Breaking Bits
Search…
US CyberGames RE-Cruise 4
The wrong way to solve this problem
Problem Description
This reverse engineering problem was the capstone problem for the "Cruise" set of reverse engineering problems for the US Cyber games final CTF. I've been messaged by a bunch of people asking how I solved it, so I've put together this walk through describing the vulnerabilities in the program and I how used them to solve it without sigqueue .
1
$ file princess
2
princess: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=43925fc945c2d6258b7ba11547fbd3236340cd62, for GNU/Linux 3.2.0, stripped
Copied!
The problem set contains a number of challenges that rely on using signals to interact with the challenge problem. The problem on the server is a setuid program that when in the correct program state will print the flag. This binary has striped symbols, but otherwise follows the same format as the previous cruise problems of:
1
get_rand_bytes() ->get_rule() -> get_signals() -> read signal_sequence -> print flag
Copied!
Running the program

Program vulnerabilities

First bug - Controlling /dev/urandom

The first issue within this challenge lies in the getRandBytes function. Where the returned fd from the open call is not checked and is instead directly read from. This is a classic ulimit -n exploitation case. The ulimit command will enable us to set program limits and restrict the number of open file descriptors, enabling us to force this call to open to fail. Since the return value from read isn't checked either, we can ensure that 0 bytes are read in the returned unsigned int.
Ghidra decompilation for get_rand_bytes() function

Second bug - Controlling rules.csv

The second issue is in the open call for the rules.csv file, where the given path is relative. Because of this we can run the princess binary in a /tmp/something directory and supply our own rules.csv file. There is a similar bug to flag.txt, and so in that /tmp/something directory we need to symlink flag.txt to ~/flag.txt.
Ghidra decompilation for get_rule()
Creating a custom rule for rules.csv
Creating this custom rule enabled me to just set a single short blast as the rule every single time the program ran.

Third bug - Crashing the program

This bug ultimately wasn't useable, however in the get_rule() function, there is a loop that adds bytes from the file into a buffer until it reaches a new line character. Since this is a stack address that is passed into the function, this enables us to overflow the rule_buffer variable and clobber everything after it.
Rule buffer passed into the get_rule() function
Unfortunately, the program ends with a call to exit(2) instead of returning, meaning any saved registers that are clobbered don't give us execution. The program would have also had full protections too, making exploitation incredibly difficult. One positive note though it that the execution environment is vulnerable to CVE-2016-3672 which would let us effectively turn off ASLR, so no leak would be needed to exploit the program.
1
checksec princess
2
[*] '/home/chris/ctf/cybergames/final/princess'
3
Arch: amd64-64-little
4
RELRO: Full RELRO
5
Stack: Canary found
6
NX: NX enabled
7
PIE: PIE enabled
Copied!
Using exit(2) at the end of the program prevents a ret call to the clobbered value

