---
# System prepended metadata

title: Balsn CTF 2019 - SecureCheck
tags: [CTF]

---

---
title: Balsn CTF 2019 - SecureCheck
description: Misc, Pwn
tags: CTF
lang: zh_tw
---

# Balsn CTF 2019 - SecureCheck
[TOC]

## Description
There is a Linux ELF file

main:
![](https://i.imgur.com/r2bChEz.png)

install_syscall_filter:
![](https://i.imgur.com/g2iDFgw.png)

## install_syscall_filter()
It is a function that load a series of rules.
Use [tool](https://github.com/david942j/seccomp-tools) to dump those rules

![](https://i.imgur.com/Camvpr8.png)

Only allow syscall `exit` `exit_group`

## What this program do
This program will receive input first then fork a new process, and this new process will execute the input.
If child process return zero, parent process will also execute the input.
The child process can only execute syscall `exit` `exit_group`.

## Exploit
![](https://i.imgur.com/dFDaT8t.jpg)
Play with x86 command rdrand.
In gdb, you can use `show follow-fork-mode` to check when gdb encounter a fork, which process (child or parent) does the gdb will attach.
In this screenshot, this gdb attaches to child process, and you can see RBX value in child process.

Let's attach to parent process!

![](https://i.imgur.com/kUM0hyk.jpg)
In the left side of screenshot is our parent process, it's waiting.

Let child process call exit(0).

![](https://i.imgur.com/AjiLq6F.jpg)

![](https://i.imgur.com/yBg7AYa.jpg)
Ok, parent will execute the same shellcode.

![](https://i.imgur.com/r1vCF1C.jpg)
See RBX, it's different to child's RBX.

We can use this feature to distinguish child & parent, let child & parent execute different shellcode.

But the rdrand generates different random number each time, this exploit needs some luck to sucess.

See [exploit.py](https://github.com/LJP-TW/CTF/blob/master/BalsnCTF-2019/misc/SecureCheck/release/exploit.py)

## Reference
- [seccomp detail 1](https://veritas501.space/2018/05/05/seccomp%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/)
- [seccomp detail 2](https://blog.betamao.me/2019/01/23/Linux%E6%B2%99%E7%AE%B1%E4%B9%8Bseccomp/)
- [seccomp detail 3](https://szlin.me/2017/08/23/kernel_seccomp/)
- [rdrand](https://www.felixcloutier.com/x86/rdrand)
- [Github 10secTW writeup](https://github.com/10secTW/ctf-writeup/tree/master/2019/balsn%20CTF/SecureCheck)