Challenge Description

File type

Binary Protection

Background

• silver_bullet gives us operations to interact with Silver Bullet and Werewolf. Power of a Silver Bullet is based on the length of user's input string.

• The program manages all information about Silver Bullet and Werewolf through local variables. Maximum power of Silver Bullet is 48:

• These are 3 following important operations of the program:

  • Create a Silver Bullet:
  c COPY

  1	int __cdecl create_bullet(int silverBullet)
  2	{
  3	int powerBullet; // [esp+0h] [ebp-4h]
  4
  5	if ( *(_BYTE *)silverBullet )
  6	return puts("You have been created the Bullet !");
  7	printf("Give me your description of bullet :");
  8	read_input(silverBullet, 48);
  9	powerBullet = strlen(silverBullet);
  10	printf("Your power is : %u\n", powerBullet);
  11	*(_DWORD *)(silverBullet + 48) = powerBullet;
  12	return puts("Good luck !!");
  13	}

  • Power up Silver Bullet:
  c COPY

  1	int __cdecl power_up(int silverBullet)
  2	{
  3	char addedBullet[48]; // [esp+0h] [ebp-34h] BYREF
  4	int addedPower; // [esp+30h] [ebp-4h]
  5
  6	addedPower = 0;
  7	memset(addedBullet, 0, sizeof(addedBullet));
  8	if ( !*(_BYTE *)silverBullet )
  9	return puts("You need create the bullet first !");
  10	if ( *(_DWORD *)(silverBullet + 48) > 47u )
  11	return puts("You can't power up any more !");
  12	printf("Give me your another description of bullet :");
  13	read_input((int)addedBullet, 48 - *(_DWORD *)(silverBullet + 48));
  14	strncat(silverBullet, (int)addedBullet, 48 - *(_DWORD *)(silverBullet + 48));
  15	addedPower = strlen(addedBullet) + *(_DWORD *)(silverBullet + 48);
  16	printf("Your new power is : %u\n", addedPower);
  17	*(_DWORD *)(silverBullet + 48) = addedPower;
  18	return puts("Enjoy it !");
  19	}

  • Beat the Werewolf:
  c COPY

  1	int __cdecl beat(int bullets, int werewolf)
  2	{
  3	if ( *(_BYTE *)bullets )
  4	{
  5	puts(">----------- Werewolf -----------<");
  6	printf(" + NAME : %s\n", *(const char **)(werewolf + 4));
  7	printf(" + HP : %d\n", *(_DWORD *)werewolf);
  8	puts(">--------------------------------<");
  9	puts("Try to beat it .....");
  10	usleep(1000000);
  11	*(_DWORD *)werewolf -= *(_DWORD *)(bullets + 48);
  12	if ( *(int *)werewolf <= 0 )
  13	{
  14	puts("Oh ! You win !!");
  15	return 1;
  16	}
  17	else
  18	{
  19	puts("Sorry ... It still alive !!");
  20	return 0;
  21	}
  22	}
  23	else
  24	{
  25	puts("You need create the bullet first !");
  26	return 0;
  27	}
  28	}

Vulnerability

• If we first create a Silver Bullet with length n, and then power it up by 48 - n; the program will show us that the power of our bullet is 48 - n instead 48 as we expected.

• Therefore, there must be a vulnerable part of code in power_up() function. After examining it, I saw the problem that after strncat() append all characters from source string to destination string, it will automatically add terminator character at the end of destination string. If we concatenate a 1-long string with destination string (silverBullet) that has the length of 47, a null character will be written into silverBullet + 48. However, that memory address is also used to store the length of silverBullet string and it is updated after strncat() is called:

• It falsifies the actual silverBullet string. Then in next time of powering up, we can modify the variable showing the length of silverBullet string and do buffer-overflow since the binary doesn't have Stack Canary mitigation.

Exploitation

Buffer Overflow

• First create a Silver Bullet having the power of 47. Then power it up by 1. This allows us to append more 47 characters after silverBullet string and modify the variable storing the length of that string (bulletPower) and the return address. However, to make main function return, we have to beat Werewolf immediately. Therefore, we have to change bulletPower variable to a bigger one.
• When we can return to escape main function, we just need to write the return address to leak libc by using printf or puts and GOTs entries. After that, just return back to main function and do buffer-overflow again to get shell.

Exploit Code