Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

6.1.24 pwn HITCONCTF2016 House_of_Orange

ไธ‹่ฝฝๆ–‡ไปถ

้ข˜็›ฎๅค็Žฐ

$ file houseoforange
houseoforange: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=a58bda41b65d38949498561b0f2b976ce5c0c301, stripped
$ checksec -f houseoforange
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FORTIFY Fortified Fortifiable  FILE
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   Yes     1               3       houseoforange
$ strings libc-2.23.so | grep "GNU C"
GNU C Library (Ubuntu GLIBC 2.23-0ubuntu3) stable release version 2.23, by Roland McGrath et al.
Compiled by GNU CC version 5.3.1 20160413.

64 ไฝ็จ‹ๅบ๏ผŒไฟๆŠคๅ…จๅผ€๏ผŒ้ป˜่ฎคๅผ€ๅฏ ASLRใ€‚

ๅœจ Ubuntu16.04 ไธŠ็Žฉไธ€ไธ‹๏ผš

$ ./houseoforange
+++++++++++++++++++++++++++++++++++++
@          House of Orange          @
+++++++++++++++++++++++++++++++++++++
 1. Build the house
 2. See the house
 3. Upgrade the house
 4. Give up
+++++++++++++++++++++++++++++++++++++
Your choice : 1                                 <-- Build a house
Length of name :20
Name :AAAAAAAAAAAAAAAAAAA
Price of Orange:1
+++++++++++++++++++++++++++++++++++++
 1. Red
 2. Green
 3. Yellow
 4. Blue
 5. Purple
 6. Cyan
 7. White
+++++++++++++++++++++++++++++++++++++
Color of Orange:1
Finish
+++++++++++++++++++++++++++++++++++++
@          House of Orange          @
+++++++++++++++++++++++++++++++++++++
 1. Build the house
 2. See the house
 3. Upgrade the house
 4. Give up
+++++++++++++++++++++++++++++++++++++
Your choice : 3                                 <-- Upgrade the house
Length of name :10
Name:BBBBBBBBBB
Price of Orange: +++++++++++++++++++++++++++++++++++++
 1. Red
 2. Green
 3. Yellow
 4. Blue
 5. Purple
 6. Cyan
 7. White
+++++++++++++++++++++++++++++++++++++
Color of Orange: 1
Finish
+++++++++++++++++++++++++++++++++++++
@          House of Orange          @
+++++++++++++++++++++++++++++++++++++
 1. Build the house
 2. See the house
 3. Upgrade the house
 4. Give up
+++++++++++++++++++++++++++++++++++++
Your choice : 2                                 <-- See the house
Name of house : BBBBBBBBBBAAAAAAAAA

Price of orange : 0
        __
        \/.--,
        //_.'
   .-""-/""----..
  / . . . . . . . \
 / . . . . . . . . \
 |.  ไน‚ . . . ไน‚. .|
 \ . . . . . . . . |
 \. . . . . . . . ./
  \ . . . ๏ผŠ. . . /
   '-.__.__.__._-'

+++++++++++++++++++++++++++++++++++++
@          House of Orange          @
+++++++++++++++++++++++++++++++++++++
 1. Build the house
 2. See the house
 3. Upgrade the house
 4. Give up
+++++++++++++++++++++++++++++++++++++
Your choice : 4
give up

็จ‹ๅบๅ…่ฎธๆˆ‘ไปฌๅฏน house ่ฟ›่กŒ Buildใ€See ๅ’Œ Upgrade ็š„ๆ“ไฝœใ€‚ๅฏไปฅ็œ‹ๅˆฐๅœจ See ็š„ๆ—ถๅ€™ไผผไนŽๆœ‰็‚น้—ฎ้ข˜๏ผŒ"A"็š„ๅญ—็ฌฆไธฒๅบ”่ฏฅๆ˜ฏ Upgrade ไน‹ๅ‰็š„๏ผŒไฝ†่ฟ™้‡Œ่ฟ˜ๆ˜ฏ่ขซๆ‰“ๅฐไบ†ๅ‡บๆฅ๏ผŒ็Œœๆต‹ๅฏ่ƒฝๅญ˜ๅœจไฟกๆฏๆณ„้œฒ๏ผŒ้œ€่ฆ้‡็‚นๅ…ณๆณจใ€‚

