i'm a bit late setting up because i have
to reconfigure obs
again again every single time
there's something new with that thing
so let's uh get everything going
okay
[Music]
all right i need to connect to
zoom
why do i have two zooms
one doesn't work okay great
no what the hell
okay
start up zoom
all right awesome and then
let's
share that screen
okay awesome i think we are set
and live
ah crazy situation all right cool
let's um let's chat
uh welcome to the office hours of course
as you know
we extended the heap
module because of um
veterans day and as a result we
launched a couple extra heap challenges
hopefully everyone is
having a good time with those let's
actually take a look
at what the scoreboard looks like real
quick
a lot of people have already finished
all of them so 12 people have finished
all
challenges led of course by root we'll
get into that at the
on on uh wednesday um
let me see that's yeah 13 people
solve level 15 so someone hasn't solved
someone saw level 15 but not a different
level
um someone's mentioning that they missed
meme week we're gonna have uh we'll have
a meme review for the two weeks
on wednesday don't worry
all right so um
what have you got what's uh what what
questions
all right so there's a question of um
level 12 and it's also coming up on on
it came up on zoom just now that's why i
was just
sitting there listening came up on
twitch
um level 12 is
an interesting one let's uh pull it up
and and
look around i'm not sure if i want to
give you the
full level 12 solution
but let's at least discuss
all right let's uh launch it
in some practice mode and open it up
and finally enjoy one sec i need to get
my
okay
all right here we go
we have one thing you'll notice right
away we have a win function
win function is uh
[Music]
very nice because that implies to you
that you don't need to do
crazy you know rob shout code injection
by a lot you just need to redirect
control flow to here
the wind function of course very
standard it says you win
and then it doesn't open of the flag
file
oops and then a send file
and you're good to go okay so
um if you look at main
it's also fairly straightforward
it's our typical kind of menu based
setup
we have a um the default unrecognized
choice then we have here
uh scanf you're very familiar with that
scanf
we have a um
some a new thing that asks not just for
the allocation index but also for an
offset
and then calls echo we'll get back to
that you have a free
and then you have a
malloc cool all right
so um you have these uh the primitives
that we have uh
to to read write allocate de-allocate
but the right
is a echo function it's not a puts
this echo function is a function
inside the um
uh a binary like it just it's not a
lipsy function or anything it does
something uh very crazy it um
allocates a uh
32 byte buffer right
uh that this allocation is 32 bytes that
doesn't mean the chunk is 32 bytes if
you recall but
you know you can roll with that later
and then it it
um puts in this buffer first
the address of the string bin echo
this address is in the binary
then it puts
[Music]
the uh address of
uh this var16 var16 is
oh the address of var16 this is actually
a string
oops yeah it's data
so it builds something that's slash been
slash echo
data
it puts a pointer to that then it puts a
pointer to arc one plus arc
uh r2 plus r1 and then it puts
a uh the the fourth um
q word is a zero right and then it calls
exact v
and it passes in first
the um the string bin echo
do references if it dereferences the
pointer to
our allocation so this will be
allocation
pointer it dereferences that
the pointer to our allocation so it
passes in this bin echo
and then it passes in um
[Music]
uh the allocation pointer itself
which is a char star star as we can see
this is a char star
this is a a character string this is a
char star star
okay that makes sense and then it passes
in a null
and it passes this to exact v e what is
exact v i mean
or rather you know what exactly he is
but let's uh put
up the man page and see what it takes
takes a string for
what to execute then arc v
which is a uh array of character
pointers
finished with a null byte and then the
environment and the environment can be
null
to make an empty environment and so what
what happens is
that this has the effect
basically just it forks it calls
bin echo with the data
and then it exits
where this is the child of course the
parent will wait on the child
to exit and then return
cool so basically
puts is being replaced with
just a different way to puts now
the pertinent things here this arc ii
plus our arg one
let's go see how it is um used
actually an easy way let's click echo
click that
it tells us okay it's being used in main
there we go
and it doesn't scroll down okay anyways
here it is um
this is our allocation selection
logic right so this is the allocation
base it's referenced
all over the place so this is
allocations
that the allocation array
and then
here's our index
it shifts it to the right to the left by
three to multiply it by eight because
every allocation
pointer is eight bytes and then it it
takes that
that pointer at that offset and then
in the second argument is this bar 98
which is the offset
cool so this is a charstar
this is an int we dive into
echo let's change this to see if it
helps anything
but i guess probably won't given
given how this typically works
char star okay it did
awesome all right so anyways um
so the difference between echo and puts
from prior levels is that inputs um
you uh
[Music]
uh just get to print
from the beginning of the string with
echo you have this offset of arc 2
right and then you can print
an offset of the string now
of course we could have written this
exact same logic with puts
we didn't have to do this insane fork
and and and so forth the question the
the pertinent question
with this um level is why did we do that
what does this give you
that otherwise would not have been
possible right and and one thing if you
if you uh
take a look let's um
take a look at the command line
if you look on the command line we have
pie enabled and then obviously
this whole thing is running with aslr
it's that means level 12.
