30C3 CTF – PWN 300 – Todos Write-up : SQL injection + ret2libc

This binary from the awesome and pwn-heavy 30C3 CTF is a todo-list manager with a telnet interface, ELF binary server and MySQL database as a storage backend.

Sample session:

We can find the queries used by the search command in the binary:

The first query is used to guess the amount of results. The second query is used to fetch the data.

Absolutely no escaping with mysql_real_escape_string() is done in the binary:

So we can do sql injections like:

This service is running on Ubuntu Saucy 64bit, this will be very useful later when we need to find offsets in the libc.

The result of the first query (SELECT COUNT(*) FROM todos WHERE…) is used to help with memory management. If the amount of results is lower or equal to 10, a fixed table in .data is used. Otherwise some space is allocated on the heap (malloc) and the results are stored there.

There is room for 10 results of 256 chars in the table in .data. After this table in .data we have some very interesting structure:

– The number of results (used by the show command)
– a table of records that describe how to manage the commands

Using some sql trickery we will control the result of the first query (count) to be 1 while we will actually send more than 10 results: we will overwrite past the fixed_result_table table

0x0e00000000000000 (15) will overwrite num_results

By overwriting the structure used to describe the help command, we can control the execution flow and call anything in the binary or library (libc)

Small problems here are that:
– The binary has been PIE-compiled (random base for .text segment)
– ASLR is enabled (libc base is random as well)

So we need to leak some pointers first so we can calculate the base for the binary and the libc and compute new offsets.

Let’s focus on this ptr_commands table and notice that for the login structure, the function pointer at 0x203C68 is perfectly aligned with the fixed_result table’s 11 result:

0x203168 (fixed_result_table) + 11 * 256 = 0x203C68

So “show 11” will leak the do_login pointer. We know the do_login function is at offset 0x19d0 in the binary, so the ELF base is going to be:

base = do_login – 0x19d0

Unfortunately we can only leak past the fixed_result_table as the ‘show’ command will not accept a negative index. So we need to find a way to leak the GOT table to calculate the libc base.

The help command to the rescue:

help will print a description of the command, this description is referenced inside our ptr_commands table:

If we change offset 0x203b90 (aHelpPrintThisH) to another location, that location will be printf. Obvious candidates are entries in GOT table:

We will leak 2 pointers so we can calculate the distance between and verify that the distance match indeed with Ubuntu Saucy Server x86_64’s libc.

After this sql injection, the help command’s description string will be a pointer to read@plt in the GOT table. Then we can call the help command and decode the pointer from the output.

We now have read()’s location in the libc, we calculate system() location based on the fact that is this Ubuntu Saucy Server x86_64 libc:

system_plt = read_plt – 0x716be0

Next step is to overwrite again with a SQL injection the ‘help’ command structure but this time we overwrite the function pointer: typing “help cat /home/user/flag” will in fact call system(“cat /home/user/flag”).

And we are done.

Full exploit:

Output: