โHackMDPWN cheatsheet
tags: pwn ๐ป
info
- x64 syscall table
- x86 syscall table
- libc_version
- download from docker ubuntu tarballs
- https://partner-images.canonical.com/core/
- libc_db: ็จ offset ๆฅ libc ็ๆฌ
debug symbols libc
- ๆฅ็ https://github.com/matrix1001/glibc-all-in-one ไพไธ่ผไธๅ็ๆฌ็ libc
- ๅฐ debug symbol ็ libc ไธๅฐ
/usr/lib/debug(ๅฏ่ฝๆๅพไบ)
gdb ๆๅ่จญ
- ่จญๅฎ LD_PRELOAD๏ผ
set exec-wrapper env "LD_PRELOAD=./libc-2.29.so"(for 2.29)- ๆไบๆๅ็ดๆฅ็จ
set environment LD_PRELOAD=./libc.soๅฐฑๅฏไปฅ๏ผๆๆๅพไธ่ก
- ๆไบๆๅ็ดๆฅ็จ
- ่จญๅฎ debug path๏ผ
set debug-file-directory /usr/lib/debug/lib/x86_64-linux-gnu
ref: https://stackoverflow.com/questions/10000335/how-to-use-debug-version-of-libc
glibc source code
libc package (dbg prefix - debug symbols)
https://mirror.tuna.tsinghua.edu.cn/ubuntu/pool/main/g/glibc/
In gdb๏ผ
dir /usr/src/glibc/glibc-2.31/exit.c
make debug symbol glibc
helper
- shell command
- gdb
- gdb trace libc
- pwntools
- disable ptrace limitation
- extract text section
base
- LD_LIBRARY_PATH, LD_PRELOAD
- ่ทไธๅ็ๆฌ libc
- loader ็็ๆฌไน้่ฆๆดๆน, ็จ patch ็ๆนๅผๆน ld ็็ๆฌ
- x64 calling convention
- user: rdi rsi rdx rcx r8 r9
- syscall: rdi rsi rdx r10 r8 r9
- syscall id: rax
- return value: rax
- common instruction
- syscall (
strace ./binary)
- protection (
checksec)
- link library
- binary layout
Shellcode
- defeat NX
- ๅฅฝ็จ็ printable shellcode in x86
- int 0x80 (
\xcd\x80) ๆ้บผ็
BOF
- danger function
- bypass canary
- leak canary at runtime
- non-linear write (ไธ้ ๆนๅ canary ๅฐฑไฟฎๆน return address)
ROP (Return Oriented Programming)
- stack pivoting
- ROP size ไธๅค ๆไฝฟ็จ
- ็ฌฌไธๆฌกไธป่ฆ้้ BOF ๆน่ฎ rbp ๅฐๅทฒ็ฅๅฏๆง็ไฝ็ฝฎ (็จฑไฝ bss)
- ็ฌฌไบๆฌกๅฏซๅ ฅ ROP chain, ไธฆ้้ ret2leave, ่ฎ rsp ้ทๅฐ bss, ๅค ไฝฟ็จๅฐ bss ็ stack ไธ return address
- defeat ASLR / PIE
- leak stack / library / code_base
- ROP gadget
ROP Advanced
gcc 4.8 ไปฅไธ, 64 bit ไธๆ่จฑๅค้็จ gadget
- ๆญฃๅธธๆ
ๆณไธ call
__libc_csu_initไธๆๅไบๆ ๏ผๅ ็บไปๅชๆฏ่ฒ ่ฒฌ call init entry ่ๅทฒ๏ผ่ init entry ไนไธๆๅนนๅ - ไฝๆฏ้ๅ function ๆ้ๅค push pop register ็ instruction ๅฏไปฅไฝฟ็จ
- csu gadget
- ไฝฟ็จๆ
ๆณ
pop rdx ; retๆพไธๅฐ- ๆฒๆ libc (?
__libc_csu_init
- ไฝฟ็จๆ
ๆณ
analysis
- bypass full relro(.got ไธๅฏๅฏซไฝๅ้่ฆ leak): ่ฎ stack ่ฝๅจ .got ่ .data ็ไบค็
- x64 ็ register ไธญ๏ผrX == rXx + ไธๅ prefix
- pop rax == 58, pop r8 == 4158, 41 ๅณ็บ prefix
- r12~r15 ็บ callee saved, ๆไปฅ pop r12 ~ r15 ๅพๅธธ่ฆ, ไธ้ไธ็จๆๅฟ, pop r14 == 415e/ pop rsi == 5e
- ไธไบ้็จ gadget
- ๆงๅถ rdi rsi (
_libc_csu_init)
- ๆณๆง rax
- ๆงๅถ rcx
- ๅฏซ rax ๅฐ memory (int
_start)
- ๆงๅถ rdi rsi (
attack
- ๅ
็จ
pop_rsp_r13_r14_r15_retไพๆ stack ้ทๅฐ got ไธ๏ผ้ๆจฃๅฐฑ่ฝๆ got value ๆพๅฐ register ๅ ง mov cs:__bass_start, 1ๆๆ add ebx, esi ; ret ็ gadget- csu_init ็จ rbx ไพๅ push๏ผ้ๆจฃๆไธๆ่ขซๅ ถไปๆฑ่ฅฟ่ๅฐ
- ่ฝๆง r12, rbx ้ฃไบ๏ผๅฐฑๅฏไปฅ็จ csu_init ไพๅไบๆ
- ้ๅธธๅจ call function ๆ๏ผ stack ๆๆฎ็ function ไฝฟ็จ็ไธไบ็่ทก๏ผๆญคๆๅฐฑๆๆ libc ไน้ก็ๆฑ่ฅฟๅฏไปฅ็จ
- csu ๅฏไปฅๆง r12, r13, r14, r15 ๅผ๏ผไธฆไธๅจ csu ๆ
call [r12+8*rbx]ๅฏไปฅ็จ- ๆไปฅ้้ pop r12, r13, r14, r15 ๅๆปๆ
_dl_runtime_resolveๅจ relro ๅ จ้ๆ็กๆณ็จ- rbx ่ฆ่จญ 0๏ผไปฅๅ rbp ่ฆ่จญ 1
leak
- call
_IO_file_writeๅฏไปฅ leak libc (ๅคงๆฆ == write) - ๅฉ็จไธๆทๅจ bss ไฝฟ็จ
gets๏ผไฝฟ็ไธ็_IO_file_writeๅฏไปฅ่ขซ call ๅฐ๏ผไธฆ่่ๆงๅถ rdi, rsi, rdx_IO_new_file_write(stdin, got, 8) - stdin ๆญคๆๅฏไปฅไปปๆๆง๏ผๅช่ฆ
*(ptr+0x70)็บ 1 ๅฐฑๅฅฝ (stdout)๏ผ้ๆจฃๅฐฑ่ฝ leak
https://github.com/lattera/glibc/blob/master/libio/fileops.c#L1180
__write (f->_fileno, data, to_do)
offset of _fileno == 0x70
ROP to control got
GOT
- GOT (Global Offset Table)
- GOT hijacking
- ๆน puts@got ๆ system
puts("/bin/sh")==system("/bin/sh")
GOT ็ๅไธๅ entry ๅๅฅๆฏ๏ผ
- .dynamic section address
- link_map
_dl_runtime_resolve
ๆดๅ runtime resolve ็ function prototype๏ผ_dl_runtime_resolve(*link_map, rel_offset)
FSB
- danger function
- ไฝ็ฝฎ
- 0 -> rdi
- 1 -> rsi
- 2 -> rdx
- 3 -> rcx
- 4 -> r8
- 5 -> r9
- 6 -> rsp
- 7 -> rsp+8 โฆ
- attack
- read: (for leak)
- stack_base
- rbp
- environ ptr (point to environ string)
- P.S ๆฑ stack address ๆ, ็ฎ address ไน้ๅฝผๆญค็ offset ๆๆฏ่ผๆบ, ๅ ็บๅณไฝฟ stack_base ็ฅ้, ๆฏๆฌก function frame ็่ตทๅงไฝ็ฝฎไนๆ random
- canary
- libc_base (return addr like
libc_start_main + 243, 242, 235 ...)
- stack_base
- write
- ptr as arg
- read: (for leak)
- helper format
-
-
%n, %hn ้ ่จญ็บๅฐไนๅๅฐๅบไพ character ๆธ้๏ผๅฏซๅฐๅฐๆ argument ptr ๆๅฐ็ไฝ็ฝฎ๏ผ่ๅฆๆๆฒๆๆๅฎ k$๏ผๅฏไปฅๅจไธๆฌก fmt ไนๅ งๆ็ ง้ ๅบไฟฎๆนๅคๆฌก
- k$ ๆๅจ fmt ๅๅฐ ptr ๆๅฐ็ address ๅญไพ๏ผๅ ๆญคไธ่ฝๅๆ ๆน่ฎ
-
printf("%*");๏ผ*ไปฃ่กจๅๅฐๆๅฝๅผๅๆธ็ๅผ -
็จไพ่จ็ฎ็ธฝๅ ฑๅฏซๅคๅฐๆฌก็ function
- pwntool fmtstr ็ไฝฟ็จๆนๅผ
FILE exploit
FILE structure
- system read write ๆๆๅ
ๅพ disk ่ฎไธๅคงๆฎตไธฆไธๆพๅจ kernel buffer, ไธฆไธๆพๅจ user space
- ้ไฝ disk I/O ๆฌกๆธ
FILE struct- high level
- file stream descriptor
- ็ฑ
fopen()็ข็
- ็ฑ
- fread/fwrite <=> stream buffer <=> read/write (user mode)
- <=> kernel buffer <=> disk (kernel mode)
- ้ไฝ system call ็ๆฌกๆธ
- ๅฎฃๅ
FILE structๆ็บๅฎฃๅ_IO_FILE_plus _IO_FILE- flag:
_flags"w+", "r" โฆ - stream buffer:
_IO_read_ptr~_IO_buf_end - fd:
_fileno็ฑsystem()open ็ข็
- flag:
_IO_FILE_plus- ๆๆ file stream ๆ่ขซไธฒๅจไธๅ linked list
- next ๅจ
_IO_FILEไธญ็บ_chain
- next ๅจ
fopen()
- ้ฆๅ ๆ malloc ไธๆฎต memory ๅญ FILE struct
- link ๅฐๅญ FILE stream ็ linked list ๅ
ง
_IO_list_allไธ้ๅงๆไธฒ่ sterr, stdout and stdin- ่ฉฒๅกซ็ๅกซไธๅกซ
_flag,chainandvtable็ญโฆ
- ๅณๅฐ linked list (linked list ๆๅ
ๆๅฐๆฐๅข็, ๆญคๆฐๅข็
chainๅจๆๅๅๆฌ็chain)- insert linked list node ็ๆ่ฆบ
- ๆๆฐ็ๆ่ขซ
_IO_list_allๆๅฐ๏ผ็ทๆฅ่ๆฏๅ ถไป fd ่ stderr, stdout, stdin (้กไผผ LIFO ?)
