6.1.26 pwn 34C3CTF2017 300
้ข็ฎๅค็ฐ
$ file 300
300: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=5f43b102f0fe3f3dd770637f1d244384f6b2a1c9, not stripped
$ checksec -f 300
RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH Yes 0 2 300
$ strings libc-2.24.so | grep "GNU C"
GNU C Library (Ubuntu GLIBC 2.24-9ubuntu2.2) stable release version 2.24, by Roland McGrath et al.
Compiled by GNU CC version 6.3.0 20170406.64 ไฝ็จๅบ ๏ผๅผๅฏไบ canaryใNX ๅ PIE๏ผ้ป่ฎคๅผๅฏ ASLRใ
ๅจ Ubuntu16.10 ไธ็ฉไธไธ๏ผ
) alloc
2) write
3) print
4) free
1 <-- alloc 1
slot? (0-9)
1
1) alloc
2) write
3) print
4) free
2
slot? (0-9)
1 <-- write 1
AAAAAAAAAAAAAAAA
1) alloc
2) write
3) print
4) free
4 <-- free 1
slot? (0-9)
1
1) alloc
2) write
3) print
4) free
2 <-- write 1
slot? (0-9)
1
BBBBBBBB
1) alloc
2) write
3) print
4) free
3 <-- print 1
slot? (0-9)
1
BBBBBBBB
AAAAAAA
1) alloc
2) write
3) print
4) free
3 <-- print 2
slot? (0-9)
2
Segmentation fault (core dumped)ๅพๆธ
ๆฐ็ 4 ไธชๅ่ฝ๏ผallocใwriteใprint ๅ freeใ้่ฟๅฐ่ฏไผผไนๅฐฑๅ็ฐไบ้ฎ้ข๏ผfree ็ๆถๅๆฒกๆๅฐๆ้็ฝฎ็ฉบ๏ผๅฏผ่ด UAFใ่ฏปๅ
ฅ็ๅญ็ฌฆไธฒๆซๅฐพๆฒกๆๅ \x00 ๅฏผ่ดไฟกๆฏๆณ้ฒใๆๅๅฆๆ print ไธไธช่ฟๆฒกๆ alloc ็ slot๏ผๅๅบ็ฐๆฎต้่ฏฏใ
้ข็ฎ่งฃๆ
main
ไป main ๅฝๆฐไธญๆไปฌ็ฅ้๏ผ็จๅบ็ๆๆๆไฝ้ฝๆฏๅบไบ slotใ
alloc
่ฏฅๅฝๆฐๅบๅฎๅ้
0x300 ็็ฉบ้ด๏ผ็ถๅๆ นๆฎ slot ๅฐ่ฟๅๅฐๅๆพๅฐไป 0x202040 ๅผๅง็ๆฐ็ป allocs ไธญใ
write
่ฏฅๅฝๆฐ่ฏปๅ
ฅๆๅค 0x300 ไธชๅญ็ฌฆๅฐ slot ๅฏนๅบ็็ฉบ้ดไธญใๆฒกๆๅจๅญ็ฌฆไธฒๆซๅฐพๅ \x00๏ผๅฏ่ฝๅฏผ่ดไฟกๆฏๆณ้ฒใ
่ฏฅๅฝๆฐ็จไบๆๅฐ slot ๅฏนๅบ็ฉบ้ดไธญ็ๅญ็ฌฆไธฒใ
free
