1

I'm currently working on the following CTF exercise (x64 version), where the objective is to overwrite a pointer stored on the heap to control the write address of strcpy():

https://exploit.education/phoenix/heap-one/

struct heapStructure {
  int priority;
  char *name;
};

int main(int argc, char **argv) {
  struct heapStructure *i1, *i2;

  i1 = malloc(sizeof(struct heapStructure));
  i1->priority = 1;
  i1->name = malloc(8);

  i2 = malloc(sizeof(struct heapStructure));
  i2->priority = 2;
  i2->name = malloc(8);

  strcpy(i1->name, argv[1]);
  strcpy(i2->name, argv[2]);

  printf("and that's a wrap folks!\n");
}

Now, my problem is that I need to overwrite the stored pointer (0x00007ffff7ef6070), with an address in the heap-one memory range 0x400000-0x404000 (see below) using input provided through argv[1] (first invocation of strcpy). This will make it possible to overwrite the printf GOT entry using input provided through argv[2] (second invocation of strcpy).

However, how can I provide input through argv[1] to overwrite the addres 0x00007ffff7ef6070 with something in the range 0x400000-0x404000 using strcpy? Is there some other strategy besides overwriting GOT-entry (see memory map below)?

This problem is not present present in the x86 version, where addresses are only 32-bits and doesn't contains null-bytes:

https://www.lucas-bader.com/ctf/2019/04/16/heap1

info proc mappings
process 22593
Mapped address spaces:

          Start Addr           End Addr       Size     Offset objfile
            0x400000           0x404000     0x4000        0x0 /opt/phoenix/amd64/heap-one
            0x604000           0x605000     0x1000     0x4000 /opt/phoenix/amd64/heap-one
      0x7ffff7d6b000     0x7ffff7dfb000    0x90000        0x0 /opt/phoenix/x86_64-linux-musl/lib/libc.so
      0x7ffff7ef6000     0x7ffff7ff6000   0x100000        0x0 
      0x7ffff7ff6000     0x7ffff7ff9000     0x3000        0x0 [vvar]
      0x7ffff7ff9000     0x7ffff7ffa000     0x1000        0x0 [vdso]
      0x7ffff7ffa000     0x7ffff7ffb000     0x1000    0x8f000 /opt/phoenix/x86_64-linux-musl/lib/libc.so
      0x7ffff7ffb000     0x7ffff7ffc000     0x1000    0x90000 /opt/phoenix/x86_64-linux-musl/lib/libc.so
      0x7ffff7ffc000     0x7ffff7fff000     0x3000        0x0 
      0x7ffffffde000     0x7ffffffff000    0x21000        0x0 [stack]
  0xffffffffff600000 0xffffffffff601000     0x1000        0x0 [vsyscall]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.