从零开始学howtoheap:理解fastbins的堆块重叠的问题1

2024-02-12 22:12

本文主要是介绍从零开始学howtoheap:理解fastbins的堆块重叠的问题1,希望对大家解决编程问题提供一定的参考价值,需要的开发者们随着小编来一起学习吧!

how2heap是由shellphish团队制作的堆利用教程,介绍了多种堆利用技术,后续系列实验我们就通过这个教程来学习。环境可参见从零开始配置pwn环境:从零开始配置pwn环境:从零开始配置pwn环境:优化pwn虚拟机配置支持libc等指令-CSDN博客

1.fastbins的overlapping_chunks攻击

这是一个简单的堆块重叠问题,首先申请 3 个 chunk
这三个 chunk 分别申请到了:
p1:0x603010
p2:0x603110
p3:0x603210
给他们分别填充"1""2""3"

free 掉 p2
p2 被放到 unsorted bin 中
现在假设有一个堆溢出漏洞,可以覆盖 p2
为了保证堆块稳定性,我们至少需要让 prev_inuse 为 1,确保 p1 不会被认为是空闲的堆块
我们将 p2 的大小设置为 385, 这样的话我们就能用 376 大小的空间

现在让我们分配另一个块,其大小等于块p2注入大小的数据大小
malloc 将会把前面 free 的 p2 分配给我们(p2 的 size 已经被改掉了)

p4 分配在 0x603110 到 0x603288 这一区域
p3 从 0x603210 到 0x603288
p4 应该与 p3 重叠,在这种情况下 p4 包括所有 p3
这时候通过编辑 p4 就可以修改 p3 的内容,修改 p3 也可以修改 p4 的内容

2.overlapping_chunks演示程序

#include <stdio.h>#include <stdlib.h>#include <string.h>#include <stdint.h>int main(int argc , char* argv[]){intptr_t *p1,*p2,*p3,*p4;fprintf(stderr, "这是一个简单的堆块重叠问题,首先申请 3 个 chunk\n");p1 = malloc(0x100 - 8);p2 = malloc(0x100 - 8);p3 = malloc(0x80 - 8);fprintf(stderr, "这三个 chunk 分别申请到了:\np1:%p\np2:%p\np3:%p\n给他们分别填充\"1\"\"2\"\"3\"\n\n", p1, p2, p3);memset(p1, '1', 0x100 - 8);memset(p2, '2', 0x100 - 8);memset(p3, '3', 0x80 - 8);fprintf(stderr, "free 掉 p2\n");free(p2);fprintf(stderr, "p2 被放到 unsorted bin 中\n");fprintf(stderr, "现在假设有一个堆溢出漏洞,可以覆盖 p2\n");fprintf(stderr, "为了保证堆块稳定性,我们至少需要让 prev_inuse 为 1,确保 p1 不会被认为是空闲的堆块\n");int evil_chunk_size = 0x181;int evil_region_size = 0x180 - 8;fprintf(stderr, "我们将 p2 的大小设置为 %d, 这样的话我们就能用 %d 大小的空间\n",evil_chunk_size, evil_region_size);*(p2-1) = evil_chunk_size; // 覆盖 p2 的 sizefprintf(stderr, "\n现在让我们分配另一个块,其大小等于块p2注入大小的数据大小\n");fprintf(stderr, "malloc 将会把前面 free 的 p2 分配给我们(p2 的 size 已经被改掉了)\n");p4 = malloc(evil_region_size);fprintf(stderr, "\np4 分配在 %p 到 %p 这一区域\n", (char *)p4, (char *)p4+evil_region_size);fprintf(stderr, "p3 从 %p 到 %p\n", (char *)p3, (char *)p3+0x80-8);fprintf(stderr, "p4 应该与 p3 重叠,在这种情况下 p4 包括所有 p3\n");fprintf(stderr, "这时候通过编辑 p4 就可以修改 p3 的内容,修改 p3 也可以修改 p4 的内容\n\n");fprintf(stderr, "接下来验证一下,现在 p3 与 p4:\n");fprintf(stderr, "p4 = %s\n", (char *)p4+0x10);fprintf(stderr, "p3 = %s\n", (char *)p3+0x10);fprintf(stderr, "\n如果我们使用 memset(p4, '4', %d), 将会:\n", evil_region_size);memset(p4, '4', evil_region_size);fprintf(stderr, "p4 = %s\n", (char *)p4+0x10);fprintf(stderr, "p3 = %s\n", (char *)p3+0x10);fprintf(stderr, "\n那么之后再 memset(p3, '3', 80), 将会:\n");memset(p3, '3', 80);fprintf(stderr, "p4 = %s\n", (char *)p4+0x10);fprintf(stderr, "p3 = %s\n", (char *)p3+0x10);}     

