From 8c11513945661f214af05de6c335e6728fd9d0da Mon Sep 17 00:00:00 2001 From: h7x4 Date: Tue, 3 Sep 2024 20:40:50 +0200 Subject: [PATCH] pwn/heap_1 --- pwn/heap_1/chall | Bin 0 -> 20664 bytes pwn/heap_1/chall.c | 116 ++++++++++++++++++++++++++++++++++++++++++ pwn/heap_1/output.txt | 34 +++++++++++++ 3 files changed, 150 insertions(+) create mode 100755 pwn/heap_1/chall create mode 100644 pwn/heap_1/chall.c create mode 100644 pwn/heap_1/output.txt diff --git a/pwn/heap_1/chall b/pwn/heap_1/chall new file mode 100755 index 0000000000000000000000000000000000000000..ce680619e232c93e397672a39d990da3df1c57b4 GIT binary patch literal 20664 zcmb<-^>JfjWMqH=W(GS35buHjM8p9?G3;=IG8h;b92hJZco`fRG#Jzw*cccXSioWs zd6;?_eS--i4x>3BTn1*SJ_!(mfq?;?mVv5+(I7X0gg`XNJ`fulwt!jyqZy$70O?}| zX@K%!;xO73Vwe_Kn`MHV1Ut3?}Fn1bi8 zc7TL}pO&P6*y#4a__*u~fa>#52ARUZfKG=%gc)Eo$PSQD;M0;6P`H5D#9&x72SM$_ z6%Pua00%`Yl!gW`gMLnCl9`EqPKs_$W?pH9ZiR)Ju9=BmalW1r*m{t=Kz4xAl)GOj z15*RT0gxC>KZq^DzyMC?Ao+(A)1*w?b60s=Tml{6Kk24n_E4@eEjU{Ewb zodV)AfY|&D4B$Ko@qZ&&93%!}TueQe3!-shSq26MAuN(pL4L*}Zo|O9Ac#fW8HYK^ zIK)Bz!e*~N4)q&xxJL|!dJi1pW;n$Cafrv^5I=y!J)pQ!!V*3V@$tzOiScQfd5Jlh zRjCYV>8T~f47rIpIr+&9@$osCNy+iWC5c5P@wthac?`uRMaj7Z3~BiVsUS{DerX9q zL1{@bLt0u+X>kTae0*kcezK)yd~tGOUK&GcMP>;@K~ZL2Ng4ylC{Q{yV{rHJbaIY2 z(ldv%jPy+5Y-1CKc+U{u_>|P5)bz~alGLIQU+0|syws4yq?}ZS`1thP{5+_e;vq`0 zDr8__Vqj!ohC>*eg@G9?4ham9XchwltQcbu&&=cn)eI$2u~Ml_PEc;BgYvgboW=$+ zxeKD50aiZ3%B2m^MEC+){=vixpyCt?xi$Agq8S4k|-HVj!%6Bo6We zNDPDxkijF%ac}B+d;IfZ_loaUQ4`h>AcG=LHFj;?WQo z4S~@R7!85Z5Eu=CAs+&t`Q?6jG{52S=w`jC&%of(dZ2{q{{@fcBOHgpe*16wNS}e> zzv>fx1_pk42ZsNuAbti&?&X93|NsA2y`|5V+ z=`%2-O#nFvghBo>eCyeHG0vm&kw^2B4*?;rh6fB!di2^}WMW|WFM3;#f#FM<9>07G zNI8Q?uWcsC-@U9!Ajpne5P;mZ#z%SnbQg|3jd-U2`f)w_eg6#Fs{O8g6 z!QvIsCRys!bWyIG&=GB9{_ zTfC?Rahs1gL?8C(wcQL-EDaLrwPoaEVDRWQWd@m-0TSwb?9q9DAE-6x(Rt{FC|KzJ zi?@IO|M%!-odz{d@8AFbhW}rL|AV_Pz@yjp051cB;ei(yA!