Skip to content

Guide-Pwn.md

Latest commit

 

History

History
188 lines (139 loc) · 8.47 KB

Guide-Pwn.md

File metadata and controls

188 lines (139 loc) · 8.47 KB

The Beginner's Guide to PWN CTF Challenges

What is PWN?

PWN (pronounced "pown") refers to the exploitation of vulnerabilities in binary programs to gain unauthorized control. In CTF competitions, PWN challenges typically involve finding and exploiting security flaws in provided executable files to obtain a "flag" (secret token).

At its core, PWN is about understanding how programs work at a low level and finding ways to manipulate their behavior. When you successfully "pwn" a program, you've taken control of it in a way its developers never intended.

Important PWN Terminology

Buffer Overflow: When a program writes data beyond the allocated memory space (buffer), potentially overwriting adjacent memory areas.

Shellcode: A small piece of code used as the payload in exploits to execute commands, often to spawn a shell.

Memory Address Space: The organization of memory in a running program, including stack, heap, and code sections.

Stack: A region of memory that stores local variables and return addresses. Key target in many PWN challenges.

Heap: A memory region used for dynamic memory allocation during program execution.

ROP (Return-Oriented Programming): Technique that chains together existing code fragments ("gadgets") to perform arbitrary operations, bypassing security protections.

PIE (Position Independent Executable): A binary that loads at a random base address each time it runs, complicating exploitation.

ASLR (Address Space Layout Randomization): A security technique that randomly arranges memory addresses, making it harder to predict where specific data resides.

Canary/Stack Cookie: A value placed between a buffer and control data to detect buffer overflows.

GOT (Global Offset Table) & PLT (Procedure Linkage Table): Structures used to resolve external function calls in dynamically linked binaries.

Libc: The standard C library containing implementations of standard functions. Often a target in multi-stage exploits.

Common PWN Challenge Types

1. Classic Buffer Overflow

  • Description: The simplest form where you overflow a buffer to overwrite a return address.
  • Goal: Usually to redirect program execution to a function that gives you a shell or prints the flag.
  • Example: A program takes user input without proper bounds checking, allowing you to overwrite the return address.

2. Format String Vulnerabilities

  • Description: Exploiting improper use of format functions like printf().
  • Goal: Read from or write to arbitrary memory locations.
  • Example: When a program passes user input directly to printf() without a format specifier, e.g., printf(user_input) instead of printf("%s", user_input).

3. Use-After-Free (UAF)

  • Description: Accessing memory after it has been freed.
  • Goal: Manipulate program data structures by exploiting memory management flaws.
  • Example: A program frees an object but continues to use it, allowing you to manipulate what fills that memory location.

4. Return-Oriented Programming (ROP)

  • Description: Challenges where direct code execution is prevented, requiring you to chain existing code fragments.
  • Goal: Bypass security mechanisms like NX (non-executable memory).
  • Example: A program with stack overflow vulnerability but with non-executable stack protection.

5. Heap Exploitation

  • Description: Exploiting vulnerabilities in heap memory management.
  • Goal: Manipulate the heap structure to gain control over program execution.
  • Example: Double-free bugs, heap overflow, or use-after-free scenarios on the heap.

6. Integer Overflow/Underflow

  • Description: When arithmetic operations produce a result outside the range that can be represented.
  • Goal: Bypass size checks or allocate less memory than needed.
  • Example: A program allocates memory based on user input, and an integer overflow allows allocating less memory than needed.

Essential PWN Tools and When to Use Them

GDB (GNU Debugger) + GEF/PEDA Extensions

  • Purpose: Debugging tool to analyze program execution, inspect memory, and set breakpoints.
  • When to Use: For examining program state, understanding crashes, and verifying exploit attempts.
  • Example Command: gdb -q ./vulnerable_binary

Pwntools (Python Library)

  • Purpose: Provides utilities for developing exploits quickly and reliably.
  • When to Use: For almost all PWN challenges - it handles connections, packing/unpacking addresses, and more.
  • Example Code:
from pwn import *

# Connect to a remote service
conn = remote('challenge.com', 1337)
# Or run a local binary
# conn = process('./vulnerable_binary')

# Send data
conn.sendline(b'A' * 40 + p64(target_address))

# Receive output
response = conn.recvline()
print(response)

# Interactive shell
conn.interactive()

Ghidra/IDA Pro

  • Purpose: Disassemblers and decompilers that convert binary code to assembly and approximate C code.
  • When to Use: To understand the program's logic, identify vulnerabilities, and locate critical functions.
  • Example Workflow: Open binary → Analyze → Examine main function → Look for unsafe functions like gets(), strcpy(), etc.

checksec

  • Purpose: Checks which security mechanisms are enabled in a binary.
  • When to Use: At the start of every challenge to understand what protections you need to bypass.
  • Example Command: checksec ./vulnerable_binary
  • Output Explanation:
    • RELRO: Controls how the GOT is structured
    • Stack: Stack protection mechanisms (canaries)
    • NX: Non-executable memory
    • PIE: Position Independent Executable
    • RUNPATH/RPATH: Runtime library search paths

ROPgadget/Ropper

  • Purpose: Finds ROP gadgets in binaries.
  • When to Use: When NX is enabled and you need to chain existing code snippets.
  • Example Command: ROPgadget --binary ./vulnerable_binary --only "pop|ret"

radare2 (r2)

  • Purpose: An open-source disassembler and debugger.
  • When to Use: As an alternative to GDB/Ghidra for analyzing binaries.
  • Example Command: r2 -d ./vulnerable_binary

Objdump

  • Purpose: Displays information about object files.
  • When to Use: To quickly examine binary sections or disassemble specific functions.
  • Example Command: objdump -d ./vulnerable_binary

ltrace/strace

  • Purpose: Trace library calls (ltrace) or system calls (strace).
  • When to Use: To understand how a program interacts with libraries or the system.
  • Example Command: ltrace ./vulnerable_binary

Step-by-Step Approach to PWN Challenges

  1. Reconnaissance:

    • Run file to identify the file type (32-bit or 64-bit).
    • Run checksec to identify security protections.
    • Try running the program to understand its behavior.

  2. Analysis:

    • Use Ghidra/IDA to decompile and analyze the code.
    • Look for vulnerable functions (gets, strcpy, scanf without bounds checking).
    • Identify key functions (main, win, print_flag, etc.).

  3. Exploitation Planning:

    • Determine the vulnerability type.
    • Find the offset needed to control program execution.
    • Plan how to bypass any security mechanisms.

  4. Development:

    • Write an exploit using pwntools.
    • Test locally before attempting remote exploitation.
    • Use GDB to debug and refine your exploit.

  5. Execution:

    • Run your exploit against the remote target.
    • Capture the flag.

Common PWN Pitfalls for Beginners

  • Endianness confusion: Remember x86 is little-endian (bytes reversed).
  • Forgetting NULL bytes: Some functions like strcpy() stop at NULL bytes.
  • Ignoring ASLR: If enabled, addresses change each run.
  • Overlooking simple solutions: Sometimes there's a "backdoor" function that gives you the flag directly.
  • Incorrect offsets: Double-check your buffer overflow offset calculations.

Quick Reference: Typical Buffer Overflow Workflow

  1. Find the buffer size and offset to return address:

    python -c "print('A' * 100)" | ./vulnerable_binary

    or use pwntools' cyclic pattern:

    from pwn import *
pattern = cyclic(100)
# After crash, find offset with:
offset = cyclic_find(value_at_crash_address)

  2. Identify target address (e.g., a win function or system call).

  3. Craft your payload:

    payload = b'A' * offset + p64(target_address)

  4. Test and refine until successful.

Remember, PWN challenges are about patience and understanding. Start with the simplest challenges and gradually build your skills. Good luck!