25 lines
1.9 KiB
Plaintext
25 lines
1.9 KiB
Plaintext
# Level07
|
|
|
|
Using hexrays, we can decompile the code and see a fascist code.
|
|
Basically it has 2 functions, `store_number()` and `read_number()` that writes or reads data to a 400 bytes buffer directly through the index.
|
|
The issue here is that there's no protection on the write to the buffer (except `index % 3`).
|
|
Since the buffer is on the stack, we could overwrite `eip` and replace it by whatever we want.
|
|
First, we will need to determine `eip`'s offset to the buffer. To achieve this, let's use `gdb`.
|
|
We want to break before a call to `store_number` for example (since it has only one argument, `data` buffer will be in `eax`). We then print both the registers and the stack frame (`info registers` and `info frame`).
|
|
We get the adresses of `eip` and `eax` now let's get the offset. Simply substract both addresses: `0xffffdc3c - 0xffffda74 = 456`.
|
|
So, at data[456] we have `eip`.
|
|
We still have 2 issues with this. The first is that the index we input is multiplied by 4 so we have to input `456/4 = 114`, so the real offset is 114.
|
|
But remember the program prevents us from writing to `index % 3 == 0`.
|
|
If we input a large number (e.g. `1e20`) into `read_number()`, we see that it is truncated to `MAX_UINT`.
|
|
We could probably use this to overflow and still print at index 114.
|
|
Let's find the value to overflow to to get 114:
|
|
`(MAX_UINT + 1) / 4 + 114`
|
|
Which is the overflow value for the input index (write to data[index * 4]) + 114. Once we have that, it's almost done.
|
|
All we have left to do is replace `eip` by a call to `system("/bin/sh")`.
|
|
Using gdb, we find both addresses (refer to level04 for the exact process).
|
|
Here, `system == 0xf7e6aed0` and `"/bin/sh" == 0xf7f897ec`.
|
|
We want to put `0xf7e6aed0` in `eip` and `0xf7f897ec` at `eip + 8` (which is eip's index + 2 in `data` since it's multiplied by 4).
|
|
|
|
Here is the final exploit:
|
|
`(python -c 'print "store\n" + "4159090384\n" "1073741938\n" + "store\n" + "4160264172\n" + "116\n" + "quit\n"'; cat) | ./level07`
|