@UrYMK81{~vJ}B;NqC zcQHt|*R~zRo(^H}1F^e7>~2;QsID`A|Nq|)N-Zxofh0Ovck41R9A_xVOwK>%z`_8L z0_*Q&odK3gf=Wdk2Blw+eMNj=_c($K=w`j80||;EFxNC2WKpke0z^&iUyvga$z_6L zSTM+lbs(pG_yY=8*>n613?7~LUpxeJZRdleu7cQ|_g|a^(cPkAx(p0Hy{3G83=BS< z-#t3786J3X2qe{c|HUd0-7WfB2T5)jNUZbzi#`zD&1w#H;&~9a`3Og}V;n3!g*t{i zhB<~hhJc-A28ymokg8r=TM*k9!Y%=^9sm6Q@6&DiN}GYfv)k@P(;rw!W`GoRvKH!K zh9p>jC#xS=3Ko(cy|(K>27dSr@joc3fcy{U+Rg__T?Mg0{s+2QfopL+*S4G+9B~~`(E||C(>$Q0TB5>Yc;Lm^ z-~azN|6t^A4PgX@xT-5RNKSSI4~SQz!s64b%g4>Y@Y=?s*VY{5P#vgQCBOgw_vw6Y zc;JN=R3r&xdgpzg&VPmnUX;Sj{lmb((Cwna(tO~5^ADEt9iGW9tqeYlFaAI9=(U}} z%fRsB*02BneLKJScK-9}wcW%Eiq-!wj{X7#m2ERf!OmYGtNy>(2omcS{iOwRqV6Y< zOFN-qvka=F52EBeNC`}?3nJ&+`Q5kknNP235*Gu*OOyX#^JhQ;DE${C*ye+^o6Z1f z@3rlPNUr+z|Nl!tkos=ZGKfqMM8*Il^Zwue|1Ut{|MD#;Gamp|1<{T%jya z6RFHEEmFuY&r>K!Eh^5>OUzM7%E?d81{sl(SdyrapNC|WG0XwQiD{|vWr-k@Jk@h@ z6jIAl^AvJYOB5>eOBHhR^RpEaOB8Y|70MEeGC@;a$j0a>c&g_rB9nUcJ<%Fk6u%&Sx=Nz5%sEy~PG z*JB9I%u7xM#Rb@i%wkYTLnF1gBr!Q#0W$(2iK9Ftu_U!DwMZc|FD)MwnhNEKc_pAY z03|q(19cQU6%uobQWH}^QInsokepZqPJE@sAYVgfUSU4e<6;0MTZLdy3bg`jkP+-v3MFyxmU0q#m2G6{*#GK3&Xbgk$IHNSPHE7KOXb$eioB#hi z7#J8T-v0l;fq{Xcb*1Ej^|NjjG1B1o;|NmJS85mZ)|Nmcxk%8gG z`~Uw<7#SEUKK%b50~%3dU|;~PApo0S6~w?;A;2ij!_F~*5h4y+8zb=c|9>@*0vC4B zlskh80|SEz0|SG{oB#h8fW-L(-1sEC__@nD8W`-QthJ0)z|+?tb7L477!JJo{~t7% z22u*bpmiIdIolO)|Nox}5^&@baN!GRW@2*U6L93?aO4XByJ-dk1B1%D|NlYi865cp z;`lhg;voO(y!-z@2dbATi;n|j7s%f&@BaTcg^CyRae&?WfPsNw&Ab2qJ3-=LDM$S%4N^GB7Ymf)s()8$;LONkjRtHlq}j4_l`P zYLkM5VDex8{m%#S7l3Af85kHqQ+FV~2b2Mt=mqglK;>a;)oy_V85kH~Yt$s5d{HP3 zqoCSAi_*bDpynZnaRWpkwVy!~$RHtc5W&E}kN_2cQVbnXhrrwo(+_ITgS5cx|NS50 z9|i`<66$|Yz6VtQe<&Xo&L5zBC8+#QC?D=_kl_P}Ve87#onQt{4{lI83`(a#=`twY z2BoJ#>19xQ8npaY)U}&gkqGzCMSPJGE))^V;8JK87g&ClV zl5-OC(iO^5i;6Sz^ArqC^bC-+=ovDYGJ{eTBRJw18F&~VECvP!CgyS$NGyR8IS4Z` zgO&#~a5F7rU}j-uVPbU!Igf{FAtQ?yXstFI8zU1tSd5oxArmVzr~||pZppyU#uC85 zz`)Klk-?flM28tv3_L5#o- z0o8vXM&twmbv7mj2Bzp40-C%aM$7^MZLk%wD+F{zKq7G)1aw6~jQAY_24K4q4hR@3 zf<%&zFtD6rWMB{!V*!N>-%Uma1{vlV%+jnJ%yR5Z%nEFbLZJ8&{>TVg2rr_2(uNxBs z124!OyxyQPLjoiy0g59@4p5(#F?jWuU|r#3~DN1_MJlCsZ$iFgmAI0FNd2?MjLr?9=G z6}L4vlLP|;vkC*VsvS2sHvK4& z7=x!UM2>-hUzm|um75!6F9U-BFW9vpjs-UZgP<@2v#O0G1A`DFBgk@LMFvk{b8ZF( z5s)Xix$U?a7(~SwU`C07)@zGHtz|`6D`5_{RubV)LtzF6DLtr0dr1XFMg|6HgfzrJ zkO3f9%g8bq3WEY8f;*BsoST6`79>fEKo9M zWRwS2k)R3?RQWhEFfgQm3Moc;CVo~qwmwkgU(J#+GyU^votfIcE2qMLl}rQe6!