# Defcon Quals 2019 Speedrun1

Let's take a look at the binary:
```
$    file speedrun-001
speedrun-001: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=e9266027a3231c31606a432ec4eb461073e1ffa9, stripped
$    pwn checksec speedrun-001
[*] '/Hackery/pod/modules/bof_static/dcquals19_speedrun1/speedrun-001'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)
$    ./speedrun-001
Hello brave new challenger
Any last words?
15935728
This will be the last thing that you say: 15935728

Alas, you had no luck today.
```

So we can see that we are dealing with a 64 bit statically compiled binary. This binary has NX (Non-Executable stack) enabled, which means that the stack memory region is not executable. For more info on this, we can check the memory mappings with the `vmmap` command while the binary is running:

```
gef➤  vmmap
Start              End                Offset             Perm Path
0x[PII_REDACTED]400000 0x[PII_REDACTED]4b6000 0x[PII_REDACTED]000000 r-x /Hackery/pod/modules/bof_static/dcquals19_speedrun1/speedrun-001
0x[PII_REDACTED]6b6000 0x[PII_REDACTED]6bc000 0x[PII_REDACTED]0b6000 rw- /Hackery/pod/modules/bof_static/dcquals19_speedrun1/speedrun-001
0x[PII_REDACTED]6bc000 0x[PII_REDACTED]6e0000 0x[PII_REDACTED]000000 rw- [heap]
0x00007ffff7ffa000 0x00007ffff7ffd000 0x[PII_REDACTED]000000 r-- [vvar]
0x00007ffff7ffd000 0x00007ffff7fff000 0x[PII_REDACTED]000000 r-x [vdso]
0x00007ffffffde000 0x00007ffffffff000 0x[PII_REDACTED]000000 rw- [stack]
0xffffffffff600000 0xffffffffff601000 0x[PII_REDACTED]000000 r-x [vsyscall]
```

Here we can see that the memory region for the stack begins at `0x00007ffffffde000` and ends at `0x00007ffffffff000`. We can see that the permissions are `rw`. There are three different permissions you can assign to a memory region, `r` for it to be readable, `w` for it to be writable, and `x` for it to be executable. Since the stack has the permissions `rw` assigned to it, we can read and write to it. So pushing shellcode onto the stack and executing it isn't an option.

Also since the binary is statically compiled, that means that the libc portions the binary needs are compiled with the binary. So libc is not linked to the binary (as you can see there is no libc memory region). As a result, there are a lot of potential gadgets (will be covered later in this writeup) for us to use. In addition to that, since PIE (Position Independent Executable) is not enabled we know the addresses of all of those gadgets. What PIE does is it essentially incorporates ASLR into addresses from the binary, so we would need to leak an address from that memory region to know any of the addresses. Also since the binary has a lot more code in it as a result of being statically compiled, ghidra will take a bit of time to analyze it.

When we run the binary, it essentially just prompts us for input. When we take a look at the binary in Ghidra, we see a long list of functions. To find out which one actually runs the code we look for, we can use the backtrace (`bt`) command in gdb when it prompts us for input, which will tell us the functions that have been called to reach the point we are at:

```
gef➤  r
Starting program: /Hackery/pod/modules/bof_static/dcquals19_speedrun1/speedrun-001
Hello brave new challenger
Any last words?
^C
Program received signal SIGINT, Interrupt.
[ Legend: Modified register | Code | Heap | Stack | String ]
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────
$rax   : 0xfffffffffffffe00
$rbx   : 0x[PII_REDACTED]400400  →   sub rsp, 0x8
$rcx   : 0x[PII_REDACTED]4498ae  →  0x5a77fffff0003d48 ("H="?)
$rdx   : 0x7d0             
$rsp   : 0x00007fffffffda28  →  0x[PII_REDACTED]400b90  →   lea rax, [rbp-0x400]
$rbp   : 0x00007fffffffde30  →  0x00007fffffffde50  →  0x[PII_REDACTED]401900  →   push r15
$rsi   : 0x00007fffffffda30  →  0x[PII_REDACTED]000000
$rdi   : 0x0               
$rip   : 0x[PII_REDACTED]4498ae  →  0x5a77fffff0003d48 ("H="?)
$r8    : 0xf               
$r9    : 0x0               
$r10   : 0x[PII_REDACTED]42ae30  →   pslldq xmm2, 0x3
$r11   : 0x246             
$r12   : 0x[PII_REDACTED]4019a0  →   push rbp
$r13   : 0x0               
$r14   : 0x[PII_REDACTED]6b9018  →  0x[PII_REDACTED]440ea0  →   mov rcx, rsi
$r15   : 0x0               
$eflags: [ZERO carry PARITY adjust sign trap INTERRUPT direction overflow resume virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────
0x00007fffffffda28│+0x0000: 0x[PII_REDACTED]400b90  →   lea rax, [rbp-0x400]     ← $rsp
0x00007fffffffda30│+0x0008: 0x[PII_REDACTED]000000     ← $rsi
0x00007fffffffda38│+0x0010: 0x[PII_REDACTED]000000
0x00007fffffffda40│+0x0018: 0x[PII_REDACTED]000000
0x00007fffffffda48│+0x0020: 0x[PII_REDACTED]000000
0x00007fffffffda50│+0x0028: 0x[PII_REDACTED]000000
0x00007fffffffda58│+0x0030: 0x[PII_REDACTED]000000
0x00007fffffffda60│+0x0038: 0x[PII_REDACTED]000000
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────
     0x44989f                  add    BYTE PTR [rbx+0x272f6605], cl
     0x4498a5                  add    BYTE PTR [rbp+0x311675c0], al
     0x4498ab                  ror    BYTE PTR [rdi], 0x5
 →   0x4498ae                  cmp    rax, 0xfffffffffffff000
     0x4498b4                  ja     0x449910
     0x4498b6                  repz   ret
     0x4498b8                  nop    DWORD PTR [rax+rax*1+0x0]
     0x4498c0                  push   r12
     0x4498c2                  push   rbp
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "speedrun-001", stopped, reason: SIGINT
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x4498ae → cmp rax, 0xfffffffffffff000
[#1] 0x400b90 → lea rax, [rbp-0x400]
[#2] 0x400c1d → mov eax, 0x0
[#3] 0x4011a9 → mov edi, eax
[#4] 0x400a5a → hlt
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
0x[PII_REDACTED]4498ae in ?? ()
gef➤  bt
#0  0x[PII_REDACTED]4498ae in ?? ()
#1  0x[PII_REDACTED]400b90 in ?? ()
#2  0x[PII_REDACTED]400c1d in ?? ()
#3  0x[PII_REDACTED]4011a