Sharif CTF Quals 2013 - Exploiting 200 - sweet

Task:

nc ctf.sharif.edu 15478

Download

This service accepts our input and echoes it using variant of printf function. As you might have already understood there will be a format string vulnerability.

Format String vulnerability exploiting - General algorithm

I would like to sum up the format section tasks with some general algorithm that is probably will be good to solve easy tasks for this kind of vulnerability. You can try to apply this algorithm if you are sure that application has a format string vulnerability.

Exploit exercises - Protostar - Format 4

Last level of the format section was more interesting. It supposed you to change code execution sequence. Immediately after printf is called there is a call to exit() function. But in order to reuse code in memory there is a PLT(procedure linkage table) that redirects execution to the place according the address of the specified function in GOT (Global Offset Table). Since .plt section in or binary is read-only and jump is made after address dereference we have to change a value that this address references to our value. This article contains very detailed description of PLT, GOT, PIC(Position Independent Code).

Exploit exercises - Protostar - Format 3

Format 3 was quite easy after the way I've tried to solve Format 0 :) . Third task in format section required to write four bytes into specific location in memory.

Exploit exercises - Protostar - Format 2

Format 2 was quite easy, even easier than format 1 for me. All you need is to write appropriate byte to the target address.

Exploit exercises - Protostar - Format 1

Format1 task differs from format0 task in a way where target variable is located. In this case target is located in .bss segment.