Double-Free Exploit
Still on Xenial Xerus, means both mentioned checks are still relevant. The bypass for the second check (malloc() memory corruption) is given to you in the form of fake metadata already set to a suitable size. Let's check the (relevant parts of) the source.
Analysis
Variables
The fakemetadata
variable is the fake size of 0x30
, so you can focus on the double-free itself rather than the protection bypass. Directly after this is the admin
variable, meaning if you pull the exploit off into the location of that fake metadata, you can just overwrite that as proof.
users
is a list of strings for the usernames, and userCount
keeps track of the length of the array.
main_loop()
Prompts for input, takes in input. Note that main()
itself prints out the location of fakemetadata
, so we don't have to mess around with that at all.
createUser()
createUser()
allocates a chunk of size 0x20
on the heap (real size is 0x30
including metadata, hence the fakemetadata
being 0x30
) then sets the array entry as a pointer to that chunk. Input then gets written there.
deleteUser()
Get index, print out the details and free()
it. Easy peasy.
complete_level()
Checks you overwrote admin
with admin
, if you did, mission accomplished!
Exploitation
There's literally no checks in place so we have a plethora of options available, but this tutorial is about using a double-free, so we'll use that.
Setup
First let's make a skeleton of a script, along with some helper functions:
Finding the Double-Free
As we know with the fasttop
protection, we can't allocate once then free twice - we'll have to free once inbetween.
Let's check the progression of the fastbin by adding a pause()
after every delete()
. We'll hook on with radare2 using
delete(0) #1
Due to its size, the chunk will go into Fastbin 2, which we can check the contents of using dmhf 2
(dmhf
analyses fastbins, and we can specify number 2).
Looks like the first chunk is located at 0xd58000
. Let's keep going.
delete(1)
The next chunk (Chunk 1) has been added to the top of the fastbin, this chunk being located at 0xd58030
.
delete(0) #2
Boom - we free Chunk 0 again, adding it to the fastbin for the second time. radare2 is nice enough to point out there's a double-free.
Writing to the Fastbin Freelist
Now we have a double-free, let's allocate Chunk 0 again and put some random data. Because it's also considered free, the data we write is seen as being in the fd
pointer of the chunk. Remember, the heap saves space, so fd
when free is located exactly where data is when allocated (probably explained better here).
So let's write to fd
, and see what happens to the fastbin. Remove all the pause()
instructions.
Run, debug, and dmhf 2
.
The last free()
gets reused, and our "fake" fastbin location is in the list. Beautiful.
Let's push it to the top of the list by creating two more irrelevant users. We can also parse the fakemetadata
location at the beginning of the exploit chain.
The reason we have to subtract 8 off fakemetadata
is that the only thing we faked in the souce is the size
field, but prev_size
is at the very front of the chunk metadata. If we point the fastbin freelist at the fakemetadata
variable it'll interpret it as prev_size
and the 8 bytes afterwards as size
, so we shift it all back 8 to align it correctly.
Now we can control where we write, and we know where to write to.
Getting the Arbitrary Write
First, let's replace the location we write to with where we want to:
Now let's finish it off by creating another user. Since we control the fastbin, this user gets written to the location of our fake metadata, giving us an almost arbitrary write.
The 8 null bytes are padding. If you read the source, you notice the metadata string is 16 bytes long rather than 8, so we need 8 more padding.
Awesome - we completed the level!
Final Exploit
32-bit
Mixing it up a bit - you can try the 32-bit version yourself. Same principle, offsets a bit different and stuff. I'll upload the binary when I can, but just compile it as 32-bit and try it yourself :)
Last updated