sys_open()the file
fread()
- ๅฆๆ stream buffer ็บ NULL, ๅฐฑ allocate ไธๅก็ตฆไป
- ็จ
vtable->_IO_file_xsgetnๅคๆท - ้้
vtable->_IO_file_doallocateallocate
- ็จ
- ็จ
vtable->_IO_file_underflow่ฎไธๅคงๆฎตๅฐ stream buffer ไธ- default 1 page
- ๅฉ็จ system call
sys_read()่ฎๆช - ๅๆ stream buffer ็ content copy ๅฐ dest
fwrite()
- allocate buffer
- ๅฐ data ๅฏซๅฐ stream buffer ไธ
fclose()
- ๅพ linked list ไธญ็งป้ค (unlinked the FILE structure)
flush()andrelease()stream buffer- close file
- release FILE structure
- ็ตฑๆด
- FILE structure ๅจ
fopen()ๆ่ชๅ malloc ไธๅ็ฉบ้ๅฐ heap ไธ _IO_new_file_init_internalๆ้ฒ่กstructure ๅๅงๅ- ๆฏๅ FILE structure ไผผไน้ฝๆๆไธ็ต buffer, ๅ็จฑไฝ file stream
- file stream ่ฒ ่ฒฌๆฅๆถ
sys_open()ๅณ้็ไธๅคง็ญ่ณๆ
- file stream ่ฒ ่ฒฌๆฅๆถ
- ๆญคๆ file stream ๅฐๆชๅ้ ๅฐ mem
- ๆฏๅ FILE structure ไผผไน้ฝๆๆไธ็ต buffer, ๅ็จฑไฝ file stream
_IO_link_inๅฐๆญค structure insert ่ณ_IO_list_all็้ ญ_IO_list_all็บ file_chain (linked list), ๆๅฐๆๆ FILE structure ไธฒ่ตทไพ
sys_open()็็ตๆ็บ fd, assign ่ณ_fileno- ๅจ
fread()ๆ, ๆๅ vtable->_IO_file_xsgetn็ file stream ๆฏๅฆ็บ NULL, ่ฅๆฏๅๅฉ็จvtable->doallocateallocate ไธๅก memory ็ตฆไป - ไนๅพ็จ
vtable->_IO_file_underflowๅผๅซsys_read(), ่ฎ_filenoๅฐๆ็ๆชๆก็ 1 page ๅฐ stream buffer ไธ - ๆ นๆ user ๅผๅซ
fread()็ๅๆธ็ตฆไบๅฐๆๅคงๅฐ็ response fclose()ๆๆๅ ๆๆญค FILE structure ๅพ_IO_list_allๆ้ค, ๆธ ็ฉบ (flush and release) file stream ไปฅๅ้้ๆชๆก, ๆๅพfree()ๆๆญค FILE structure
- FILE structure ๅจ
- ๅ
ถไป
- ๅจ trace code ๆๆ็ๅฐ debug symbol ๆไบ็บ
__GI__IO_file_XXX๏ผๅฐฑๆฏๅฉ็จ vtable ไพๅผๅซ็ function _IO_buf_base็บ buffer ้ๅง๏ผ้ๅธธๆฒ็นๅฅ่จญๅฎๅฐฑๆๅจ heap ไธ- ็ๆญฃๅจๅ้
_IO_XXX_ptr or base or end็ญ็ญๆฏๅจ_IO_new_file_underflow๏ผไธ้ๅง้คไบ_IO_buf_end๏ผๅ ถไปๅ จ้จ้ฝๆ็ญๆผ_IO_buf_base - ๆๅพๆ call read syscall๏ผๅพ fd ่ฎ buffer size (st_blksize)๏ผไธฆๅฏซๅฐ buffer ๅ
ง
read_endๆๅ้้ syscall read ่ฎๅฐ็็ตๅฐพ
- ๆๅพๅฏซๅฐ dest ไธญ๏ผ่ฉฒ่ผชๅฎๆ
- ๅฏซๅฎไนๅพ
read_ptrๆ ==read_endไปฃ่กจ่ฎๅฎไบ
- ่ๅพๆๅฐๆๆ ptr ็ญ็ญ้ฝ reset ๆ buffer base (
_IO_new_file_underflow)๏ผๅ่ฎไธๆฌก๏ผๆ่ฎๆๅ๏ผไฝๆฏๅชๆ EOF (0xffffffff)๏ผ่ๆญคๆๅฐฑๆ return
freadfwrite_IO_buf_base่ผธๅ ฅ่ผธๅบ buffer base_IO_buf_end่ผธๅ ฅ่ผธๅบ buffer end_IO_bufๅจ_IO_doallocbufๆ่ขซ init
_IO_write_base่ผธๅบ buffer base_IO_write_ptr่ผธๅบๅทฒไฝฟ็จๅฐ็ไฝ็ฝฎ_IO_write_end่ผธๅบ buffer end
_IO_OVERFLOW่ฝ fflush ๆๆ็- ๅจ
_IO_new_file_overflowๅ ง๏ผๆๅๅงๅๆฒๆ write ptr ็ fp _IO_setbๆฏ็จไพ set buffer- ไนๅพ
_IO_write_base==_IO_write_ptr==_IO_buf_baseใ_IO_write_end==_IO_buf_end_IO_OVERFLOWflush buffer
- ็ถไธไธๆ้ฆฌไธๅฏซๅฐ file ไธญ๏ผ่ๆฏ็ญๅฐ main ็ตๆๅพ๏ผ
_IO_cleanup->_IO_flush_all_lockpๆๆๅฏซๅ
- write ๆฏ call
_IO_new_file_overflow๏ผ read ๆฏ call_IO_new_file_underflow
- ๅจ trace code ๆๆ็ๅฐ debug symbol ๆไบ็บ
arb write example
_IO_fread็bytes_read = _IO_sgetn (fp, (char *) buf, bytes_requested);_IO_sgetn็return _IO_XSGETN (fp, data, n);- https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/genops.c#L464
- file operation ็ define ๅค้ฝๅจ
libio/genops.c
_IO_file_xsgetnๆ call__underflow()๏ผๅฆไธ- https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/fileops.c#L1359
- ๅ ็บ buffer size ๆ่จญ๏ผๆไปฅไปๆๅ ๆชขๆฅ FILE ็ๆฑ่ฅฟ
__underflow็return _IO_UNDERFLOW (fp);- https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/genops.c#L315
- ้็จๅชๆๅไธไบ backup ๆชขๆฅ่ๅ ถไป็ๆชขๆฅ
_IO_new_file_underflow็if (was_writing && _IO_switch_to_get_mode (fp))- https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/fileops.c#L530
- ่จป่งฃ่ชชๆ
Flush unwritten characters.
_IO_switch_to_get_mode- https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/genops.c#L174
- ๅจ้้ๆๆ
_IO_read_base่จญ็บ_IO_buf_base
- ๅไพ
_IO_new_file_underflow๏ผไธ้ข็จๅผ็ขผๆๆไปฅไธ ptr ้ฝ่จญ็บbuf_base๏ผไนๅพๅจ call_IO_SYSREAD _IO_file_readไฝ็บ read ็ wrapper๏ผๅๆฌ่ฆๅพ file ไธญ่ฎ 100 bytes (buffer ็้ไฟ) ๅฏซๅฐ buffer๏ผไฝ็พๅจ่ฎๆๅพ stdin ่ฎ (fileno = 0)๏ผๅฏซๅฐๆๅๆๅฎ็ buffer ไฝ็ฝฎ- https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/fileops.c#L1212
- ้้ want ็บๆๅๅณๅ ฅ็ 6๏ผhave ็บๅฏฆ้ๅพ stdin ่ผธๅ ฅ็ๅคงๅฐ (ๅๆฌๆ่ฉฒๆฏๅพ file ไธญ่ฎ 100 bytes ็)๏ผ copy ๅฎๅพๅฐฑ return ๅๅปไบ
arb read example
_IO_fwrite็written = _IO_sputn (fp, (const char *) buf, request);_IO_new_file_xsputn็if (_IO_OVERFLOW (f, EOF) == EOF)_IO_new_file_overflow็if (ch == EOF)- https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/fileops.c#L806
- ๆญคๆ int ch ็บ -1
f->_IO_write_ptr - f->_IO_write_base้้็บ่ฆๅ ๅฏซๅ fd ็ size๏ผ่ๅๅ ็บๆนๅ fd fileno ็บ 1๏ผๆไปฅๆๆๆญค range ๅฐๅฐ 1 (stdout)
_IO_new_do_write็new_do_writenew_do_write็count = _IO_SYSWRITE (fp, data, to_do);_IO_new_file_write็: write (f->_fileno, data, to_do));- https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/fileops.c#L1255
- ๅณๅฐๆ write_base ~ write_ptr ็ๆฑ่ฅฟๅฐๅฐ stdout๏ผไธฆไธๅจๅฐๅฎๅพๆ reset buffer
ๆ้่ฆ็ๆฏๆญค if condition๏ผๆๅ
ๅคๆทๆๆฒๆ่ณๆ่ฆ flush๏ผไนๅพๅๅไธๆฌก new_do_write()๏ผ่ฎ็ๆญฃ่ฆ่ฎ็ๆฑ่ฅฟ
https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/fileops.c#L1327
ๆญฃๅธธๆ
ๆณๆ่ท _IO_default_xsputn๏ผๆ่ผธๅบๅฏซๅฐ buffer ๅ
ง
่ฃๅ ่ชชๆ
ไฝฟ็จๅฐ stdout ็ function (puts, fwriteโฆ) ๅฏไปฅ่ฎๆฑ่ฅฟๅฐ buffer (ไปปๆๅฏซ)๏ผไน่ฝๅฐ buffer ไธญ็ๆฑ่ฅฟๅฐๅบไพ (ไปปๆ่ฎ)
ไปปๆ่ฎ็ๆง้ ๅฆไธ๏ผๆงๅถ write / read ไปฅๅ fileno
ไปปๆๅฏซ็ example payload ๅฆไธ๏ผๅฉ็จ _IO_new_file_xsputn ไธญๅคๆท (f->_IO_write_end > f->_IO_write_ptr)๏ผ่ฅๆ็ซๅไปฃ่กจ่ผธๅบ buffer (write) ้่ฝๅญๆฑ่ฅฟ๏ผๆไปฅๅ
ๆ่ณๆๅฏซๅฐ่ฃก้ข๏ผไฝๆฏ่ฆๆงๅถๅฅฝ read_end ่ฆ็ญๆผ write_base๏ผ้ๆจฃ buffer ๆไธๆ้็
่็บไป้บผ่ฆ 0x8000 (_IO_USER_LOCK)๏ผๅ ็บๅฆๆๆฒๆ _IO_acquire_lock_clear_flags2๏ผๅ process ๆ้ทๅ
ฅ for loop
https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/libioP.h#L872
https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/libio.h#L448
close trace
_IO_new_fclosecall_IO_un_link ((struct _IO_FILE_plus *) fp);_IO_un_link- https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/genops.c#L58