3.调试overlapping_chunks

3.1 获得可执行程序 

gcc -g overlapping_chunks.c -o overlapping_chunks

3.2 第一次调试程序

root@pwn_test1604:/ctf/work/how2heap# gcc -g overlapping_chunks.c -o overlapping_chunks
root@pwn_test1604:/ctf/work/how2heap# ll
total 232
drwxr-xr-x  2 1000 1000  4096 Feb 12 01:24 ./
drwxr-xr-x 12 1000 1000  4096 Feb  8 13:06 ../
-rwxr-xr-x  1 root root 11168 Feb  9 02:26 fastbin_dup*
-rw-r--r--  1 1000 1000  1383 Feb  9 02:25 fastbin_dup.c
-rwxr-xr-x  1 root root 11176 Feb 10 03:42 fastbin_dup_consolidate*
-rw-r--r--  1 1000 1000   957 Feb 10 03:27 fastbin_dup_consolidate.c
-rwxr-xr-x  1 root root 15432 Feb  9 04:05 fastbin_dup_into_stack*
-rw-r--r--  1 1000 1000  2124 Feb  9 03:52 fastbin_dup_into_stack.c
-rwx--x--x  1 1000 1000 15224 Feb  8 13:26 first_fit*
-rwxr-xr-x  1 root root 21408 Feb  8 15:02 first_fit1*
-rw-r--r--  1 1000 1000  1591 Feb  8 13:16 first_fit.c
-rw-------  1 root root 12944 Feb 12 01:13 .gdb_history
-rwxr-xr-x  1 root root 15744 Feb 11 13:15 house_of_lore*
-rw-r--r--  1 1000 1000  2794 Feb 11 13:15 house_of_lore.c
-rwxr-xr-x  1 root root 11240 Feb 11 03:43 house_of_spirit*
-rw-r--r--  1 1000 1000  1575 Feb 11 03:43 house_of_spirit.c
-rwxr-xr-x  1 root root 15512 Feb 12 01:24 overlapping_chunks*
-rw-r--r--  1 1000 1000  2929 Feb 12 01:23 overlapping_chunks.c
-rwxr-xr-x  1 root root 15624 Feb 11 04:37 poison_null_byte*
-rw-r--r--  1 1000 1000  2853 Feb 11 04:36 poison_null_byte.c
-rwxr-xr-x  1 root root 10176 Feb  8 15:20 uaf*
-rw-r--r--  1 1000 1000  1023 Feb  8 15:19 uaf.c
-rwxr-xr-x  1 root root 15544 Feb 10 05:39 unsafe_unlink*
-rw-r--r--  1 1000 1000  2965 Feb 10 05:39 unsafe_unlink.c
root@pwn_test1604:/ctf/work/how2heap# gdb ./overlapping_chunks
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
pwndbg: loaded 171 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
Reading symbols from ./overlapping_chunks...done.
pwndbg> r
Starting program: /ctf/work/how2heap/overlapping_chunks 
这是一个简单的堆块重叠问题,首先申请 3 个 chunk
这三个 chunk 分别申请到了:
p1:0x603010
p2:0x603110
p3:0x603210
给他们分别填充"1""2""3"free 掉 p2
p2 被放到 unsorted bin 中
现在假设有一个堆溢出漏洞,可以覆盖 p2
为了保证堆块稳定性,我们至少需要让 prev_inuse 为 1,确保 p1 不会被认为是空闲的堆块
我们将 p2 的大小设置为 385, 这样的话我们就能用 376 大小的空间现在让我们分配另一个块,其大小等于块p2注入大小的数据大小
malloc 将会把前面 free 的 p2 分配给我们(p2 的 size 已经被改掉了)p4 分配在 0x603110 到 0x603288 这一区域
p3 从 0x603210 到 0x603288
p4 应该与 p3 重叠,在这种情况下 p4 包括所有 p3
这时候通过编辑 p4 就可以修改 p3 的内容,修改 p3 也可以修改 p4 的内容接下来验证一下,现在 p3 与 p4:
p4 = 22222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222
p3 = 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333�如果我们使用 memset(p4, '4', 376), 将会:
p4 = 444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444�
p3 = 44444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444�那么之后再 memset(p3, '3', 80), 将会:
p4 = 444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444333333333333333333333333333333333333333333333333333333333333333333333333333333334444444444444444444444444444444444444444�
p3 = 33333333333333333333333333333333333333333333333333333333333333334444444444444444444444444444444444444444�
[Inferior 1 (process 114) exited normally]
pwndbg> 

 

3.3 第二次调试程序

3.3.1 ​设置断点第14行并走起

这个比较简单,就是堆块重叠的问题。通过一个溢出漏洞,改写unsorted bin 中空闲堆块的size,改变下一次malloc可以返回的堆块大小。

​ 直接动手调试,首先申请三个堆块。

pwndbg> b 14
Breakpoint 2 at 0x4006dd: file overlapping_chunks.c, line 14.
pwndbg> c
Continuing.
这是一个简单的堆块重叠问题,首先申请 3 个 chunkBreakpoint 2, main (argc=1, argv=0x7fffffffe6a8) at overlapping_chunks.c:14
14                   fprintf(stderr, "这三个 chunk 分别申请到了:\np1:%p\np2:%p\np3:%p\n给他们分别填充\"1\"\"2\"\"3\"\n\n", p1, p2, p3);
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────────────────────RAX  0x603210 ◂— 0x0RBX  0x0RCX  0x7ffff7dd1b20 (main_arena) ◂— 0x100000000RDX  0x603210 ◂— 0x0RDI  0x0RSI  0x603280 ◂— 0x0R8   0x603000 ◂— 0x0R9   0xdR10  0x7ffff7dd1b78 (main_arena+88) —▸ 0x603280 ◂— 0x0R11  0x0R12  0x400590 (_start) ◂— xor    ebp, ebpR13  0x7fffffffe6a0 ◂— 0x1R14  0x0R15  0x0RBP  0x7fffffffe5c0 —▸ 0x400a40 (__libc_csu_init) ◂— push   r15RSP  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'RIP  0x4006dd (main+87) ◂— mov    rax, qword ptr [rip + 0x20197c]
────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────────────────────────────────────────► 0x4006dd <main+87>     mov    rax, qword ptr [rip + 0x20197c] <0x602060>0x4006e4 <main+94>     mov    rsi, qword ptr [rbp - 0x10]0x4006e8 <main+98>     mov    rcx, qword ptr [rbp - 0x18]0x4006ec <main+102>    mov    rdx, qword ptr [rbp - 0x20]0x4006f0 <main+106>    mov    r8, rsi0x4006f3 <main+109>    mov    esi, 0x400b100x4006f8 <main+114>    mov    rdi, rax0x4006fb <main+117>    mov    eax, 00x400700 <main+122>    call   fprintf@plt <0x400550>0x400705 <main+127>    mov    rax, qword ptr [rbp - 0x20]0x400709 <main+131>    mov    edx, 0xf8
─────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]─────────────────────────────────────────────────────────────────────────────────────────────────
In file: /ctf/work/how2heap/overlapping_chunks.c9              fprintf(stderr, "这是一个简单的堆块重叠问题,首先申请 3 个 chunk\n");10          11              p1 = malloc(0x100 - 8);12              p2 = malloc(0x100 - 8);13              p3 = malloc(0x80 - 8);► 14              fprintf(stderr, "这三个 chunk 分别申请到了:\np1:%p\np2:%p\np3:%p\n给他们分别填充\"1\"\"2\"\"3\"\n\n", p1, p2, p3);15          16              memset(p1, '1', 0x100 - 8);17              memset(p2, '2', 0x100 - 8);18              memset(p3, '3', 0x80 - 8);19          
─────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'
01:0008│      0x7fffffffe588 ◂— 0x100400a8d
02:0010│      0x7fffffffe590 ◂— 0x0
... ↓
04:0020│      0x7fffffffe5a0 —▸ 0x603010 ◂— 0x0
05:0028│      0x7fffffffe5a8 —▸ 0x603110 ◂— 0x0
06:0030│      0x7fffffffe5b0 —▸ 0x603210 ◂— 0x0
07:0038│      0x7fffffffe5b8 ◂— 0x0
───────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────────► f 0           4006dd main+87f 1     7ffff7a2d830 __libc_start_main+240
Breakpoint /ctf/work/how2heap/overlapping_chunks.c:14
pwndbg> n
这三个 chunk 分别申请到了:
p1:0x603010
p2:0x603110
p3:0x603210
给他们分别填充"1""2""3"16                   memset(p1, '1', 0x100 - 8);
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────────────────────RAX  0x6eRBX  0x0RCX  0x7ffff7b042c0 (__write_nocancel+7) ◂— cmp    rax, -0xfffRDX  0x7ffff7dd3770 (_IO_stdfile_2_lock) ◂— 0x0RDI  0x2RSI  0x7fffffffbef0 ◂— 0xb8e489b8e499bfe8R8   0x7ffff7feb700 ◂— 0x7ffff7feb700R9   0x6eR10  0x0R11  0x246R12  0x400590 (_start) ◂— xor    ebp, ebpR13  0x7fffffffe6a0 ◂— 0x1R14  0x0R15  0x0RBP  0x7fffffffe5c0 —▸ 0x400a40 (__libc_csu_init) ◂— push   r15RSP  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'RIP  0x400705 (main+127) ◂— mov    rax, qword ptr [rbp - 0x20]
────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────────────────────────────────────────0x4006f0 <main+106>    mov    r8, rsi0x4006f3 <main+109>    mov    esi, 0x400b100x4006f8 <main+114>    mov    rdi, rax0x4006fb <main+117>    mov    eax, 00x400700 <main+122>    call   fprintf@plt <0x400550>► 0x400705 <main+127>    mov    rax, qword ptr [rbp - 0x20]0x400709 <main+131>    mov    edx, 0xf80x40070e <main+136>    mov    esi, 0x310x400713 <main+141>    mov    rdi, rax0x400716 <main+144>    call   memset@plt <0x400530>0x40071b <main+149>    mov    rax, qword ptr [rbp - 0x18]
─────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]─────────────────────────────────────────────────────────────────────────────────────────────────
In file: /ctf/work/how2heap/overlapping_chunks.c11              p1 = malloc(0x100 - 8);12              p2 = malloc(0x100 - 8);13              p3 = malloc(0x80 - 8);14              fprintf(stderr, "这三个 chunk 分别申请到了:\np1:%p\np2:%p\np3:%p\n给他们分别填充\"1\"\"2\"\"3\"\n\n", p1, p2, p3);15          ► 16              memset(p1, '1', 0x100 - 8);17              memset(p2, '2', 0x100 - 8);18              memset(p3, '3', 0x80 - 8);19          20              fprintf(stderr, "free 掉 p2\n");21              free(p2);
─────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'
01:0008│      0x7fffffffe588 ◂— 0x100400a8d
02:0010│      0x7fffffffe590 ◂— 0x0
... ↓
04:0020│      0x7fffffffe5a0 —▸ 0x603010 ◂— 0x0
05:0028│      0x7fffffffe5a8 —▸ 0x603110 ◂— 0x0
06:0030│      0x7fffffffe5b0 —▸ 0x603210 ◂— 0x0
07:0038│      0x7fffffffe5b8 ◂— 0x0
───────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────────► f 0           400705 main+127f 1     7ffff7a2d830 __libc_start_main+240
pwndbg> parseheap
addr                prev                size                 status              fd                bk                
0x603000            0x0                 0x100                Used                None              None
0x603100            0x0                 0x100                Used                None              None
0x603200            0x0                 0x80                 Used                None              None
pwndbg> 

3.3.2 设置断点第22行并走起

接着free掉p2,这时候p2被放到unsorted bin中。

pwndbg> b 22
Breakpoint 3 at 0x400771: file overlapping_chunks.c, line 22.
pwndbg> c
Continuing.
free 掉 p2Breakpoint 3, main (argc=1, argv=0x7fffffffe6a8) at overlapping_chunks.c:22
22                   fprintf(stderr, "p2 被放到 unsorted bin 中\n");
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────────────────────RAX  0x1RBX  0x0RCX  0x7ffff7b042c0 (__write_nocancel+7) ◂— cmp    rax, -0xfffRDX  0x0RDI  0x7ffff7dd1b20 (main_arena) ◂— 0x100000000RSI  0x0R8   0xcR9   0x1R10  0x8b8R11  0x7ffff7a914f0 (free) ◂— push   r13R12  0x400590 (_start) ◂— xor    ebp, ebpR13  0x7fffffffe6a0 ◂— 0x1R14  0x0R15  0x0RBP  0x7fffffffe5c0 —▸ 0x400a40 (__libc_csu_init) ◂— push   r15RSP  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'RIP  0x400771 (main+235) ◂— mov    rax, qword ptr [rip + 0x2018e8]
────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────────────────────────────────────────► 0x400771 <main+235>    mov    rax, qword ptr [rip + 0x2018e8] <0x602060>0x400778 <main+242>    mov    rcx, rax0x40077b <main+245>    mov    edx, 0x1e0x400780 <main+250>    mov    esi, 10x400785 <main+255>    mov    edi, 0x400b800x40078a <main+260>    call   fwrite@plt <0x400570>0x40078f <main+265>    mov    rax, qword ptr [rip + 0x2018ca] <0x602060>0x400796 <main+272>    mov    rcx, rax0x400799 <main+275>    mov    edx, 0x370x40079e <main+280>    mov    esi, 10x4007a3 <main+285>    mov    edi, 0x400ba0
─────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]─────────────────────────────────────────────────────────────────────────────────────────────────
In file: /ctf/work/how2heap/overlapping_chunks.c17              memset(p2, '2', 0x100 - 8);18              memset(p3, '3', 0x80 - 8);19          20              fprintf(stderr, "free 掉 p2\n");21              free(p2);► 22              fprintf(stderr, "p2 被放到 unsorted bin 中\n");23          24              fprintf(stderr, "现在假设有一个堆溢出漏洞,可以覆盖 p2\n");25              fprintf(stderr, "为了保证堆块稳定性,我们至少需要让 prev_inuse 为 1,确保 p1 不会被认为是空闲的堆块\n");26          27              int evil_chunk_size = 0x181;
─────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'
01:0008│      0x7fffffffe588 ◂— 0x100400a8d
02:0010│      0x7fffffffe590 ◂— 0x0
... ↓
04:0020│      0x7fffffffe5a0 —▸ 0x603010 ◂— 0x3131313131313131 ('11111111')
05:0028│      0x7fffffffe5a8 —▸ 0x603110 —▸ 0x7ffff7dd1b78 (main_arena+88) —▸ 0x603280 ◂— 0x3333333333333333 ('33333333')
06:0030│      0x7fffffffe5b0 —▸ 0x603210 ◂— 0x3333333333333333 ('33333333')
07:0038│      0x7fffffffe5b8 ◂— 0x0
───────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────────► f 0           400771 main+235f 1     7ffff7a2d830 __libc_start_main+240
Breakpoint /ctf/work/how2heap/overlapping_chunks.c:22
pwndbg> biin
Undefined command: "biin".  Try "help".
pwndbg> bins
fastbins
0x20: 0x0
0x30: 0x0
0x40: 0x0
0x50: 0x0
0x60: 0x0
0x70: 0x0
0x80: 0x0
unsortedbin
all: 0x603100 —▸ 0x7ffff7dd1b78 (main_arena+88) ◂— 0x603100
smallbins
empty
largebins
empty
pwndbg> 