The solve

The first trick is pretty cool for taking all randomness out of the program, however there is a value that gets checked based off those random bytes that needs to equal 1 and not 0, and the check producing the value from the random bytes uses shifts and can never produce a 1.
Since the generated compare value is calculated through shifts. The first bug is useless
This leaves us with a brute-force approach toward solving the problem with the second bug. There is no python on the server, so we need to write in C a method for invoking the princess program and sending a signal calculated based off the rand value.
The task becomes pretty straight forward as we need to fork a process, read and send data through a pipe, and send a signal to the process before it terminates.
We're relying on the randomness of /dev/urandom since it will occasionally provide a value from the getCompareValue function that passes the check. So we just need to run this program until it produces the flag with a bash one-liner of:
1
while true; do timeout 1 ./run_till_flag;done | grep uscg # only print flag
Copied!
1
#include<unistd.h>
2
#include<sys/wait.h>
3
#include<sys/prctl.h>
4
#include<signal.h>
5
#include<stdlib.h>
6
#include<string.h>
7
#include<stdio.h>
8
9
//#define PROG "/home/chris/ctf/cybergames/final/princess"
10
#define PROG "/tmp/something/princess"
11
12
int get_signal(unsigned int rand_val)
13
{
14
int sig_num[] = {0x1a,0x12,1,10,0xb,0x15,0x1d,0xd,6,0x10,0x1f,0x1e,0x14,0x17,0xb};
15
int index = rand_val >> 0x18 & 0xf;
16
return sig_num[index];
17
}
18
19
int get_cmp_val(unsigned int num)
20
{
21
return (num >> 0x10 & 0xff) * (num >> 0x18) - (num & 0xff ^ num >> 8 & 0xff);
22
}
23
24
int main(int argc, char** argv)
25
{
26
pid_t pid = 0;
27
int inpipefd[2];
28
int outpipefd[2];
29
char buf[2048];
30
char msg[256];
31
int status;
32
33
pipe(inpipefd);
34
pipe(outpipefd);
35
pid = fork();
36
if (pid == 0)
37
{
38
// Child
39
dup2(outpipefd[0], STDIN_FILENO);
40
dup2(inpipefd[1], STDOUT_FILENO);
41
dup2(inpipefd[1], STDERR_FILENO);
42
43
//ask kernel to deliver SIGTERM in case the parent dies
44
prctl(PR_SET_PDEATHSIG, SIGTERM);
45
46
execl(PROG, "princess", (char*) NULL);
47
exit(1);
48
}
49
50
//close unused pipe ends
51
close(outpipefd[0]);
52
close(inpipefd[1]);
53
54
// Read until rand value is printed
55
int count = read(inpipefd[0], buf, 50);
56
// Since we're running fast, we might
57
// SIGBUS or SIGPIPE and we might as
58
// well restart
59
if(count != 50)
60
{
61
usleep(100);
62
kill(pid, SIGKILL); //send SIGKILL signal to the child process
63
waitpid(pid, &status, 0);
64
return -1;
65
}
66
memset(buf, '\x00',sizeof(buf));
67
68
// Get the rand value printed
69
read(inpipefd[0], buf, 8);
70
71
unsigned int rand_val = (unsigned int)strtol(buf, NULL, 16);
72
//printf("rand_val %X\n",rand_val);
73
74
unsigned int signal_val = get_signal(rand_val);
75
unsigned int cmp_val = get_cmp_val(rand_val);
76
77
//printf("Signal %d\ncmp_val %X\n",signal_val, cmp_val);
78
79
read(inpipefd[0], buf, 2048);
80
//printf("%s\n", buf);
81
memset(buf, '\x00',sizeof(buf));
82
83
// I was only going to kill if it's the right cmp_val
84
// but it's just as fast to run all of them
85
if (cmp_val == 1 || 1)
86
{
87
kill(pid, signal_val);
88
89
write(outpipefd[1], "\n\n", 2);
90
close(outpipefd[1]);
91
read(inpipefd[0], buf, 2048);
92
// Should contain the flag
93
printf("%s\n", buf);
94
//printf("rand_val %X\n",rand_val);
95
//printf("Signal %d\ncmp_val %X\n",signal_val, cmp_val);
96
return -1;
97
}
98
99
kill(pid, SIGKILL); //send SIGKILL signal to the child process
100
waitpid(pid, &status, 0);
101
}
Copied!

Speeding up the process

Since we're running this over a remote connection and the remote server has two cores, I opted to write a script that would run 32 separate instances of the program concurrently to minimize the chance of another player seeing my run folder or process running in memory and speed up the solve.
1
from pwn import *
2
import multiprocessing
3
4
cmd = "cd /tmp/something/;while true;do timeout 1 ./run_till_flag;done | grep uscg"
5
6
7
def do_work(nothing):
8
conn = ssh(user="challenger",host='0.cloud.chals.io',\
9
port=28429,password="5f4dcc3b5aa765d61d8327deb882cf99")
10
11
p = conn.shell(cmd)
12
print(p.recv())
13
14
15
p = multiprocessing.Pool(32)
16
p.map(do_work,range(32))
Copied!

The real solve

The real solve follows the escalating process of how to use signals and wants you to pass some data with the signal to the signal hander.
Setting up signal handlers inside main()
handling signals and setting the compared value
The intended solution uses sigqueue to add data to the signal to be processed.
Sigqueue manpage
The value argument can be set in a struct and passed in the sigqueue command, which enables us to set the compared value. From the man page:
1
The value argument is used to specify an accompanying item
2
of data (either an integer or a pointer value) to be sent with the
3
signal, and has the following type:
4
5
union sigval {
6
int sival_int;
7
void *sival_ptr;
8
};
Copied!
1
uscg{a_signal_inside_a_signal__achievement_unlocked!}
Copied!