_IO_list_all = (struct _IO_FILE_plus *) _IO_list_all->file._chain;ๅฐฑๆฏๅจ unlink FILE
- ๅๅฎๅพๆ return ๅ
_IO_new_fclose๏ผไธฆไธ call_IO_file_close_it้้ไป- ๅฏไปฅ็ฅ้๏ผglibc ๅ ๆ FILE ๅพ list ็งป้คๅพๆ close
_IO_new_fclose้ๆ call_IO_new_file_close_it- https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/fileops.c#L157
- ้้ๅฏไปฅ็ๅฐ๏ผๅฆๆๆฏ ~
_IO_NO_WRITES(ไปฃ่กจๆๅฏซ) ็่ฉฑ๏ผๅฐฑๆๅ_IO_do_flush๏ผๆ่ฆ write ็ๅผๅฏซ
- ็ถๅพๆๅ
? _IO_SYSCLOSE (fp) : 0);ไพ close fd - ไนๅพไธ้ฃไธฒ
_IO_setXไพๆธ ็ฉบ buffer - ่ฃก้ขๅๆ
_IO_un_link
_IO_FINISH- https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/fileops.c#L199
- ่ฃก้ข็ขบๅฎๆฏๅฆ open๏ผๅฆๆๆฏ็่ฉฑ่ฆๅ
_IO_do_flush (fp);๏ผไธฆไธ้้ไป
- ๆๅพๅฆๆไธๆฏ stdin stdout stderr๏ผๅฐฑ free ๆ (stdin stdout stderr ้ ่จญๅฐฑๆ space๏ผไธๆฏ malloc ๅบไพ็
- code
_IO_setb (FILE *f, char *b, char *eb, int a)๏ผset buffer_IO_setg(fp, eb, g, eg)๏ผset read_XX (g ๆ่ฉฒๆฏๆ gets)- code
_IO_setp(__fp, __p, __ep)๏ผset write_XX (p ๆ่ฉฒๆฏๆ print)- code
use stdout to libc leak
ๅๆ็บ
sebvbuf(stdout, 0, 2, 0)
ๆณ่พฆๆณๆ๏ผ
stdout->_flags == 0xfbad18000xfbad0000(file magic)- &= ~
_IO_NO_WRITES== 0xfbad0000 - |=
_IO_CURRENTLY_PUTTING(0x800) ==0xfbad0800 - |=
_IO_IS_APPENDING(0x1000) ==0xfbad1800
- &= ~
_IO_write_base- ่จญ็บ
&(stdout->_flags)ไน้ก็ libc ไฝ็ฝฎ (้่ฆๆฏๅๆฌๅฐ๏ผๅ ็บๅๆฌ็_IO_write_base==_IO_write_ptr==_IO_write_end
- ่จญ็บ
ไนๅพๅจ puts ๆๅฐฑๆๅพ &(stdout->_flags) ้ๅงๅด๏ผๅดๅฐ _IO_write_end
use stdin to code execution
ๅๆ็บ
sebvbuf(stdin, 0, 2, 0)
็จ unsorted bin attack ่ๆ _IO_buf_end๏ผๆญคๆๅๅฏซๅฐฑ่ฝๅพ _IO_buf_ptr ๅฏซๅฐ _IO_buf_end๏ผไนๅฐฑๆฏ unsorted bin (in main_arena)๏ผ้็จไธญๅฐฑๆ __malloc_hook ๅฏไปฅ่
vtable hijack
https://ray-cp.github.io/archivers/IO_FILE_vtable_hajack_and_fsop
https://ray-cp.github.io/archivers/IO_FILE_vtable_check_and_bypass
้้ไฟฎๆน vtable ptr๏ผๆๅๅฏไปฅๆงๅถ็ๅฐๆน๏ผ็ถๅพๅ ็บ vtable ptr ๆๅฐ็ๅฐๆนไนๆฏไธๅ funcion ptr๏ผๆไปฅๆๅๅฏไปฅ้้ไฟฎๆนๅฐๆไฝฟ็จๅฐ็ function ptr ไพ้ฒ่กๆปๆใ (glibc 2.24 ๅ)
glibc 2.24 ๅพๅขๅ ไบไปฅไธ check๏ผไธป่ฆๆฏ check vtable ptr ๆฏไธๆฏๅจ glibc vtable range ไธญ
__start___libc_IO_vtables็บ vtable range ็้ๅง__stop___libc_IO_vtables็บ vtable range ็็ตๆ
fsop (studying)
https://elixir.bootlin.com/glibc/glibc-2.23/source/libio/genops.c#L58
glibc ไธญๆๅ function ๅซ _IO_flush_all_lockp๏ผไธป่ฆ่ฒ ่ฒฌ flush ๆๆ FILE๏ผๅจ็จๅผ็ตๆไนๅๆ่ขซ call ๅฐ
- ๆญฃๅธธ้ข้ (main return)
- exit
- abort
GLIBC 2.27 the
abort()function no longer calls_IO_flush_all_lockp()
ๆปๆๆนๆณ็บ๏ผๅฝ้ ไธๅ fake FILE๏ผไธฆๅฐ _IO_list_all ๆๅฐๆๅ็ fake FILE๏ผๆๅพ็น้ไปฅไธๆชขๆฅ๏ผไฝฟ็จ _IO_OVERFLOW ไพ control flow
glibc 2.23
่ house of orange ็บไพๅญ๏ผๅฐ_IO_list_all่ๆ unsorted bin ๅพ๏ผsmallbin 0x60 ็ไฝ็ฝฎๅๅฅฝๆๆฏ_chain๏ผ่้้ๅจๆญค chunk ๆง้ ๅฅฝ data ่ vtable๏ผๅจไฝฟ็จ vtable_IO_OVERFLOWๆๆๆ fp ็ถไฝ็ฌฌไธๅๅๆธๅณๅ ฅ๏ผๅฆๆๆๅๆ_IO_OVERFLOW็ไฝ็ฝฎๅฏซๆ system๏ผfake chunk fp ไธ้ๅงๅฏซๆ/bin/sh\x00๏ผ้ๆจฃๅจ call_IO_OVERFLOWๆๅฐฑ็ญๆผ่ทsystem(fp)๏ผgetshell
glibc 2.24 ๅพ
ๅฉ็จ_IO_str_jumpsๆ_IO_wstr_jumps๏ผ่ๅ ฉ่ ๅชๅทฎๅจไธๅๆฏ่็ wchar (ๅฏฌๅญๅ )
่ฆๆ็ๅฐๆนๅจ _IO_str_finish
็ดๆฅ call ((_IO_strfile *) fp)->_s._free_buffer๏ผไธฆๆ fp->_IO_buf_base ็ถไฝๅๆธ
ๅฆๆๆๅ่ฝ่ฎ vtable == _IO_str_jumps-8๏ผ้ๆจฃๅฐๆๅฐ็ __overflow offset ๅฐฑๆๆฏ _IO_str_finish
exploit
- buffer overflow ่ๆ fp
- ๆ crash ๅจ
_IO_acquire_lock(fp), ๅ ็บ FILE ๅ งๆ*_lock, ้ ้ฒ multihread ๆ RC ็ๆ ๆณ- ๆณ่พฆๆณๅฐๅ ถ่จญ็บๆๅ 0 ็ address (offset ็บ 0x88)
- ๆง
_IO_FILE_plus.vtable, ่ฎไปๆๅ system- ๆๅพๅๆงๅถ call function ๅ็ๅๆธ, ๆๅฐ
/bin/sh
- ๆๅพๅๆงๅถ call function ๅ็ๅๆธ, ๆๅฐ
- ๆ crash ๅจ
FSOP
- file-stream oriented programing
- ๆงๅถ
_chainand_IO_list_all - ๅฅฝ็จ็ function
_IO_flush_all_lockp- main return, abort ็ญ็ญๆๆ flsuh ๆๆ file stream
- ๅคๆทไธไบๆขไปถ, ๆ็ซๅพๆๅผๅซ
_IO_OVERFLOW
- ๆง้ linked list
- ๆงๅถ
- e.g. house of orange
- ็จ unsorted bin attack ๅฐ unsorted bin ็ไฝ็ฝฎๅฏซๅฐ
_IO_list_all, ๅๆไนๆง้ ๅบ 0x60 ๅคงๅฐ็ chunk ้ฒๅ ฅ small bin - unsorted bin attack
malloc()ๆ, ไธ็ฎก unsorted bin ๆฏๅฆๆๅๅฅฝๅคงๅฐ็ chunk, ไป้ฝๆ unsorted bin ็ chunk ๅ unlink- ๅๅฅฝๅคงๅฐ: ็ดๆฅๅพ unsorted bin ็งป้ค็ตฆไฝฟ็จ่
- ไธๆฏๅๅฅฝ: ๅพ unsorted bin ็งป้ค, ๆพๅฐๅฐๆ็ bin
- ไฝ้้ๆฒๅฐ double linked list ๅๆชขๆฅ
- ๅๅบ unsorted bin ็ๆๅพไธๅก chunk ๅ victim, ็ถๅพๅฐ้ๅก bk ๆๅ็ chunk ็ fd ๆนๆ unsorted bin ็ไฝ็ฝฎ
- ๅฐฑๆฏ linked list ็ delete node
- ๆไปฅๆๅพไธๅก chunk ็ bk ๆนๅฏซ็บ"ๅ
ถไปไฝ็ฝฎ"ๅพ, ๅจ unlink ๅฎ unsorted bin ๆๆๅ "ๅ
ถไปไฝ็ฝฎ" ๆๅฐ็ fd
- ็บๅพๅคง็ๆธๅญ (?
- ้ๅธธๆๅฏซๅฐ global_max_fast
- ๅคๆทๆฏๅฆ็บ fastbin chunk
- ๅฐๆผๆญคๅผๅฐฑไธๆฏ fastbin
- ๅจ้ ๅ fastbin corruption attack
- ๅฆๆ size ไธๅฐ, ๆๆไปๆพๅฐ small bin
- ็จ unsorted bin attack ๅฐ unsorted bin ็ไฝ็ฝฎๅฏซๅฐ
- ่ฆ็ขบไฟ
_IO_FILE_plus._flags< 0 - ๅฆไฝๅจๆฒๆ
free()็ๆ ๆณไธๆ chunk ๆพๅ ฅ small bin- ๆๅฏๆงๅทฒ็ถ free ็ chunk ็ size ๆนๆ 0x60
- ๅจ
malloc()ๆ, ๆๆๅฐๆญค chunk, ็ผ็พ size ไธๅฐๅพๆๆพๅฐ small bin (0x60)- ๅฐ chunk (fd, bk) ็ address ๆนๆไปปๆๆๅๆณ็ถไฝ chunk ็ไฝ็ฝฎ
- ไธๆฌกๅๆฟ chunk ๆๅ ็บ chunk ไธๅๆณ (ๅ่จญ), ๆ่งธ็ผ
abort()->_IO_flush_all_lockp()- ๆ call vtable ็ๆๅ function, ไธฆไธๅฐ FILE ptr ็ถไฝๅๆธๅณๅ ฅ
- ๅฆๆๆๅๅฐ bk ไฝ็ฝฎๆนๆ
_IO_list_all- 0x10_IO_list_allๅ ็บ unlink unsorted bin ็ๆฉๅถๆๆๅ unsorted_bin[0] (in main_arena)- ่ๆญคๆๅ ็บ FILE ็ๆฉๅถ (
_IO_list_all), main_arena ็smallbin[4](chunk size ็บ 0x60) ๆๆๅๆๅ็ chunk, ไธฆๆๆๅ็ chunk ็ถไฝ FILE structure ็_IO_list_all->_chainๅๅฅฝ็บ smallbin[4] (0x60)- ้่ฆๆปฟ่ถณ
_IO_write_ptr>_IO_write_base
- ไธฆๅจ abort ๆ, ๅ FILE structure ไนๆ่ขซ
_IO_flush_all_lockp()ๅฝฑ้ฟ- ๅฐ
_flagsๆนๆ '/bin/sh;' - vtable ็ function ๆนๆ
system() - ๅจ abort ๆๅฏไปฅ trigger
system("/bin/sh")
- ๅฐ
- ๆฐ็ glibc ็ๆฌ่ฆๆฑ vtable ่ฆๅจ
_IO_vtablesection ไนๅ ง- ๅฆๆไธๆฏ, ๆ้ฒ่ก็ฌฌไบๆฎตๆชขๆฅ
- for compatibilty
- pointer guard ไธๆ้บผๅฏ่ฝ็น้
- for shared library
- ๅฏซๅฐ
_dl_open_hookไน่ฝ็น, ไฝ่ฝๅฏซๅฐ้, ไนไธๅฟ ่ฆๅฏซๅฐๆญค hook
- ๅฏซๅฐ
- for compatibilty
- FILE structure ๆฏไธๆฏๆฒๆไบโฆ ้ๆ!!