pwndbg> bins
fastbins
0x20: 0x0
0x30: 0x0
0x40: 0x0
0x50: 0x0
0x60: 0x0
0x70: 0x0
0x80: 0x0
unsortedbin
all: 0x603100 —▸ 0x7ffff7dd1b78 (main_arena+88) ◂— 0x603100

smallbins
empty
largebins
empty
 

3.3.3 设置断点第39行并走起

​ 然后把p2的size改成0x180,这时候就把p3给包含进去了。

pwndbg> c
Continuing.
我们将 p2 的大小设置为 385, 这样的话我们就能用 376 大小的空间Breakpoint 5, main (argc=1, argv=0x7fffffffe6a8) at overlapping_chunks.c:31
31                   *(p2-1) = evil_chunk_size; // 覆盖 p2 的 size
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────────────────────RAX  0x55RBX  0x0RCX  0x7ffff7b042c0 (__write_nocancel+7) ◂— cmp    rax, -0xfffRDX  0x7ffff7dd3770 (_IO_stdfile_2_lock) ◂— 0x0RDI  0x2RSI  0x7fffffffbef0 ◂— 0xb0e5acbbe49188e6R8   0x7ffff7feb700 ◂— 0x7ffff7feb700R9   0x55R10  0x0R11  0x246R12  0x400590 (_start) ◂— xor    ebp, ebpR13  0x7fffffffe6a0 ◂— 0x1R14  0x0R15  0x0RBP  0x7fffffffe5c0 —▸ 0x400a40 (__libc_csu_init) ◂— push   r15RSP  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'RIP  0x4007f8 (main+370) ◂— mov    rax, qword ptr [rbp - 0x18]
────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────────────────────────────────────────0x4007e3 <main+349>    mov    edx, dword ptr [rbp - 0x28]0x4007e6 <main+352>    mov    esi, 0x400c500x4007eb <main+357>    mov    rdi, rax0x4007ee <main+360>    mov    eax, 00x4007f3 <main+365>    call   fprintf@plt <0x400550>► 0x4007f8 <main+370>    mov    rax, qword ptr [rbp - 0x18]0x4007fc <main+374>    lea    rdx, [rax - 8]0x400800 <main+378>    mov    eax, dword ptr [rbp - 0x28]0x400803 <main+381>    cdqe   0x400805 <main+383>    mov    qword ptr [rdx], rax0x400808 <main+386>    mov    rax, qword ptr [rip + 0x201851] <0x602060>
─────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]─────────────────────────────────────────────────────────────────────────────────────────────────
In file: /ctf/work/how2heap/overlapping_chunks.c26          27              int evil_chunk_size = 0x181;28              int evil_region_size = 0x180 - 8;29              fprintf(stderr, "我们将 p2 的大小设置为 %d, 这样的话我们就能用 %d 大小的空间\n",evil_chunk_size, evil_region_size);30          ► 31              *(p2-1) = evil_chunk_size; // 覆盖 p2 的 size32          33              fprintf(stderr, "\n现在让我们分配另一个块,其大小等于块p2注入大小的数据大小\n");34              fprintf(stderr, "malloc 将会把前面 free 的 p2 分配给我们(p2 的 size 已经被改掉了)\n");35              p4 = malloc(evil_region_size);36          
─────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'
01:0008│      0x7fffffffe588 ◂— 0x100400a8d
02:0010│      0x7fffffffe590 ◂— 0x0
03:0018│      0x7fffffffe598 ◂— 0x17800000181
04:0020│      0x7fffffffe5a0 —▸ 0x603010 ◂— 0x3131313131313131 ('11111111')
05:0028│      0x7fffffffe5a8 —▸ 0x603110 —▸ 0x7ffff7dd1b78 (main_arena+88) —▸ 0x603280 ◂— 0x3333333333333333 ('33333333')
06:0030│      0x7fffffffe5b0 —▸ 0x603210 ◂— 0x3333333333333333 ('33333333')
07:0038│      0x7fffffffe5b8 ◂— 0x0
───────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────────► f 0           4007f8 main+370f 1     7ffff7a2d830 __libc_start_main+240
Breakpoint /ctf/work/how2heap/overlapping_chunks.c:30
pwndbg> n
33                   fprintf(stderr, "\n现在让我们分配另一个块,其大小等于块p2注入大小的数据大小\n");
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────────────────────RAX  0x181RBX  0x0RCX  0x7ffff7b042c0 (__write_nocancel+7) ◂— cmp    rax, -0xfffRDX  0x603108 ◂— 0x181RDI  0x2RSI  0x7fffffffbef0 ◂— 0xb0e5acbbe49188e6R8   0x7ffff7feb700 ◂— 0x7ffff7feb700R9   0x55R10  0x0R11  0x246R12  0x400590 (_start) ◂— xor    ebp, ebpR13  0x7fffffffe6a0 ◂— 0x1R14  0x0R15  0x0RBP  0x7fffffffe5c0 —▸ 0x400a40 (__libc_csu_init) ◂— push   r15RSP  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'RIP  0x400808 (main+386) ◂— mov    rax, qword ptr [rip + 0x201851]
────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────────────────────────────────────────0x4007f8 <main+370>    mov    rax, qword ptr [rbp - 0x18]0x4007fc <main+374>    lea    rdx, [rax - 8]0x400800 <main+378>    mov    eax, dword ptr [rbp - 0x28]0x400803 <main+381>    cdqe   0x400805 <main+383>    mov    qword ptr [rdx], rax► 0x400808 <main+386>    mov    rax, qword ptr [rip + 0x201851] <0x602060>0x40080f <main+393>    mov    rcx, rax0x400812 <main+396>    mov    edx, 0x550x400817 <main+401>    mov    esi, 10x40081c <main+406>    mov    edi, 0x400ca80x400821 <main+411>    call   fwrite@plt <0x400570>
─────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]─────────────────────────────────────────────────────────────────────────────────────────────────
In file: /ctf/work/how2heap/overlapping_chunks.c28              int evil_region_size = 0x180 - 8;29              fprintf(stderr, "我们将 p2 的大小设置为 %d, 这样的话我们就能用 %d 大小的空间\n",evil_chunk_size, evil_region_size);30          31              *(p2-1) = evil_chunk_size; // 覆盖 p2 的 size32          ► 33              fprintf(stderr, "\n现在让我们分配另一个块,其大小等于块p2注入大小的数据大小\n");34              fprintf(stderr, "malloc 将会把前面 free 的 p2 分配给我们(p2 的 size 已经被改掉了)\n");35              p4 = malloc(evil_region_size);36          37              fprintf(stderr, "\np4 分配在 %p 到 %p 这一区域\n", (char *)p4, (char *)p4+evil_region_size);38              fprintf(stderr, "p3 从 %p 到 %p\n", (char *)p3, (char *)p3+0x80-8);
─────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'
01:0008│      0x7fffffffe588 ◂— 0x100400a8d
02:0010│      0x7fffffffe590 ◂— 0x0
03:0018│      0x7fffffffe598 ◂— 0x17800000181
04:0020│      0x7fffffffe5a0 —▸ 0x603010 ◂— 0x3131313131313131 ('11111111')
05:0028│      0x7fffffffe5a8 —▸ 0x603110 —▸ 0x7ffff7dd1b78 (main_arena+88) —▸ 0x603280 ◂— 0x3333333333333333 ('33333333')
06:0030│      0x7fffffffe5b0 —▸ 0x603210 ◂— 0x3333333333333333 ('33333333')
07:0038│      0x7fffffffe5b8 ◂— 0x0
───────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────────► f 0           400808 main+386f 1     7ffff7a2d830 __libc_start_main+240
pwndbg> p p3
$1 = (intptr_t *) 0x603210
pwndbg> x/10gx 0x603210
0x603210:       0x3333333333333333      0x3333333333333333
0x603220:       0x3333333333333333      0x3333333333333333
0x603230:       0x3333333333333333      0x3333333333333333
0x603240:       0x3333333333333333      0x3333333333333333
0x603250:       0x3333333333333333      0x3333333333333333
pwndbg> p p2
$2 = (intptr_t *) 0x603110
pwndbg> bins
fastbins
0x20: 0x0
0x30: 0x0
0x40: 0x0
0x50: 0x0
0x60: 0x0
0x70: 0x0
0x80: 0x0
unsortedbin
all: 0x603100 —▸ 0x7ffff7dd1b78 (main_arena+88) ◂— 0x603100
smallbins
empty
largebins
empty
pwndbg> x/10gx  0x7ffff7dd1b78
0x7ffff7dd1b78 <main_arena+88>: 0x0000000000603280      0x0000000000000000
0x7ffff7dd1b88 <main_arena+104>:        0x0000000000603100      0x0000000000603100
0x7ffff7dd1b98 <main_arena+120>:        0x00007ffff7dd1b88      0x00007ffff7dd1b88
0x7ffff7dd1ba8 <main_arena+136>:        0x00007ffff7dd1b98      0x00007ffff7dd1b98
0x7ffff7dd1bb8 <main_arena+152>:        0x00007ffff7dd1ba8      0x00007ffff7dd1ba8
pwndbg> parseheap
addr                prev                size                 status              fd                bk                
0x603000            0x0                 0x100                Used                None              None
0x603100            0x3131313131313131  0x180                Used                None              None
pwndbg> x/10gx 0x603110
0x603110:       0x00007ffff7dd1b78      0x00007ffff7dd1b78
0x603120:       0x3232323232323232      0x3232323232323232
0x603130:       0x3232323232323232      0x3232323232323232

pwndbg> p p3
$1 = (intptr_t *) 0x603210

pwndbg> p p2
$2 = (intptr_t *) 0x603110


pwndbg> bins
fastbins
0x20: 0x0
0x30: 0x0
0x40: 0x0
0x50: 0x0
0x60: 0x0
0x70: 0x0
0x80: 0x0
unsortedbin
all: 0x603100 —▸ 0x7ffff7dd1b78 (main_arena+88) ◂— 0x603100

smallbins
empty
largebins
empty

pwndbg> parseheap
addr                prev                size                 status              fd                bk                
0x603000            0x0                 0x100                Used                None              None
0x603100            0x3131313131313131  0x180                Used                None              None

p2->fd 

pwndbg> x/10gx 0x603110
0x603110:       0x00007ffff7dd1b78      0x00007ffff7dd1b78

p2->bk 

pwndbg> x/10gx 0x603110
0x603110:       0x00007ffff7dd1b78      0x00007ffff7dd1b78

pwndbg> x/10gx 0x603110
0x603110:       0x00007ffff7dd1b78      0x00007ffff7dd1b78
0x603120:       0x3232323232323232      0x3232323232323232
0x603130:       0x3232323232323232      0x3232323232323232
0x603140:       0x3232323232323232      0x3232323232323232
0x603150:       0x3232323232323232      0x3232323232323232
 

