> For the complete documentation index, see [llms.txt](https://www.ctfrecipes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/blind-return-oriented-programming-brop/challenge-example.md).

# Challenge example

## Source code

{% tabs %}
{% tab title="Vulnerable" %}
{% code lineNumbers="true" %}

```c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "serve.h"

int fd_f;

int authentification(void) {
    char buf[20];
    char passwd[16] = "";  // array to store the secret pass

    FILE *fp = fopen(".passwd", "r");
    fread(passwd, 1, 15, fp);
    fclose(fp);
    passwd[15] = '\0';

    write(fd_f, "Password :\n",11);
    read(fd_f, buf, 1024);
    if (!strcmp(buf, passwd)) {
        return 1;
    } else {
        return 0;
    }
}

void admin(void){
    write(fd_f, "Congratulation\n", 15);
}

void serve(int fd_) {
    int auth;
    fd_f = fd_;

    write(fd_f, "Welcome, please login in order to use the app.\n",47);
    auth = authentification();

    if (auth) {
        write(fd_f, "Welcome User\n",13);
    } else {
        write(fd_f, "Bad password\n",13);
    }
    return;
}


int main() {
    Serve socket = Serve_Create();

    if(socket.Bind(&socket, "0.0.0.0", 1337) < 0){
        perror("Binding socket error :");
        exit(1);
    } else if (socket.Listen(&socket, serve, 5) < 0){
        perror("Listen error :");
        exit(1);
    }
    return 0;
}
```

{% endcode %}

The binary is compiled with both [PIE ](/pwn/protections/pie.md)and [Stack canary](/pwn/protections/stack-canaries.md) and is served using the serve.c code

{% hint style="info" %}
The serve.c code will not be explain here.

It will just serve the binary over a socket and make a **fork** of it to handle multiple connection at a time.
{% endhint %}
{% endtab %}

{% tab title="Patched" %}
{% code lineNumbers="true" %}

```c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "serve.h"

int fd_f;

int authentification(void) {
    char buf[20];
    char passwd[16] = "";  // array to store the secret pass

    FILE *fp = fopen(".passwd", "r");
    fread(passwd, 1, 15, fp);
    fclose(fp);
    passwd[15] = '\0';

    write(fd_f, "Password :\n",11);
    read(fd_f, buf, 19);
    if (!strcmp(buf, passwd)) {
        return 1;
    } else {
        return 0;
    }
}

void admin(void){
    write(fd_f, "Congratulation\n", 15);
}

void serve(int fd_) {
    int auth;
    fd_f = fd_;

    write(fd_f, "Welcome, please login in order to use the app.\n",47);
    auth = authentification();

    if (auth) {
        write(fd_f, "Welcome User\n",13);
    } else {
        write(fd_f, "Bad password\n",13);
    }
    return;
}


int main() {
    Serve socket = Serve_Create();

    if(socket.Bind(&socket, "0.0.0.0", 1337) < 0){
        perror("Binding socket error :");
        exit(1);
    } else if (socket.Listen(&socket, serve, 5) < 0){
        perror("Listen error :");
        exit(1);
    }
    return 0;
}
```

{% endcode %}
{% endtab %}
{% endtabs %}

The buffer overflow occur during the `authentication` function at line 19 :

```c
read(fd_f, buf, 1024);
```

## Exploitation

Using the [stack reading](/pwn/stack-exploitation/stack-buffer-overflow/stack-reading.md) technique is possible to retrieve the needed values and then reuse it and overwrite RIP to search gadgets.

[Bropper ](https://github.com/Hakumarachi/Bropper)can be used to do it

```bash
$ python3 bropper.py -t 127.0.0.1 -p 1337 --wait "Password :" --expected Bad --expected-stop Welcome -o dump
```

## Exercice

If you want to try this exploit by yourself, you can pull [this docker image](https://hub.docker.com/r/thectfrecipes/pwn/general) :

```
docker pull thectfrecipes/pwn:brop
```

Deploy the image using the followed command :

```
docker run --name buffer_overflow_brop -it --rm -d -p 3000:3000 thectfrecipes/pwn:brop
```

Access to the web shell with your browser at the address : `http://localhost:3000/`

```
login: challenge
password: password
```