# warmup - 2020 Defenit CTF (pwn, 316p, 32 solved)## Introduction
warmup is a pwn task.
A binary, and a libc are provided.
The libc provided is `Ubuntu GLIBC 2.23-0ubuntu11`.
## Reverse engineering
The binary is quite small and has symbols.
It opens `flag.txt`. It then reads `0x100` bytes in a buffer from the standardinput, and calls `snprintf` on it, resulting in a format string vulnerability.It calls `exit` right after. It does not display anything, which makes itimpossible to leak memory.
There is a `win` function that displays the flag. It is located right after thevulnerable function.
## Exploitation
The author of this challenge expects players to redirect the flow of executionto the `win` function.
The format string vulnerability allows an attacker to overwrite arbitrarymemory. ASLR + PIE means that the attacker is restricted to addresses that areleft on the stack. PIE also means that the overwritten pointer has to be alreadypointing to the main binary's mapping.
The binary is `relro`. Overwriting the `.got.plt` is not an option.
The vulnerable function never returns. It calls `exit` that calls a few hooks(TLS destructors, `atexit` functions, etc.). Tracing the execution shows nohooks that can be overwritten and whose function is located in the main binary'smappings.
`snprintf` uses a return address. It is possible to overwrite it during itscall, which will make it return to a different address.
`snprintf` originally returns to `$base + 00000a0a`, which is conveniently veryclose to the `win` function, located in `$base + 00000a14`. Partiallyoverwriting the last byte of the return address to `0x14` will thus make thecall to `snprintf` return to the `win` function.
There are no pointers to `snprintf`'s return address on the stack. However,there is a pointer to a stack address that contains an other stack address.
```0x7fffffffda20:	0x00007fffffffda30	0x473734f9ce51ca000x7fffffffda30:	0x00007fffffffda40	0x0000000100000a89```
It is possible to overwrite the second pointer (`0x7fffffffda30`) to make itpoint what would be the return address of `snprintf`.
With ASLR, this has a reasonable chance of success. It is possible to run ascript multiple time in parallel to get the flag faster.
**Flag**: `Defenit{printf_r3t_0v3rwrit3}`
## Appendices
### pwn.php
```php#!/usr/bin/php