For the complete documentation index, see llms.txt. This page is also available as Markdown.

6.1.13 pwn 34C3CTF2017 readme_revenge

ไธ‹่ฝฝๆ–‡ไปถ

้ข˜็›ฎๅค็Žฐ

่ฟ™ไธช้ข˜็›ฎๅฎž้™…ไธŠ้žๅธธๆœ‰่ถฃใ€‚

$ file readme_revenge
readme_revenge: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=2f27d1b57237d1ab23f8d0fc3cd418994c5b443d, not stripped
$ checksec -f readme_revenge
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FORTIFY Fortified Fortifiable  FILE
Partial RELRO   Canary found      NX enabled    No PIE          No RPATH   No RUNPATH   Yes     3               45      readme_revenge

ไธŽๆˆ‘ไปฌ็ปๅธธๆŽฅ่งฆ็š„้ข˜็›ฎไธๅŒ๏ผŒ่ฟ™ๆ˜ฏไธ€ไธช้™ๆ€้“พๆŽฅ็จ‹ๅบ๏ผŒ่ฟ่กŒๆ—ถไธ้œ€่ฆๅŠ ่ฝฝ libcใ€‚not stripped ็ปๅฏนๆ˜ฏไธชๅฅฝๆถˆๆฏใ€‚

$ ./readme_revenge
aaaa
Hi, aaaa. Bye.
$ ./readme_revenge
%x.%d.%p
Hi, %x.%d.%p. Bye.
$ python -c 'print("A"*2000)' > crash_input
$ ./readme_revenge < crash_input
Segmentation fault (core dumped)

ๆˆ‘ไปฌ่ฏ•็€็ป™ๅฎƒ่พ“ๅ…ฅไธ€ไบ›ๅญ—็ฌฆ๏ผŒ็ป“ๆžœ่ขซๅŽŸๆ ทๆ‰“ๅฐๅ‡บๆฅ๏ผŒ่€Œไธ”็œ‹่ตทๆฅไนŸไธๅญ˜ๅœจๆ ผๅผๅŒ–ๅญ—็ฌฆไธฒๆผๆดžใ€‚ไฝ†ๅฝ“ๆˆ‘ไปฌ่พ“ๅ…ฅๅคง้‡ๅญ—็ฌฆๆ—ถ๏ผŒ่งฆๅ‘ไบ†ๆฎต้”™่ฏฏ๏ผŒ่ฟ™ๅ€’ๆ˜ฏไธ€ไธชๅฅฝๆถˆๆฏใ€‚

ๆŽฅ็€ๅˆๅ‘็Žฐไบ†่ฟ™ไธช๏ผš

็œ‹ๆฅ flag ๆ˜ฏ่ขซ้š่—ๅœจ็จ‹ๅบไธญ็š„๏ผŒๅœฐๅ€ๅœจ 0x006b4040๏ผŒไฝไบŽ .data ๆฎตไธŠใ€‚็ป“ๅˆ้ข˜็›ฎ็š„ๅๅญ— readme๏ผŒๆŽจๆต‹่ฟ™้ข˜็š„็›ฎๆ ‡ๅบ”่ฏฅๆ˜ฏไปŽ็จ‹ๅบไธญ่ฏปๅ–ๆˆ–่€…ๆณ„ๆผๅ‡บ flagใ€‚

้ข˜็›ฎ่งฃๆž

ๅ› ไธบ flag ๅœจ็จ‹ๅบ็š„ .data ๆฎตไธŠ๏ผŒๆ นๆฎๆˆ‘ไปฌ็š„็ป้ชŒ๏ผŒๅบ”่ฏฅ่ƒฝๆƒณๅˆฐๅˆฉ็”จ __stack_chk_fail() ๅฐ†ๅ…ถๆ‰“ๅฐๅ‡บๆฅ๏ผˆๅ‚่€ƒ็ซ ่Š‚ 4.12๏ผ‰ใ€‚

main ๅ‡ฝๆ•ฐๅฆ‚ไธ‹๏ผš

ๅพˆ็ฎ€ๅ•๏ผŒไปŽๆ ‡ๅ‡†่พ“ๅ…ฅ่ฏปๅ–ๅญ—็ฌฆไธฒๅˆฐๅ˜้‡ name๏ผŒๅœฐๅ€ๅœจ 0x6b73e0๏ผŒไธ”ไฝไบŽ .bss ๆฎตไธŠ๏ผŒๆ˜ฏไธ€ไธชๅ…จๅฑ€ๅ˜้‡ใ€‚ๆŽฅไธ‹ๆฅ็จ‹ๅบ่ฐƒ็”จ printf ๅฐ† name ๆ‰“ๅฐๅ‡บๆฅใ€‚

