light

challenge created by Duckupus

Binary files included:

17KB

Light

Open

Light: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=4f5666ec467110524f0c021daa1c606177697cb5, for GNU/Linux 3.2.0, not stripped

Static Disassembly

decompiled C code

the stack

we can see that the program asks for a user input that is limited to 100 bytes before comparing the length of our input to 0x16 which is 22 in decimal format

when our input is, indeed, 22 bytes long, it will then copy our user input into local_28

there are two vulnerable functions at play here, which we can exploit

1. strlen()

2. memcpy

Strlen

vulnerability: refer to the exploitation / rev manual

the key idea is a buffer overflow attack that exploits the memcpy function, which copies our input into local_28However, the memcpy function here specifies a limit of 100 characters, whereas local_28 can only store 22 characters. using this knowledge, our attack will work like this

1. trick the program into thinking our input is 22 characters

2. allow the program to copy our input of more than 22 characters into local_28

3. overflow the values of local_28 (things that are after the 22nd character) into to_overwrite

we can then change the value of to_overwrite to something that is not 0

solve script is found here

exploit.py

from pwn import *
io = process('./Light')

payload = b'A' * 22 + b'\0' + b'A'*100 + p32(0x1)

io.sendline(payload)

io.interactive()