um so there's a couple things you don't
know
you know that there is a win function
right and you know the offset of the
wind function in the binary it's from
the binary base
it's at 1358 hexadecimal
but you don't know where the binary base
is
so the question is
using the difference between you know
basically puts an echo
can you leak out the binary base
and the answer obviously is yes and i'll
get you started bin echo
is a string in the read-only data
section or in the in the data section
of the binary right so this pointer
to bin echo that is set here
is going to your pointer into the binary
and by leaking that
you can break pie
uh yeah i can repeat that that the um
this bin echo is a pointer into the
binary into the yeah
into the data segment of the binary
right
it gets written into an allocation
that gets mallet right from prior
uh levels you know how to control
and influence where this allocation uh
gets allocated or at least to
make it get allocated at the same place
as
a previously freed pointer that you
[Music]
have a reference to right
this then uh so an allocation happens
a pointer into the binary gets written
to that allocation
while we're at it this data string is a
local variable it's a pointer to the
stack
a pointer to the stack gets written on
that allocation as well
right and then it gets passed
to echo which prints it out
so of course
using this capability
you can leak out the
um address of the of the
bin echo in the data segment which of
course based on that you can calculate
where the binary is in memory
and of the data string on the stack and
based on that you can figure out
where the stack is in memory and then
you have everything you need
to jump to win
all right um there's a question about
level 13
on uh the twitch basically something
um that they get an invalid pointer
message when calling uh
stack free so level 13 lets you
free a buffer on the stack you get an
invalid pointer
because of the following so let me let
me say
stack free example.c
oops
all right
let's write a an example
um of a uh where we free a stack buffer
right um let's have an unsigned
long pointer stack stuff
of um let's just do i don't know 10
uh unsigned long integer so this is 80
bytes long it doesn't actually matter
we're just going to be
um let's zero it out we're going to um
care about the first uh two by so
if you recall um our
[Music]
lecture on the metadata
let me pull it up
all right here's that um the metadata of
a chunk
right recall the first eight bytes of a
chunk
is the previous size the size of the
previous chunk
as long as the chunk the previous chunk
is um uh
not in use if the previous chunk is in
use
then um this is used by the previous
chunk
right the chunks overlap as you see here
right so if the chunk if chunk one
is not in use then chunk two has to have
its previous size if chunk one is in use
then it uses this uh same location to
store its data
okay um
so first we have the previous size then
we have the size of our chunk
and a bunch of bits and then we have the
usable a bunch of flags
and then we have the usable memory so in
order for a free to succeed
on a um
buffer that normally wouldn't be a
[Music]
an allocation we need to set up the
metadata properly
so if we don't set up the metadata
properly if you say stack stuff
zero equals one two three four stack
stuff
one five six seven eight
and then we try to free
stack stuff too right
of course when you call a free you're
freeing the allocation
that uh malik would give you
which is two keywords after
the chunk starts right so malek returns
a pointer
where is it oh well yeah malik returns
this
mem adder but
what we're building is a chunk so we're
starting at chunk adder
so when we do a free of that we want to
free
starting from the third element onwards
right
or the third the we pass in a pointer
to the memory uh after
this metadata all right
if we compile it
and run it boom invalid
pointer and we get an actually really
crazy am
unmapped chunk uh
invalid pointer which is really
interesting
so
several questions why one why was it
trying to unmap our chunk
two um
[Music]
why did we get an invalid pointer right
well this
has to make sense this is metadata that
needs to make sense
when we actually do the
do the free right
we need a previous size that is either a
valid size
or we need to tell malik that hey
actually don't worry about the previous
size because the previous
um chunk is in use previous
is bit zero so that's you know a
value of decimal value one that we need
to
set we need to set that last bit which
is or one
right then is mapped was accidentally
set
when we were playing around just now and
we need to make sure it is not set
and then bit two is this non-main arena
also needs to
not be set so basically the last bit
needs to be set and that needs to be the
only
uh and then other than that the uh size
has to be valid a valid chunk size as
you've seen
through experimentation and and the
lectures is basically
uh 16 uh 32
and onwards right those are the chunk
sizes they go up by
hex 10. so
let's uh let's take a look
quick question zoom go ahead
uh not quite so the question is does the
previous chunk size the first bit always
have to be one
no this is just the size and only if the
previous bit
is or the previous chunk is not in use
and that goes here it is the least
significant bit
of the m chunk of the of the size of the
current
chunk so this is the size the current
chunk and some flags
right um so for example if the current
size
is hex 20 which is a valid chunk size
right
and we're making this up because this is
this is a fake chunk that we're
crafting on the stack to free it um
this if you put a zero here that means
