CSAW18_boi : My First Pwn challenge
This is a Writeup for my first Pwn challenge ‘CSAW18_boi’
we got a binary that we have to consult it to pass the challenge, I start by examining the executable :
it’s a 64 bit ELF executable non stripped and it have some protections
Next i executed the binary :
The program print a message then It asks for an input. i fill it randomly and it terminates by printing the date .
I tried to put a large number of characters and i notice something that the program accepts 24 character exactly and the others are overflowed on the terminal and it did not terminate with a segmentation fault :
Maybe it uses a secure function to read the input like fgets
Next I Loaded the executable on Ghidra to take a look at the decompiler :
Now we are certain ,it used the Function read and the third argument is equal to 24 . so it accepts 24 byte .
Get AkilesTheDark’s stories in your inbox
Join Medium for free to get updates from this writer.
Based on the Decompiled code ,i think we have to spawn “/bin/bash” to solve the challenge , so we have to make the flag_var equals to -0x350c4512 , but if we read it as an unsigned number it give as the ‘Oxcaf3baee’ hexadecimal number
looking close to the variables on the stack we see that the offset Distance between flag_var and input_buffer = 0x38 - 0x24 = 0x14 = 20 bytes.
Also the Read function accepts 24 bytes but input_buffer is a qword so it’s size is only 8 bytes
we can make a buffer overflow to overwrite the value ‘0xcaf3baee’ on flag_var to get the flag .
To exploit this we need to create a payload with 20 random bytes + ‘Oxcaf3baee’ , but because the binary is little-endian we have to reverse the bytes of ‘Oxcaf3baee’ , I used python2 to create a simple payload
As you can see the payload have some special characters so we can’t COPY PASTE it but we can redirect it to a file , than giving the content of the file as a stdin for the program or we can simply pipe it directly
looks like we have solved the challenge but we don’t see the shell , that’s because we have to keep stdin open after sending the payload so we can interact with the shell
The challenge took me more than 3 hours to solve but i learned a lot and i had soo much fun solving it 😁.
