writeup
DEF CON 2016 Quals - feedme
24 May 2016feedme is a baby’s first pwnable task.
The binary is a fork-based server. There is an obvious buffer overflow vulnerability in the child process routine.
int handler()
{
char buf[32]; // [ebp-0x2c]
int canary; // [ebp-0xc]
printf("FEED ME!\n");
int size = read_byte();
readn(buf, size);
// Shows up to 16 bytes. Cannot leak canary with this.
printf("ATE %s\n", tohex(buf, size, 16));
return size;
}
void server()
{
while (1) {
int pid = fork();
if (pid == 0) {
int n = handler();
printf("YUM, got %d bytes!", n);
return;
}
else {
waitpid(pid, &status, 0);
printf("child exit.\n");
}
}
}
So we can exploit this program by brute-forcing stack canary and doing ROP to get a shell. Classic.