- ๅฆๆไธๆฏ, ๆ้ฒ่ก็ฌฌไบๆฎตๆชขๆฅ
- ๅฉ็จ stream buffer ่ท file descriptor
- stdout ไปปๆ่ฎ
- set
_filenoto fd of stdout - set
_flag&~_IO_NO_WRITES - set
_flag|=_O_CURRENTLY_PUTTING - set
write_base&write_ptrto mem you want to read - set
_IO_read_end==_IO_write_base- ่ฆ้ฟ้ไธไบๆๅๅฐ stream buffer ็ๆขไปถ
- set
- stdin ไปปๆๅฏซ
- set
_filenoto fd of stdin - set
_flag&~_IO_NO_READS - set
read_base==read_ptr - set
buf_base&buf_ptrto mem you want to read buf_end-buf_base> size of fread
- set
- GOT hijack
__malloc_hook/__free_hook_/__realloc_hook_
- stdout ไปปๆ่ฎ
- ๅฆๆๆฒๆ file operation ๅฏไปฅ็จๆ้บผ่พฆ
- stdin / stdout / stderr ็ธ้็ function ้ฝๅฏไปฅ
- put / printf
- scanf / gets / fgets
- ๅ่จญ็็บ unbuffer
- stdout
- ็จ fastbin attack
- overwrite
_flags - partial overwrite
_IO_write_baseptr
- overwrite
- partial overwrite unsorted bin ptr
- ๆฟๅฐ stdout ๅพ๏ผๆนๅฏซ stdout ็
_IO_write_base(่ชคไปฅ็บๆฑ่ฅฟ้ๆฒ่ผธๅบๅฎ) - ๅ house of roman
- ๆฟๅฐ stdout ๅพ๏ผๆนๅฏซ stdout ็
- ็จ fastbin attack
- stdin
- unsorted bin attack ่
_IO_buf_end - if
scanf("%d", &var)read(0, buf_base, sizeof(stdin buffer))- ่ๆ
__malloc_hook
- unsorted bin attack ่
- ็จ
_IO_strfile_== struct{_IO_streambuf;_IO_str_fields}- field ๅ งๅซๅ ฉๅ function ptr
- stdin / stdout / stderr ็ธ้็ function ้ฝๅฏไปฅ
- ๅฉไธ้ๆ
_IO_str_finish,_IO_str_jumps,_IO_wstr_finish็ญ็ญ
scanf("%d", &var)ๅบๅฑคๆ callread(0, buf_base, sizeof(stdin buffer))_IO_write_base~_IO_write_ptrๅ งๅฎน็ๆฑ่ฅฟๆฏ่ฆ่ขซๅฏซๅพ๏ผๅฏซๅปๅช?_fileno_IO_buf_base~_IO_buf_endๅ งๅฎน็ๆฑ่ฅฟๆฏ่ฆ่ขซ่ฎ็๏ผๅพๅช่ฎ?_fileno(1)
file other trick
- vtable ๅญ็ function ptr ๅจ 2.29 ๅพๅฏไปฅๅฏซ
- vtable ๆฌ่บซ ๅจ 2.24 ๅพๆๅดๆ ผ็ๆชขๆฅ๏ผๅบๆฌไธ็นไธๅคชๆ๏ผๆฒ่พฆๆณ็ดๆฅไฟฎๆน
ๅฏไปฅๆงๅถ stdout ๆๆฏ stdin ็ญ็ญ fp๏ผๅฏไปฅๅ่ฉฆๆนๅ chain๏ผๆนๆ heap address ไน้กๅฏไปฅๆงๅถ็ๅฐๆน๏ผไธฆๅฝ้ fake _IO_file_plus
heap
็บๅฏไปฅๅจ runtime ไฝฟ็จไธฆ้ๆพ็ memory space, ๆฏ็ฑ low address -> large address
allocate heap memory region: mmap & brk
- brk
void *sbrk(intptr_t increment):start_brk็บ heap ่ตทๅง,brk็บ heap ็ตๆ- increment=0 ๆๆ่ฟๅ็ถๅ
brk
void brk(void *addr):- ๅณๅ
ฅๆๅฎ
brkaddress
- ๅณๅ
ฅๆๅฎ
- mmap
void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset);:- ex :
mmap(NULL, (size_t)(4*1024+1), PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) - creates a new mapping in the virtual address space of the calling process.
- ๆ ๅฐไธๅก address ็ตฆ process ไฝฟ็จ, ่ฉฒๅก address ๅฏ่ฝ็บ file ็ mapping, ไนๅฏ่ฝๅชๆฏไธๅก virtual address
- addr=NULL: ่ฎ kernel ่ชๅทฑ้ธ
- prot:
- READ ไปฃ่กจๅฏ่ฎ
- WRITE ไปฃ่กจๅฏๅฏซ
- flags:
- MAP_PRIVATE ไปฃ่กจไธ่ขซๅ ถไป process ๅ ฑ็จ
- MAP_ANONYMOUS ไปฃ่กจไธๅฑฌๆผไปปไฝ file, initial with 0
- fd ้็บ -1
- offset ็บ 0
- ex :
PS. getchar(), scanf() ็ญ็ญๆ้ input ็ function ็ๆไฝฟ็จๅฐ heap
The GNU C Library ("glibc", the usual C runtime on Ubuntu) allocates memory for internal use the first time stdout is used for anything
ไธป่ฆ็ๅ ฉๅ function: malloc & free
malloc():- first malloc
- size >= 128KB: mmap โ> sys_mmap
- size < 128KB: brk โ> sys_brk
- ้้ brk, kernel ๆ็ตฆ glibc
132KB็ heap segment(rw), ไธฆๆจ็คบ็บไฝฟ็จ้, ๆๅ็จฑไน main arena - ็คบๆ flow :
- binary โ่ฆ1KBโ> glibc โโ> kernel
- binary โโ> glibc โ่ฆmemoryโ> kernel
- binary โโ> glibc <โ็ตฆไฝ 132KBโ kernel
- binary <โ็ตฆไฝ 1KBโ glibc(ๅ ฑๆ132KB) <โโ kernel
- ๅฐ binary ไพ่ชช,
free()ๆฏ้ๆพ็ตฆ glibc - ๅฐ glibc ไพ่ชช, glibc ๆๆก 132KB memory, ๆง็ฎก binary ็ memory
- ๅฐ kernel ไพ่ชช, ไปๅทฒ็ถๅ้ 132KB ็ตฆ glibc, ไปฃ่กจๆญค 132KB ๅทฒ่ขซไฝฟ็จ
- ้้ brk, kernel ๆ็ตฆ glibc
malloc()return ๅไพ็ ptr ๆๅ chunk, ็บ glibc ๅฏฆไฝ memory management ็ data struct (header + data)- next malloc
- if(size < 0x90), ๆๅ ๅป fast bin ๆพๆ็ก size ็ธ็ฌฆ็ chunk, ๆๅๅๅณ
- ๅป unsorted bin ๆพๆ็ก size ็ธ็ฌฆ็ chunk, ๆๅๅๅณ
- ็ก็ธ็ฌฆไฝๆๆดๅคง size ็ chunk, ๅๅๅฒๅพๅๅณ, ๅฉ้ค็ไธๅ unsorted bin
- ้ฝๆฒๆ, ๅๅพ top chunk ๅไธฆๅๅณ
- first malloc
free():- ็ถ้ fastbin size ็ chunk ่ขซ free, ่ฅ่ top chunk ็ธๆฅ(ๅจ top chunk ๅ้ข, chunk ๅพ้ขๆฏ top chunk), ๅๆ่ขซ merge
- ็ถ will be freed chunk ๅ้ข็ chunk ๆฏ no inuse(freed), ๅๆ trigger consolidate
ๅผๅซๆต็จๅฆไธ
malloc()โโ>__lib_malloc()โโ>_int_malloc()free()โโ>_int_free()
data structure
- fast bin struct
- unsorted, small and large bin struct
- ๅ thread arena ็ heap header
- arena structure, e.g. main_arena
- chunk
- tcache & its entry
detail
heap_info
thread arena ๅฏไปฅๆๅคๅ heap, ไธๆฏๅ heap ้ฝๆ่ชๅทฑ็ header, ็จฑไฝ heap_info, ็จไพๆ่ฟฐ heap ็ info
- ็ฑๆผ arena ๅ้ๆผๆ ธๅฟๆธ้, ๆไปฅๆไบ thread ๆ share arena, ่ arena ๅ งๅฏ่ฝๅ ๅซไธๅ thread ็ heap, ๆไปฅ็จ heap_info ๅปๆ่ฟฐ heap
- ็ถ heap ไธๅค ็จๆ, kernel ๆ็จ
mmap()orbrk()allocate memory (arena) ็ตฆ heap, ่ๆญคๆ่ฉฒ thread ๆๅคๅ sub-heap (ๅ arena + ๆฐ arena), ็ตๆ heap
- ๅฆๆญคๅ thread_arena ๅ
ง้จๆๅ
ฉๅ
mmap()ๅบ็ heap, ไธ heap2 ็heap_info->prevๆๅฐ heap1 ็heap_info->ar_ptr, ่ heap1 ็heap_info->ar_ptrๆๅฐmalloc_state, ๆญคไฝๆณๆนไพฟๅพ็บ็ฎก็
- ่ main_arena ๅฟ
ๅฎ้ธๅฑฌๆผ main_thread, ๆไปฅไธ้่ฆ heap_info
malloc_state
malloc_state ๅฒๅญ arena ็ info, ๅ ๅซ bin, top chunk, last remainder chunk ็ญ็ญ่ณ่จ (arena_header)
- main thread ็ arena (malloc_state) ็บ global, ๅจ libc ็ bss
- other threads ็ arena (malloc_state) not global, ไธ other threads arena ๅช่ฝ้้
mmap()create
chunk
- Chunk type
- Allocated
- Freed
- Top
- ็ถ็ท้ฐ็ chunk ่ขซ free, top chunk ๆๅฐๅ ถ merge (conlidate), ๅ ๆญค top chunk ็ PREV_INUSE bit ๆฐธ้ ็บ 1
- Allocated
- Freed chunk
- Fast bin
- free ๅฎๅพ, ๅชๆๆ fd (single linked list)
- default: 0x20 ~ 0x80 (7 ๅ)
- ๅ็จๅฐ 0xb0
- LIFO
- P (PREV_INUSE) ไธๆ่ขซๆธ ๆ
- Small bin
- ๆ fd, bk (double linked list)
- 0x20 ~ 0x3f0 (62 ๅ)
- FIFO
- ไธๅๅคงๅฐไธๅ bin
- Large bin
- ๆ fd, bk (double linked list) + fd_nextsize, bk_nextsize (ไธ/ไธไธๅๅคงๅฐ่ท่ชๅทฑไธไธๆจฃ็ chunk ไฝ็ฝฎ)
- allocate ๆ, ๆกๅ Best fit (ๆปฟ่ถณ chunk size ๆ่ฟ size)
- Unsorted bin
- ๆ fd, bk (double linked list)
- temporary cache (free ็ size ้ fast bin)
- malloc ๆๆๅ้ ๅฐๅฐๆ size ็ (small / large) chunk
- Tcache
- ๆฏๅ thread ็ heap, ็บไบๆธๅฐ lock ็ๆฌกๆธ่ๆๅๆ่ฝ
- ๅชๆ fd, ไฝๅฆๅคๆ key at bk ๅ double free ็ check
- 0x20 ~ 0x410 (64 ๅ)
- 7 ๅ entry per bin
- LIFO
- P ไธๆ unset
- Fast bin
- overlap bin size (fast / small)
- ็จไพๆพๅๅฉ็ๅคงๅฐๅๅฅฝๅจ fast bin ็ size range ๅ
