PIE TIME | CyLab | Writeup

Original article published on Medium - SiapaHeker

Challenge Overview

Can you try to get the flag? Beware we have PIE! Connect to the program with netcat:

nc xebec.cylabacademy.net <PORT>

The program’s source code and the binary are provided.

Hints:

• Can you figure out what changed between the address you found locally and in the server output?

challenge overview

First, i downloaded the given binary and checked the file type using the **file **command.

file output

The binary is a 64-bit PIE executable and it is not stripped, so the function names are still visible. Next, i checked the protections using checksec.

checksec --file=vuln

checksec output

The output shows Full RELRO, stack canary, NX, and PIE are all enabled. Since PIE is enabled, the base address of the binary is randomized every time it runs, so we cannot simply hardcode a function address.

Then i ran the binary locally.

run test

The program prints the address of main, then asks for an address to jump to. When i entered a random address (0x12345), it crashed with a segfault. This tells us the program really jumps to whatever address we give it.

To understand it better, i opened the binary in pwndbg and listed the functions.

pwndbg> info function

info function output

There is an interesting function called win. Here are the offsets that matter: win 0x12aa and main 0x134c

Then i disassembled main.

The relevant part of the code:

• **prinf **prints the address of main (this is our leak)
• scanf reads our input into a variable
• call rax executes the address we entered

So there is no buffer overflow here. We only need to provide the correct address of win. A quick look at **win **shows it opens a file and prints its content, which is exactly what we want.

disassemble win output

PIE only randomizes the base address, the distance between functions inside the binary stays the same. Because the program leaks the address of main, we can calculate **win **from it. First, calculate the difference between the two functions:

p/x &main - &win

offset calculation

Now connect to the server and get the leaked address.

Then subtract the offset from the leaked address:

p/x 0x62306d04834c - 0xa2

Finally, send the calculated address as the input. Note that the address changes on every new connection, so the calculation must be done in the same session.

flag output

and there we goo, we got the flag!!

academy{REDACTED}