that the previous chunk is freed
and that means that the previous chunk
has to have a valid size
something like this this might still run
into issues
because then it'll start looking at the
previous chunk but actually we got lucky
it didn't run into issues right so this
didn't crash because we gave it a proper
previous chunk size if we gave it a
crazy chunk previous chunk size
oh it was still okay
awesome all right so actually you
trusted that previous chunk size
depending on
various scenarios it can actually fail
later when it actually
tries to uh uh
if the chunk is big enough for example
and then it
these end up getting put into the
unsorted bin
instead of the t cash etc etc um
the bottom line is to that to avoid
issues make sure this is always one and
that this
otherwise is a valid chunk size so ax21
works
exactly so instead of hex20 it's hex 21
specifically because
we're setting this previous bit make
sure that
is mapped is not set and
non main arena is not set otherwise
crazy things start happening actually uh
could be interesting things you might
want to unmap
a piece of memory in the course of an
attack and then you can set to this
but normally um that's exotic situation
so realistically
make sure it's a proper chunk size and
uh
put a one you can of course you can put
the proper chunk size and then you can
bit wise or it with one it has the same
effect
but maybe easier for you to keep track
of
if you put something like something
invalid here 25
this starts doing weird things
right um say 2f
this will put all of the that
all of the flags to one
invalid pointer right so make sure this
is zero
make sure this is the chunk size you
want
and then make sure the last the last bit
is one
or just do this
cool all right the other um relevant
thing
that i'll mention is here you control
um basically the size of a chunk that
you
um are injecting into the t cash here
we allocated on the stack 80 bytes
10 8 byte integers right but we could
say actually
what if we do um
well how about hide this let's say hex
100
right this way more than 80 or let's
just uh yeah whatever hex 100
this should still fit in t cash yeah
that obviously that's 256. all right so
basically
here we're saying to a make a 256 byte
or fake a 256 by chunk on the stack free
it
now when the malik
we're going to get back
what
oh sorry this is this is the chunk size
including the metadata of course the
metadata takes up 16 bytes of that
so in actuality this is oxf0
when we mallocate if we wanted to return
the same thing
here we go this is a stack pointer that
we received back from malik
and if we um
and this stack pointer if you print out
its usable space
malik things oops
what do we have to include for that one
wait why do we have to include anything
why doesn't like us
undefined alec usable space
um one sec what was it called
malek usable size usable size
usable size
that's weird
i wonder if something was going on
including malek.h
space zero
what if we do without the attack
that is happily
obviously this shouldn't say zero
what if we put zero
okay good i was gonna go crazy
um why is this zero
c printf allocated pointer
say post allocation precise
is going to be
stacks stuff zero
stack stuff one
okay aside from
malik usable spot size being a returning
zero here for some
reason i don't quite understand right
now maybe it has some special
the fact that it's a stack pointer is
breaking it
but obviously if you're mallocking
something that is you know 248 bytes
and
um
hold on
now no that wouldn't be it anyways we're
maliking 248 bytes
and uh
the program would presumably allow you
to write
that much over this and if you do
if you do something like b0 or whatever
let's do memsat
uh b
what's the order of arguments here yep
um
if you set all oxf0 bytes of your
allocation with an
a you will
smash the stack
cool um
yeah i don't know why it's okay so
someone suggested what if you warm up
the heap if we do
warm up the caches
and then let's um
form cache here and then we just
make sure
something like this
still usable space zero
she's supposed to pay zero but obviously
internally malik obviously puts it in
the right t cash because it gives it
back to us when we
allocate it
damn but obviously
i'm doing something weird here because
this is of course how the
the challenge is solvable
in level 13. but the important thing
make sure this size
is correct if you are having problems
with
invalid pointer
yeah what's up
uh so the problem here is uh why am i
using c
instead of python here i'm using c i'm
actually compiling programs that use
malik and free to show you what goes
wrong
right um this this isn't interacting
with the challenge in any way
it's just calling malikin-free locally
against the
in libsy right in fact probably
probably for future uh assignments to
avoid confusion
for future years we should rename all of
these
to like pawn college malik pawn college
free porn college echo
what do you think connor
oh connor's not on the zoom that'll
probably help confus
uh avoid confusion yeah this is
these are lib c calls there's nothing to
do with the challenge itself it's just
i'm showing similar problems that the
challenge is exhibiting
uh no what's uh what's showing here is
not a heap overflow it is
an overlap of i'm overlapping
this heap allocation with the stack
right and then i am writing
a normal amount of bytes to the heap
allocation i'm not overflowing the heap
allocation here
but because the heap allocation is at
the same space as the stack
because of this
i am uh
over overflowing the stack
exactly yeah uh the heap and ch and
staff are the same location so i'm
overriding the stack
cool um
what else
yeah that's uh that's level 13.
