Sheet 3

General Information

All solutions must be Python 3 scripts if not stated otherwise. If you are new to Python 3, have a look online, there are many good resources to get started such as this intro course, this advanced course, this blog post, and this slide deck.

Please keep in mind that you should:

  • read the task description carefully

  • push all your changes to the GitLab repository (main branch) before the deadline. Make also sure that the file permissions are set correctly! If you are new to Git check out this site!

  • Make sure that your solution (also) runs in the CI environment (and not just your local machine); this also means that you must install all additional packages yourself from within the solution script (see our blog post for details how to do that).

  • Make sure that the solution is an executable Python 3 script named solution (chmod +x ./solution) with a working shebang line at the top (i.e. #!/usr/bin/env python3) so that it can be executed like this: ./solution (do not name your script solution.py, Solution, solution.sh, … – just solution)

  • The final solution string, and only that, must be written to stdout and could be a number, a string, a string with the format FLAG{some letters and digits here}, depending on the specific task.

  • Describe what you are doing using detailed comments for all your solution scripts! For example, use Docstrings (link) or inline comments:

    1
2
3
4
5
6
7
8

    def check_input_length(input_string):
    """
    The input string must have a length greater than 42 and must also be even.
    """
    length = len(input_string)

    # the final check happens here
    return (length > 42) and (length % 2 == 0)

    This helps us to find out if you really understood the task and you are not just brute-forcing some solutions. Please do not leave any commented code (i.e., code that is not needed to solve the task) in your solution files!

  • Make sure that your solution executes within 10 seconds (this is a hard timeout on our server).

  • Violating any of the points above might lead to reduced final points for the specific task!

The deadline for this sheet is 2023-06-06 23:00:00 UTC

Task 9 – ROP ROP ROP ROP ROP (8 Points, individual Task)

This time there are two binaries: vuln and execute_me_with_rop. There is a simple vulnerability in vuln.

Your task is to build a ROP chain that executes execute_me_with_rop so that it prints the flag.

Use the execve system call and prepare all necessary arguments accordingly.

You must not use pwntools' pwnlib.shellcraft for this exercise!

You must also not just execve("/bin/sh -c './execute_me_with_rop arg1 arg2'") for the execution of execute_me_with_rop!

Once again, edit the provided solution template and explain your approach with meaningful comments!

Hints:

  • Try to write a C program first which executes execute_me_with_rop, to find out how to build your ROP chain:
1
2
3
4
5
6
7
8
9

#include <unistd.h>

int main()
{
  char* argv[] = { "./execute_me_with_rop" , "foo", "bar", NULL };
  char* envp[] = { "PABE=FUN",  NULL };
  execve("./execute_me_with_rop", argv, envp);
  return 0;
}

  • Have a look at the Hello-World ROP chain in order to build your ROP chain

  • Remember how to set argv**

Task 10 – Back to Bavaria (4 Points)

Looks like our ABE developer thinks that small binaries are harder to exploit. Prove them wrong by exploiting the minimal1 binary and making it print the flag!

Edit the provided solution template and explain your approach with meaningful comments.

Your solution should execute like this:

1
2

./solution
FLAG{some letters here}

Task 11 – Minimalist (8 Points)

Looks like someone really wanted to save disk space. Are you still able to expoit the problem_srop binary and make it print the flag? Do it!

Once again, edit the provided solution template and explain your approach with meaningful comments.

Hints:

  • You might want to use SROP, as the name of the binary suggests.
  • System call return values and system call numbers are stored in eax. Can you chain system calls so that the return value of one system call correctly sets up the next one?
  • Is there a nice place to pivot the stack to?

Your solution should execute like this:

1
2

./solution
FLAG{some letters here}

Task 12 – The Path to Pivot (8 Points)

Path translation produces notoriously many bugs. Good thing we are here to finally provide a good, reliable, safe and clean solution… In other words, please exploit the binary and print the flag.

Edit the provided solution template and explain your approach with meaningful comments!

Hints:

  • The backslash character is 0x5c in ASCII. How can we use this…?

Your solution should execute like this:

1
2

./solution
FLAG{some letters here}

Task 13 – Time to Pivot! (8 Points)

Our company ABE inc. is migrating to SAP. Hooray! Unfortunately, this migration requires a secret value to authorize the data transfer to the new system. And the last accountant that knew this value is already retired.

Luckily, our secretary remembers that they hid a backup of this value somewhere deep in the HR system. Can you help us out?

Exploit the HR server and print the flag!

Edit the provided solution template and explain your approach with meaningful comments!

Hints:

  • This time the flag is well hidden in libhr.so.

Your solution should execute like this:

1
2

./solution
FLAG{some letters here}
19 May 2023