0

in this challenge i have to overwrite RIP register to point to the function "print_flags" which calls "getenv" to get the "FLAGS" variable.

I have overwritten RIP register with the address of "print_flags", but when it is going to call "getenv" i get a SIGSEGV because of the argument passed to getenv which is "AGS" instead of "FLAGS".

What am i doing wrong?

00000000004006a6 <read_all_stdin>:
  4006a6:   55                      push   rbp
  4006a7:   48 89 e5                mov    rbp,rsp
  4006aa:   48 83 ec 20             sub    rsp,0x20
  4006ae:   48 89 7d e8             mov    QWORD PTR [rbp-0x18],rdi
  4006b2:   c7 45 fc 00 00 00 00    mov    DWORD PTR [rbp-0x4],0x0
  4006b9:   eb 18                   jmp    4006d3 <read_all_stdin+0x2d>
  4006bb:   8b 45 fc                mov    eax,DWORD PTR [rbp-0x4]
  4006be:   8d 50 01                lea    edx,[rax+0x1]
  4006c1:   89 55 fc                mov    DWORD PTR [rbp-0x4],edx
  4006c4:   48 63 d0                movsxd rdx,eax
  4006c7:   48 8b 45 e8             mov    rax,QWORD PTR [rbp-0x18]
  4006cb:   48 01 d0                add    rax,rdx
  4006ce:   8b 55 f8                mov    edx,DWORD PTR [rbp-0x8]
  4006d1:   88 10                   mov    BYTE PTR [rax],dl
  4006d3:   48 8b 05 86 09 20 00    mov    rax,QWORD PTR [rip+0x200986]        # 601060 <stdin@@GLIBC_2.2.5>
  4006da:   48 89 c7                mov    rdi,rax
  4006dd:   e8 ae fe ff ff          call   400590 <fgetc@plt>
  4006e2:   89 45 f8                mov    DWORD PTR [rbp-0x8],eax
  4006e5:   83 7d f8 ff             cmp    DWORD PTR [rbp-0x8],0xffffffff
  4006e9:   75 d0                   jne    4006bb <read_all_stdin+0x15>
  4006eb:   90                      nop
  4006ec:   c9                      leave  
  4006ed:   c3                      ret    

00000000004006ee <print_flags>:
  4006ee:   55                      push   rbp
  4006ef:   48 89 e5                mov    rbp,rsp
  4006f2:   48 8d 3d 0b 01 00 00    lea    rdi,[rip+0x10b]        # 400804 <_IO_stdin_used+0x4>
  4006f9:   e8 52 fe ff ff          call   400550 <getenv@plt>
  4006fe:   48 89 c7                mov    rdi,rax
  400701:   e8 5a fe ff ff          call   400560 <puts@plt>
  400706:   bf 00 00 00 00          mov    edi,0x0
  40070b:   e8 90 fe ff ff          call   4005a0 <exit@plt>

0000000000400710 <main>:
  400710:   55                      push   rbp
  400711:   48 89 e5                mov    rbp,rsp
  400714:   48 83 ec 20             sub    rsp,0x20
  400718:   48 8d 45 e0             lea    rax,[rbp-0x20]
  40071c:   ba 20 00 00 00          mov    edx,0x20
  400721:   be 00 00 00 00          mov    esi,0x0
  400726:   48 89 c7                mov    rdi,rax
  400729:   e8 52 fe ff ff          call   400580 <memset@plt>
  40072e:   48 8d 45 e0             lea    rax,[rbp-0x20]
  400732:   48 89 c7                mov    rdi,rax
  400735:   e8 6c ff ff ff          call   4006a6 <read_all_stdin>
  40073a:   48 8d 45 e0             lea    rax,[rbp-0x20]
  40073e:   0f b6 00                movzx  eax,BYTE PTR [rax]
  400741:   84 c0                   test   al,al
  400743:   75 0e                   jne    400753 <main+0x43>
  400745:   48 8d 3d be 00 00 00    lea    rdi,[rip+0xbe]        # 40080a <_IO_stdin_used+0xa>
  40074c:   e8 0f fe ff ff          call   400560 <puts@plt>
  400751:   eb 18                   jmp    40076b <main+0x5b>
  400753:   48 8d 45 e0             lea    rax,[rbp-0x20]
  400757:   48 89 c6                mov    rsi,rax
  40075a:   48 8d 3d bc 00 00 00    lea    rdi,[rip+0xbc]        # 40081d <_IO_stdin_used+0x1d>
  400761:   b8 00 00 00 00          mov    eax,0x0
  400766:   e8 05 fe ff ff          call   400570 <printf@plt>
  40076b:   b8 00 00 00 00          mov    eax,0x0
  400770:   c9                      leave  
  400771:   c3                      ret    
  400772:   66 2e 0f 1f 84 00 00    nop    WORD PTR cs:[rax+rax*1+0x0]
  400779:   00 00 00 
  40077c:   0f 1f 40 00             nop    DWORD PTR [rax+0x0]

Here are some screenshots of the payload that i used to and the Segmentation fault error: enter image description here enter image description here

UPDATE: Fixing the memory out of bounds, now i get another SIGSEGV:

Stopped reason: SIGSEGV __strlen_sse2 () at ../sysdeps/x86_64/multiarch/../strlen.S:120 120 ../sysdeps/x86_64/multiarch/../strlen.S: No such file or directory.

I've read some articles and it might be a NULL terminated string problem or like EOF problem from fgets?

I'm freaking out for this.

enter image description here

  • The SIGSEGV you have is not because of "AGS", its because your rbx register is out of bounds of mapped memory (0x43434343...43). cmp instruction threats it as an address and tries to read memory from there. – w s May 13 at 10:22
  • Thank you a lot! – Fl0wBuFf3r0v3r May 13 at 10:29
  • The next sigsegv is because your RAX register now is 0, which is also threated as address and not mapped. movdqu instruction tries to read memory from address 0. – w s May 14 at 5:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.