http://exploit.education/phoenix/heap-zero/
Luckily it gives us the source:
So let's analyse what it does:
Allocates two chunks on the heap
Sets the fp
variable of chunk f
to the address of nowinner
Copies the first command-line argument to the name
variable of the chunk d
Runs whatever the fp
variable of f
points at
The weakness here is clear - it runs a random address on the heap. Our input is copied there after the value is set and there's no bound checking whatsoever, so we can overrun it easily.
Let's check out the heap in normal conditions.
We'll break right after the strcpy and see how it looks.
If we want, we can check the contents.
So, we can see that the function address is there, after our input in memory. Let's work out the offset.
Since we want to work out how many characters we need until the pointer, I'll just use a De Bruijn Sequence.
Let's break on and after the strcpy
. That way we can check the location of the pointer then immediately read it and calculate the offset.
So, the chunk with the pointer is located at 0x2493060
. Let's continue until the next breakpoint.
radare2 is nice enough to tell us we corrupted the data. Let's analyse the chunk again.
Notice we overwrote the size
field, so the chunk is much bigger. But now we can easily use the first value to work out the offset (we could also, knowing the location, have done pxq @ 0x02493060
).
So, fairly simple - 80 characters, then the address of winner
.
We need to remove the null bytes because argv
doesn't allow them
http://exploit.education/phoenix/heap-one/
This program:
Allocates a chunk on the heap for the heapStructure
Allocates another chunk on the heap for the name
of that heapStructure
Repeats the process with another heapStructure
Copies the two command-line arguments to the name
variables of the heapStructures
Prints something
Let's break on and after the first strcpy
.
As we expected, we have two pairs of heapStructure
and name
chunks. We know the strcpy
will be copying into wherever name
points, so let's read the contents of the first heapStructure
. Maybe this will give us a clue.
Look! The name
pointer points to the name
chunk! You can see the value 0x602030
being stored.
This isn't particularly a revelation in itself - after all, we knew there was a pointer in the chunk. But now we're certain, and we can definitely overwrite this pointer due to the lack of bounds checking. And because we can also control the value being written, this essentially gives us an arbitrary write!
And where better to target than the GOT?
The plan, therefore, becomes:
Pad until the location of the pointer
Overwrite the pointer with the GOT address of a function
Set the second parameter to the address of winner
Next time the function is called, it will call winner
But what function should we overwrite? The only function called after the strcpy
is printf
, according to the source code. And if we overwrite printf
with winner
it'll just recursively call itself forever.
Luckily, compilers like gcc
compile printf
as puts
if there are no parameters - we can see this with radare2:
So we can simply overwrite the GOT address of puts
with winner
. All we need to find now is the padding until the pointer and then we're good to go.
Break on and after the strcpy
again and analyse the second chunk's name
pointer.
The pointer is originally at 0x8d9050
; once the strcpy occurs, the value there is 0x41415041414f4141
.
The offset is 40.
Again, null bytes aren't allowed in parameters so you have to remove them.
Heap Overflow, much like a Stack Overflow, involves too much data being written to the heap. This can result in us overwriting data, most importantly pointers. Overwriting these pointers can cause user input to be copied to different locations if the program blindly trusts data on the heap.
To introduce this (it's easier to understand with an example) I will use two vulnerable binaries from .