CTFtimeMediumPwn250 pts

ret2libc

cyberhub2024-05Original source

Overview

Return-to-libc attack against a 32-bit binary with stack canaries disabled. Chain libc gadgets to call system('/bin/sh') and pop a shell.

ret2libcNX BypassROP ChainspwntoolsBinary Exploitation

01Reconnaissance

Every engagement starts with mapping what is reachable. A full service scan of ret2libc highlighted the exposed surface and pointed at ret2libc as the most promising entry point.

Enumeration is deliberately exhaustive here — the goal is to leave no service unexamined before committing to an attack path.

nmap — service discovery

$ nmap -sC -sV -oN nmap/initial 10.10.11.42
PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.9p1 Ubuntu
80/tcp   open  http     nginx 1.18.0
$ echo "10.10.11.42 ret2libc.htb" | sudo tee -a /etc/hosts
$ gobuster dir -u http://ret2libc.htb -w /usr/share/wordlists/dirb/common.txt -q
/login                (Status: 200)
/api                  (Status: 401)

02Exploitation

A missing bounds check on the input buffer let us overwrite the saved return address and redirect execution.

In this pwn challenge that translated into a repeatable foothold. Return-to-libc attack against a 32-bit binary with stack canaries disabled. Chain libc gadgets to call system('/bin/sh') and pop a shell.

exploitation — memory corruption

$ checksec --file=./vuln
$ python3 -c 'from pwn import *; print(cyclic(200))' | ./vuln
$ python3 exploit.py REMOTE target 1337

03Flags

The flag is recovered directly from the solved challenge.

flags

$ cat flag.txt
flag{redacted_for_this_writeup}

Commands are illustrative of the technique and platform, not a live exploit against a specific target. Follow the original source link for the authoritative walkthrough.