้ข˜็›ฎ่งฃๆž

Build the house

้€š่ฟ‡ๅฏน่ฟ™ๆฎตไปฃ็ ็š„ๅˆ†ๆžๅฏไปฅๅพ—ๅˆฐไธคไธช็ป“ๆž„ไฝ“๏ผš

Build ๆœ€ๅคšๅฏไปฅ่ฟ›่กŒ 4 ๆฌก๏ผŒๆ•ดไธช่ฟ‡็จ‹ๆœ‰ 2 ไธช malloc ๅ’Œ 1 ไธช calloc๏ผš

  • malloc(0x10)๏ผš็ป™ house struct ๅˆ†้…็ฉบ้—ด

  • malloc(length)๏ผš็ป™ name ๅˆ†้…็ฉบ้—ด๏ผŒๅ…ถไธญ length ๆฅ่‡ช็”จๆˆท่พ“ๅ…ฅ๏ผŒๅฆ‚ๆžœๅคงไบŽ 0x1000๏ผŒๅˆ™ๆŒ‰็…ง 0x1000 ๅค„็†ใ€‚

  • calloc(1, 8)๏ผš็ป™ orange struct ๅˆ†้…็ฉบ้—ด

้‚ฃไนˆๆˆ‘ไปฌๅ†ๆฅ็œ‹ไธ€ไธ‹็”จไบŽ่ฏปๅ…ฅ name ็š„ๅ‡ฝๆ•ฐ๏ผš

่ฟ™ไธชๅ‡ฝๆ•ฐๅœจ่ฏปๅ…ฅ length ้•ฟๅบฆ็š„ๅญ—็ฌฆไธฒๅŽ๏ผŒๆฒกๆœ‰ๅœจๆœซๅฐพๅŠ ไธŠ \x00 ๆˆชๆ–ญ๏ผŒๆญฃๅฆ‚ๆˆ‘ไปฌไธŠ้ข็œ‹ๅˆฐ็š„๏ผŒๅฏ่ƒฝๅฏผ่‡ดไฟกๆฏๆณ„้œฒใ€‚

See the house

See ไผšๆ‰“ๅฐๅ‡บ house->name๏ผŒorange->price ๅ’Œ orange ๅ›พๆกˆใ€‚

Upgrade the house

Upgrade ๆœ€ๅคšๅฏไปฅ่ฟ›่กŒ 3 ๆฌก๏ผŒๅฝ“็กฎ่ฎค house ๅญ˜ๅœจๅŽ๏ผŒๅฐฑ็›ดๆŽฅๅœจ orange->name ็š„ๅœฐๆ–น่ฏปๅ…ฅ้•ฟๅบฆไธบ length ็š„ name๏ผŒ็„ถๅŽ่ฏปๅ…ฅๆ–ฐ็š„ price ๅ’Œ colorใ€‚ๆ–ฐ็š„ length ๅŒๆ ทๆฅ่‡ช็”จๆˆท่พ“ๅ…ฅ๏ผŒๅฆ‚ๆžœๅคงไบŽ 0x1000๏ผŒๅˆ™ๆŒ‰็…ง 0x1000 ๅค„็†ใ€‚

่ฟ™้‡Œ็š„้—ฎ้ข˜ๅœจไบŽ็จ‹ๅบๆฒกๆœ‰ๅฐ†ๆ–ฐ length ไธŽๆ—ง length ๅšไปปไฝ•ๆฏ”่พƒ๏ผŒๅฆ‚ๆžœๆ–ฐ length ๅคงไบŽ ๆ—ง length๏ผŒ้‚ฃไนˆๅฐ†ๅฏผ่‡ดๅ †ๆบขๅ‡บใ€‚

