Challenge Description

File type

Binary Protection

Background

• re-alloc file offers 4 options to interact with memory:
  • Option 1: Allocate a new memory
  • Option 2: Reallocate an old memory
  • Option 3: Free a memory
  • Option 4: Quit the program

• The program stores the returned memory address into a global array of pointer (heap var) whose length is 2. First 3 options is provided through 3 separated functions:

  • Option 1: allocate() function takes and validates the index and size from user, then allocates a memory chunk on heap and store in global heap variable.
  c COPY

  1	int allocate()
  2	{
  3	_BYTE *v0; // rax
  4	unsigned __int64 index; // [rsp+0h] [rbp-20h]
  5	unsigned __int64 size; // [rsp+8h] [rbp-18h]
  6	void *ptr; // [rsp+18h] [rbp-8h]
  7
  8	printf("Index:");
  9	index = read_long();
  10	if ( index > 1 || heap[index] )
  11	{
  12	LODWORD(v0) = puts("Invalid !");
  13	}
  14	else
  15	{
  16	printf("Size:");
  17	size = read_long();
  18	if ( size <= 120 )
  19	{
  20	ptr = realloc(0LL, size); // malloc(size);
  21	if ( ptr )
  22	{
  23	heap[index] = ptr;
  24	printf("Data:");
  25	v0 = (_BYTE *)(heap[index] + read_input(heap[index], (unsigned int)size));
  26	*v0 = 0;
  27	}
  28	else
  29	{
  30	LODWORD(v0) = puts("alloc error");
  31	}
  32	}
  33	else
  34	{
  35	LODWORD(v0) = puts("Too large!");
  36	}
  37	}
  38	return (int)v0;
  39	}

  • Option 2: reallocate() function receives index, size of new chunk from user and reallocates a memory chunk.
  c COPY

  1	int reallocate()
  2	{
  3	unsigned __int64 index; // [rsp+8h] [rbp-18h]
  4	unsigned __int64 size; // [rsp+10h] [rbp-10h]
  5	void *newPtr; // [rsp+18h] [rbp-8h]
  6
  7	printf("Index:");
  8	index = read_long();
  9	if ( index > 1 || !heap[index] )
  10	return puts("Invalid !");
  11	printf("Size:");
  12	size = read_long();
  13	if ( size > 120 )
  14	return puts("Too large!");
  15	newPtr = realloc((void *)heap[index], size);
  16	if ( !newPtr )
  17	return puts("alloc error");
  18	heap[index] = newPtr;
  19	printf("Data:");
  20	return read_input(heap[index], size);
  21	}

  • Option 3: rfree() function free a allocated memory chunk and set the corresponding index entry of the heap variable to null pointer.
  c COPY

  1	int rfree()
  2	{
  3	_QWORD *v0; // rax
  4	unsigned __int64 v2; // [rsp+8h] [rbp-8h]
  5
  6	printf("Index:");
  7	v2 = read_long();
  8	if ( v2 > 1 )
  9	{
  10	LODWORD(v0) = puts("Invalid !");
  11	}
  12	else
  13	{
  14	realloc((void *)heap[v2], 0LL);
  15	v0 = heap;
  16	heap[v2] = 0LL;
  17	}
  18	return (int)v0;
  19	}

• The special thing is those 3 operations both repurpose the realloc function:

  • realloc(NULL, size): same as malloc(size).
  • realloc(ptr, size): normal usage of realloc. If the size value is the same as old chunk size, then it does nothing and returns the same address as before.
  • realloc(ptr, NULL): same as free(ptr).

• Constraints:

  • We cannot allocate a chunk whose size is more than 120 bytes.
  • Reading user input function always checks the buffer size to prevent buffer overflow.

Vulnerability

• The vulnerability is in reallocate function. It doesn't handle case that the size value is 0. If we do reallocating operation with the size is 0, the function will run realloc(ptr, 0) which is equivalent to free(ptr). Because the index in array storing the pointer to that memory after that isn't set to null, it leads to use-after-free vulnerability.

Exploitation

Arbitrary Write

• The libc provided in this challenge has mitigation that prevent double-free vulnerability so we cannnot make tcache poisoning attack.
• However, this mitigation only check if an address exists in a bin of tcache corresponding to its chunk size. Therefore, we can bypass double-free check by resize the chunk and free it again.
• We use this attack to put an arbitrary address we want to tcache. In next malloc usage will return that address and we have privilege to write any data to that address. Below is the sample code for that idea:

• After running the above code, tcache should look like:

Leak Libc

• Since we have arbitrary write and PIE is disabled, I think of overwriting the GOT table. In this case, I would like to overwrite atoll function to printf so that we can leak data from stack using format string attack.

• With the code above, we leaked the data from stack when do an operation and get libc base address.

Get Shell

• Now we have libc base address, so we can calculate the address of system function and again overwrite atoll function to system function.
• However, atoll now became printf which returns the number of output character. Therefore, we should input in a more appropriate way.

Exploit Code