{"id":1789,"date":"2016-01-25T05:27:45","date_gmt":"2016-01-25T05:27:45","guid":{"rendered":"https:\/\/www.hackmethod.com\/?p=1789"},"modified":"2022-06-03T06:01:31","modified_gmt":"2022-06-03T06:01:31","slug":"overthewire-narnia-0","status":"publish","type":"post","link":"https:\/\/hackmethod.com\/overthewire-narnia-0\/","title":{"rendered":"OverTheWire – Narnia 0"},"content":{"rendered":"\n\n\n
Introduction<\/a> Source Code vs Executable Code<\/a> Narnia Level 0 – Source Code<\/a> Narnia Level 0 – Exploitation<\/a> Narnia Level 0 – Solution<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n
\n
\n

Introduction<\/span><\/span><\/strong><\/span><\/h4>\n<\/div>\n
This is an introduction to reverse engineering. I will be going through a series of reverse engineering puzzles developed by OverTheWire and explaining the methodology I used to solve these puzzles.<\/span><\/span><\/div>\n

<\/p>\n

In the challenges that are provided, you are given an executable and the source code to a program. The goal is to figure out a way to exploit or PWN the executable. Exploitation in this context typically refers to <\/span>overwriting<\/span> system memory to achieve some unintended outcome. Lets first talk about the files that are give to you.<\/span><\/span><\/p>\n

\n
\n

Source Code vs Executable Code<\/strong><\/span><\/h4>\n

Source code is the original language that a program is written in. Source code is then compiled into a set of instructions that the computer processor can execute. This translation from source code to executable <\/span><\/span>code must happen, because computer processors do not understand source code, but they do understand the machine instructions inside executable code. Lets take <\/span><\/span>a look at the difference<\/p>\n<\/div>\n<\/div>\n

\"HelloWorld.c\"    Figure 1. Example C Source Code<\/div>\n
<\/div>\n
\n
\"HelloWorld.obj\"<\/a>Figure 2. Example C Executable Code<\/div>\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n
<\/div>\n
\n
\n
\n
As you can see from the examples above, even for a small “Hello World!” program, machine instructions are not easy to read, which is why high level source code exists in the first place. High level programming languages such as C, C++ and Java, are easier to understand and are human readable. Even without being a programmer, you can probably determine that the source code in figure 1 prints the text “Hello World” to the screen.<\/div>\n
<\/div>\n
Unfortunately for the reverse engineer, most compiled programs do not come with the source code that was used to generate them. This is done for a couple of reasons, first, the source code is not needed for a program to run, the only thing a computer needs is the compiled object code, therefore shipping a program without the source code makes it smaller. Second, people who sell their programs for a profit, don’t want you to see how they created the program, or else anyone could steal the code and compile it for themselves without paying. <\/span><\/div>\n
\n
\n
\n

Narnia Level 0 – Source Code<\/span><\/strong><\/span><\/h1>\n

Lets get started…<\/p>\n<\/div>\n

First we must ssh into the game server using the following credentials:<\/p>\n

Server<\/strong>: narnia.labs.overthewrite.org Username<\/strong>: narnia0 Password<\/strong>: narnia0<\/p>\n<\/div>\n

\n
The \/narnia<\/strong> folder holds all of the challanges for each level, but our current permissions level only allows us access to the level 0 files, which are: narnia0<\/strong> and narnia0.c<\/strong> . What are these two files? The first one is the compiled program and the second one is the source code.<\/span><\/div>\n
Lets first look at the source code<\/span><\/div>\n
\n\n\n\n
\"Narnia0Source1\"<\/a><\/span><\/span>

<\/p>\n

Here we see two variables being created, val<\/strong> is initialized to the hex value 0x41414141<\/em> and buf<\/strong> is an array that is not initialized to any value, but space has been reserved for 20 1-byte values. <\/span>The “char” data type in C is defined as 1-byte in length, therefore char buf[20]<\/strong> reserves 20 consecutive 1-byte memory locations. <\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