่ฏฅๅฝๆฐ็จไบ้ๆพ slot ๅฏนๅบ็็ฉบ้ด๏ผไฝๆฏๅดๆฒกๆๅฐ allocs[slot] ๆ้็ฝฎ็ฉบ๏ผๅฏผ่ด UAF๏ผๆ่ double-freeใ
ๆผๆดๅฉ็จ
ไปไธ้ขๆไปฌๅฏไปฅ็ๅฐ๏ผ็จๅบ็ๅ้กนๆไฝ้ฝๅบไบ slot๏ผๅฏน allocs[slot] ๆๅ็ๅ ๅญ็ฉบ้ด่ฟ่กๆไฝ๏ผไฝๆฒกๆๅฏน allocs[slot] ๆฏๅฆไธบ็ฉบ๏ผๆ่ ๅ ถๆๅ็ๅ ๅญๆฏๅฆไธบ่ขซ้ๆพ็็ถๆ๏ผ้ฝๆฒกๆๅไปปไฝๆฃๆฅ๏ผ่ฟไนๆฏไนๅๅ็ๆฎต้่ฏฏ็ๅๅ ใ
leak
้ฆๅ
ๅฉ็จ unsorted bin ๅฏไปฅๆณ้ฒๅบ libc ๅ heap ็ๅฐๅใๅ้
5 ไธช chunk ็ๅๅ ๆฏไธบไบ้ฟๅ
\x00 ๆชๆญ๏ผheap ๅบๅฐๅ็ไฝไฝ 0x00๏ผใ็ถๅ้ๆพๆ 1 ๅ 3 ๅณๅฏใ
house of orange
่ฟไธๆญฅๅฐฑๆฏ่พๅคๆไบใๅ ไธบ็จๅบๅชๅ ่ฎธๅ้ 0x300 ๅคงๅฐ็ chunk๏ผ่ๆไปฌ็ฅ้ house-of-orange ้่ฆๅคงๅฐไธบ 0x60 ็ chunk๏ผๆพๅ ฅ smallbins[5]๏ผใ็ฑไบๆไปฌๅฏไปฅๅ ทๆไฟฎๆน free chunk ็่ฝๅ๏ผๆไปฅๅฏไปฅไฟฎๆน unsorted bin ้ chunk ็ bk ๆ้ๆๅไผช้ ็ fake chunk๏ผไปฅๅฐๅ ถ้พๆฅๅฐ unsorted bin ไธญใๆฅไธๆฅ็็ฌฌไธๆฌก malloc ๅฐไฟฎๆน unsorted_bin->TAIL->bk ๅฐๆๅ fake chunk๏ผ่็ฌฌไบๆฌก malloc ็ๆถๅ๏ผ็ฑไบๅคงๅฐไธๅ้๏ผfake chunk ๅฐฑไผ่ขซๆด็ๅ smallbins[5]๏ผ
ๅฏนไบ vtable ็ๅฉ็จ๏ผไธไธ่ๆไปฌไฝฟ็จไบ _IO_str_overflow ๅฝๆฐ๏ผ่ฟๆฌกๆไปฌๅฐฑ็จ _IO_wstr_finish ๅฝๆฐใๅ
ทไฝๆไน็จ่ฏทๆฅ็็ซ ่ 4.13ใ
ๅผๅพๆณจๆ็ๆฏ fp->_wide_data ๆๅไบ fake chunk๏ผๆไปฅๅฐฑ็ธๅฝไบๆไปฌๅค็จไบ่ฟไธๅ็ฉบ้ด๏ผfp->_IO_write_end ็ๅฐๆนไนๆฏๅฐฑๆฏ fp->wide_data->buf_baseใ
ๆฅไธๆฅๅฉ็จ unsorted bin attack ไฟฎๆน _IO_list_all ๆๅ &unsorted_bin-0x10๏ผ่ๅ็งป 0x60 ็ๅฐๆนๅฐฑๆฏ _IO_list_all->_chain๏ผๅณ smallbins[5]๏ผๆๅไบ fake chunkใ
pwn
ๆๅ่งฆๅๅผๅธธๅค็๏ผmalloc_printerr -> __libc_message -> __GI_abort -> _IO_flush_all_lockp -> __GI__IO_str_finish๏ผ่ทๅพ shellใ
ๅผๅฏ ASLR๏ผBingo!!!
exploit
ๅฎๆด็ exp ๅฆไธ๏ผ
ๅ่่ตๆ
Last updated
Was this helpful?