0

Working on a CTF challenge and the coordinators hint suggests that one of the vectors to inject shellcode is via pathing. Looking at debugging prints does show the cwd and filename are passed onto the stack and a quick test shows creating a symlink and using that the pathing is reflected on the stack. I took a shellcode template produced by pwntools, stored it in a bytestring and created both a file and directory containing the bytestrings.This is what I'm seeing, one contains NOPs pre-appended the other just the shellcode.

enter image description here

Inspecting the stack, I'm seeing that each char is encoded into ASCII so "90" becomes 3930. I'm a bit lost as to how I can preserve the bytestring or encode this first so that when it's read in as a string it can interpreted as the correct bytes. Any suggestions would be very welcome!

EDIT:

Here's what I am working with, new to pwntools but this is my bytestring that I'm trying to inject into a filename. The last entry shows what I'm seeing reflected in memory when inspecting the directory or symlink execution shown above.

enter image description here

Here's what I'm seeing in GDB where the filename gets read in as a string:

enter image description here

Finally, here's what I see when inspecting the hex contents of these addresses, we see the ASCII values for each char in the string.

enter image description here

Improve this question
3
  • Convert every byte to hexadecimal. It will use only chars 0-9 and A-F, and they are valid chars for filenames. Later convert back from hexadecimal to binary.
    – ThoriumBR
    Sep 19 at 20:35
  • I'm not sure I have the ability to convert back, I need a format to write my shellcode into a filename or directory and have that format be interpreted in a manner that when executing the ctf binary I can jump to where the filename is on the stack and have it execute. My issue is that every attempt so far looks to be treated like a string and each char gets converted. Could have been a bad hint.
    – TKC
    Sep 19 at 21:36
  • How are you passing the filename to pwndbg?
    – paulahniuk
    Sep 20 at 16:03

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .