i’m making a ctf in rust rocket on the topic of buffer overflow, however when i try to get to the flag by entering something too long, my rocket server crashes. not only that but it always gives me the same error and doesn’t give me what i tell him to print.
this is my rocket server:
#[macro_use] extern crate rocket;
use rocket::serde::json::Json;
use rocket::serde::Deserialize;
use rocket::serde::Serialize;
use rocket::post;
use rocket::http::Header;
use rocket::response::status;
use rocket::response::status::Custom;
use rocket::http::Status;
use rocket::http::Method;
use rocket_cors::{CorsOptions, AllowedHeaders, AllowedOrigins};
use std::process::Command;
#[repr(C)]
struct Hackvist {
buffer: [u8; 16],
point: *const fn(),
}
#[post("/execute", data = "<data>")]
fn execute_command(data: Json<ExecuteRequest>) -> Json<ExecuteResponse> {
let input_command = data.command.clone();
let mut hackvist = Hackvist {
buffer: [0; 16],
point: 0 as *const fn() -> (),
};
let input_bytes: &[u8] = input_command.as_bytes();
unsafe {
std::ptr::copy(
input_bytes.as_ptr(),
hackvist.buffer.as_mut_ptr(),
input_bytes.len(),
)
}
let result = if hackvist.point as usize == 0 {
"Try again".to_string()
} else {
let code: fn() = unsafe { std::mem::transmute(hackvist.point) };
code();
"Success".to_string()
};
Json(ExecuteResponse { result })
}
#[derive(Deserialize)]
struct ExecuteRequest {
command: String,
}
#[derive(Serialize)]
struct ExecuteResponse {
result: String,
}
#[options("/execute")]
fn options_execute() -> status::Custom<String> {
let header_value = "Access-Control-Allow-Origin: *";
let header = Header::new("Access-Control-Allow-Origin", header_value);
status::Custom(Status::Ok, header.value().to_string())
}
#[rocket::main]
async fn main() {
let cors = CorsOptions {
allowed_origins: AllowedOrigins::all(),
allowed_methods: vec![rocket::http::Method::Get, rocket::http::Method::Post, rocket::http::Method::Put]
.into_iter()
.map(From::from)
.collect(),
allowed_headers: AllowedHeaders::all(),
allow_credentials: true,
..Default::default()
}
.to_cors()
.expect("Cors configuration failed");
rocket::build()
.attach(cors)
.mount("/", routes![execute_command, options_execute])
.launch()
.await
.expect("Rocket did not launch successfully");
}
this is the error:
OPTIONS /execute:
>> Matched: (options_execute) OPTIONS /execute
>> Outcome: Success(200 OK)
>> Response succeeded.
POST /execute application/json:
>> Matched: (execute_command) POST /execute
error: process didn't exit successfully: `targetdebugrocket.exe` (exit code: 0xc0000005, STATUS_ACCESS_VIOLATION)
the rocket is more or less supposed to function like this:
https://tgrez.github.io/posts/2022-06-19-buffer-overflow-in-rust.html