Tags: pwn heap
Rating:
The binary is an implementation of a suffix array to efficiently search for needles in large haystack strings. I expected a logical bug in the algorithmic part, but my teammate informed me about a very easy yet powerful bug so I just used it instead. I think it's probably unintentional...
The bug is triggered when the needle is longer than the haystack in the recant needle feature. By using the proof of concept below we can easily get a heap overflow.
payload = p64(0)*2 #our data
payload += p64(0)+p64(0x31) #next heap header
payload += p64(0x100)+chr(0)
add ("A"*0x10)
add ('')
add (payload)
delete(1)
recant (2, payload+"\x00")
We can overwrite the haystack structure of index 2, so I changed the length to a long value and its buf pointer's least significant byte so that it leaks a heap pointer.
Afterwards getting a LIBC leak and getting arbitrary write is super easy in tcache malloc so i'll just skip that part.
I looked at other teams' writeups and found out they used a much complex exploit primitive and used a ptmalloc exploit technique to get arbitrary write. Based on the scoring (500 point for a heap overflow challenge?) and other people's opinions I concluded that this bug is most likely unintentional.