ง
- e.g. 0x500 = 0x4c0 + 0x40, 0x40 ๆๅ ่ขซๆพๅฐ "unsorted bin", ๅจๅๆถๆๆ่ขซๆพๅฐ "small bin", ่ไธๆ้ฒๅ ฅ "fast bin"
- ็จไพๆพๅๅฉ็ๅคงๅฐๅๅฅฝๅจ fast bin ็ size range ๅ
ง
- Consolidate
- glibc ๅจ user malloc large bin size (>= 0x420), ๆๅๆถ + merge "fast bin" ็ chunk, ๆพๅ ฅ "unsored bin"
large chunk
็ธๅ index ไธ๏ผๆๅๆไปฅไธ็น้ป๏ผ
- ๅคงๅฐๅพๅคงๅฐๅฐ
- ๅคงๅฐ็ธๅ๏ผๅๅพ free ็ๆ้
- ๅคงๅฐ็ธๅ็ chunk๏ผๅชๆ็ฌฌไธๅก็ fd_nextsize ่ bk_nextsize ๆๆๅฐๅ ถไปๅฐๆน๏ผๅ ถไป้ฝๆฏ 0
- size ๆๅคง็ chunk bk_nextsize ๆๅๆๅฐ็ chunk๏ผsize ๆๅฐ็ fd_nextsize ๆๅๆๅคง็ chunk
- fd_nextsize ๆๅ size ๅ้ข (ๆดๅฐ็) ็ linked list๏ผbk_nextsize ๆๅ size ๅพ้ข (ๆดๅคง็) ็
- fd ๆๅๅพ้ขๆ้ๆ้ฒไพ็ chunk (bk == NULL ็บๆๅคง็ chunk)
example
- code
- ็ตๆ
trace
chunk detail
- top:
- 1~16 ๅ allocated
- P flag ๆ็บไธ, ๅ ็บๅฆๆ free ๆ้ฃ็บ memory ไธญ top chunk ็ไธๅ chunk ๆ, ่ฅ้ fastbin, ๅ่ฉฒๅก chunk ๆ่ top chunk merge
- allocated:
- 1~8 bytes:
- ้ฃ็บ memory ไธญไธไธๅก:
- ๅฆๆๆฏ free chunk ๅ็บprev_size, ็บๅไธๅ free chunk ็ๅคงๅฐ
- ๅฆๆๆฏ allocated chunk ๅ็บ data, ไปฃ่กจไธไธๅก allocated chunk ่็ถๅ allocated chunk ๆ 8 bytes ้็
- ้ฃ็บ memory ไธญไธไธๅก:
- 9~16 bytes:
- ๅ ็บ chunk ๅฐ้ฝ 0x10, ๆไปฅๅ 28 bits ็บ chunk size
- ๅพ 4 bits ็จไพๅญๅ
ถไป่ณ่จ:
- ๆฒ็จๅฐ
- non_main_arena(N): ๆญค chunk ๆฏๅฆๅฑฌๆผ main_arena, 0 ไปฃ่กจๅฑฌๆผ thread_arena
- is_mmaped(M): chunk ๆฏๅฆ้้
mmapๆฟๅฐ - prev_inuseยง: ้ฃ็บ memory ไธๅ chunk ๆฏๅฆๅจไฝฟ็จไธญ, ่ฅ็บ 1 ๅไปฃ่กจไธๅ chunk ็บ allocated chunk, ๆญฃๅจ่ขซไฝฟ็จไธญ
- 1~8 bytes:
- free:
- 1~16 ๅ allocated
- ๅ ็บ่ขซ free ๆ, ไปฃ่กจ็จไธๅฐไบ, ๆไปฅ data ๅๅฏไปฅๅญไธไบ meta-data(็จไพๆ่ฟฐๅ ถไป่ณๆ็่ณๆ)
- 1~8 bytes (for data):
- fd: ๆๅๅไธ bin ็ๅไธๅก chunk (linked list), ้้ฃ็บ memory ็ๅไธๅก
- 9~16 bytes (for data):
- bk: ๆๅๅไธ bin ็ๅพไธๅก chunk (linked list), ้้ฃ็บ memory ็ๅพไธๅก
- 17~24 bytes (for data):
- fd_nextsize: ๆๅๅไธๅก large chunk (ไธๅซ bin)
- 25~32 bytes (for data):
- bk_nextsize: ๆๅๅพไธๅก large chunk (ไธๅซ bin)
- ๅฆๆ่ขซ
free()็ chunk ็บ bin ไธญ็็ฌฌไธๅ freed chunk, ๅfd == bk == main_arena->bin, ๅ ็บmain_arena->binlinked list ็้ ญๅฐพ็บmain_arena->bin่ชๅทฑ็ chunk 
- last remainder:
- malloc ๆ, ptmalloc2 ๆพๅฐไธๅฐ็ธ็ฌฆ็ chunk, ๅช่ฝๅพๅคงๅก็ chunk ๅ, ๅฉไธ็ๅๆฏ last remainder chunk, ๅจ unsorted ๅ ง
bin detail
- bins ๆ นๆ sizes ๅๆ:
- fast bin
- chunk size < 0x90 bytes, ่ขซ free ๅฎๆๅๅฐๆญค bin
- fast bin ไธ้ขๅๆ นๆ size, ๅๅๆ 0x20, 0x30, 0x40โฆ, global_max_fast ็บ 0x80
- global_max_fast ๅๅงๅผ็บ 0, ็ฌฌไธๆฌก
malloc()ๆๆๆ่ขซๅกซๅ ฅ - ๅช็จๅฐ fb, ไธ NULL ็ตๅฐพ (<โ-> small, large ้ฝๆฏไปฅ bin_chunk ็ถ้้ ญ&็ตๅฐพ)
- ็บ LIFO, ๆไปฅๅพ fast bin ๆฟ chunk ๆๆๅ ๅพ็ฌฌไธๅๆฟ
- ๅ chunk ๅจ่ขซ free ๆๅพ, ่ฅๅจ fast bin, ๅไธๆๅฐไธไธๅก chunk ็ P ่จญๆ 0
- default_mxfast = 64 * SIZE_SZ / 4
- max_fast_size = 80 * SIZE_SZ / 4
- x86
- default = 0x40
- max = 0x50
- ๅคงๅฐ็บ 0x10, 0x18โฆ, 0x58 ๅ ฑ 10 ๅ
- x64
- default = 0x80
- max = 0xA0
- ๅคงๅฐ็บ 0x20, 0x30โฆ, 0xb0 ๅ ฑ 10 ๅ
- small bin
- chunk size < 0x400, 0x20~0x80 ็ chunk ๆๆ นๆๆฉๅถๆพๅ ฅ fast bin or small bin
- ๅ ถๅ ง้จๅๅๆ 0x20~0x3f0 ๅ ฑ 62 ๅ bin
- circular doubly linked list
- FIFO
- large bin
- chunk size > 0x400
- ๅจๆญค bin ็ free chunk ็ 17~32 bytes (for data) ๆพไบๅ
ถไป็ meta-data:
- 17~24 bytes: fd_nextsize, linked list ไธญไธๅ chunk ็ size
- 25~32 bytes: bk_nextsize, linked list ไธญไธๅ chunk ็ size
- unsorted bin
- ่ฅ chunk size > 0x80, ่ขซ free ๅพๆๅ ้ฒๅ ฅ unsorted bin
- circular doubly linked list
- ่ฅ trigger ๅฐ
consolidate, ๆๆธ ็ฉบ unsorted bin, ๅฐๅฐๆๅคงๅฐ็ chunk ๅ้ ๅฐ small & large bin 
- fast bin
- fast bin struct
- unsorted, small and large bin struct
tcache detail
glibc >= 2.26 ๅพๅขๅ ็ๆฉๅถ (ubuntu 17.10), ็ฎ็่ฆๆๅ performance
- https://medium.com/@ktecv2000/tcache-exploitation-871044f8b210
- fastbin ๅ็จฎ size ๅ้ข้ฝๅคไบ 7 ๅcache (ex. 0x30 free 7 ๆฌกๆๆๅฐ fastbin), ็จฑไฝ tcache
- ๆฏๅ thread ้ฝๆๆไธๅ
- ๅ
ฑ 64 ๅ bin (TCACHE_MAX_BINS) (24 0x18 ~ 1032 0x408)
- ไธๅ bin ๆๅค 7 ๅ chunk
- ่ถ ้ๅฐฑ็ดๆฅๆพ unsorted bin
- ๆๅ
ๅพ tcache ๆฟ, ็ญๅฐ็ฉบ็ๆๆๅป fastbin ๆพ, ่ๆญคๆๆฟๅฎ็ฌฌไธๅ fastbin ๅพ, ๆๅฐๅฉไธ็ chunk ไธๅฐ tcache, ๅ ็บๆฏ LIFO, ๆไปฅ:
- tcache ็บ็ฉบ, fastbin ๅ งๆฏ abcd
- ๅๅบ a, ๅฐ bcd ไปฅ reverse ็้ ๅบๆพๅ ฅ tcache
- tcache dcb, fastbin ็บ็ฉบ
- secure
- ๆฒๆๆชขๆฅ double free
malloc()ๆฒๆๆชขๆฅ size
- tcache ็็ฏๅๆถต่ small bin, ๆไปฅ่ฆ้้ unsorted bin ๅป leak libc, malloc size ๅฟ
้ ๅคงๆผ small bin
- ๅฆๆๆ UAF, ไนๅฏไปฅ้้
malloc()0x100 ไปฅไธ็ chunk 7 ๆฌก, ไธฆไธ free 7 ๆฌก่ฎ cache ๅกๆปฟ, ๆๅพๅฐฑๅฏไปฅ้ฒๅ ฅ unsorted bin ไธฆ leak ๅบ libc addr - ๆๆฏ็ดๆฅ allocte > 0x408 (1032) ็ chunk ่ฎ tcache ็กๆณไฝฟ็จ, ็ดๆฅ้ฒๅ ฅ unsorted bin
- ๅฆๆๆ UAF, ไนๅฏไปฅ้้
- tcache ็ free ๆฉๅถไปฅๅ malloc ๆฉๅถๅๅไธๅด่ฌน, ๆๅไปปๆๆง้ ไธๅๅคงๅฐ้ 0x50 ็ chunk ไน่ฝๆพๅ
ฅ 0x50 ็ chunk ไธญไธฆๅจ
malloc()ๆ่ขซๅๅบ- ไฝๅ่จญๆญค chunk size ็บ 0x410, ่ขซๅๅบๅพๆ่ขซ็ถไฝๆฏ 0x410 ็ chunk ็ๅพ
Trace Code
- ๅๅพ chunk size (mask & nomask)
- ๅๅพ next_chunk (็ถๅ chunk address + chunk size)
- ๅๅพ prev_chunk (็ถๅ chunk address - prev_size)
- ๆฅ็ chunk ๆฏๅฆไฝฟ็จ (ๅๅพ next_chunk ็ mchunk_size ไธฆ mask (PREV_INUSE flag))
- fastbin malloc
Vulnerability
ๆ heap ็้้ป
- mess chunk metadata ่ฎ glibc ๆททไบ
- UAF
- double free
- dangling ptr read/write
- Heap overflow
use-after-free
ๅ จๅ็บ use-after-free, free ๅฎ ptr ๅพไธฆๆฒๆ
ptr = NULL;, ๅฐ่ดๅ ptr ไปๆๅฐ heap address, ๅ็จฑ dangling pointer
- ็ฑๆผ free ๅฎๅพ, free chunk ๆๆพ meta-data (fd, bk), ๆไปฅๅฏไปฅๅ
information leak - double free ๅพ, ่ฉฒ pointer ๆๅฐ็ chunk, ๅ ถ fd ็ๅผๆๆฏ่ชๅทฑ, ่ heap ๅๅฐ aslr ไฟ่ญท
- malloc ๅบไธๅ free ๆๅพๆๅฐ unsorted bin ็ chunk, ๅ ็บ unsorted bin ็ fd & bk ๆๆฏ libc address(top chunk address, and main_arena ๅจ libc ็ bs
off-by-one
็ฑๆผๆขไปถๅคๆท้ฏ่ชค, ๅฐ่ดๅจๅฏซๅ ฅๆ้กๅคๅฏซๅ ฅ 1 byte, ๅฏ่ฝๆฏไปปๆๅญๅ , ๅฏ่ฝๆฏ null, ๅ็จฑ one byte overflow
่่้็ byte, ๅจ heap ๆฎต่ฅๆฏprev_in_useorprev_size, ๅๅฏ่ฝๆๅบ็พๆผๆด
- ็ผ็ๆ
ๆณ:
strlen(buf)ๅคๆท้ทๅบฆไธฆ็กๅคๆท\x00, ่strcpy(a, buf)ๆๆๆ\x00ไนไธ่ตท copy, ๅฐ่ด่ๅฐไธไธๅ bytefor loopๅคไธๆฌก, ๅฏซๅฐไธ่ฉฒๅฏซๅ ฅ็ๅฐๆน
ไธป่ฆ็บ่ prev_inuse bit
fastbin attack
fastbin ๅจๆชขๆฅ double free ๆ, ๅชๆชขๆฅ linked list ็ฌฌไธๅๆฏๅฆ็บ่ฆ free ็ ptr, ๅฏไปฅ็จ
free(A); free(B); free(A);bypass
- goal: ่ฎ in fastbin chunk->fd ๆๅๆๅ่ฆ็ไฝๅ, ๅ้้
malloc()ๅๅพ่ฉฒไฝๅ็ ptr, ้้่ฎๅฏซๅ exploit- e.g.
