# KiDPwN 437pt ?solves
## TLDR* Set $rsp to higher address 	* use misusing movsx operation* Overwrite the return address from main() to rop gadget in libc	* bruteforce attack against 4bits* Leak the binary address and the libc address* Overwrite got\_printf to one\_gadget	* format string attack
## Challenge### Descriptionresult of file command* Arch    : x86-64* Library : Dynamically linked* Symbol  : Stripped
result of checksec* RELRO  : Partial RELRO* Canary : Disable* NX     : Enable* PIE    : Enable
### Exploit The binary has vulnerability of format string attack(0x97a) and misuses movsx operation(0x905).
```905:   48 0f bf 45 fe          movsx  rax,WORD PTR [rbp-0x2]90a:   48 8d 50 0f             lea    rdx,[rax+0xf]90e:   b8 10 00 00 00          mov    eax,0x10913:   48 83 e8 01             sub    rax,0x1917:   48 01 d0                add    rax,rdx91a:   b9 10 00 00 00          mov    ecx,0x1091f:   ba 00 00 00 00          mov    edx,0x0924:   48 f7 f1                div    rcx927:   48 6b c0 10             imul   rax,rax,0x1092b:   48 29 c4                sub    rsp,rax92e:   48 89 e0                mov    rax,rsp931:   48 83 c0 0f             add    rax,0xf935:   48 c1 e8 04             shr    rax,0x4939:   48 c1 e0 04             shl    rax,0x493d:   48 89 c2                mov    rdx,rax940:   48 8d 05 19 07 20 00    lea    rax,[rip+0x200719]        # 201060 <__cxa_finalize@plt+0x200920>947:   48 89 10                mov    QWORD PTR [rax],rdx94a:   0f b7 45 fe             movzx  eax,WORD PTR [rbp-0x2]94e:   0f b7 d0                movzx  edx,ax951:   48 8d 05 08 07 20 00    lea    rax,[rip+0x200708]        # 201060 <__cxa_finalize@plt+0x200920>958:   48 8b 00                mov    rax,QWORD PTR [rax]95b:   48 89 c6                mov    rsi,rax95e:   bf 00 00 00 00          mov    edi,0x0963:   e8 a8 fd ff ff          call   710 <read@plt>968:   48 8d 05 f1 06 20 00    lea    rax,[rip+0x2006f1]        # 201060 <__cxa_finalize@plt+0x200920>96f:   48 8b 00                mov    rax,QWORD PTR [rax]972:   48 89 c7                mov    rdi,rax975:   b8 00 00 00 00          mov    eax,0x097a:   e8 81 fd ff ff          call   700 <printf@plt>```Normally, rsp register is set to lower address to store user input (at 0x92b), which of length is defined by the user at fgets (0x8d9).But, for example, if the length of user input is 65424(0xff90), rsp is set to higher address.So we can change rsp to arbitary addresses and overwrite the return address from main().
However, it is difficult to set rip to the ideal address, because PIE is enabled.I found the usable address on stack at rbp+0x18. It is main() address.So I wanted to change the return address to rop gadget (3 pop and ret).By default, the return address from main() is an address in libc\_start\_main.In distributed libc.so, offset of libc\_start\_main\_ret is 0x20830.I searched rop gadget in libc, which of offset is near 0x20830. And I found it(at 0x202e3).
Using this gadget, I overwrote lower 2bytes of the return address.So we have to do a bruteforce attack against 4bits.
The following memory dump is captured in my local environment using libc-2.27.so.So the address of libc\_start\_main\_ret is different from contest server's one.
In the dump:  binary base = 0x555555554000  rbp = 0x7fffffffe370  return address from main() = 0x7ffff7a05b97  main() address = 0x555555554880  
```0x7fffffffe360: 0x00007fffffffe450      0xff900000000000000x7fffffffe370: 0x00005555555549e0      0x00007ffff7a05b970x7fffffffe380: 0x0000000000000001      0x00007fffffffe4580x7fffffffe390: 0x0000000100008000      0x00005555555548800x7fffffffe3a0: 0x0000000000000000      0x944fb65297d913360x7fffffffe3b0: 0x0000555555554750      0x00007fffffffe4500x7fffffffe3c0: 0x0000000000000000      0x00000000000000000x7fffffffe3d0: 0xc11ae307c3191336      0xc11af3b8b28713360x7fffffffe3e0: 0x00007fff00000000      0x00000000000000000x7fffffffe3f0: 0x0000000000000000      0x00007ffff7de5733```
Using this trick, I set rsp to $rbp-0x10.And leaked the binary base address and the libc base address.
After [3 pop; ret] gadget, I overwrote got\_printf to one\_gadget by format string attack.
My exploitcode is [solve.py](https://github.com/kam1tsur3/2020_CTF/blob/master/nullcon/pwn/KiDPwN/solve.py).
In this code, I use fsb() which returns format string payload.
Twitter@kam1tsur3