We are given a binary file the_hinge_whisper:

file the_hinge_whisper

the_hinge_whisper: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=5c9da03ab7d1ba6428268efa73d1d6e650befb5f, for GNU/Linux 3.2.0, not stripped

Let's load the binary in Ghidra. There is an interesting function called service_hatch:

void service_hatch(void)

{
  undefined1 local_48 [64];

  printf("  [+] The keyway sits at: %p\n",local_48);
  printf("  [+] Forge your latch-key: ");
  fflush(stdout);
  read(0,local_48,0x50);
  return;
}

There is a buffer overflow vulnerability in this function. The buffer local_48 is 64 bytes long, but the program reads up to 80 bytes from standard input into it.

Let's check the protections of the binary:

checksec the_hinge_whisper

    Arch:       amd64-64-little
    RELRO:      Full RELRO
    Stack:      No canary found
    NX:         NX unknown - GNU_STACK missing
    PIE:        PIE enabled
    Stack:      Executable
    RWX:        Has RWX segments
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No

Interestingly, the binary has no stack canary and the stack is executable. That means that we can inject shellcode into the stack and, if we find a way to jump to it, we can execute it.

Fortunately, the program prints the start address of the buffer. Therefore we can exploit the buffer overflow vulnerability to overwrite the return address of the function with the address of the buffer. In the buffer, we will place our shellcode. When the function returns, it will jump to our shellcode and execute it.

See the script sol.py for the full solution.

See the file shellcode_64.asm for the source code of the shellcode.