__malloc_hook- 0x23 (0x13 for padding)
- e.g.
- ๅจ double free A ๅพ, ๅๆฌก malloc ๆๆๅพๅฐ chunk A, ่ๆญค chunk A ๅๆ็บ free chunk(in fastbin) ไปฅๅ allocated chunk
- ๅฏไปฅ่ๆญคๆนๆ chunk A ๅจ free chunk ไธญ็ fd ๆฌไฝ, ่ๅพ malloc 3 ๆฌกๅพๆๅพๅฐๆๅๆนๆ็ fake fd ๆๆๅฐ็ไฝๅ+0x10
- ๅฏไปฅๆ fake fd ๆนๆ got address, ่ฎๆ hijack got; ๆ fake fd ๆนๆ stack, ่ฎๆ BOF ็ญ็ญโฆ
- allocate large bin ๆ trigger
malloc_consolidate(), ๅฐ fastbin ๅฏไปฅ merge ็ merge ๅพๅๆพๅ ฅ unsorted bin, ไธ่ฝ merge ็็ดๆฅๆพๅ ฅ, ๆไปฅๅฏไปฅ bypass double free
ไฝๆฏ็ฌฌไธๆฌก malloc() ๆฟๅบ็ fake_chunk ๅฟ
้ ็ฌฆๅ fastbin check, chunk_size ้็ธ็ฌฆ
- ๆพ stack
- in 64, ๅฏไปฅๆพ GOT ๆฒ call ้็ function, ๅ ็บๅ ถ้้ ญ้ๅธธ็บ 0x40 ====> 0x40
- hook - offset(3) function ====> 0x7f
tcache attack
- free ็ฌฌไธๅกๆ, key ๆ่ขซๅกซไธ tcache; free ็ฌฌไบๅกๆๆๆชขๆฅ
key (chunk+0x18) == tcache- if true, ๆ traverse ๆๆ็ธๅ size ็ chunk, ๆพๆฏๅฆๆ chunk ่ทไฝ ่ฆ free ็ ptr ็ธๅ chunk
- if ๆ => error
- if ๆฒๆ => ๅทงๅ
- if true, ๆ traverse ๆๆ็ธๅ size ็ chunk, ๆพๆฏๅฆๆ chunk ่ทไฝ ่ฆ free ็ ptr ็ธๅ chunk
- tcache attack ็ๅฅฝ่ๆฏ, ๅฎๅ จไธๆๆชขๆฅ malloc ็ size
tcache stashing unlink
- ๆ size tcache bin ๆฏ็ฉบ็, ไฝๅฐๆ็ smallbin ๆๆฑ่ฅฟ
- malloc ๆ smallbin ๆฟ chunk => ๅฉไธไธ้ฒ tcache, ไธฆไธไธๆชขๆฅ chunk size
- ่ฅๅๅฅฝ bck ๆฅ่ๆฏ target, smallbin ๅจ่ขซ libc ๆด็ๅพ, target ๆ่ขซๅฏซๅ ฅ smallbin ็ไฝ็ฝฎ (libc)
- ่ฝ้ๅฐๅจไปปๆไฝ็ฝฎๅฏซๅ ฅ small bin address (ๅพๅคง็ๅผ)
- ่ฅ้่ฆๆ unsorted bin ็ chunk ไธๅฐ small bin ไธญ, ๅช้่ฆ malloc ๆฏไปๆดๅคง็ size ๅณๅฏ
stack pivoting
้ๅๆปๆๆๆณๅฟ ้ ่ฆ่ฝๅจ stack ็ไธๆพ ROP chain ็ heap address๏ผ็ถๅพ่ฝๅฏซๅฐ realloc_hook ่ท malloc_hook
ๅ ็บ malloc ่ท realloc ๅจๅท่กๅ้ฝๆ push + sub rsp๏ผๆไปฅๅพๆๅฏ่ฝๆๆ heap address ๅ ๅจ function frame ไนไธญ๏ผ่ๆญคๆๅ่จญ่ท malloc๏ผ่ๆญคๆๅๅฅฝ rsp ๆพ่ heap address๏ผๆๅๅฏไปฅๆนๅฏซ malloc_hook ๆ realloc+6๏ผrealloc_hook ๆ pop rsp ; ret๏ผ้ๆจฃ malloc ๅจ call malloc_hook ๆ๏ผๆ call realloc+6๏ผ+6 ่ท + 0 ็ธๅทฎๆๅฐ push ไธๅ register๏ผ่ realloc ๅจ call realloc_hook ๆ๏ผๆๆ rsp ไธ็ value pop ๅๅป๏ผไฝๆฏๅ ็บไธ้ๅงๅฐ push ไธๅ๏ผๆไปฅๆๅพๅจ jmp ๅฐ pop rsp ; ret ๆ๏ผrsp ๅๅฅฝๆๆพ heap address๏ผๆๅพ้้ pop rsp ; ret ๅฐฑ่ฝ่ท ROP
่ๆญค็จฎๆปๆๆนๆณไน่ฝ็จๅจ one_gadget๏ผๅฏไปฅๆงๅถ่ฎ rsp ็ฌฆๅ one_gadget ็ๆขไปถ
hook
__free_hook- ้ๅธธไธ้ขๆฒๆๅๆณ็ size ๅฏไปฅ็จ๏ผ่ฆ็่ฉฑไนๅจ้ๅธธไธ้ข (stdout ้ฃ้)๏ผๆไปฅไธๅคชๅฏ่ฝๅฎ็จไฝฟ็จ fastbin attack ไพ้ฒ่ก้ ๅ๏ผ้ๅธธๅฏไปฅไฝฟ็จ stashing (็็ใๆ่ฆบๅฏไปฅ)ใunsorted bin attack ็ญ็ญๅฏไปฅๅจๆ่ๅฏซ libc ไฝ็ฝฎ็ๆปๆๆนๆณ๏ผๅจ free_hook ไธ้ขๅฏซ๏ผ้ๆจฃ fastbin attack ๅฐฑๅฏไปฅๆฟๅฐ free_hook
__malloc_hook- ๅ ็บ - 0x23 ่ๆๆ 0x7f๏ผ้ๅธธ้ ๅ fastbin attack ไพๅฏซ one_gadget
- trigger malloc ็ๆนๅผๆๅพๅค็จฎ๏ผinput ้ๅค้่ฆ bufferใoutput ้ๅค้่ฆ bufferใ้่ฆๅฐ error msg ็ญ็ญ้ฝๆๅฏ่ฝ (e.g.
printf("%10000c"))
__realloc_hook- ็ทๆฅๅจ malloc_hook ๅพ๏ผ่ฝ็จไพ่ชฟๆด one_gadget ็ stack layout๏ผ่ฅ stack ๆๆฎ็ heap address๏ผไน่ฝ้้ๆงๅถ malloc_hook => realloc => realloc_hook ้็จไธญ็ push pop๏ผไพๅ stack pivoting to heap
other heap trick
- free unsorted bin ็ chunk ๆ, ๆๆชขๆฅไธไธๆฏๅฆ็บ freed, ่ฅๆฏ, ๅๆ merge ๆไธๅกๅคงๅก็ unsorted bin
- any function about output, maybe malloc some spaces
- e.g. double free -> printf -> malloc -> malloc_hook
- one_gadget ๅฏไปฅๅ่ฉฆ
- ่งธ็ผ double free => ๅฐๆฑ่ฅฟๅบไพ (
printf()) => buffer ไธๅค ๅคง =>malloc()=> malloc_hook - ๅพ main return =>
__libc_start_mainๅบๅฑค malloc()
- ่งธ็ผ double free => ๅฐๆฑ่ฅฟๅบไพ (
- main_arena ๅจ libc ็ bss ๆฎต and
malloc - 0x10 callocskip ๆๆ่ tcache ็ธ้็ๆฑ่ฅฟ- tcache ็ fd, bk ๆฏๆๅ chunk data, ๅ ถไป็ๆๅ chunk header
- hook ็ณปๅ
__free_hook__malloc_hook__realloc_hook- ่
__free_hook็บไพ, ่ฅ chunk (ptr) ๆพ็ๆฑ่ฅฟๆฏ '/bin/sh', ไธ__free_hookๅ งๆพ system addr, ๅจ callfree(ptr)ๆๅ็่ก็บๅฐฑๆฏsystem(ptr), ไนๅฐฑๆฏsystem("/bim/sh")
- main_arena ๅจ
malloc_hookไธ้ข (+ 0x10)๏ผๅ ๆญคๅฆๆ malloc_hook ๅฏซ one_gadget ้ฝๆฒ็จ็่ฉฑ๏ผๅฏไปฅๅ่ฉฆๅฏซ top_chunk- ๅ ๅจไธๆนๅปบ็ซ็นๅฎๅคงๅฐ็ chunk size (e.g. 0x70)๏ผไธฆๅจ 0x70 fastbinY ็ๅฐๆนๆนๆ chunk address
- ๆพ chunk + 0x8 ็บๅค ๅคง size ๏ผไธฆไธๅจ
free_hookไธ้ข็ๅฐๆน๏ผไนๅพๅฐ top chunk ๅฏซๆๆญค chunk - ไธ็ด malloc๏ผ็ดๅฐ่ฆๅฐ
free_hook๏ผๅฏซ free_hook
malloc trick
- ็ถ malloc ็ size ่ถ
้
mp_.mmap_threshold(0x20000) ๆ๏ผๆไฝฟ็จmmap้ไธๅๆฐ็ memory space ็ตฆ user๏ผ่้ๅไฝ็ฝฎ่ libc ็ offset ๆฏๅบๅฎ็๏ผ่ๆญคๅฏไปฅ leak libc - ๅฆๆๆฒๆ free ๅฏไปฅ็จ๏ผๅ้่ฆ unsorted bin attack ็่ฉฑ๏ผๅฏไปฅ้้ๆนๅฏซ
top chunk๏ผ่ฎ libc ๅจๅคๆทไธไบๆขไปถๅพ๏ผๆ top chunk ไธๅฐ unsorted bin ไธญ - ๅจ libc2.23 ็ๆขไปถๅฆไธ๏ผsrc
(old_top == initial_top (av) && old_size == 0)๏ผไธ็ขบๅฎ้ๆฎตๆไธๆ้๏ผinitial_top ไผผไนๆฒๆณ็น๏ผ(unsigned long) (old_size) >= MINSIZE๏ผold_size ๆฏๆ top chunk ็ size๏ผ่ณๅฐ่ฆ >= 0x20prev_inuse (old_top)๏ผprev_inuse bit ่ฆ่จญ(unsigned long) old_end & (pagesize - 1)) == 0)๏ผtop chunk ๅ ๅฎ size ๅพ็ address ้่ฆ่ page ๅฐ้ฝ
ๅพ unsorted bin ๅ chunk ๅบไพๆ๏ผๅฉไธ็ chunk (last remainder) fd bk ๆๆๅ main_arena + 0x58๏ผ่ๆฟๅฐ็ chunk ้ฝๆๆฎ็ๅๆฌ chunk size ๅฐๆๅฐ็ large/small bin ็ address (in libc)
other
pic vs pie
http://gcc.gnu.org/onlinedocs/gcc-4.8.0/gcc/Code-Gen-Options.html#Code-Gen-Options
https://stackoverflow.com/questions/2463150/what-is-the-fpie-option-for-position-independent-executables-in-gcc-and-ld
- pic ๆ่ฉฒๆฏๅผท่ชฟ shared library
- ็ข็็ code ไธฆไธๆ็ดๆฅๅฏซๆญป libc function๏ผ่ๆฏๅฏซ็ธๅฐๆผไธไธๅ intruction ็ offsetใ่่ฆไฝฟ็จ libc function ๆ๏ผๆ้้ dynamic loader ่งฃๆ GOT (lazy binding ็ญ็ญ)๏ผๆพๅบๆญฃ็ขบ็ function ไฝ็ฝฎ
- pie ๅฏไปฅ่ฎ binary ๆฌ่บซไธๅฏซๆญป address
- ่ฎ linker ่ฝๅ relocate๏ผ้ๅฐ executable file ็ ASLR
- ไฝๆฏๆ่ฆบๆๅพ pie ๅ ๅซไบ pic ็ๅ่ฝ๏ผ่ไธ้ๅฐ Local variable ๆๅๅชๅ
lazy binding & ret2dlresolve:
็ถ resulting file call shared object ็ function ๆ, ๆๆๅป so ๅ ง้จๆพ function ๅฏฆ้ไฝ็ฝฎไธฆๅฏซๅ ฅ .got.plt (global offset table), ไปฅๆธๅฐ initial ๅคง้ๅปถ้ฒ(ไธ้ๅงๅฐฑ่ฆๅ จๆพ) ไปฅๅ็ฏ็ๆ้(ๆไบๆ นๆฌไธๆ่ขซ call ๅฐ)
- ๆญฅ้ฉๅฆไธ:
- ๅจ็ฌฌไธๆฌก call function ๆ, ๆ
jmp่ณ func@plt, ่ func@plt ็ฌฌไธ่กๅณๆฏjmp่ณ func@got ๅ งๅฏซ็ๅผ, ่ๆญคๆ็บ func@plt+6. ่ๅพ func@plt+6 ๆๅท่กpushไปฅๅjmp, ่ฉฒpush็ๅผ็บrel_offset(.rel.plt ็ index),jmpๅฐ plt[0]
0x8048380, ไนๅฐฑๆฏ plt[0] ๆๅpushไธฆjmp, ๆญคๆpush็ๅผ็บ *link_map,jmpๅฐ lib ไธญ็ <dl_runtime_resolve> (.got.plt ็ ็ฌฌไธ้ , 0x8040a000(.got.plt) + 8) function ็ไฝ็ฝฎ้ฒ่ก binding.
