I started by analyzing the binary using Ghidra to reverse engineer the func() function, where I identified a buffer overflow vulnerability in the use of the gets() function. The gets() function allows unbounded input, creating the potential for a buffer overflow. By overflowing the local buffer local_3c (52 bytes in size), we can overwrite the return address.
The buffer is 52 bytes long. After the buffer comes the saved frame pointer (4 bytes) and then the return address (4 bytes). We need to overflow the buffer, overwrite the saved frame pointer, and then control the return address or the param_1 value.
To overwrite param_1, we need to send 52 + 4 = 56 bytes of junk followed by the value 0xcafebabe which execute system(“/bin/sh”)
I used gdb to find and print address of func() (0x68d) and added this in payload that helps to call the func() function.
Then, I used dummy return address that tells after completing the func() function where control flow should go. After that I add the parameter (0xcafebabe) to payload.
Finally, sending the payload to the binary and it trigger the vulnerability and it successfully gaining a shell which help to get flag.
Task2: ROP Chain
I used Ghidra to understand the binary’s code flow and went to the main function and see condition that stopping to debugger. Before printf Call instruction, there is JNZ instruction. So when I changed it to JZ. It inverts the logic what is in the IF now is in the else and viceversa.
I used command (readelf -S ./target | grep ‘.data\|.bss\|.got’) to find writeable sections of the binary. .data section located at 0x0804c060 with a size of 0xC0. This is writable sections.
I use command (strace -c ./target_3) to print the recorded system calls
Syscalls Used:
• open(): The open() syscall was used to open the privileged file.
• read() (again): Used to read the contents of the privileged file into a buffer.
• write(): Finally, the write() syscall was used to output the contents of the privileged file to stdout.
List of gadgets use for ROP chain:
1. pop eax; ret — Address: 0x0804896d
• This gadget will allow you to control the value of the eax register, which is important for setting up system calls.
2. pop ebx; ret — Address: 0x08048575
• This gadget allows you to control the ebx register, which is used for the first argument in system calls (such as the filename for open).
3. pop ecx; pop edx; ret — Address: 0x08048974
• This gadget lets you control both ecx and edx, which are the second and third arguments for many system calls (e.g., open, read, write).
4. int 0x80; ret — Address: 0x0804897b
• This gadget trigger a system call.
Then, I use python script to get the crash_address (0x6161616c) and to find offset value.
I setup python exploit file with ROP gadgets and syscall value of open, read and write. But unable to exploit the vulnerability.
Task 3: Use-After-Free
By analyzing the code in Ghidra, The binary allocates memory using malloc() in the check function. Then the memory is cleared using memset(). The memory is freed with free() int the reset function. However, after the memory is freed, the pointer auth is not set to NULL. This creates a dangling pointer, which is a UseAfter-Free vulnerability.
The login function checks the value at auth + 0x20. If it’s non-zero, it prints a success message and calls the win() function.
Therefore, I simply provide payload with non-zero and send login to trigger the Use-After-Free. So it successfully gaining the shell and able to get the flag.
