search
Blog

Blast From The Past

Ret2Shellcode + push rsp gadget

hashtag
Analysis

We are given a binary and the source challenge.c where we can spot a buffer overflow in scanf 

#include <stdio.h>
#include <string.h>

void ignore_me() {
        setbuf(stdin, 0);
        setbuf(stdout, 0);
}

void pew_pew_90s() {
    printf("🔫 *pew pew* Retro laser gun fires! But it's still just a cat toy from the 90s...\n");
}

int main() {

        ignore_me();

    char retro_cat[32];
        int ver = 50004;
    
    printf("🕹  BLAST TO THE PAST - Cyber Cat Defense %d! 🐱💾\n", ver);
    printf("Enter your retro cyber-cat's name, dude: ");
    // Takes in 320 character to a 32 byte buffer
    scanf("%320s", retro_cat);
    
    printf("Radical! %s is locked and loaded with a sweet laser gun!\n", retro_cat);
    pew_pew_90s();
    
    return 0;
}

Using pwndbg's cyclic, we can easily determine the offset to gain control of our instruction pointer (RIP), which is 56.

As the challenge description suggests, no protections exist for this binary, allow executable stack which can be verified with checksec. This allows us to execute code or instructions on the stack, allowing us to perform ret2shellcodearrow-up-right

We can just search for any x64 linux shellcode onlinearrow-up-right or opt to use pwntool's shellcraft function.

However, we need to somehow redirect execution to the start of our shellcode which is where the RSP register comes in.

RSP points to the top of your stack and by using a gadget like push rsp; ret, it pushes RSP's current value onto the stack before redirecting execution flow through ret.

So putting all the pieces together we need to:

  1. Buffer Overflow till we gain control over RIP

  2. Execute the gadget push rsp; ret to redirect execution to our shellcode which is placed after the gadget on the stack

  3. Shellcode execution happens because ret jumps to the address that was pushed (the old RSP value)

You can see this using pwndbg and setting a breakpoint at the end of main

chevron-rightpwndbg debugginghashtag

With that we get the flag!

chevron-rightSolve Scripthashtag
PreviousGreyhats Welcome CTF 25NextEchoCrash

Last updated