[PWN] DeadsecCTF 2024 - User Management Challenge

 ( بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ )

(إن أحسنت فمن الله، وإن أسأت فمن نفسي والشيطان)

User Management

it is a format string challenge, let's start it.

First, our menu contains the following

after reversing the binary with Ghidra and trying the options we know that there is a Format String in the view description and we can hit it when we create a new user and login with it but to create a user we have to login as admin first and the admin password is random :-).

with some static/dynamic analysis, we know that there something weird with the admin login function

it reads 21 bytes and it just needs 12 ;-) so we have a trigger here if we check the address (DAT_555555559340) it is close to the address of the password on (DAT_555555559350) and we have an overflow on the first address so we can overwrite the password.

When we overwrite the password with the following payload we will get the "strncmp" check for the username and we can get it

after logging in with admin we can hit the Format String vulnerability, but we have a forbidden char "$" so we can not use it in our payload.

Let's leak the needed addresses and calcualte the offset and the offset is 6 as we can see in the following screenshot.

so now we can overwrite the RIP using the format string and control it to do what we want ;-), the following is the failed ROP chain.

I tried to do an ROP chain but did not work (the length of payload), but the one gadget works with me because we have the libc file, the first one works with me.

the following is the payload that I used to write into the RIP, I used the option "no_dollars" in pwntools (note that if you are learning and new to this try to do it manually and when you understand it use the automation to make it easy for CTFs).

and we got our shell.

solve script,

Thank you for reading this ;-)

عن تميم بن أوس رضي الله عنه ، أن النبي صلى الله عليه وسلم قال : ( الدين النصيحة ، قلنا : لمن يا رسول الله ؟ قال : لله ، ولكتابه ، ولرسوله ، ولأئمة المسلمين وعامتهم ) رواه البخاري ومسلم .