gimme
Bypassing PIE with a provided address leak.
Last updated
Was this helpful?
Bypassing PIE with a provided address leak.
Last updated
Was this helpful?
This binary is the first we've covered thus far that enables PIE. We see this in the checksec output:
The only thing that's disabled is the canary. This means that this code is still susceptible to buffer overflows.
We'll start PIE binaries the same way we start the others. While we search through the binary, we are looking for ways that can leak any address in the binary so that we beat PIE.
We'll start with win(). win() only makes one call to system. We can dissect that the string being passed is cat flag.txt, but I'll leave it to the reader to verify this.
The main() function only makes a call to read_in and then returns.
Now, let's discuss the read_in function. We can start dissecting each call and the arguments being passed. The first call is to printf:
Checking what's at the address pushed addresses:
We see that the first call to printf is printing the address of main. After this, there is a gets call to a 0x30 byte buffer.
We have everything we need. Our steps are:
Leak the address of main
Use this to register the base address of the binary
Calculate the address of win
Overwrite the return address with the address of win
Pwntools helps out with most of this. By loading in the binary using ELF(), the offsets will be automatically registered. Once we find the base address, we can register this inside the ELF object and proceed as usual.
We use libc = elf.libc to register the libc offsets. This is because we will be using the system call from libc. Then, we can call any function using elf.sym.<function_name>. When we find the base address, we store it in elf.address.
Let's make this happen. We first establish the binary and process:
From here, we get the leak. This is the same way we received the leak in location.
Once we have the leak, we know that the base address is the leak minus the offset of main. We can then register this in the ELF object.
Now, when we use the elf.sym.<function_name> syntax, it automatically adds the base address to the offset. Now, we can build our payload using elf.sym.win instead of a hardcoded address.
Finally, we send the payload and get the flag:
As we can see, PIE is bypassed, and the binary is exploited: