{"id":68,"date":"2022-07-17T22:07:46","date_gmt":"2022-07-17T22:07:46","guid":{"rendered":"http:\/\/moveax.me\/?p=68"},"modified":"2022-08-31T19:01:27","modified_gmt":"2022-08-31T19:01:27","slug":"protostar-unravel-stack0-with-radare2","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/protostar-unravel-stack0-with-radare2\/","title":{"rendered":"Protostar: Unravel stack0 with Radare2"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">After a few months without using radare2 it\u2019s now time to get back to the write ups. During this time, and as you can see in my previous posts, I\u2019ve been acquiring knowledge in other IT Security areas. I\u2019ll now return with&nbsp;<a href=\"\">Protostar<\/a>&nbsp;challenges and Radare2, starting with&nbsp;<a href=\"\">stack0<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Looking at the code for the stack0 challenge, we can realize it\u2019s not that complicated. The program collects input from the user and after that, checks if the modified variable, set to 0 in the beginning of the program has changed. But wait\u2026 how can it be changed if there isn\u2019t a single line of code that changes this variable??? Let\u2019s see if the assembly has the answer.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/07\/afll.png\" alt=\"afll\" class=\"wp-image-868\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">We basically have the main function. Let\u2019s disassemble it and analyze the code.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/07\/main.png\" alt=\"main\" class=\"wp-image-869\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Simple! We have two local variables, local_5ch and local_1ch. The first one is the modified variable, which contains 0. The other one will hold our input. We can also identify the gets function call, which will collect our input and the two strings present in the C code. The&nbsp;<code>jump<\/code>&nbsp;instruction at 0x08048417 address will decide the string to print, based on the result of the test operator.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now let\u2019s retrieve the two variables from the stack.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/07\/px.png\" alt=\"px\" class=\"wp-image-870\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">See? The modified variable is at a higher address than our input and remember, the stack grows from higher addresses to lower addresses. Now, the distance between these two addresses is 0x40 bytes (or 64 in decimal).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Because there\u2019s no limitation on our input, what happens if we write more than 64 bytes of data?<\/strong><\/h3>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/07\/overflow.png\" alt=\"overflow\" class=\"wp-image-872\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Overflow, that\u2019s what happens. In this case a&nbsp;<a href=\"https:\/\/www.owasp.org\/index.php\/Buffer_Overflows\">stack overflow<\/a>, a very known vulnerability. In a stack overflow we write where we\u2019re not supposed to and in stack0 we overwrite the modified variable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you have trouble understanding this by just reading, I advise you to draw the stack like I did in&nbsp;<a href=\"ioli-crackme-radare2\/\">previous posts<\/a>. Remember, doing is better than watching\/reading\u2026<\/p>\n","protected":false},"excerpt":{"rendered":"<p>After a few months without using radare2 it\u2019s now time to get back to the write ups. During this time, and as you can see&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/giga-rapid.com\/esites\/moveaxme\/protostar-unravel-stack0-with-radare2\/\">Continue reading<span class=\"screen-reader-text\">Protostar: Unravel stack0 with Radare2<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,5,1],"tags":[],"class_list":["post-68","post","type-post","status-publish","format-standard","hentry","category-nebula","category-radare2","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/68","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=68"}],"version-history":[{"count":2,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/68\/revisions"}],"predecessor-version":[{"id":111,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/68\/revisions\/111"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=68"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=68"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=68"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}