ๅœจ gdb ้‡Œ่ฏ•่ฏ•๏ผš

็จ‹ๅบ็š„ๆผๆดžๅพˆๆ˜Žๆ˜พไบ†๏ผŒๅฐฑๆ˜ฏ็ผ“ๅ†ฒๅŒบๆบขๅ‡บ่ฆ†็›–ไบ† libc ้™ๆ€็ผ–่ฏ‘ๅˆฐ็จ‹ๅบ้‡Œ็š„ไธ€ไบ›ๆŒ‡้’ˆใ€‚ๅ†ๅพ€ไธ‹็œ‹ไผšๅ‘็Žฐไธ€ไบ›ๅฏ่ƒฝๆœ‰็”จ็š„๏ผš

ๅ†็œ‹ไธ€ไธ‹ๆ ˆๅ›žๆบฏๆƒ…ๅ†ตๅง๏ผš

ไพๆฌก่ฐƒ็”จไบ† printf() => vfprintf() => printf_positional() => __parse_one_specmb()ใ€‚้‚ฃๅฐฑ็œ‹ไธ€ไธ‹ glibc ๆบ็ ๏ผŒ็„ถๅŽๅ‘็Žฐไบ†่ฟ™ไธช๏ผš

่ฟ™้‡Œๅฐฑๆถ‰ๅŠๅˆฐ glibc ็š„ไธ€ไธช็‰นๆ€ง๏ผŒๅฎƒๅ…่ฎธ็”จๆˆทไธบ printf ็š„ๆจกๆฟๅญ—็ฌฆไธฒ๏ผˆtemplate strings๏ผ‰ๅฎšไน‰่‡ชๅทฑ็š„่ฝฌๆขๅ‡ฝๆ•ฐ๏ผŒๆ–นๆณ•ๆ˜ฏไฝฟ็”จๅ‡ฝๆ•ฐ register_printf_function()๏ผš

  • ่ฏฅๅ‡ฝๆ•ฐไธบๆŒ‡ๅฎš็š„ๅญ—็ฌฆ __spec ๅฎšไน‰ไธ€ไธช่ฝฌๆข่ง„ๅˆ™ใ€‚ๅ› ๆญคๅฆ‚ๆžœ __spec ๆ˜ฏ Y๏ผŒๅฎƒๅฎšไน‰็š„่ฝฌๆข่ง„ๅˆ™ๅฐฑๆ˜ฏ %Yใ€‚็”จๆˆท็”š่‡ณๅฏไปฅ้‡ๆ–ฐๅฎšไน‰ๅทฒๆœ‰็š„ๅญ—็ฌฆ๏ผŒไพ‹ๅฆ‚ %sใ€‚

  • __func ๆ˜ฏไธ€ไธชๅ‡ฝๆ•ฐ๏ผŒๅœจๅฏนๆŒ‡ๅฎš็š„ __spec ่ฟ›่กŒ่ฝฌๆขๆ—ถ็”ฑ printf ่ฐƒ็”จใ€‚

  • __arginfo ไนŸๆ˜ฏไธ€ไธชๅ‡ฝๆ•ฐ๏ผŒๅœจๅฏนๆŒ‡ๅฎš็š„ __spec ่ฟ›่กŒ่ฝฌๆขๆ—ถ็”ฑ parse_printf_format ่ฐƒ็”จใ€‚

