Court of Analysis and Testing

  Previously in the arm exploitation series, we take a look at how we can perform buffer overflow and format string attack in ARM binary, both of them prove to be powerful enough to take control of program execution if it correctly utilizes, furthermore it can also bypass anti-exploit mechanism. But both of the attack methods are conducted in stack region of memory and today lets try to explore the other attack mechanism in ARM binary which is heap exploit. I already introduced how to get a start in the heap exploitation binary, in this post and this post so I will not cover it again. This post is meant to give an idea of how heap exploitation happens in arm binary and how we can leverage this exploit to be able to take control of the program workflow and drop a shell. For the POC, I will take the source code from protostar heap0 challenge, compiled it in raspberry pi qemu and try to exploit it source: https://exploit.education/protostar/heap-zero/ just like in t...

  Its been a while since my last update in this blog, I finally have some time to make another write up of pwn CTF challenge. Thanks to my classmate Christos for sharing this challenge, I hope this blog can help you to understand how to approach this challenge. The challenge was named BabyStack. It was a 64 bit ELF executable and it's expected us to change the flow of program execution in order to spit out the flag At first, if you try to run the app it will show read() open error function this indicates that this binary needs to have some additional file in order to run properly. Since this is a CTF challenge I just try to create like a dummy file called flag to see if this the correct file to be prepared. It turns out it was a correct file and we can see that the binary give us two input first is the "size" and the "data" next, let's try to load the binary to ghidra so we have more detail information about the binary. Examining the p...

In the previous post , we are taking a look at the new approach of how we can utilize ROP without taking too much time selected the necessary gadgets using sigreturn oriented programming. But in the example, we purposely leak the stack address to help us execute mprotect function. what if there is no leaked address? can we still bypass NX and ASLR at the same time using sigreturn? Of course you can! To proof it let's try to solve the pwn challenge from rooters CTF(srop). Binary can be downloaded from this link: https://github.com/abs0lut3pwn4g3/RootersCTF2019-challenges/tree/master/pwn/srop Hmmm, it seems we get a stripped binary. This means the symbol for the function is stripped and it will be harder for us to understand the assembly. When we run the program we can see that it only shows some prompt and expect an input after we enter some value it doesn't give us anything. Let's load the binary to Ghidra. If you got stripped binary, the first thing that...