atrLen as parameter. Thus, we can forge APDU to read more than MAX_ATR_SIZE and hijack control flow.

Information Leak

Note that the server fork a new process for each connection, so all the information can be leaked using different connections.

  • Canary
    • Brute-force each byte (8 * 256 times)
      • Success: received 200 OK
      • Failed: received 500 Internal Server Error
  • Code address
    • After we have the canary, we can overwrite RIP to cleanup() function in line 36.
    • Brute-force each byte (4 * 256 + 16 times)
      • Success: received 500 Internal Server Error
      • Failed: set a timeout
  • Libc address
    • With code address, we can build ROP to leak libc address from GOT
    • There is a self reference pointer in BSS (code + 0x5008), we can modify this value using add [rbp-0x3d], ebx gadget and jump to code + 0x1560, which will send [code+0x5008] value to the socket fd.
  • Current connection socket fd
    • Use Libc address to build ROP and leak connection_sock in bss

Finally, you can perform orw to get flag. My exploit took about 20 minutes to run :(

Writeup