Overview
Note Manager provides a heap setup where we can create, edit, delete, and print note text. The allocation addresses are leaked upon creation.
Reconnaissance
A vulnerability is discovered in the Append content command of the Edit logic: it writes beyond chunk boundaries, causing a heap overflow primitive.
Exploitation Strategy
By arranging note allocations of size 0x20 and freeing them, we can poison the tcache freelist. Because of safe-linking in newer glibc versions, the next pointer is encoded as encoded = target ^ (chunk_addr >> 12). We bypass safe-linking, overwrite a target address to reference our win() function, and trigger it during note creation.
Solution Code
# Glibc Safe-linking heap exploit script snippet
# Poison freed note1->next pointer
# target = 0x404050
# enc = (target ^ (a1 >> 12)).to_bytes(8, 'little')[:4]
# e(0, b'R' * 17 + enc + b'S' * (32 - 17 - 4))
# Pop allocations to overwrite target memory with win()Flag
ctf7{hope_is_fine_but_69_8f5e15d1}