[PWN] [RITSIC-CTF 2024] gadget_database Challenge ARM64 Exploitation
I decided to go back to a challenge from RITSEC-CTF 2024 called "gadget_database" After months, it was an ROP challenge in ARM64 binary, let's start.
Let's drop the binary into Ghidra to understand what it is doing, "main" function checks the return value from the "answer" function. If it is right we will trigger a branch that is vulnerable to buffer overflow because it takes "0x200" byte and the buf size "32" byte.
now it is an ARM64 binary and we running on Intel Processor so we have to setup the script for debugging using "gdb-mutliarch" and "qemu"
when we run the script with "GDB" argument it will run "qemu-aarch64-static -g 2020 ./gadget_database" to start a listener for gdb and in our "gdb-mutliarch" session we can run command "target remote :2020" to connect, create a breakpoint on the "ret" of "main" using 'b *main+152" when the GDB session start we will need it.
pwntools said that the stack is not executable (that's why I could not solve the challenge during the CTF), but if we check the memory map we will find a wired thing
the above address is the buffer and we control the data on it and what we can see? it is Executable 0_0. i don't know why this happens but i think it is because of the emulation (ARM on Intel) using qemu.
after months I did not forget the challenge and I took another check on it after learning form a friend that he did a simple "ret2shell", so i started again with a new POV and a new target.
so i wanna a gadget that will jump to any of these controlled addresses and add my shellcode to it, and i could do it with the following two gadgets:
- mov x0, x20 ; ldp x19, x20, [sp, #0x10] ; ldp x29, x30, [sp], #0x40 ; ret
- mov x16, x0 ; br x16 ;
and we got these bytes "\xe0\x03\x00\x91\xa8\x1b\x80\xd2\x01\x00\x00\xd4".
now we have to combine these together in a simple script and see the result
and we got it ;-).
Thank you for reading guys.
عَنْ أَبِيْ رُقَيَّةَ تَمِيْم بْنِ أَوْسٍ الدَّارِيِّ رضي الله عنه أَنَّ النبي ﷺ قَالَ:( الدِّيْنُ النَّصِيْحَةُ قُلْنَا: لِمَنْ يَا رَسُولَ اللهِ ؟ قَالَ: للهِ، ولكتابه، ولِرَسُوْلِهِ، وَلأَئِمَّةِ المُسْلِمِيْنَ، وَعَامَّتِهِمْ (رواه مسلم.
References to learn ARM:
- ARM assembly from azeria-labs.
- ARM Dojo from pwn.college
Comments
Post a Comment