Task 4: A bit more advanced ROP implementation

You have the option to do the pre-defined task below or suggest another task you would like to do. Something interesting in shellcoding that we have not covered yet? Feel free to implement it and show us what you came up with. It does not necessarily have to be related to ROP, although in most cases it probably will be. Your task has to be approved by the assistant before you can start working on it.

Defeating ASLR (kinda): pre-defined task

As the name implies, ASLR (Address Space Layout Randomization) randomizes the virtual memory locations at which modules are loaded.

In this task, the executable is compiled with Position Independent Executable (PIE) disabled, so ASLR does not affect this executable. However, you cannot hardcode, for example, libc function addresses into the exploit, because ASLR still randomizes the libraries.

Before you start working on this task, confirm that ASLR is enabled:

$ cat /proc/sys/kernel/randomize_va_space
2

If not, enable ASLR:

$ echo 2 | sudo tee /proc/sys/kernel/randomize_va_space
2

Your objective is to:

1. Find the buffer overflow vulnerability
2. Figure out how it could be used to read memory. Hints:
   1. Does the executable import functions that can print strings (or memory) to stdout?
3. Use that to disclose imported libc function addresses. Hints:
   1. Check out .got.plt.
   2. Remember to enter the main loop again after every read (ret back to the loop start)
      • Be careful that you ret to the correct place, otherwise a segfault is likely.
4. Find the libc version and base address using that information. Hints:
   • Use a libc database, such as https://libc.rip/ or the libc-database tool
5. Compute the address of your desired libc function (or gadget) using that information
6. Create a ROP chain that opens a local shell using, e.g., system or execve

See task4.c for the source code of the vulnerable program. The 32-bit binary is in prog_bins/. The binary was compiled with:

gcc task.c -m32 -no-pie -o task4

I recommend that you develop your exploit as a pwntools script, similar to the one below. This one debugs the program with gdb and sets breakpoints at main and 0x8049246. In gdb, assembly can be viewed using layout asm and the stack can be printed using x/20xw $esp. Similarly, x/20xw $ebp prints the current stack frame. See GDB documentation.

#!/usr/bin/python3
import pwn
import pwnlib.util.packing as packing
import struct

pwn.context.terminal = ['/usr/bin/x-terminal-emulator', '-e']
pwn.context.log_level = 'debug'

io = pwn.pwnlib.gdb.debug('./program', '''
break main
break *0x8049246
''')

# put your exploit here

io.interactive()