\n\n\n\n
\"Narnia0Source2\"<\/a><\/span>These are the instructions that tell you what your trying to accomplish. The variable val<\/strong>, has been initialized to the value 0x41414141<\/em>, the program wants you to somehow change it to the value 0xdeadbeef<\/em>.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
\n\n\n\n
\n
\"Narnia0Source3\"<\/a><\/div>\n
 The scanf function is used for user input. The %24s means that the function will accept a 24 byte character string (1 char = 1 byte) and store that into the buf<\/strong> variable, but if you remember buf<\/strong> was only allocated 20 bytes of memory. This is how we’re going to exploit the program, more on this later.<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n
\"Narnia0Source4\"<\/a>These two lines help you see what values were actually stored in buf<\/strong> and val<\/strong> after scanf()<\/strong><\/span>received<\/span> user input.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n
\"Narnia0Source5\"<\/a>If you correctly overwrite va<\/strong>l’s memory location to hold 0xdeadbeef<\/em>, then this branching statement gives you a shell (command prompt). Otherwise, it prints “WAY OFF!!!!”<\/em> and then exits. Don’t despair, it doesn’t matter how close you are, it will always print this statement if it is incorrect.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n
\n
\n
\n

Narnia Level 0 – Exploitation<\/span><\/strong><\/span><\/h1>\n

As I stated before, we will need to take advantage of<\/p>\n

scanf()<\/strong> in order to exploit this program, but to understand how, we first need to understand how programs get mapped into system memory.<\/p>\n<\/div>\n

Every program gets mapped into memory and uses a data structure known as “the stack” to store information such as variables, arguments and what instruction to execute next. It make sense to store these variables on the stack so that they can be easily and quickly retrieved as the program runs. Here is a graphical representation of what the stack looks like. <\/span> \"\"<\/a><\/span><\/p>\n

Notice the arrow pointing from high memory to low memory, this is because the stack grows towards the lower memory locations. That means that if a programs defines three variables in the following order… <\/span>int x= 10 <\/span>int y = 20 <\/span>int z = 30 <\/span>…then they will be stored on the stack as such. <\/span><\/p>\n

\"\"<\/a><\/span><\/p>\n

In order to exploit narnia0<\/strong>, this is all the information that we need to know. Other details about the stack such as the return address and old EBP (base pointer) will be explained in detail as we progress through the other levels. <\/span>Lets see how the the narnia0<\/strong> program looks on the stack.<\/span>\"\"<\/a><\/span><\/p>\n

Since the stack grows from high memory to low memory, val<\/strong> is stored at a higher memory address than buf<\/strong>, because val<\/strong> was declared first in the program. Notice that the main program does not take any arguments on the command line, so those memory locations on the stack have been grey out (in reality they don’t even exist), and since this challenge only require us to manipulate buf<\/strong> and val<\/strong>, I’ve also grayed out Old EBP and Return Address, again we’ll discuss the purpose of these during future levels. How are we going to change val<\/strong> on the stack, so that it reads 0xdeadbeef<\/em>? Remember the scanf()<\/strong> function that reads in 24 bytes of data? For the visual learners, here’s how that looks in memory. <\/span>\"\"<\/a><\/span><\/p>\n

Each square in the illustration above represents 1-byte. val<\/strong> is of type long and long is defined as being 8-bytes. Again, we see that scanf()<\/strong> is set to take in 24-bytes of input and store them in the memory location of buf<\/strong>. The scanf()<\/strong> function does not check or care how big the destination location is; therefore, by filling up the scanf()<\/strong> buffer, we can overwrite the adjacent memory location of val<\/strong>.<\/span><\/p>\n

\n

Narnia Level 0 – Solution<\/span><\/span><\/strong><\/h1>\n

Armed with the knowledge above, you may be temped (as I was) to try and solve the puzzle.<\/span> Attempt 1:<\/span><\/strong><\/p>\n

