Skip to content
This repository has been archived by the owner on Feb 3, 2025. It is now read-only.

Latest commit

 

History

History
108 lines (71 loc) · 4.77 KB

GettingStarted.md

File metadata and controls

108 lines (71 loc) · 4.77 KB

Getting started

Description

Get ready for the last guided challenge and your first real exploit. It’s time to show your hacking skills.

We are given a .zip containing several files. We are also given a docker container with an IP address.

Files

GettingStarted.zip

Instructions

Let us examine the contents of the zip.

unzip GettingStarted.zip

cd /GettingStarted/challenge

file *

flag.txt: ASCII text

glibc: directory

gs: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter ./glibc/ld-linux-x86-64.so.2, BuildID[sha1]=505eb225ba13a677aa5f00d5e3d840f63237871f, for GNU/Linux 3.2.0, not stripped

wrapper.py: Python script, ASCII text executable

flag.txt file contains a test flag; this is not the flag needed to solve the challenge.

glibc is a directory contains some libc files that help the gs binary run.

gs is a 64-bit ELF executable that is not stripped. We will come back to this file in a minute.

wrapper.py file is a python script. This will help later, with the docker container.

Running gs

Running gs ./gs will show a stack frame layout. This layout includes labels for various parts of the buffer, including the address value that we are meant to override 0x00000000deadbeef

We are instructed to fill and overwrite the 32-byte buffer of gs and are given an example of using the characters A and B.

There are a few ways we could approach filling the buffer. The simplest is to use the prompt provided >> in gs, and enter varying amount of A's, B's, etc. through trial and error, opening the file each time it isn't long enough.

A faster alternative is to use a command when launching the file (credit: siunam321)

python3 -c "print('A' * 32 + 'B' * 8)" | ./gs

After performing the stack buffer overflow against gs you will see the test flag HTB{f4k3_fl4g_4_t35t1ng}. The test flag serves as an indicator that our stack buffer overflow is long enough.

With this new information, it is now time to modify wrapper.py

Modifying wrapper.py

After opening wrapper.py in your text editor, you will see instructions to install pwntools, if you have not done so already. You will also want to make sure that you are using python3 to run wrapper.

  • On line 12 change 0.0.0.0 to the docker IP address
  • On line 13 change 1337 to the docker port
  • On line 18 change the code
    • From payload = b'A' * 10
    • To payload = b'A' * 32 + b'B' * 8

When completed, run python3 ./wrapper.py

Flag

After modifying wrapper.py and running it you will receive flag HTB{b0f_s33m5_3z_r1ght?}

Issues encountered

It is possible to see the test flag HTB{f4k3_fl4g_4_t35t1ng} and also see "You failed!" if the stack buffer overflow used is over 40 bytes.

Technically only the "correct" amount of 32 A's and 8 B's should be used, but you could use 41 or more, and still get confirmation with the test flag in gs.

Lessons learned

Basics of Stack Buffer Overflow

References

In no particular order