ๅณ็บ:_dl_runtime_resolve(*link_map, rel_offset)
_dl_runtime_resolveๆๆ นๆไปฅไธ pseudo code lookup function, ๆๅ่ฆๅ็ไบๆ ๅฐฑๆฏ:- build fake rel_entry
- build fake sym_entry
- puts "system\0" symbol string
- calculate offset
- build the ROP chain
- ๅจ็ฌฌไธๆฌก call function ๆ, ๆ
trace
_dl_runtime_resolve->_dl_fixup->_dl_lookup_symbol_x->do_lookup_x->check_match
_dl_runtime_resolve:
- cfi(Call Frame Information) ้้ ญ็ inst ่ๅฝๆธๆชขๆธฌๆ้, ๅณ็บ GNU Profiler
- function ๅจๅ:
- ไฟๅญ regs value
- call
_dl_fixup - ๆขๅพฉ regs value
- jmp ่ณ return value, ไนๅฐฑๆฏ real function address
_dl_fix_up:
- ๅณๅ
ฅ
link_mapไปฅๅreloc_arg็ถๅๆธ, ๅ่ ็บๅฎๅผ .plt[1], ๅพ่ ็บ function ๅจ .rel.plt ็ offset - ๆ นๆๅณๅ ฅๅๆธ, ๅพๅฐ reloc_struct(reloc) & symbol(*sym) & ่ฆ่ขซ reloc ็ addr(rel_addr)
- call
_dl_lookup_symbol_x - ๆๅพ็ตๆๆ, call
elf_machine_fixup_pltๅฐ got ๅฏซๅ ฅ real function address
- ๅณๅ
ฅ
_dl_lookup_symbol_x:- ๅจๆฏๅ scope ไธญ, ็จ
do_lookup_xๆพๅฐ symbol - ๆพๅฐๅพ, ๆจ่จ symbol ไฝฟ็จไธญ, ไธฆ return symbol & it's link_map
- ๅจๆฏๅ scope ไธญ, ็จ
do_lookup_x:- traverse ๆๆ link_map, ๆพๅฐๅพ assign ็ตฆ result
check_match:- ็จ
strcmpๆฏๅฐ symbol name, ๅๆฏๅฐ version
- ็จ
้้NX
ref: https://quentinmeffre.fr/pwn/2017/01/26/ret_to_stack.html
่ไพไพ่ชช
- ็ฐกๅฎ็ BOF
- ๆฒๆ canary
- ๆฒๆไบบๅฎถ้็ๅพ้
- functionๆฒๆ่พฆๆณ leak ๅบ glibc address
- => ROP chain ็ gadget ๆ้กฏไธๅค
- ๆดๆฐ
__stack_prot- ๅๆฌ 0x01000000
- ๆนๆ 0x7 (0x07000000 in x86 address)
- call
_dl_make_stack_executable_dl_make_stack_executable(void* address)- ๅฐ rdi ๆพๅ
ฅ
__libc_stack_endaddress ็ถไฝๅๆธ - ๅท่ก
__mprotect, ไฝฟๅ ถๆ นๆ__stack_prot- function info:
mprotect(const void *start, size_t len, int prot); - prot
- PROT_READ
- R
- RROT_WRITE
- W
- PROT_EXEC
- X
- PROT_NONE
- cannot access
- PROT_READ
- ้่ฆๅฐ prot ่จญ็บ 7 (RWX)
- function info:
csu_init
https://code.woboq.org/userspace/glibc/csu/elf-init.c.html#__libc_csu_init
__libc_csu_init ๆฏ __libc_start_main ๆๆไฝฟ็จๅฐไพๅๅงๅ็ function๏ผไฝๆฏๅจๆไบๆขไปถไธ๏ผไป่ฝๅค ๅๅฐ "ๆงๅถ register ๅผ" + "call function" + ๅจ stack ็ไธๆฑ่ฅฟ๏ผไธฆไธๆฒๆๅฏไฝ็จ
่ๆๅ้่ฆ็้จๅๅๆๅ ฉๅก๏ผ
- ไปปๆๆงๅถ register value
- call function ไปฅๅๆงๅถๅๆธ
(r12)(rdi, rsi, rdx)
ๅจ่จญ rbx = 0 and rbp = 1 ็ๆ
ๆณไธ๏ผcmp rbx, rbp ๆ็ดๆฅ้้
้ๆ็็ๅพๅผท (X
Function Residue
้ๆฏ่ผ่ฆ่ฌ็ๆฏไธๅๆฆๅฟต
push ๆๆๆๅผๅพ regsiter ๅฏซๅฐ stack ไธ๏ผpop ๆๆๆๅผๅพ stack ๆฟๅฐ regsiter ๅ ง๏ผ้ไธๅฎๅคงๅฎถ้ฝ็ฅ้๏ผไฝๆฏ้้ๆไธๅ้้ต๏ผpush ๆๆๅผๆดๆ๏ผไฝๆฏ pop ๆฟไบๅผไธๆๆธ ้ถ
ๅ ๆญคๅท่กๅฎ libc function ๅพ๏ผๅพๅฎนๆๅจ stack ๆฎ็ libc address๏ผไฝๆฏ่ฆๅฐๅฟ rsp ่ rbp ็ๅผ๏ผๅ ็บ libc function ๅฏ่ฝ้ฝๆไฝฟ็จๅฐ๏ผๅฆๆ้ขๅคช่ฟๆๆฏๆๆจฃ๏ผๅฏ่ฝๆๆๅผ่ขซ่ๆ็็ๆ
ฎ๏ผๅ ๆญค่ฆๅค่งๅฏใๅค try
Example of gets
ๅฉ็จไธๆทๅจ gets + stack pivoting๏ผไฝฟ็ไธ็ _IO_file_write address ๅฏไปฅๆฎ็ๅจๆๅๆงๅถๅฐ็ๅฐๆน (bss ็ญ็ญ)๏ผไธฆ่่ __libc_csu_init๏ผๆงๅถ rdi, rsi, rdx, r12๏ผๅท่ก _IO_new_file_write(stdin, got, 8)
https://github.com/lattera/glibc/blob/master/libio/fileops.c#L1180
็ๅพๅบไพๆญค function ๅช้่ฆ็จๅฐ fileno๏ผๅ ๆญค stdin [:0x70] ๅฏไปฅไปปๆๅผ๏ผๅช่ฆ *(fake_stdin+0x70) ็บ 1 ๅฐฑๅฅฝ
Intel - Control-flow Enforcement Technology (CET)
https://binpwn.com/papers/control-flow-enforcement-technology-preview.pdf
https://www.linuxplumbersconf.org/event/2/contributions/147/attachments/72/83/CET-LPC-2018.pdf
https://software.intel.com/content/www/us/en/develop/articles/emulating-applications-with-intel-sde-and-control-flow-enforcement-technology.html
CET
- endbr64๏ผEnd Branch 64 bit
- ๅฆๆ CET ๆฒ้ๅฐฑๆฏ NOP
- ้ฟๅ
ๆ ROP
- ่ฝๆงๅถ control flow ็ instruction ๆ
- RET
- JMP %rax
- CALL %rax
- ่ฝๆงๅถ control flow ็ instruction ๆ
- ๆๅ
ฉๅ component
- Shadow Stack (SHSTK)
- ๅบๆฌไธๆๆ program ้ฝ็ธๅฎน (?