um other questions
let's see if we had a question on
zoom let me pull up the chat
shell code level 13. all right let's uh
do a
blast from the past take a look at
shell coding level 13.
at this point shellconey has completely
been paged out of my mind so this is
going to be
exciting um actually let's
grab the teaching one
oh in shell coding we still have the
source code right
so that's going to be easier than binary
ninja
all right here's the shell coating
map shell code okay
this challenge reads in some bytes oh
this just a normal one okay
okay let's see close initialize
mapping shell code read the shell code
removing write permissions
wait i'm confused where this challenge
is i'm missing
i'm sorry
oh sorry all right so for
of course the shell coding levels
the um
there's source code for
wait their source code for the baby
heaps
how's this possible
connor are you releasing all of the
source code backs in it here
oh haha these are just the binders okay
sorry
all right um yeah
so which ones have
yeah okay everything before reversing
all right anyways
level 12 testing one
let's try to figure out what the
challenge is here we read in the shell
code
oh we were reading in 12 bytes of shell
code that's the challenge okay
our hex 12. so this is an 18 byte shell
code
no that's level 12 sorry you're asking
about level 13.
boom okay we're
reading in a 12 byte shell code
that is in
non-modifiable memory so
tell me what is your current thinking on
this one
no current thinking
right
right so there's a the question is
how do we make shell code
if you saw something like this right
where we read in 12 bytes of shell code
and um
it's not executable it's not writable
afterwards so this is a scenario for
example on a careful just-in-time
compiler or something along these lines
um one
easy path forward would be
to hope that there is somewhere else
memory mapped that
is modifiable and executable and call
your
read into that memory to read in stage
two shellcode
right
in this case you can't
do that
[Music]
so you need to figure out
basically you need to write shell code
remember like i said i
don't quite remember what i would
approach this in initially is just
write really short tiny shell code
um let me confirm that that's the
reference solution
but 12 bytes you can definitely write
reasonable shell code in 12 bytes
because keep in mind this is a local
th this is running locally right all you
need to do
is call exactv on anything
if you can call exec ve then you can
create a file with the name it's calling
and that file will do your your cat flag
right um
hmm
yeah that is the reference solution just
gotta write shell code that's really
small
there are no tricks just gotta do it
one stage there's no no other place in
memory
that will um
map there no other place in memory uh at
the time of your shell code execution
here that is
writable and executable so there's no
easy place to
write it in of course your shellcode
could
make a place in memory like that
right so for example by using them
protect system call
it's very possible right so you could
use them protect system call
to create a place in memory to read
stage two but then you have to do and
protect
and then call read that is probably too
much
in 12 bytes and it's a bit overkill
so
in level six yeah yeah and level six you
you should be able to call
and protect let's see what level six
does
the bubble short uh which level is that
level 11
is
no level 11 is um the blind one
12.