ๆผๆดžๅˆฉ็”จ

ๅ’Œๅธธ่ง็š„ๅ †ๅˆฉ็”จ้ข˜็›ฎไธๅŒ็š„ๆ˜ฏ๏ผŒ่ฟ™้ข˜ๅชๆœ‰ malloc ่€Œๆฒกๆœ‰ free๏ผŒไบŽๆ˜ฏๅพˆๅคšๅˆฉ็”จๆ–นๆณ•้ƒฝ็”จไธไบ†ใ€‚ๅฝ“็„ถ่ฟ™้ข˜ๆ˜ฏ็‹ฌๅˆ›ไบ†ไธ€็ง house-of-orange ็š„ๅˆฉ็”จๆ–นๆณ•๏ผŒ่ฟ™็งๆ–นๆณ•ๅˆฉ็”จๅ †ๆบขๅ‡บไฟฎๆ”น _IO_list_all ็ป“ๆž„ไฝ“๏ผŒไปŽ่€Œๆ”นๅ˜็จ‹ๅบๆต๏ผŒๅ‰ๆๆ˜ฏ่ƒฝๅคŸๆณ„ๆผๅ †ๅ’Œ libc๏ผŒๆณ„้œฒ็š„ๆ–นๆณ•ๆ˜ฏ่งฆๅ‘ไฝไบŽ sysmalloc() ไธญ็š„ _int_free() ๅฐ† top chunk ้‡Šๆ”พๅˆฐ unsorted bin ไธญ๏ผˆ่ฏฆ็ป†ๅ†…ๅฎนๅ‚่€ƒ็ซ ่Š‚ 3.1.8 ๅ’Œ 4.13๏ผ‰ใ€‚

overwrite top chunk

็ฌฌไธ€ๆญฅ๏ผŒ่ฆ†็›– top chunk ็š„ size ๅŸŸ๏ผŒไปฅ่งฆๅ‘ sysmalloc()ใ€‚ๅˆ›ๅปบ็ฌฌไธ€ไธช house๏ผš

ๆ นๆฎไธ€ๅฎš็š„่ง„ๅˆ™ไฟฎๆ”น size๏ผŒ็ฎ€ๅ•่ฏดๅฐฑๆ˜ฏ่ฟ™้‡Œ top chunk size ๆ˜ฏ 0x20fa1๏ผŒ้‚ฃๅฐฑไฟฎๆ”นไธบ 0xfa1๏ผš

leak libc

ๆŽฅไธ‹ๆฅๅˆ†้…ไธ€ไธชๅคงไบŽ top chunk๏ผŒๅฐไบŽ mp_.mmap_threshold ็š„ large chunk๏ผŒๆญคๆ—ถๅฐ†่งฆๅ‘ sysmalloc() ไธญ็š„ _int_free()๏ผŒtop chunk ๅฐ†่ขซ้‡Šๆ”พๅˆฐ unsorted bin ไธญ๏ผŒๅŒๆ—ถๆ–ฐ็š„ top chunk ๅฐ†็”ฑๆ‰ฉๅฑ•ๆ–นๅผๅˆ†้…ๅ‡บๆฅ๏ผš

ๅฏไปฅ็œ‹ๅˆฐ old top chunk ๅทฒ็ป่ขซๆ”พๅˆฐ unsorted bin ไธญไบ†๏ผŒๅ…ถ fd, bk ๆŒ‡้’ˆๆŒ‡ๅ‘ libcใ€‚ๆŽฅไธ‹ๆฅๅ†ๅˆ†้…ไธ€ไธช large chunk๏ผŒ่ฟ™ไธช chunk ๅฐ†ไปŽ old top chunk ไธญๅˆ‡ไธ‹ๆฅ๏ผŒๅ‰ฉไธ‹็š„ๅ†ๆ”พๅ›ž unsorted bin๏ผš