ๆƒณไธ€ไธ‹๏ผŒๅœจ็จ‹ๅบ็š„ main ๅ‡ฝๆ•ฐไธญ๏ผŒไฝฟ็”จ %s ่ฐƒ็”จไบ† printf๏ผŒๅฆ‚ๆžœๆˆ‘ไปฌ่ƒฝ้‡ๆ–ฐๅฎšไน‰ไธ€ไธช่ฝฌๆข่ง„ๅˆ™๏ผŒๅฐฑ่ƒฝๅšๅˆฉ็”จ __func ๅšๆˆ‘ไปฌๆƒณๅš็š„ไบ‹ๆƒ…ใ€‚็„ถ่€Œๆˆ‘ไปฌๅนถไธ่ƒฝ็›ดๆŽฅ่ฐƒ็”จ register_printf_function()ใ€‚้‚ฃไนˆ๏ผŒๅฆ‚ๆžœๅˆฉ็”จๆบขๅ‡บไฟฎๆ”น __printf_function_table ๅ‘ข๏ผŒ่ฟ™ๅฝ“็„ถๆ˜ฏๅฏไปฅ็š„ใ€‚

register_printf_function() ๅ…ถๅฎžไนŸๅฐฑๆ˜ฏ __register_printf_specifier()๏ผŒๆˆ‘ไปฌๆฅ็œ‹็œ‹ๅฎƒๆ˜ฏๆ€Žไนˆๅฎž็Žฐ็š„๏ผš

็„ถๅŽๅ‘็Žฐ spec ่ขซ็›ดๆŽฅ็”จๅšๆ•ฐ็ป„ __printf_function_table ๅ’Œ __printf_arginfo_table ็š„ไธ‹ๆ ‡ใ€‚s ไนŸๅฐฑๆ˜ฏ 0x73๏ผŒ่ฟ™ๅ’Œๆˆ‘ไปฌๅœจ gdb ้‡Œ็œ‹ๅˆฐ็š„็›ธ็ฌฆ๏ผšrdx=0x73๏ผŒ[rax+rdx*8]ๆญฃๅฅฝๆ˜ฏๆ•ฐ็ป„ๅ–ๅ€ผ็š„ๆ–นๅผ๏ผŒ่™ฝ็„ถ่ฟ™้‡Œ็š„ rax ้‡Œไฟๅญ˜็š„ๆ˜ฏ __printf_modifier_tableใ€‚

ๆผๆดžๅˆฉ็”จ

ๆœ‰ไบ†ไธŠ้ข็š„ๅˆ†ๆž๏ผŒไธ‹้ขๆˆ‘ไปฌๆฅๆž„้€  expใ€‚

ๅ›ž้กพไธ€ไธ‹ __parse_one_specmb() ๅ‡ฝๆ•ฐ้‡Œ็š„ if ๅˆคๆ–ญ่ฏญๅฅ๏ผŒๆˆ‘ไปฌ็Ÿฅ้“ C ่ฏญ่จ€ๅฏน || ็š„ๅค„็†ๆœบๅˆถๆ˜ฏๅฆ‚ๆžœ็ฌฌไธ€ไธช่กจ่พพๅผไธบ True๏ผŒๅฐฑไธๅ†่ฟ›่กŒ็ฌฌไบŒไธช่กจ่พพๅผ็š„ๅˆคๆ–ญ๏ผŒๆ‰€ไปฅไธบไบ†ๆ‰ง่กŒๅ‡ฝๆ•ฐ *__printf_arginfo_table[spec->info.spec]๏ผŒ้œ€่ฆๅ‰้ข็š„ๅˆคๆ–ญๆกไปถ้ƒฝไธบ Falseใ€‚ๆˆ‘ไปฌๅฏไปฅๅœจ .bss ๆฎตไธŠไผช้€ ไธ€ไธช printf_arginfo_size_function ็ป“ๆž„ไฝ“๏ผŒๅœจ็ป“ๆž„ไฝ“ๅ็งป 0x73*8 ็š„ๅœฐๆ–นๆ”พไธŠ __stack_chk_fail() ็š„ๅœฐๅ€๏ผŒๅฝ“่ฏฅๅ‡ฝๆ•ฐๆ‰ง่กŒๆ—ถ๏ผŒๅฐ†ๆ‰“ๅฐๅ‡บ argv[0] ๆŒ‡ๅ‘็š„ๅญ—็ฌฆไธฒ๏ผŒๆ‰€ไปฅๆˆ‘ไปฌ่ฟ˜้œ€่ฆๅฐ† argv[0] ่ฆ†็›–ไธบ flag ็š„ๅœฐๅ€ใ€‚

Bingo!!!

exploit

ๅฎŒๆ•ด็š„ exp ๅฆ‚ไธ‹๏ผš

ๅ‚่€ƒ่ต„ๆ–™

Last updated