3.3.4 设置断点第52行并走起

​ 然后再去申请一块大小为0x180的堆块p4,就能够编辑p4,就可以修改p3的内容,编辑p3也可以修改p4的内容。

pwndbg> b 51
Breakpoint 10 at 0x4009b6: file overlapping_chunks.c, line 51.
pwndbg> c
Continuing.
p3 = 44444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444�Breakpoint 10, main (argc=1, argv=0x7fffffffe6a8) at overlapping_chunks.c:52
52                   fprintf(stderr, "\n那么之后再 memset(p3, '3', 80), 将会:\n");
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────────────────────RAX  0x71RBX  0x0RCX  0x7ffff7b042c0 (__write_nocancel+7) ◂— cmp    rax, -0xfffRDX  0x7ffff7dd3770 (_IO_stdfile_2_lock) ◂— 0x0RDI  0x2RSI  0x7fffffffbef0 ◂— 0x343434203d203370 ('p3 = 444')R8   0x7ffff7feb700 ◂— 0x7ffff7feb700R9   0x71R10  0x6bR11  0x246R12  0x400590 (_start) ◂— xor    ebp, ebpR13  0x7fffffffe6a0 ◂— 0x1R14  0x0R15  0x0RBP  0x7fffffffe5c0 —▸ 0x400a40 (__libc_csu_init) ◂— push   r15RSP  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'RIP  0x4009b6 (main+816) ◂— mov    rax, qword ptr [rip + 0x2016a3]
────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────────────────────────────────────────► 0x4009b6 <main+816>    mov    rax, qword ptr [rip + 0x2016a3] <0x602060>0x4009bd <main+823>    mov    rcx, rax0x4009c0 <main+826>    mov    edx, 0x2e0x4009c5 <main+831>    mov    esi, 10x4009ca <main+836>    mov    edi, 0x400eb00x4009cf <main+841>    call   fwrite@plt <0x400570>0x4009d4 <main+846>    mov    rax, qword ptr [rbp - 0x10]0x4009d8 <main+850>    mov    edx, 0x500x4009dd <main+855>    mov    esi, 0x330x4009e2 <main+860>    mov    rdi, rax0x4009e5 <main+863>    call   memset@plt <0x400530>
─────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]─────────────────────────────────────────────────────────────────────────────────────────────────
In file: /ctf/work/how2heap/overlapping_chunks.c47              fprintf(stderr, "\n如果我们使用 memset(p4, '4', %d), 将会:\n", evil_region_size);48              memset(p4, '4', evil_region_size);49              fprintf(stderr, "p4 = %s\n", (char *)p4+0x10);50              fprintf(stderr, "p3 = %s\n", (char *)p3+0x10);51          ► 52              fprintf(stderr, "\n那么之后再 memset(p3, '3', 80), 将会:\n");53              memset(p3, '3', 80);54              fprintf(stderr, "p4 = %s\n", (char *)p4+0x10);55              fprintf(stderr, "p3 = %s\n", (char *)p3+0x10);56          } 
─────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'
01:0008│      0x7fffffffe588 ◂— 0x100400a8d
02:0010│      0x7fffffffe590 ◂— 0x0
03:0018│      0x7fffffffe598 ◂— 0x17800000181
04:0020│      0x7fffffffe5a0 —▸ 0x603010 ◂— 0x3131313131313131 ('11111111')
05:0028│      0x7fffffffe5a8 —▸ 0x603110 ◂— 0x3434343434343434 ('44444444')
06:0030│      0x7fffffffe5b0 —▸ 0x603210 ◂— 0x3434343434343434 ('44444444')
07:0038│      0x7fffffffe5b8 —▸ 0x603110 ◂— 0x3434343434343434 ('44444444')
───────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────────► f 0           4009b6 main+816f 1     7ffff7a2d830 __libc_start_main+240
Breakpoint /ctf/work/how2heap/overlapping_chunks.c:51
pwndbg> parseheap
addr                prev                size                 status              fd                bk                
0x603000            0x0                 0x100                Used                None              None
0x603100            0x3131313131313131  0x180                Used                None              None
pwndbg> p p3
$3 = (intptr_t *) 0x603210pwndbg> x/20gx 0x603210
0x603210:       0x3434343434343434      0x3434343434343434
0x603220:       0x3434343434343434      0x3434343434343434
0x603230:       0x3434343434343434      0x3434343434343434
0x603240:       0x3434343434343434      0x3434343434343434
0x603250:       0x3434343434343434      0x3434343434343434
0x603260:       0x3434343434343434      0x3434343434343434
0x603270:       0x3434343434343434      0x3434343434343434
0x603280:       0x3434343434343434      0x0000000000020d81
0x603290:       0x0000000000000000      0x0000000000000000
0x6032a0:       0x0000000000000000      0x0000000000000000
pwndbg> p p4
$4 = (intptr_t *) 0x603110pwndbg> x/80gx 0x603110
0x603110:       0x3434343434343434      0x3434343434343434
0x603120:       0x3434343434343434      0x3434343434343434
0x603130:       0x3434343434343434      0x3434343434343434
0x603140:       0x3434343434343434      0x3434343434343434
0x603150:       0x3434343434343434      0x3434343434343434
0x603160:       0x3434343434343434      0x3434343434343434
0x603170:       0x3434343434343434      0x3434343434343434
0x603180:       0x3434343434343434      0x3434343434343434
0x603190:       0x3434343434343434      0x3434343434343434
0x6031a0:       0x3434343434343434      0x3434343434343434
0x6031b0:       0x3434343434343434      0x3434343434343434
0x6031c0:       0x3434343434343434      0x3434343434343434
0x6031d0:       0x3434343434343434      0x3434343434343434
0x6031e0:       0x3434343434343434      0x3434343434343434
0x6031f0:       0x3434343434343434      0x3434343434343434
0x603200:       0x3434343434343434      0x3434343434343434
0x603210:       0x3434343434343434      0x3434343434343434
0x603220:       0x3434343434343434      0x3434343434343434
0x603230:       0x3434343434343434      0x3434343434343434
0x603240:       0x3434343434343434      0x3434343434343434
0x603250:       0x3434343434343434      0x3434343434343434
0x603260:       0x3434343434343434      0x3434343434343434
0x603270:       0x3434343434343434      0x3434343434343434
0x603280:       0x3434343434343434      0x0000000000020d81
0x603290:       0x0000000000000000      0x0000000000000000
0x6032a0:       0x0000000000000000      0x0000000000000000
0x6032b0:       0x0000000000000000      0x0000000000000000
0x6032c0:       0x0000000000000000      0x0000000000000000
0x6032d0:       0x0000000000000000      0x0000000000000000
0x6032e0:       0x0000000000000000      0x0000000000000000
0x6032f0:       0x0000000000000000      0x0000000000000000
0x603300:       0x0000000000000000      0x0000000000000000
0x603310:       0x0000000000000000      0x0000000000000000
0x603320:       0x0000000000000000      0x0000000000000000
0x603330:       0x0000000000000000      0x0000000000000000
0x603340:       0x0000000000000000      0x0000000000000000
0x603350:       0x0000000000000000      0x0000000000000000
0x603360:       0x0000000000000000      0x0000000000000000
0x603370:       0x0000000000000000      0x0000000000000000
0x603380:       0x0000000000000000      0x0000000000000000
pwndbg> 

接下来验证一下,现在 p3 与 p4:
p4 = 22222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222
p3 = 33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333�

如果我们使用 memset(p4, '4', 376), 将会:
p4 = 444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444�
p3 = 44444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444�

 

