RCTF 2017 供養(Writeup)

RCTF 2017に参加。185ptで176位。

Sign In (Misc 32)

Please join #rctf2017 on Freenode. And the flag is in topic.

Format: RCTF{…}

RCTF{Welcome_To_RCTF_2017}

easyre (Reverse 153)

32 bit ELF実行ファイル。

$ file easy_re
easy_re: ELF 32-bit LSB executable, Intel 80386, version 1, statically linked, corrupted section header size

straceすると別のELF実行ファイルを書き出していることがわかる。

$ strace -i ./easy_re
[00007f29d9c1dbc7] execve("./easy_re", ["./easy_re"], [/* 20 vars */]) = 0
strace: [ Process PID=6426 runs in 32 bit mode. ]
[080482a9] getpid()                     = 6426
[080482f1] open("/proc/6426/exe", O_RDONLY) = 3
[08048314] lseek(3, 1588, SEEK_SET)     = 1588
[08048238] read(3, "w\24\7\0t\35\0\0t\35\0\0", 12) = 12
[08048379] gettimeofday({2057282240221484, 3762246642832666671}, NULL) = 0
[080483ad] unlink("AAAAAAAAAW3PZK1AGI0") = -1 ENOENT (No such file or directory)
[080483d2] open("AAAAAAAAAW3PZK1AGI0", O_WRONLY|O_CREAT|O_EXCL, 0700) = 4
[080483e2] ftruncate(4, 7540)           = 0
[080483f8] mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf776b000
[08048238] read(3, "t\35\0\0\220\n\0\0", 8) = 8
[08048238] read(3, "\177?d\371\177ELF\1\0\2\0\3\0\r@\205\4\377o\263\335\0104\7p\21\27\v \0\10"..., 2704) = 2704
[08048484] write(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\2\0\3\0\1\0\0\0@\205\4\0104\0\0\0"..., 7540) = 7540
[08048238] read(3, "\0\0\0\0UPX!", 8)   = 8
[080484a5] unlink("AAAAAAAAAW3PZK1AGI0") = 0
[080484b1] exit(127)                    = ?
[????????] +++ exited with 127 +++

gdbでunlink直前まで実行して、ファイルを得る。

$ objdump -D -b binary -m i386 easy_re | grep -C3 '4a5:'
     499:       b8 0a 00 00 00          mov    eax,0xa
     49e:       bb 08 96 04 08          mov    ebx,0x8049608
     4a3:       cd 80                   int    0x80
     4a5:       bb 7f 00 00 00          mov    ebx,0x7f
     4aa:       b8 01 00 00 00          mov    eax,0x1
     4af:       cd 80                   int    0x80
     4b1:       eb f2                   jmp    0x4a5

$ gdb ./easy_re
Reading symbols from ./easy_re...(no debugging symbols found)...done.
(gdb) b *0x080484a3
Breakpoint 1 at 0x80484a3
(gdb) r
Starting program: /home/user/tmp/20170521_rctf/easy_re

Breakpoint 1, 0x080484a3 in ?? ()
1: x/i $pc
=> 0x80484a3:   int    0x80
(gdb) quit
A debugging session is active.

        Inferior 1 [process 6485] will be killed.

Quit anyway? (y or n) y

$ ls -al
total 24056
drwxr-xr-x 4 user user     4096 May 21 22:10 ./
drwxr-xr-x 9 user user     4096 May 21 04:25 ../
-rwx------ 1 user user     7540 May 21 22:10 AAAAAAAAA0H0BOBAGKV*

$ file AAAAAAAAA0H0BOBAGKV
AAAAAAAAA0H0BOBAGKV: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.15, BuildID[sha1]=f4ac362f7b89fbd142b55e02d1cc4906d669be44, not stripped

