Rating: 4.0
## CHALLENGE DESCRIPTION
*Static Analysis*
* Using the commands `file chall && checksec chall && rabin2 -z chall && rabin2 -i chall`. The binary file has no protections and it is a 64-bit binary file.
* There are various imports in the binary including `gets` and therefore this definately leads to a buffer overflow.
* Since there is no `nx` therefore we can store shellcode in memory and execute the shellcode getting a shell.
*Dynamic Anaylsis*
- Using a debugger the binary is a small binary and uses gets to get input therefore definately a buffer overflow. The offset to the saved `rip` registers is @ 24
- Therefore we will store the shellcode @ `elf.sym.bomb` this is where out first input goes and return there to execute our shellcode
*Seccomp*
* There are some seccomp-filters in the binary that only allow the use of `open, read && write`. Therefore our shellcode should only contain the read and write
and open syscall.
* Therefore this means we:
* open("flag.txt", 0, 0)
* read(rax, rsp, 0x100) : The value of rax this is the value returned by open that is the `fd` of the opened file.
: The value of `rsp` that will be our buffer and this is the region where we copy the contents of the file.
* write(1, rsp, rax): The value of `rax` this is returned by `read` and this is the number of bytes read from the opened file.
* These filters can be seen using the command `seccomp-tools dump ./chall`
```
line CODE JT JF K
=================================
0000: 0x20 0x00 0x00 0x00000004 A = arch
0001: 0x15 0x00 0x09 0xc000003e if (A != ARCH_X86_64) goto 0011
0002: 0x20 0x00 0x00 0x00000000 A = sys_number
0003: 0x35 0x00 0x01 0x40000000 if (A < 0x40000000) goto 0005
0004: 0x15 0x00 0x06 0xffffffff if (A != 0xffffffff) goto 0011
0005: 0x15 0x04 0x00 0x00000000 if (A == read) goto 0010
0006: 0x15 0x03 0x00 0x00000001 if (A == write) goto 0010
0007: 0x15 0x02 0x00 0x00000002 if (A == open) goto 0010
0008: 0x15 0x01 0x00 0x0000003c if (A == exit) goto 0010
0009: 0x15 0x00 0x01 0x000000e7 if (A != exit_group) goto 0011
0010: 0x06 0x00 0x00 0x7fff0000 return ALLOW
0011: 0x06 0x00 0x00 0x00000000 return KILL
```
- There using pwntools shellcraft we can generate our shellcode and that can be used to read the flag.
- Therefore the final exploit code [exploit.py](exploit.py)
