Merge pull request #11 from JustinZYen/SMCxDeathBurger-Use-This-One

Public test case that doesn't segfault

Author: zardus

what-is-a-bug/libxml-cve-2023-28484/challenge/.dockerignore

@@ -0,0 +1 @@
+Dockerfile

what-is-a-bug/libxml-cve-2023-28484/challenge/DESCRIPTION.md

@@ -0,0 +1,8 @@
+Bugs often rear themselves in sparcely-maintained, but prominently used infrastructure.
+Often, such infrastructure takes the form of small, little-known libraries handling specific functionality for larger, well-known projects.
+One such example is [libcue](https://github.com/lipnitsk/libcue) and [CVE-2023-43641](https://github.blog/security/vulnerability-research/coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/).
+
+In real life, the actual attack vector was a part of gnome.
+Here, we've provided the `parse_cue` program.
+Understand this bug, understand the software around it, and trigger the crash.
+If you can segfault `parse_cue` (when invoked via `/challenge/check`), you will earn the flag!

what-is-a-bug/libxml-cve-2023-28484/challenge/Dockerfile

@@ -0,0 +1,23 @@
+FROM ubuntu:24.04
+RUN apt-get update && apt-get install -y autotools-dev autoconf libtool automake pkg-config make git python3
+ADD --chown=0:0 --chmod=6755 http://github.com/pwncollege/exec-suid/releases/latest/download/exec-suid /usr/bin/exec-suid
+COPY parse_xsd.c crash_to_flag.c /challenge/
+RUN mkdir -p /challenge/bin;\
+    cd /challenge;\ 
+    git clone https://github.com/GNOME/libxml2 ./libxml;\
+    git config --global user.email "you@example.com";\
+    git config --global user.name "Your Name";\
+    git -C libxml revert e4f85f1bd2eb34d9b49da9154a4cc3a1bc284f68;\
+    git -C libxml diff HEAD^ > /challenge/patch.diff;\ 
+    cd /challenge/libxml;\
+    ./autogen.sh;\  
+    ./configure --prefix=/challenge;\
+    make -j$(nproc);\  
+    make -j$(nproc) check;\
+    make -j$(nproc) install;\
+    rm /challenge/bin/*;\
+    gcc -I/challenge/include/libxml2 -o /challenge/bin/parse_xsd /challenge/*.c -L/challenge/lib -lxml2;\
+    chmod 6755 /challenge/bin/parse_xsd
+
+COPY run.sh /challenge/run
+RUN chmod 6755 /challenge/run

what-is-a-bug/libxml-cve-2023-28484/challenge/crash_to_flag.c

@@ -0,0 +1,44 @@
+#include <sys/stat.h>
+#include <unistd.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+#include <stdio.h>
+
+void handle_crash(int signum)
+{
+	puts("You crashed it! Here is your flag:");
+	char flag[1024] = {0};
+	int fd = open("/flag", O_RDONLY);
+	if (fd < 0)
+	{
+		perror("unable to open /flag");
+		exit(1);
+	}
+	read(fd, flag, 1024);
+	puts(flag);
+	chmod("/flag", 0644);
+	close(fd);
+	exit(-11 & 0xff);
+}
+
+__attribute__((constructor)) void register_crash_flag_handler()
+{
+	stack_t ss;
+	ss.ss_sp = malloc(SIGSTKSZ);
+	ss.ss_size = SIGSTKSZ;
+	ss.ss_flags = 0;
+	if (sigaltstack(&ss, NULL) == -1) {
+		perror("sigaltstack");
+		exit(1);
+	}
+
+	struct sigaction sa = { 0 };
+	sa.sa_handler = handle_crash;
+	sa.sa_flags = SA_ONSTACK;
+
+	sigaction(SIGSEGV, &sa, NULL);
+	sigaction(SIGILL, &sa, NULL);
+	sigaction(SIGBUS, &sa, NULL);
+}

what-is-a-bug/libxml-cve-2023-28484/challenge/crash_to_flag.c.j2

@@ -0,0 +1 @@
+{% extends "base_templates/crash_to_flag.c" %}

what-is-a-bug/libxml-cve-2023-28484/challenge/parse_xsd.c

@@ -0,0 +1,31 @@
+#include <libxml/xmlschemas.h>
+#include <libxml/parser.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+
+int main(int argc, char* argv[]) {
+    if (argc < 2) {
+        fprintf(stderr, "Usage: %s <schema.xsd>\n", argv[0]);
+        return 9001;
+    }
+    // Make sure we're not doing something dumb like sending in the flag
+    int schema_fd = open(argv[1],O_RDONLY);
+    char schema_smallbuff[13] = {0};
+    read(schema_fd,schema_smallbuff,12);
+    if (strncmp(schema_smallbuff,"pwn.college{",12) == 0) {
+        printf("NO CHEATING\n");
+        close(schema_fd);
+        return 1;
+    }
+    close(schema_fd);
+    // Load the crafted schema
+    xmlSchemaParserCtxtPtr ctxt = xmlSchemaNewParserCtxt(argv[1]);
+    xmlSchemaPtr schema = xmlSchemaParse(ctxt);
+
+    // Free resources, if we got this far
+    xmlSchemaFree(schema);
+    xmlSchemaFreeParserCtxt(ctxt);
+    return 0;
+}

what-is-a-bug/libxml-cve-2023-28484/challenge/run.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+export LD_LIBRARY_PATH=/challenge/lib:$LD_LIBRARY_PATH
+exec /challenge/bin/parse_xsd "$@"

what-is-a-bug/libxml-cve-2023-28484/tests_private/test_crash.sh

@@ -0,0 +1,23 @@
+#!/bin/sh -e
+cat > /tmp/pass.xsd << 'EOF'
+<?xml version="1.0"?>
+
+<xs:schema xmlns:xs="pwn.college">;
+  <xs:complexType name="Hackers">
+    <xs:sequence/>
+  </xs:complexType>
+
+  <xs:complexType name="Hello">
+    <xs:complexContent>
+      <xs:extension base="Hackers">
+        <xs:attribute name="bar" type="xs:int" use="optional"/>
+      </xs:extension>
+    </xs:complexContent>
+  </xs:complexType>
+
+</xs:schema>
+EOF
+
+/challenge/run /tmp/pass.xsd
+
+