Running this gets us all the information we need to build a ROP chain:Īndrew ~/fusion/level04 $. Password += b'A' * (offset - buff - len(password)) Offset = 2080 # Bytes from 'details' buffer to saved ret addressīuff = 32 # Number of bytes from the canary to the saved return address

I’m still not sure why this happens so feel free to leave a comment if you know. The conditions for this seem to be having an incorrect value for the canary and the saved return address must be overwritten with a value somewhere between 0xb75d2000 and 0xbfa5dffc. I had inadvertently obtained a backtrace and memory map. Honestly, I got lucky here while playing around with this. text section (and a few others) we normally rely on to have consistent addresses are now impacted by ASLR.

This part is a little more difficult than with past levels as this binary is a “position independent executable” meaning the entire body of code can function properly no matter where, in memory, it’s placed. So the saved return address is 28 bytes after the end of the canary. Now on the Fusion VM, I can check what the value of the EIP register dmesg | tail -n1 Opening connection to fusion on port 20004: Done Now I need to figure out how far after the canary the saved return address is:Īndrew ~/fusion/level04 $. Print(f'Password so far: ')Īndrew ~/fusion/level04 $. I spotted a buffer overflow in the validate_credentials() function:īase64_decode(line, strlen(line), details, &output_len) Next, I’ll look for vulnerabilities to see if I can bypass that authentication. If you just click cancel on the dialog, you’ll get a “401 Unauthorized” message. So the first thing I did was open a browser and tried to connect to the Fusion VM over port 20004:Īs you can see, some basic authentication is required. Starting with the comments, we can see that this is an HTTP server based on an open source implementation called micro_httpd. Like the last level, I won’t go into great detail with all the source code since most of it doesn’t matter. 5 Creating a ROP Chain Source Code Analysis

Stack smashing detected bypass