\"NarniaAttemp1\"<\/a><\/span><\/p>\n

Although this did not work, important information can be gleaned from our failure. The first thing to notice is that value 0x64616564 is no where close to 0xdeadbeef. The answer to why lies on the second line that says “Correct val’s value from 0x4141414141 to 0xdeadbeef”. The 0x portion means that it wants the value of val to be in hex, but instead we passed it ASCII. The second thing to notice is that 0x64616564 is the ASCII equivalent of daed (or dead backwards). The reason our input was displayed backwards is because most x86 architectures store data in little-endian format when it is pushed onto the stack. This means that the least significant byte (far right value) gets stored in the lowest memory location, for example, if we set val <\/strong>to Hello<\/em>, it would be stored in memory like this… \"\"<\/a><\/p>\n

Using this information lets try again. Attempt 2:<\/strong>\"NarniaAttemp2\"<\/a><\/p>\n

First we need to figure out how to get hex into our ASCII input. The BASH shell has the ability to represent hex using the \\x <\/em>escape sequence, but in order for echo to parse escape sequence we have to add the -e option. Since hex values outside the ASCII range contain non-printable characters that are not easily copied and pasted, we are going to pipe the output directly to the program. This has the affect of storing our custom string into a buffer and waiting for scanf() to read it. Success? Sort of. The program didn’t yell at us and the val<\/strong> has been overwritten to the correct value, but the program closes immediately without allowing us to use our newly acquired privileges. Attempt 3:<\/strong> SUCCESS!<\/p>\n

\"NarniaAttemp3\"<\/a><\/p>\n

If you create a command group ( command 1 ; command 2; )<\/em> and pipe the result to your program, each command is provided as a separate input to the program. The first input is our custom string which gets fed to the scanf()<\/strong> function. After the program executes system(“\/bin\/sh”)<\/strong> we are given a command shell, by passing cat to the command shell as a the second input, it keeps the command shell open, we are free to run any commands under the new elevated permissions. (I have scoured the internet high and low to figure out how and why that last part works, but have yet to find a solid answer).<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n

That wasn’t so difficult, was it? Pretty simple tbh. If you’re interested and want to keep going, check out Narnia Level 1 using the button below.<\/p>\n\n\n\n

\n
\n

<\/p>\n<\/div>\n\n\n\n

\n
Narnia Level 1
<\/a><\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Introduction Source Code vs Executable Code Narnia Level 0 – Source Code Narnia Level 0 – Exploitation Narnia Level 0 – Solution Introduction This is an introduction to reverse engineering. I will be going through a series of reverse engineering puzzles developed by OverTheWire and explaining the methodology I used to solve these puzzles.<\/p>\n","protected":false},"author":8,"featured_media":1842,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[52,49],"tags":[],"class_list":["post-1789","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacking","category-tutorials"],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/hackmethod.com\/wp-content\/uploads\/2016\/01\/NarniaImage.jpeg?fit=600%2C400&ssl=1","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p5zY4D-sR","_links":{"self":[{"href":"https:\/\/hackmethod.com\/wp-json\/wp\/v2\/posts\/1789","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hackmethod.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hackmethod.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hackmethod.com\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/hackmethod.com\/wp-json\/wp\/v2\/comments?post=1789"}],"version-history":[{"count":55,"href":"https:\/\/hackmethod.com\/wp-json\/wp\/v2\/posts\/1789\/revisions"}],"predecessor-version":[{"id":27862,"href":"https:\/\/hackmethod.com\/wp-json\/wp\/v2\/posts\/1789\/revisions\/27862"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hackmethod.com\/wp-json\/wp\/v2\/media\/1842"}],"wp:attachment":[{"href":"https:\/\/hackmethod.com\/wp-json\/wp\/v2\/media?parent=1789"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hackmethod.com\/wp-json\/wp\/v2\/categories?post=1789"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hackmethod.com\/wp-json\/wp\/v2\/tags?post=1789"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}