|Ro z{*1k7bNtaIOjb!T-#F)i%0lV2?C#Q)CHMW#$jay}Vt=*(&1CYq>J*+%?!D2#ek*or2^H^EgN?8Twv+_Zi zjPqF;GC(R>d9H)i39?19va*%1GO}G~WjMvk%H_TL>26l#W{@Bohb@eCl9dM}1aev= zE5kEZRxakmHH2(q=9-7kFdH`JhzN)uY*^XYm~|sqrP(<2SlMitSJbDm^0G01VBlE8 z%D~1vp}vHbm5o{X1S`)nR#rBI>JuQ2AX^42Cz}`Zvic^Fs>2NP*qHa$?_y&J) z>X&P5C*fXUF6Qupc;AK<>V0O%Ypfz{%ug92Sb2-tnCH}AV`F~B5W&Vgtv-T{`5i+9 zt0Hq2hY%Ax10y4m6>M@wVor`;GJ`&tk(!sD%8*x@8xP*vQp}KsuX-Z3c1F)}{bGs-nSBr?D?KAs^SGy?(-2M_~f3CIjH z6A;VOKR!7>B{jLM1gxMuGbJ@19N6(`MX9Mpsm1X*nZ+dxa2~{tg2WV4g!6Lp^U@iL zGpkZT2Il6cq%y>p=9LzwrWk?Ebo2Cag>GKT%!6$@iU$q2L-rrV=ceYBGC*PhGNHqe zoRONG9bcZA#{k~il$OE(nfPG118NyDa4>X0M_ntRbOV%zl^>kYjbhAD+8Rm+LFoi2 zT?eHbp!60f{Q*kz34_W+1_lEty%91}|tQ;xv^02bEt1l|KNbd7$!g zQ2HU1mV)+;kTQgRX>pN$W?phmX-X;sGDp9{!Ytm*1iFhbJ+D+hDYK+lzofDtwU`Kn z5G6U8N%}cCWx2YBCZK(Z`rsz9KBOrOw-uZ_^^zHiOHwlP^)f(P%u16>;z1Frm%#wG z5GOz5Zg1R`Mb-XOESR2?_&amBMV*ss=1J_y%3=HZF3=E*%epaAewG0dl zo(v2OMT`s#K@1EGvCzsa8#F7zz`)STz`!t>fq`KW0|U4^+{eJcaGHUE;W`5Y!&3$Z zhOeMHh>?MTn~{M*jFEvsmXU!$m63r#myv-1)D*R3WMFV)WMJ@RWMBZzoMbaHFqAVg zFf=kUFid4+V3^Iwz+lM8z_5&wfnhTv1H%SJ28R8N3=Df185lq<&l`*k44}5{8%72O zP|K2$3DnwWU=UzpU;wpVC7Bo)hbKK@6S0`)H$8CV!v$RNc~0L_aa_kqMiK`jUdQ3hCl9wY|BHBfV4;|U-!5C+Y2 zF*1n2_wRwkKzKQ*DS^fPxcs#qY_BlG2hao-$N(gaEgbfO)r&Ep_g{~J^$EfE6@$49 z3=B8H>LuXg1TgXUIQD&T5wurQ z5+43A^}%5E{0y)%4b;m3$t8fqnFJVM<1!#I5KaS$gBWPI5-iTo04rlbU0INlX0ZFE z7+_^FDC>j7d%)^JEL1!X>P~cjt;V5#A2=LP%>ePvg6w6IWPptWfW$!f7Dybl;~12H z!D$90%D`}*2^4Pp46w2u)Byv@yacP4Vt~~lF!z4}yN90vR#!lcWB3mi2kAt`pnf8> z+CY&|Wdg;E6vG6xcw7QDho1pQ zuM_X~}8^?=HHxCAl8yZiV%Ir_x=ySW9shQxuo1|ej*1&W!Fo$M$=@!&Rh zd{S{S)G6QwBT{DqydNG_3(7`#xRg0~OFWzl3dZ>O5MO6lgn~A{W8KXTaWl9*i@IYU z)htlLVPMcJuFNe-Ok&V0E-8Z088B8RXqis|gI->KNvd9YUa4L|QGP*cQAs6|P*Q1T zPKs`33RK9^$x|1UFTlz(5{ok!^inGGiYs#=bV(5dSOz-MiNc95V$dr}%}E4lfU*j5 zN*MIO&eSW&DbY*MFJaItNv$Yh&`ZnA%Vf|i$_FPRz0?e7j>t$UVu14?S|M2jq65ZG zsmx2v%}izhnFunOK@Vb1QgJbZUUGhJZfaf$gI-E%QfYcTXmJjVotTtVlv)Pkks!~73(KTI8r2Ax9zn!ADVVe>aI8dm+IyB}gZ14A#gtpd{zn?Hilu=yjH{pkLm z4%P1jH4ru*1*4JmgTf45|3YwkmH~YJ64(gXd<&EYrEjn}lt7RFIcWM7p!#4mc+8+a{1!45?JA$Sk*EvQYy&#OP{}P)1 z1)u_jfq?-=gZ8h1^uaJJ++cjr*b1o24s#~#{1n(ZN9gKdd>H+LfdSNu1fNd?G85L{ zdjUOn3Z@Pu2f{EujQ#?RJDB~jei-cBD%kl{p!