3.3.5 设置断点第54行并走起 

pwndbg> b 54
Breakpoint 12 at 0x4009ea: file overlapping_chunks.c, line 54.
pwndbg> c
Continuing.那么之后再 memset(p3, '3', 80), 将会:Breakpoint 12, main (argc=1, argv=0x7fffffffe6a8) at overlapping_chunks.c:54
54                   fprintf(stderr, "p4 = %s\n", (char *)p4+0x10);
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────────────────────RAX  0x603210 ◂— 0x3333333333333333 ('33333333')RBX  0x0RCX  0x7ffff7b042c0 (__write_nocancel+7) ◂— cmp    rax, -0xfffRDX  0x50RDI  0x603210 ◂— 0x3333333333333333 ('33333333')RSI  0x603260 ◂— 0x3434343434343434 ('44444444')R8   0x2eR9   0x7ffff7dd2540 (_IO_2_1_stderr_) ◂— 0xfbad2887R10  0x1R11  0x246R12  0x400590 (_start) ◂— xor    ebp, ebpR13  0x7fffffffe6a0 ◂— 0x1R14  0x0R15  0x0RBP  0x7fffffffe5c0 —▸ 0x400a40 (__libc_csu_init) ◂— push   r15RSP  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'RIP  0x4009ea (main+868) ◂— mov    rax, qword ptr [rbp - 8]
────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────────────────────────────────────────0x4009d4 <main+846>    mov    rax, qword ptr [rbp - 0x10]0x4009d8 <main+850>    mov    edx, 0x500x4009dd <main+855>    mov    esi, 0x330x4009e2 <main+860>    mov    rdi, rax0x4009e5 <main+863>    call   memset@plt <0x400530>► 0x4009ea <main+868>    mov    rax, qword ptr [rbp - 8]0x4009ee <main+872>    lea    rdx, [rax + 0x10]0x4009f2 <main+876>    mov    rax, qword ptr [rip + 0x201667] <0x602060>0x4009f9 <main+883>    mov    esi, 0x400e630x4009fe <main+888>    mov    rdi, rax0x400a01 <main+891>    mov    eax, 0
─────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]─────────────────────────────────────────────────────────────────────────────────────────────────
In file: /ctf/work/how2heap/overlapping_chunks.c49              fprintf(stderr, "p4 = %s\n", (char *)p4+0x10);50              fprintf(stderr, "p3 = %s\n", (char *)p3+0x10);51          52              fprintf(stderr, "\n那么之后再 memset(p3, '3', 80), 将会:\n");53              memset(p3, '3', 80);► 54              fprintf(stderr, "p4 = %s\n", (char *)p4+0x10);55              fprintf(stderr, "p3 = %s\n", (char *)p3+0x10);56          } 
─────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp  0x7fffffffe580 —▸ 0x7fffffffe6a8 —▸ 0x7fffffffe8d1 ◂— '/ctf/work/how2heap/overlapping_chunks'
01:0008│      0x7fffffffe588 ◂— 0x100400a8d
02:0010│      0x7fffffffe590 ◂— 0x0
03:0018│      0x7fffffffe598 ◂— 0x17800000181
04:0020│      0x7fffffffe5a0 —▸ 0x603010 ◂— 0x3131313131313131 ('11111111')
05:0028│      0x7fffffffe5a8 —▸ 0x603110 ◂— 0x3434343434343434 ('44444444')
06:0030│      0x7fffffffe5b0 —▸ 0x603210 ◂— 0x3333333333333333 ('33333333')
07:0038│      0x7fffffffe5b8 —▸ 0x603110 ◂— 0x3434343434343434 ('44444444')
───────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────────► f 0           4009ea main+868f 1     7ffff7a2d830 __libc_start_main+240
Breakpoint /ctf/work/how2heap/overlapping_chunks.c:54
pwndbg> p p3
$5 = (intptr_t *) 0x603210
pwndbg> x/80gx 0x603210
0x603210:       0x3333333333333333      0x3333333333333333
0x603220:       0x3333333333333333      0x3333333333333333
0x603230:       0x3333333333333333      0x3333333333333333
0x603240:       0x3333333333333333      0x3333333333333333
0x603250:       0x3333333333333333      0x3333333333333333
0x603260:       0x3434343434343434      0x3434343434343434
0x603270:       0x3434343434343434      0x3434343434343434
0x603280:       0x3434343434343434      0x0000000000020d81
0x603290:       0x0000000000000000      0x0000000000000000
0x6032a0:       0x0000000000000000      0x0000000000000000
0x6032b0:       0x0000000000000000      0x0000000000000000
0x6032c0:       0x0000000000000000      0x0000000000000000
0x6032d0:       0x0000000000000000      0x0000000000000000
0x6032e0:       0x0000000000000000      0x0000000000000000
0x6032f0:       0x0000000000000000      0x0000000000000000
0x603300:       0x0000000000000000      0x0000000000000000
0x603310:       0x0000000000000000      0x0000000000000000
0x603320:       0x0000000000000000      0x0000000000000000
0x603330:       0x0000000000000000      0x0000000000000000
0x603340:       0x0000000000000000      0x0000000000000000
0x603350:       0x0000000000000000      0x0000000000000000
0x603360:       0x0000000000000000      0x0000000000000000
0x603370:       0x0000000000000000      0x0000000000000000
0x603380:       0x0000000000000000      0x0000000000000000
0x603390:       0x0000000000000000      0x0000000000000000
0x6033a0:       0x0000000000000000      0x0000000000000000
0x6033b0:       0x0000000000000000      0x0000000000000000
0x6033c0:       0x0000000000000000      0x0000000000000000
0x6033d0:       0x0000000000000000      0x0000000000000000
0x6033e0:       0x0000000000000000      0x0000000000000000
0x6033f0:       0x0000000000000000      0x0000000000000000
0x603400:       0x0000000000000000      0x0000000000000000
0x603410:       0x0000000000000000      0x0000000000000000
0x603420:       0x0000000000000000      0x0000000000000000
0x603430:       0x0000000000000000      0x0000000000000000
0x603440:       0x0000000000000000      0x0000000000000000
0x603450:       0x0000000000000000      0x0000000000000000
0x603460:       0x0000000000000000      0x0000000000000000
0x603470:       0x0000000000000000      0x0000000000000000
0x603480:       0x0000000000000000      0x0000000000000000
pwndbg> p p4
$6 = (intptr_t *) 0x603110
pwndbg> x/80gx 0x603110
0x603110:       0x3434343434343434      0x3434343434343434
0x603120:       0x3434343434343434      0x3434343434343434
0x603130:       0x3434343434343434      0x3434343434343434
0x603140:       0x3434343434343434      0x3434343434343434
0x603150:       0x3434343434343434      0x3434343434343434
0x603160:       0x3434343434343434      0x3434343434343434
0x603170:       0x3434343434343434      0x3434343434343434
0x603180:       0x3434343434343434      0x3434343434343434
0x603190:       0x3434343434343434      0x3434343434343434
0x6031a0:       0x3434343434343434      0x3434343434343434
0x6031b0:       0x3434343434343434      0x3434343434343434
0x6031c0:       0x3434343434343434      0x3434343434343434
0x6031d0:       0x3434343434343434      0x3434343434343434
0x6031e0:       0x3434343434343434      0x3434343434343434
0x6031f0:       0x3434343434343434      0x3434343434343434
0x603200:       0x3434343434343434      0x3434343434343434
0x603210:       0x3333333333333333      0x3333333333333333
0x603220:       0x3333333333333333      0x3333333333333333
0x603230:       0x3333333333333333      0x3333333333333333
0x603240:       0x3333333333333333      0x3333333333333333
0x603250:       0x3333333333333333      0x3333333333333333
0x603260:       0x3434343434343434      0x3434343434343434
0x603270:       0x3434343434343434      0x3434343434343434
0x603280:       0x3434343434343434      0x0000000000020d81
0x603290:       0x0000000000000000      0x0000000000000000
0x6032a0:       0x0000000000000000      0x0000000000000000
0x6032b0:       0x0000000000000000      0x0000000000000000
0x6032c0:       0x0000000000000000      0x0000000000000000
0x6032d0:       0x0000000000000000      0x0000000000000000
0x6032e0:       0x0000000000000000      0x0000000000000000
0x6032f0:       0x0000000000000000      0x0000000000000000
0x603300:       0x0000000000000000      0x0000000000000000
0x603310:       0x0000000000000000      0x0000000000000000
0x603320:       0x0000000000000000      0x0000000000000000
0x603330:       0x0000000000000000      0x0000000000000000
0x603340:       0x0000000000000000      0x0000000000000000
0x603350:       0x0000000000000000      0x0000000000000000
0x603360:       0x0000000000000000      0x0000000000000000
0x603370:       0x0000000000000000      0x0000000000000000
0x603380:       0x0000000000000000      0x0000000000000000
pwndbg> 