アセンブリコードを読むと、lol関数でflagが出力されていることが推測できる。

$ python ~/tmp/minipwn/objdump.py AAAAAAAAA0H0BOBAGKV
(snip)
080485f4 <lol>:
sub_80485f4:
 80485f4:       55                      push   ebp
 80485f5:       89 e5                   mov    ebp,esp
 ...
 80486b0:       c7 45 f4 00 00 00 00    mov    DWORD PTR [ebp-0xc],0x0
 80486b7:       83 7d f4 01             cmp    DWORD PTR [ebp-0xc],0x1
 80486bb:       75 16                   jne    80486d3 <lol+0xdf>
 80486bd:       b8 c0 88 04 08          mov    eax,0x80488c0                    ; '%s'
 80486c2:       8d 55 ed                lea    edx,[ebp-0x13]
 80486c5:       89 54 24 04             mov    DWORD PTR [esp+0x4],edx
 80486c9:       89 04 24                mov    DWORD PTR [esp],eax
 80486cc:       e8 ff fd ff ff          call   80484d0 <printf@plt>
 80486d1:       eb 0d                   jmp    80486e0 <lol+0xec>
loc_80486d3:
 80486d3:       b8 c3 88 04 08          mov    eax,0x80488c3                    ; 'flag_is_not_here'
 80486d8:       89 04 24                mov    DWORD PTR [esp],eax
 80486db:       e8 f0 fd ff ff          call   80484d0 <printf@plt>
loc_80486e0:
 80486e0:       c9                      leave
 80486e1:       c3                      ret
(snip)
loc_80487bc:
 80487bc:       b8 24 89 04 08          mov    eax,0x8048924                    ; '\nYou got the key\n '
 80487c1:       89 04 24                mov    DWORD PTR [esp],eax
 80487c4:       e8 07 fd ff ff          call   80484d0 <printf@plt>
 80487c9:       8d 44 24 2e             lea    eax,[esp+0x2e]
 80487cd:       89 04 24                mov    DWORD PTR [esp],eax
 80487d0:       e8 1f fe ff ff          call   80485f4 <lol>
(snip)

gdblol関数を実行し、最後の分岐の直前で止め、分岐の片方で出力される文字列を得る。

$ gdb ./AAAAAAAAA0H0BOBAGKV
Reading symbols from ./AAAAAAAAA0H0BOBAGKV...(no debugging symbols found)...done.
(gdb) set follow-fork-mode parent
(gdb) b *0x80486bb
Breakpoint 1 at 0x80486bb
(gdb) r
Starting program: /tmp/AAAAAAAAA0H0BOBAGKV

OMG!!!! I forgot kid's id
Ready to exit
^C
Program received signal SIGINT, Interrupt.
0xf7fd8be9 in __kernel_vsyscall ()
1: x/i $pc
=> 0xf7fd8be9 <__kernel_vsyscall+9>:    pop    ebp
(gdb) shell
$ ps auxf | grep AAAA
user      6666  0.5  0.9  63772 20072 pts/0    S    22:20   0:00  |           \_ gdb -q -nh -x /home/user/.gdbinit ./AAAAAAAAA0H0BOBAGKV
user      6668  0.0  0.0   2192   612 pts/0    t    22:20   0:00  |               \_ /tmp/AAAAAAAAA0H0BOBAGKV
user      6672  0.0  0.0      0     0 pts/0    Z    22:20   0:00  |               |   \_ [AAAAAAAAA0H0BOB] <defunct>
user      6684  0.0  0.0  11284   900 pts/0    S+   22:20   0:00  |                       \_ grep --color=auto AAAA

$ exit
(gdb) c
Continuing.
6672

You got the key

Breakpoint 1, 0x080486bb in lol ()
1: x/i $pc
=> 0x80486bb <lol+199>: jne    0x80486d3 <lol+223>
(gdb) x/s $ebp-0x13
0xffffdb45:     "rhelheg"
(gdb) quit
A debugging session is active.

        Inferior 1 [process 6668] will be killed.

Quit anyway? (y or n) y

これがフラグだった。

RCTF{rhelheg}

所感

低得点問題1問しか解けず厳しい。他に解きたかった問題は以下。

  • intoU (Misc 82)
  • RSA_sign1 (Crypto 307)
  • baby flash (Reverse 222)
  • Recho (Pwn 370)

関連リンク