Harness the power of FILE structs to arbitrarily read data.
初见FILE Struct，大概看了一点教学视频，来看看第一关的程序需要我们做什么
int __fastcall main(int argc, constchar **argv, constchar **envp) { int v3; // eax
setvbuf(stdin, 0LL, 2, 0LL); setvbuf(stdout, 0LL, 2, 0LL); puts("###"); printf("### Welcome to %s!\n", *argv); puts("###"); putchar(10); puts( "This challenge allows you to manipulate the memory of an _IO_FILE struct object. By doing this, you can arbitrarily read"); puts( "or write to take control of the process. You may also take control of the virtual function table at the end of the FILE"); puts("struct. If you do this, then you can directly take control of the process and call some other function.\n"); printf("The flag has been read into memory and is located at %p\n", &secret); v3 = open("/flag", 0); read(v3, &secret, 0x64uLL); challenge((unsignedint)argc, argv, envp); puts("### Goodbye!"); return0; }
将flag中的内容读到secret里面了，并且给出了secret的地址。跟进一下challenge
size_tchallenge() { create_tmp_file(); buf = malloc(0x100uLL); puts("This exploit will involve performing an arbitrary read to leak some sensitive the flag.\n"); fp = fopen("/tmp/babyfile.txt", "w"); print_fp(fp); puts("Now reading from stdin directly to the FILE struct.\n"); read(0, fp, 0x1E0uLL); print_fp(fp); return fwrite(buf, 1uLL, 0x100uLL, fp); }
sla('Now reading from stdin directly to the FILE struct.\n\n',payload)
level 2
Harness the power of FILE structs to arbitrarily write data to bypass a security check.
先看看程序
int __fastcall main(int argc, constchar **argv, constchar **envp) { setvbuf(stdin, 0LL, 2, 0LL); setvbuf(_bss_start, 0LL, 2, 0LL); puts("###"); printf("### Welcome to %s!\n", *argv); puts("###"); putchar(10); puts( "This challenge allows you to manipulate the memory of an _IO_FILE struct object. By doing this, you can arbitrarily read"); puts( "or write to take control of the process. You may also take control of the virtual function table at the end of the FILE"); puts("struct. If you do this, then you can directly take control of the process and call some other function.\n"); challenge((unsignedint)argc, argv, envp); puts("### Goodbye!"); return0; }
实际上与前一关才差不多，继续跟进challenge
intchallenge() { create_tmp_file(); authenticated = 0; buf = malloc(0x100uLL); puts( "This exploit will involve performing an arbitrary write to execute a code segment which is otherwise unreachable.\n"); fp = fopen("/tmp/babyfile.txt", "r"); print_fp(fp); puts("Now reading from stdin directly to the FILE struct.\n"); read(0, fp, 0x1E0uLL); print_fp(fp); fread(buf, 1uLL, 0x100uLL, fp); if ( authenticated ) return win(); else returnputs("You are not 1337 enough."); }
create_tmp_file(); buf = malloc(0x100uLL); puts( "This exploit will involve altering the flow of data by editing the _fileno attribute of a FILE structure so that private"); puts("data can be made publicly readable.\n"); fp = fopen("/tmp/babyflag.txt", "r+"); fread(buf, 1uLL, 0x100uLL, fp); v1 = fopen("/tmp/babyfile.txt", "r+"); printf("fp2->_fileno = %d\n", (unsignedint)v1->_fileno); print_fp(fp); puts("Now reading from stdin directly to the FILE struct.\n"); read(0, &fp->_fileno, 0x170uLL); print_fp(fp); return fwrite(buf, 1uLL, 0x100uLL, fp); }
__int64 challenge() { create_tmp_file(); buf = (__int64)malloc(0x100uLL); puts( "This FILE struct points to _IO_2_1_stdout_ (otherwise known as just stdout). The stdout FILE struct can be abused to"); puts("perform arbitrary read exploits. These exploits will be triggered by functions such as puts() or printf()\n"); fp = stdout; print_fp(stdout); puts("Now reading from stdin directly to the FILE struct.\n"); read(0, fp, 0x1E0uLL); return print_fp(fp); }
是一个读flag文件的函数，所以也就是level2同款解法