ๅฏไปฅ็œ‹ๅˆฐ name 3 ไธŠๆœ‰้—็•™็š„ old top chunk ็š„ bk ๆŒ‡้’ˆใ€‚ๅช่ฆๅฐ†ๅ…ถๆ‰“ๅฐๅ‡บๆฅ๏ผŒ้€š่ฟ‡่ฎก็ฎ—ๅณๅฏๅพ—ๅˆฐ libc ็š„ๅŸบๅ€ใ€‚

leak heap

ๅœจไธŠไธ€ๆญฅไธญๆˆ‘ไปฌ่ฟ˜ๅฏไปฅ็œ‹ๅˆฐ name 3 ไธŠ่ฟ˜ๆœ‰้—็•™็š„ fd_nextsize ๅ’Œ bk_nextsize๏ผŒ่ฟ™ๆ˜ฏๅ› ไธบๅœจๅˆ†้…ไธ€ไธช large chunk ๆ—ถ๏ผŒไผšๅ…ˆๅฐ† unsorted bin ไธญ็š„ large chunk ๅ–ๅ‡บๆ”พๅˆฐ large bin ไธญใ€‚ๅ› ไธบๅฝ“ๅ‰ large bin ๆ˜ฏ็ฉบ็š„๏ผŒๆ‰€ไปฅ chunk ็š„ fd_nextsize ๅ’Œ bk_nextsize ้ƒฝๆŒ‡ๅ‘่‡ช่บซ๏ผš

ๆ‰€ไปฅ่ฟ™้‡Œๆˆ‘ไปฌ้€š่ฟ‡ไฟฎๆ”น name ๅณๅฏๆณ„้œฒๅ‡บ heap ๅœฐๅ€๏ผš

house of orange

็Žฐๅœจๆˆ‘ไปฌๆœ‰ไบ† libc ๅ’Œ heap ๅœฐๅ€๏ผŒๆŽฅไธ‹ๆฅๅฐฑๆ˜ฏ็œŸๆญฃ็š„ house-of-orange๏ผŒ็›ธไฟกไฝ ๅทฒ็ป็œ‹ไบ†ๅ‚่€ƒ็ซ ่Š‚๏ผŒ่ฟ™้‡Œๅฐฑไธๅ†้‡ๅคไบ†ใ€‚็ป“ๆžœๅฆ‚ไธ‹๏ผš

ๅฏไปฅ็œ‹ๅˆฐ old top chunk ็š„ size ่ขซๆ”นๅ†™ไธบ 0x60๏ผŒๅœจไธ‹ๆฌกๅˆ†้…ๆ—ถ๏ผŒไผšๅ…ˆไปŽ unsorted bin ไธญๅ–ไธ‹ old top chunk๏ผŒๅฐ†ๅ…ถๆ”พๅˆฐ smallbins[5]๏ผŒๅŒๆ—ถ๏ผŒunsorted bin ็š„ bk ไนŸๅฐ†่ขซๆ”นๅ†™ๆˆไบ† &IO_list_all-0x10ใ€‚

pwn

็”ฑไบŽไธ่ƒฝๅคŸ้€š่ฟ‡ๆฃ€ๆŸฅ๏ผŒๅฐ†่งฆๅ‘ๅผ‚ๅธธๅค„็†่ฟ‡็จ‹๏ผŒmalloc_printerr -> __libc_message -> __GI_abort -> _IO_flush_all_lockpใ€‚

ๅผ€ๅฏ ASLR๏ผŒBingo!!!

exploit

ๅฎŒๆ•ด็š„ exp ๅฆ‚ไธ‹๏ผš

ๅ‚่€ƒ่ต„ๆ–™

Previous6.1.23 pwn BCTF2016 bcloud
Next6.1.25 pwn HCTF2017 babyprintf

Last updated

Was this helpful?