Daily PWN: GOT targets

I'll do the chall_08 from the Sunshine CTF speedruns:

https://github.com/AndyNovo/speedruns/blob/master/chall_08

Class 14: The printf Vulnerability

Welcome to the next stage of your x86 exploitation journey.

Here are the stories to tell for printf, I will use several lectures on this.

• printf(x)
• Leaking addresses with "%p"
• Leaking/referencing a particular spot in the stack with %19$p
• Bypassing a Canary
• Writing to an address on the stack using %19$hn
• Providing an address to the stack AND writing to the address: p64(target)+"%3230x%7$hn"
• Wielding this "write-what-where" to control program flow
• Speeding this up with pwntools fmt_payload

Here's the basic vulnerability in the wild:

Let's play with that a little bit.

Typically printf is used like this:

      printf("%d + %d == %d\n", 1, 2, 3);
    

The format string references arguments to the function printf.

Here we are letting the user CONTROL the format string (rather than an argument).

This is a bit like SQL injection but for C.

So what goes wrong?

Part 1: Calling Conventions

When we ask for printf("%d %d %d %d %d %d %d"); but there weren't any arguments passed in code... well... the CPU doesn't know that.

So it just looks where the arguments are supposed to be and gives you whatever is there.

In this case we're referencing the first 7 arguments, so what will show up on screen is going to be a mix of values from registers and from the stack.

The first 6 args to printf are in registers BUT only 5 of the format string args are in registers since the format string itself is in RDI.

So any arguments needed by the format string beyond the registers are read directly from the stack.

Of course in 32-bit the arguments are all on the stack.

Part 2: Silly Format String Things

Here are some format string tricks that are useful to us:

• "%3$p" grabs the 3rd argument to printf (4th to the sym.imp.printf)
• "%1234d" displays it's argument padded to width 1234
• "12345%n" will WRITE the int value 5 (the width so far) to it's argument
• "%hn" writes a short, "%hhn" a char, "%ln" a long and "%lln" a long long

I'll demo these in class, but here's a nice run-down in a blog somewhere:

%[parameter][flags][width][.precision][length]type

Baby Printf Pwns

This is our first real PWN without using stack smashing. Here's a rough guideline of problems I've seen using this:

• Reading the flag directly from the stack
• Reading the canary from the stack then smashing the stack
• Getting a glibc leak from printf then ret2libc

Toddler printf pwns

• Changing 1-2 bytes in the GOT to convert one function address into another
• Write-what-where with a leak and a GOT setup

Advanced printf pwns

• No leaks, full green, DIY
• Crafting a ROP chain surgically in the stack

Grown-Up printf pwns

• Actually the HEAP problems are the same concept (Write-What-Where)

Demo Time

We will tackle the write-what-where more on Monday but for now let's get comfortable with the basics and try to bypass a canary.