TUCTF 2018: Shella Easy

Description

Difficulty: easy-ish

Want to be a drive-thru attendant? Well, no one does… But! the best employee receives their very own flag! whatdya say?

nc 52.15.182.55 12345

Solution

The target uses gets to read into a stack buffer which is a straightforward example of a stack buffer overflow. The target also has an executable stack, which means that we can simply write our shellcode in the buffer, then jump to it by overwriting the saved return address. The binary even prints the address of the stack buffer we will overflow before asking us for input so this is pretty much as simple as it gets in terms of exploitation.

The only thing that stands between us and a shell is an additional check that the target is doing. During initialization one of the stack variables is set to 0xcafebabe but before returning from main the target checks if the same variable is 0xdeadbeef. If this check fails, the target calls exit, thus never returning (and never executing our shellcode). To make it succeed, we can just overwrite the variable with the correct value when smashing the stack.

$ python2 exploit.py
[+] Opening connection to 52.15.182.55 on port 12345: Done
[*] Switching to interactive mode
$ ls
chal
flag
$ cat flag
TUCTF{1_607_4_fl46_bu7_n0_fr135}
$
[*] Closed connection to 52.15.182.55 port 12345