Challenge Description

File type

Binary Protection

Background

• hacknote gives us 4 operations to manage our notes:
  • Create a new note
  • Delete an existed note
  • Print a note
  • Exit the program

• The program saves all notes into a global array of pointer (noteStorage var) which has length of 5. We will explore first 3 operations:

  • Operation 1: addNote() function
  c COPY

  1	unsigned int addNote()
  2	{
  3	int v0; // ebx
  4	int v2; // [esp-Ch] [ebp-34h]
  5	int v3; // [esp-Ch] [ebp-34h]
  6	int v4; // [esp-8h] [ebp-30h]
  7	int v5; // [esp-8h] [ebp-30h]
  8	int v6; // [esp-4h] [ebp-2Ch]
  9	int i; // [esp+Ch] [ebp-1Ch]
  10	int size; // [esp+10h] [ebp-18h]
  11	char buffer[8]; // [esp+14h] [ebp-14h] BYREF
  12	unsigned int canary; // [esp+1Ch] [ebp-Ch]
  13
  14	canary = __readgsdword(0x14u);
  15	if ( globalIndex <= 5 )
  16	{
  17	for ( i = 0; i <= 4; ++i )
  18	{
  19	if ( !noteStorage[i] )
  20	{
  21	noteStorage[i] = malloc(8);
  22	if ( !noteStorage[i] )
  23	{
  24	puts("Alloca Error");
  25	exit(-1, v2, v4, v6);
  26	}
  27	*(_DWORD *)noteStorage[i] = printVal;
  28	printf("Note size :");
  29	read(0, buffer, 8);
  30	size = atoi(buffer);
  31	v0 = noteStorage[i];
  32	*(_DWORD *)(v0 + 4) = malloc(size);
  33	if ( !*(_DWORD *)(noteStorage[i] + 4) )
  34	{
  35	puts("Alloca Error");
  36	exit(-1, v3, v5, v6);
  37	}
  38	printf("Content :");
  39	read(0, *(_DWORD *)(noteStorage[i] + 4), size);
  40	puts("Success !");
  41	++globalIndex;
  42	return __readgsdword(0x14u) ^ canary;
  43	}
  44	}
  45	}
  46	else
  47	{
  48	puts("Full");
  49	}
  50	return __readgsdword(0x14u) ^ canary;
  51	}

  • Operation 2: deleteNote() function
  c COPY

  1	unsigned int deleteNote()
  2	{
  3	int v1; // [esp-Ch] [ebp-24h]
  4	int v2; // [esp-8h] [ebp-20h]
  5	int v3; // [esp-4h] [ebp-1Ch]
  6	int index; // [esp+4h] [ebp-14h]
  7	char buffer[4]; // [esp+8h] [ebp-10h] BYREF
  8	unsigned int canary; // [esp+Ch] [ebp-Ch]
  9
  10	canary = __readgsdword(0x14u);
  11	printf("Index :");
  12	read(0, buffer, 4);
  13	index = atoi(buffer);
  14	if ( index < 0 || index >= globalIndex )
  15	{
  16	puts("Out of bound!");
  17	_exit(0, v1, v2, v3);
  18	}
  19	if ( noteStorage[index] )
  20	{
  21	free(*(_DWORD *)(noteStorage[index] + 4));
  22	free(noteStorage[index]);
  23	puts("Success");
  24	}
  25	return __readgsdword(0x14u) ^ canary;
  26	}

  • Operation 3: printNote() function
  c COPY

  1	unsigned int printNote()
  2	{
  3	int v1; // [esp-Ch] [ebp-24h]
  4	int v2; // [esp-8h] [ebp-20h]
  5	int v3; // [esp-4h] [ebp-1Ch]
  6	int index; // [esp+4h] [ebp-14h]
  7	char buffer[4]; // [esp+8h] [ebp-10h] BYREF
  8	unsigned int canary; // [esp+Ch] [ebp-Ch]
  9
  10	canary = __readgsdword(0x14u);
  11	printf("Index :");
  12	read(0, buffer, 4);
  13	index = atoi(buffer);
  14	if ( index < 0 || index >= globalIndex )
  15	{
  16	puts("Out of bound!");
  17	_exit(0, v1, v2, v3);
  18	}
  19	if ( noteStorage[index] )
  20	(*(void (__cdecl **)(int))noteStorage[index])(noteStorage[index]); // call printVal() function
  21	return __readgsdword(0x14u) ^ canary;
  22	}

• The structure of a 'note' memory on heap includes the address of printVal() function and a memory address that stores the content of note.

Vulnerability

• In deleteNote() function, after free note, it doesn't set that pointer in noteStorage array to NULL:

This leads to use-after-free vulnerability.

Exploitation

Leak Libc

• Since it allows to print the content of note, I came up with an idea that use unsorted bins to leak the address of main arena.
• First, I created 2 notes; one to get the address of main arena, one to prevent the chunk of the first one from merging into top chunk. Then I deleted the first note and added a new one which has the same size of content as the first one.
• When a chunk is put into unsorted bin, its fd and bk pointer must point back to the list head which lives inside main_arena struct in libc. It still remains after that chunk is allocated again.
• Therefore, I just needed to print the content of the third note to get that address, so that I calculated the libc base address

Get Shell

• After having libc base address, it's trivial to calculate the address of system function.

• Now we have to find where to write the address of system function and get shell. After analyzing, I decided to write it into first 4 bytes of note memory which contains the address of printVal function.
• To do that, I freed chunk of the second and the third note. Since size of chunk of these notes is the same and it is 8 bytes, if we allocate a new note with size of the content is 8, we will do arbitrary write to one of these 2 chunks so that we can change the address of printVal to the address of system function.
• However, when print note operation happens, it calls printVal function with the argument is that note pointer. If we change to system, it will call system(noteStorage[i]) and what system try to execute is \xf7\xf3... which represents the exact address of system function. This command obviously cannot be run. Therefore, to get shell, or execute sh command in other words, I put || operation between the address of system and command sh. This makes system function run \xf7\xf3...||sh which will execute sh when the first command is fail and it always gets shell because the first command never can be run successfully.

Exploit Code