- function prologue ๆๆๅฐ return address ๅญๅจ shadow stack
- function epilogue ๆๆๆ shadow stack ็ address ๅๅบไธฆๆฏ่ผ
- stack checks
./sde -cet -- application
- Indirect Branch Tracking (IBT)
- ENDBRANCH (endbr64)
- indirect branch ็บไฝฟ็จๅๆธ็ถไฝ่ทณ่ฝ็ไฝ็ฝฎ๏ผๅฆ x64 ็
jmp rax - ๆๅท่กๅฐ endbr ็ address (jump target) ๅณ็บๅฎๅ
จ
endbr mark valid jump target addresses of indirect calls and jumps in the program
- ๅ ๆญคๅฏไปฅ่ฟฝ่นค indirect branch
- 1 KB page
- SSP (shadow stack pointer)
- Enable CET๏ผ
gcc -fcf-protection ...๏ผไฝไธ็ฅ้ๆๆจฃๆ็ฎๆๆ (? - Intelยฎ SDE (Software Development Emulator)
- Shadow Stack (SHSTK)
- stack unwind
- function ๆๆ
__unwind {็ prefix - ไปฃ่กจๅจ้ๅฐ exception ๆ๏ผๆๆฒฟ่ stack bt ๅพไธๆพ exception handler
- ๆญค็บไธ็จฎๅผทๅคง็ๆฆๅฟต๏ผResource Acquisition Is Initialization (RAII)
- resource ็ๆๆๆ่ๆๆ resource ็็ฉไปถ็็ๅฝๆๅดๆ ผ็นซ็ต๏ผๅณ็ฑ็ฉไปถ็ๅปบๆงๅฝๅผๅฎๆ resource ็ๅ้ ๏ผๅๅพ๏ผ๏ผๅๆ็ฑ่งฃๆงๅฝๅผๅฎๆ resource ็้ๆพ
- ๅจ้็จฎๆ ๆณไธ๏ผๅช่ฆ็ฉไปถ่ฝๆญฃ็ขบๅฐ่งฃๆง๏ผๅฐฑไธๆๅบ็พ resource ๆณ้ฒๅ้ก
- function ๆๆ
- debug
sde -debug -- yourapp
้จๆ note
- ld ๅ
ง็
__libc_stack_endๅฏไปฅ leak ๅบ stack ็ไฝ็ฝฎ scanf("%u")ๆๅฏไปฅ่ผธๅ ฅ+,-็นๆฎ็ฌฆ่ไพ pass ้ๆฌก็่ฎๅ- ๆธๅญ๏ผ่ฎ่ฟไพ
- ่ฑๆ๏ผ็ดๆฅ่ฎๅฐๅบ
+ -๏ผpass ้ๆฌก
- gdb ไธญๆพ fs ๅผ (TIB address)
search -8 <canary>
- malloc.c ไธญ็
check_inuse_chunkmacro ๅชๆๅจ MALLOC_DEBUG == 1 ๆๆๅไบ๏ผ่ๅนณๅธธๅจๆชขๆฅ inuse ็้ฝๆๆฏinusemacro
browser
https://www.youtube.com/watch?v=1eF7fMdVoOA&ab_channel=jwang
https://www.youtube.com/watch?v=emt1yf2Fg9g&ab_channel=BlackHat
https://saelo.github.io/presentations/blackhat_us_18_attacking_client_side_jit_compilers.pdf
https://medium.com/walkout/ๆทบๆทก-js-engine-ๆฉๅถ-77391b4dd3db
- Chrome: V8 engine
- Firefox: Spidermonkey
- Safari: JavaScriptCore
- Edge: hakraCore
- jsengine object
- ๅๅคง implement ็ๆนๅผ้ฝไธไธๆจฃ, ไฝๆฏ้ฝๆๅผๅฐ shape
- object ๅจ new ๆ, ็ผ็พๆฏๆฐ็, ๆ create ๅ
ฉๅๆฑ่ฅฟ
- object ๆฌ่บซ็ values (slot)
- shape of object
- ไนๅพ่ฅๅ ถไป่ฎๆธ create object ๆ, ๆๅปๆพๆๆฒๆไธๆจฃ็ shape
- ๅ browser ็จฑๅผ๏ผไธ้้ฝๆฏๅๅๆฑ่ฅฟ
- firefox: shape
- v8: map
- webkit: structure
- edge: type
- ๆน shape ๅ
ง member ็ pointer
- JIT-compiler (vanilla)
- Runtime
- ๅท่กๅฟซ overhead ๅค
- ไธ็ตฆ JIT compiler or Interpreter ็ๆจๆบ็บ๏ผไฝฟ็จๅฐ็ๆฌกๆธ
- ๅธธๅธธ่ทๅฐ็ code ๆไธ็ตฆ JIT compiler (ๅ ็ทจ่ตทไพ็ๆ็่ผ้ซ)
- JIT compiler ๆ้่ฆๆ bytecode ่งฃๆๅบ็็ตๆๅญ่ตทไพ๏ผไธฆไธๅไธไบ trace๏ผๅ ๆญค overhead ้ซ
- multi level JIT (้จ่ๅท่กๆฌกๆธๅขๅ ่ๅข้ซ level)
- L1๏ผno JIT (only interpreter)
- L2๏ผๅฎ็ด compile๏ผไธๅชๅ
- L3๏ผJIT with optimization
- parser๏ผ็ขๅบ bytecode
- runtime๏ผruntime ๆ้่ฆ็ๆฑ่ฅฟ (object info โฆ)
- JIT ็ไธป่ฆๅ้ก๏ผtype ่ณ่จๅฐ๏ผfunction ๅๆธไธ็ฅ้ๆ้บผ่็๏ผcompiler ๅฆไฝๅ operation?
- ็ดๆฅๆพ shape structure -> type (ไฝๆๆ่จฑๅค้กๅค็ check)
add(a: smi, b: smi)- trace ไนๅ function ็ไฝฟ็จ็ๆณ
- speculation
- ๅฆๆ้ๅฐไธไธๆจฃ็ๆ ๆณๅข?
- guard
- ็ขบไฟๅณ้ฒ็ๅๆธๅฆๆ่ไนๅ compile ๅฎ็ code ็ type ไธไธๆจฃ๏ผไปไธๆๅบ้ฏ
if (check int fail) {jmp bailout}- bailout ๆๅป interpreter or ๅจ้กๅคๅป compile ๅฐๆ type ็ bytecode
- optimization
- ๅ ็บๅชๅ็้ไฟ, function ๆๆ้้ ๆ็็ตๆ (side effect)
- redundancy elimination
- eliminate duplicate guards (checks)๏ผๅช้คๅค้ค็ๆชขๆฅ
- ไฝๆฏๅฆๆไธญ้ๆ callback๏ผๅ "ๅช้คๅค้ค็ๆชขๆฅ" ๅฏ่ฝๆ่ฎๅบๅ้ก็ๅฐๆนๆฒ่ขซๆชขๆฅๅฐ
- CVE-2018-4233
- bound-check elimination
- ๆปๆๆๆณ
- ๆ shape ptr ๆนๆ๏ผ่ฃฝ้ type confusion
exit hook
exit() vs atexit()๏ผ
int on_exit(void (*function)(int , void *), void *arg);- ็บ SunOS ็ function๏ผไธฆ้ standard๏ผๆไปฅไธไธๅฎ่ขซๅ ถไปๅนณๅฐๆฏๆด
- ๅฏไปฅๅณ้ argument
int atexit(void (*function)(void));- ็บๆจๆบ exit hook
- register a function to be called at normal process termination
- ็บๆจๆบ exit hook
__libc_start_main -> main function -> __run_exit_handler -> dl-fini
ๅ
ถไธญๅจ __libc_start_main ไธญ๏ผๆไฝฟ็จ atexit() ่จปๅไธไบ exit function
่ __cxa_atexit() ๅ่ท atexit() ๅทฎๅจๅช่ฃกๅข๏ผ
__cxa_atexit()is not limited to 32 functions.__cxa_atexit()will call the destructor of the static of a dynamic library when this dynamic library is unloaded before the program exits.
control flow
exit()ๆๅผๅซ__run_exit_handler()__run_exit_handler()- cur ็บ
(struct exit_function_list *) 0x7f1ff52229a0 <initial> - exit_function_list
- exit_function
- flavor ๅ 5 ็จฎ
- ef_free: 0
- ef_us: 1
- ef_on: 2
- ef_at: 3
- ef_cxa: 4
PTR_DEMANGLE:ror 0x11 ; xor qword ptr fs:[0x30]- ไปฃ่กจ MANGLE ๆๆๅ rol 0x11๏ผๅทฆไฝ็งป 0x11๏ผๅจ xor fs:[0x30] ไธๅ magic number
- ex_cxa ๅฐๅฐ็ๆ่ฉฒๆๆฏ
_dl_fini๏ผไธป่ฆๅ็ไบๆ ๆฏ "call the destructors for all still loaded objects" - ๅฟ ้ ่ฆๅพ constructor ็้ ญ้ๅง destruct
- ๆๅพๆๆพ
_DYNAMIC๏ผl_ldๆๆๅ_DYNAMICsection๏ผไธฆไธๆๅผๅซl_ld->l_info[DT_FINI_ARRAY]๏ผๆๅพ_DYNAMICๆพๅฐ fini_array ็ไฝ็ฝฎ#define DT_FINI_ARRAY 26 /* Array with addresses of fini fct */(Elf64_Dyn *) 0x403e70- ๅญๆพ 0x403E18๏ผไนๅฐฑๆฏ fini ็้้ ญ
- ๆญฃๅธธไพ่ชชๅจ ASLR ็ๆ
ๆณไธ๏ผl->l_addr ๆๆพ ELF base๏ผfini ๆๆพ offset๏ผไนๅพๆ call
(ELF_base + fini)[0]ไพๅผๅซ fini function- ๆไปฅ่ฆๆพ l_address offset ๅจ stack ไธญ็ไฝ็ฝฎไนๅฏไปฅ็จๆญคไพๅคๆท
- ่ๅจ no ASLR ็ๆ ๆณไธ fini ๆ็ดๆฅๆฏไฝ็ฝฎ๏ผl->l_addr ๅฐฑๆๆฏ 0
- ๆๅๅฏไปฅ่็ฑๆน่ฎ offset ็ๅฐๆนไพๆงๅถ่ฆๅผๅซๅฐ็ function
- ๆฒๆ่ฎๅ็ๆ
ๆณไธ๏ผๆๅป call
__do_global_dtors_aux__do_global_ctors_auxand__do_global_dtors_auxfor calling the constructors and destructors of these static objects- ้ๅ ฉๅ function ็บ gcc ๅ ไธ็๏ผ้ฝๆฏ็จไพๅๆ ้ฃ็ต๏ผๅจ main ไนๅ่ผๅ ฅ dynamic library ็่ฎๆธไน้ก็
__do_global_dtors_aux๏ผๆๅผๅซๅฐ__cxa_finalize()ไพๅท่ก็จatexit()่จปๅ็ function (glibc ไธ้ขๆฏ้ๆจฃๅฏซๆฒ้ฏ๏ผไฝๆฏๅฏฆ้ไธๅฅฝๅๆฏ_run_exit_handler)
- ๆญคๆๅฏไปฅ้
ๅ one_gadget๏ผ่ one_gadget ่ฝๅค ็ฌฆๅ็ๆขไปถๅฏไปฅ็ดๆฅๅป
execvpeๆพ RUN_HOOK (__libc_atexit, ());ๆๅผๅซ__elf_set___libc_atexit_element__IO_cleanup__็_IO_cleanup__elf_set___libc_atexit_element__IO_cleanup__ๅฏๅฏซ๏ผๆไปฅไน่ฝๅฐ one_gadget ๅฏซๅจ้
- cur ็บ
C++
how vector work
vector => [abi:cxx11] ็ฌฌไธๅ element => vector member (data ptr, data_size)๏ผไธ vector ไธ้ๅง็ size ็บ 0x80 (4 elements)
- ๅฆๆ vector data size ๅฐๆผ 0x10๏ผๆ็ดๆฅๅจ vector ไธ้ขๆพ่ณๆ
- ่ชๅทฑ่งๅฏ c++11 ็่ตทไพๅๆฏ
- vector ๅจ capacity ๅคงๆผ 75% ๆๅฐฑๆ double its size
glibc 2.32 ๆฉๅถ
ๅ่ๆ็ซ ๏ผhttps://medium.com/@ktecv2000/่่glibc-2-32-mallocๆฐๅข็ไฟ่ญทๆฉๅถ-safe-linking-9fb763466773
้ๅฐ tcache ่ fastbin ็ next pointer ๅ XOR ็ไฟ่ญท
- heap address xor
- ๆๆ นๆ็ถๅ address ่ๅผๅ xor๏ผ็ฐกๅฎไพ่ชช็จๆณๅฐฑๆฏ value = xor(value, &value >> 12)
- align
- xor ๅฎ LSB ๅฏไปฅๆฏ 0x0 - 0xf๏ผไฝๆฏ xor ๅๅปๆ่ฉฒ่ฆๆฏ 0 ๆๅฐ
ๆไปฅๅจ heap ไธๅๆปๆๆ๏ผๆ่ฉฒ่ฆๅ leak heap address๏ผๆ่ฝ้้ tcache ่ fastbin ไธญ address ็ๆชขๆฅ
