Cosmic Ray V3 (pwn)

I promise it's the last one. The grand finale to the cosmic trinity. Good luck!

16KB
cosmicrayv3
Open
2MB
libc-2.35.so
Open
235KB
ld-2.35.so
Open

The code in main is quite simple. It calls cosmic_ray, then does a syscall.

undefined8 main(void)
{
  setbuf(stdout,(char *)0x0);
  setbuf(stderr,(char *)0x0);
  cosmic_ray();
  syscall();
  return 0;
}

The equivalent assembly looks like this:

cosmic_ray essentially allows us to choose any bit in the program to flip. The pseudocode is as follows:

We should first enter the byte to flip in the format 0x123456, then enter the bit to flip which is between 0 (for most significant bit) and 7 (for least significant bit).

Since cosmic_ray is only called by main once, we need to find a way to get many bit flips. Notice that the assembly code for cosmic_ray is located above the assembly code for main:

As such, if we were to modify the RET instruction to another valid instruction, the program execution would continue to main and call cosmic_ray again. We can change the byte 0x4015aa at bit 0 from 1 to 0, which would change the byte from c3 to 43, changing our RET to an instruction that is still valid.

Now we want instructions after the CALL cosmic_ray instruction in main to contain shellcode. This way, when we finally allow the cosmic_ray function to return, our shellcode will be executed. So from address 0x4015e5 onwards, the bytes will contain our shellcode.

Our plan is as follows:

  1. Flip bit 0 at 0x4015aa

  2. Flip bits from 0x4015e5 onwards until our entire shellcode is in the program code

  3. Flip bit 0 at 0x4015aa again to allow cosmic_ray to return

In my script, I define the function flip to handle process i/o, indicating which bit to flip. I also have a function getbit that obtains the specified bit from the program's code.

For step 2, I iterate through every bit of the shellcode. If the bit is different from the corresponding bit in the program's code, I request the bit to be flipped. Below is my solve script.

Last updated