i think it
oh yeah level nine
oh yeah it's it's level nine so level so
this is
this is a bubble sword right the
question was
what does the bubble sword do well the
bubble sword
sorts the shell code and it sorts the
shell code
by treating it as 64-bit
integers and
taking it that eight bytes at a time
and making sure that each eight bytes is
just ascending
right that's what it does now
in reality by the time for the solution
what it should do is nothing
right you should provide shell code that
this just does nothing ideally provide
shell code that's already sorted
then you don't have to worry about this
exactly you need to come up with a shell
code that's already sorted
uh each line it's not per instruction
it's eight bytes at a time
you can fit several bytes into eight
instructions by the way
sorry the other way around you can fit
several instructions into eight bytes
and one of those instructions i'll give
you a hint can be
um so a couple of hints one is keep in
mind this is all little endian
right so if you're just if you're
writing in in in terms of bytes
assembling instructions and everything
it's the last bite
that's critical right
and it's the easy way to to
approach this is to do something where
the last byte is irrelevant
and just put a an instruction that'll
eat that last bite
cool okay
we have a question about level 14
heap let's let's uh
check it out
exactly so guys um the teaching and the
testing aren't gonna
give you the same information and the
information that the
if you solve the teaching by relying on
the information that it gives you
you're gonna have trouble with the
testing right specifically
um let's
run let's run the teaching first
actually
all right this gives you a lot of uh
um things that you can uh
oh terminal god damn
all right this gives you a lot of things
that that
you can do
the key thing here is this stack free
stack scanf
um functions right let's let's take a
quick look at binary ninja
i'm looking at the twitch chat that's
full of uh
people complaining they can't see the
terminal i feel terrible all right um
let's take a look
all right um we have the the send flag
just by looking at
what we have here here's the send flag i
ask you for the secret it compares the
secret this seems familiar
right um against uh
uh a secret that is stored
somewhere in memory uh and it even tells
you where that secret is stored
uh on the stack here it is
um if you get the secret right
it gives you the the flag right so
secret is stored on the stack
and uh
um god dang where's my
llama me let me relaunch this take off
this dash v so stop spinning debugs
all right um then we have stack scanf
and stack free stack scanf is
um
[Music]
where's dexter
[Music]
this is text enough okay um
it's very simple it just scanfs to this
stack uh buffer that's defined here
right um and stack free just freeze
that stack buffer uh plus
some amount um
that stack buffer is 128 bytes
and uh
it freeze wait
freeze 118
hmm this is interesting
okay let's let's just look at the
disassembly
sorry here we go disassembly
let's see where scanf
is called
let's start seeing where freeze called
all right in main
here nope that's the allocation guy okay
here
awesome okay so scanf just
just calls free on rbp
minus hex one five zero
all right and
[Music]
scanf
now we need to find where yes scanf
just gets called rbp minus
one five
eight no one five zero as well
one
hold on guys i'm having a brain dump
this is a
bit of a tired day
oh okay okay okay okay okay
so it frees when it comes to free it
adds
hex 40. that's quite a lot of adding
but we do it that's fine
okay and when we call the scanf
nope that's not scanf
we don't add it okay so you have a
buffer
that you you can write over and that
buffer and you can write 127 bytes
uh which is hex 80
or hex 7f and then hex
4o bites into that is the address that
will be sent
to free cool
um so this means exactly that you can do
the uh house of spirit
based injection into the t
cash right of a stack of buffer that we
just saw earlier when talking about
level 12.
okay um
[Music]
cool but and here it um tells you that
hey
in this challenge there is a secret that
is stored at
this address of course using this
address
you can and and using um
other concepts from the level to be able
to
uh actually
knowing this address you can
you don't even need this this stack uh
free and stack scan up functionality
right you can use concepts from earlier
levels i forget the numbers now because
if you move them around so much
but you can use concepts from earlier
levels to allocate
uh poison the t cash directly and
allocate this
as an allocation right very familiar to
the previous
level where you needed to get the secret
even without white space armoring
my advice do this with stack free and
stack scanf
because if you don't do that then the
teaching version or the testing version
of this
and later levels are not going to be
solvable for you
so i guess the question for the for odin
on zoom
on zoom on twitch did you use stack free
and stack scanf
in your solution that's the key thing
cool all right we are at the top of the
hour as you can see i'm kind of
discombobulated today
so i'm going to go and
try to take a nap i think i've been on
basically on meetings non-stop
since nine yeah
um and and and it's taking a toll
all right so i'm gonna go try to pass
out
um and then we'll uh get you race
conditions
brought up shortly it's gonna be awesome
cool if you have more questions ask
on discord make sure
if you ask on discord and you're not
getting a good answer from
fellow students you're still confused
tag us in
it's hard for us to you know scroll
through and make sure that everything
got answered
if you feel that your our request for
help hasn't been answered just
at zardis at canac and we'll take a look
or just shoot us an email cool
good luck