|cZADT=URzv*{(+@khH8GFkoO{fR*1c_2~LR>r~OjKx(U@9o9y8#sZ0AmfsFg z`=QQ-C}Ln>_+t)XCg9Kyv(p=@AEFvT#(;*KKHADqy zd;!9OkTCr)IvuJXB8wn@LiIzP0hfU3g9(5}r_jYfa>k$oxEL51(93Uhwe2|U_k-#O z9~cHQ5Q@?DgZOAc3|1KcUFY!wT3~_txuAY2Ed7G&B9KDRxD{Fw0|_&DKr6H>XoiFA a11o?MpkXR(`ei`#unY_gv(Pl4aTx&gPqh93 literal 0 HcmV?d00001 diff --git a/pwn/heap_1/chall.c b/pwn/heap_1/chall.c new file mode 100644 index 0000000..ec094ba --- /dev/null +++ b/pwn/heap_1/chall.c @@ -0,0 +1,116 @@ +#include +#include +#include + +#define FLAGSIZE_MAX 64 +// amount of memory allocated for input_data +#define INPUT_DATA_SIZE 5 +// amount of memory allocated for safe_var +#define SAFE_VAR_SIZE 5 + +int num_allocs; +char *safe_var; +char *input_data; + +void check_win() { + if (!strcmp(safe_var, "pico")) { + printf("\nYOU WIN\n"); + + // Print flag + char buf[FLAGSIZE_MAX]; + FILE *fd = fopen("flag.txt", "r"); + fgets(buf, FLAGSIZE_MAX, fd); + printf("%s\n", buf); + fflush(stdout); + + exit(0); + } else { + printf("Looks like everything is still secure!\n"); + printf("\nNo flage for you :(\n"); + fflush(stdout); + } +} + +void print_menu() { + printf("\n1. Print Heap:\t\t(print the current state of the heap)" + "\n2. Write to buffer:\t(write to your own personal block of data " + "on the heap)" + "\n3. Print safe_var:\t(I'll even let you look at my variable on " + "the heap, " + "I'm confident it can't be modified)" + "\n4. Print Flag:\t\t(Try to print the flag, good luck)" + "\n5. Exit\n\nEnter your choice: "); + fflush(stdout); +} + +void init() { + printf("\nWelcome to heap1!\n"); + printf( + "I put my data on the heap so it should be safe from any tampering.\n"); + printf("Since my data isn't on the stack I'll even let you write whatever " + "info you want to the heap, I already took care of using malloc for " + "you.\n\n"); + fflush(stdout); + input_data = malloc(INPUT_DATA_SIZE); + strncpy(input_data, "pico", INPUT_DATA_SIZE); + safe_var = malloc(SAFE_VAR_SIZE); + strncpy(safe_var, "bico", SAFE_VAR_SIZE); +} + +void write_buffer() { + printf("Data for buffer: "); + fflush(stdout); + scanf("%s", input_data); +} + +void print_heap() { + printf("Heap State:\n"); + printf("+-------------+----------------+\n"); + printf("[*] Address -> Heap Data \n"); + printf("+-------------+----------------+\n"); + printf("[*] %p -> %s\n", input_data, input_data); + printf("+-------------+----------------+\n"); + printf("[*] %p -> %s\n", safe_var, safe_var); + printf("+-------------+----------------+\n"); + fflush(stdout); +} + +int main(void) { + + // Setup + init(); + print_heap(); + + int choice; + + while (1) { + print_menu(); + if (scanf("%d", &choice) != 1) exit(0); + + switch (choice) { + case 1: + // print heap + print_heap(); + break; + case 2: + write_buffer(); + break; + case 3: + // print safe_var + printf("\n\nTake a look at my variable: safe_var = %s\n\n", + safe_var); + fflush(stdout); + break; + case 4: + // Check for win condition + check_win(); + break; + case 5: + // exit + return 0; + default: + printf("Invalid choice\n"); + fflush(stdout); + } + } +} diff --git a/pwn/heap_1/output.txt b/pwn/heap_1/output.txt new file mode 100644 index 0000000..b7a8081 --- /dev/null +++ b/pwn/heap_1/output.txt @@ -0,0 +1,34 @@ +$ nc tethys.picoctf.net 53475 + +Welcome to heap1! +I put my data on the heap so it should be safe from any tampering. +Since my data isn't on the stack I'll even let you write whatever info you want to the heap, I already took care of using malloc for you. + +Heap State: ++-------------+----------------+ +[*] Address -> Heap Data ++-------------+----------------+ +[*] 0x623d3771a2b0 -> pico ++-------------+----------------+ +[*] 0x623d3771a2d0 -> bico ++-------------+----------------+ + +1. Print Heap: (print the current state of the heap) +2. Write to buffer: (write to your own personal block of data on the heap) +3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified) +4. Print Flag: (Try to print the flag, good luck) +5. Exit + +Enter your choice: 2 +Data for buffer: picopicopicopicopicopicopicopicopico + +1. Print Heap: (print the current state of the heap) +2. Write to buffer: (write to your own personal block of data on the heap) +3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified) +4. Print Flag: (Try to print the flag, good luck) +5. Exit + +Enter your choice: 4 + +YOU WIN +picoCTF{starting_to_get_the_hang_9e9243f9}