 

那么之后再 memset(p3, '3', 80), 将会:
p4 = 444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444333333333333333333333333333333333333333333333333333333333333333333333333333333334444444444444444444444444444444444444444�
p3 = 33333333333333333333333333333333333333333333333333333333333333334444444444444444444444444444444444444444�

  4.参考资料

【PWN】how2heap | 狼组安全团队公开知识库

这篇关于从零开始学howtoheap:理解fastbins的堆块重叠的问题1的文章就介绍到这儿,希望我们推荐的文章对编程师们有所帮助!



http://www.chinasem.cn/article/703736

相关文章

oracle killed会话不释放的问题

一般情况下,在杀一个会话的时候,直接执行alter system kill session ‘sid,serial#’; Administrator's Guide说,当session是active的时候,alter system kill session 只是将session标识为killed 或者pseudo状态,并不会释放session持有的资源,所以我们在执行完alter sy

连接池问题

[2014-01-27 13:40:53 112 ERROR] [http-nio-8888-exec-133] com.jeedsoft.ecp.application.action.DataServlet - Unexpected Exceptioncom.jeedsoft.common.basic.exception.SystemException: 获取数据库连接失败。at com.je

oracle 排序分页混乱【验证后有问题】

今天有个需求用oracle排序分页: sql如下:select *   from (select id, member_id, company_name, rownum rn           from (select t.id, t.member_id, t.company_name                   from table1 t, table2 d

java 连接池问题oracle

[2014-01-15 10:06:09 326 ERROR] [http-nio-8888-exec-9] com.jeedsoft.ecp.application.action.DataServlet - Unexpected Exceptioncom.jeedsoft.common.basic.exception.SystemException: 获取数据库连接失败。at com.jeed

centos6 关于 ssh,svn,tomcat远程不能访问的问题处理过程

问题:局域网内配置好tocmat,服务器本机访问http://ip:8080成功,但远程访问http://ip:8080失败,下面是一步步排查过程: 1、tomcat禁用IPv6 关闭网卡IPV6协议 #netstat –anp |grep 8080  //是jsvc程序和tomcat用户在用,且端口在监听状态 #lsof –i:8080 //发现type=IPV6,很奇怪怎么

tomcat启动时SessionIdGeneratorBase.createSecureRandom耗时5分钟的问题

通常情况下,tomcat启动只要2~3秒钟,突然有一天,tomcat启动非常慢,要花5~6分钟,查了很久,终于在这篇文章找到了解决方案,博主牛人啊。 原文参见:http://blog.csdn.net/chszs/article/details/49494701   Tomcat 8启动很慢,且日志上无任何错误,在日志中查看到如下信息: [2017-03-17 14:16:32 1

买房问题

现在北京有一套房子,价格200 万,假设房价每年上涨10%,一个软件工程师每年固定能赚40 万。如果他想买这套房子,不贷款,不涨工资,没有其他收入,每年不吃不喝不消费,那么他需要几年才能攒够钱买这套房子? #include <stdio.h>#define rate 0.1main(){int i,a=200,b=0;for(i=1;i<=100;i++){a*=(1+rate);b+

RAG知识库问答LangChain+LLM的二次开发:商用时的典型问题及其改进方案

前言 如之前的文章所述,我司下半年成立大模型项目团队之后,我虽兼管整个项目团队,但为让项目的推进效率更高,故分成了三大项目组 第一项目组由霍哥带头负责类似AIGC模特生成系统第二项目组由阿荀带头负责论文审稿GPT以及AI agent项目第三项目组由朝阳带头负责企业多文档的知识库问答系统,朝阳、bingo、猫药师等人贡献了本文的至少一半 对于知识库问答,现在有两种方案,一种基于llamaind

Kubernetes 学习总结(46)—— Pod 不停重启问题分析与解决

我们在做性能测试的时候,往往会发现我们的pod服务,频繁重启,通过kubectl get pods 命令,我们来逐步定位问题。 现象:running的pod,短时间内重启次数太多。  定位问题方法:查看pod日志 kubectl get event #查看当前环境一个小时内的日志kubectl describe pod pod_n

AI:148-开发一种智能语音助手,能够理解和执行复杂任务

🚀点击这里跳转到本专栏,可查阅专栏顶置最新的指南宝典~ 🎉🎊🎉 你的技术旅程将在这里启航! 从基础到实践,深入学习。无论你是初学者还是经验丰富的老手,对于本专栏案例和项目实践都有参考学习意义。 ✨✨✨ 每一个案例都附带关键代码,详细讲解供大家学习,希望可以帮到大家。正在不断更新中~ 一. 开发一种智能语音助手,能够理解和执行复杂任务 在人工智能领域的不断发展中,语音助手已经成为