four-function-heap
TLDR
- tcache double free
- overwrite tcache_perthread_struct
- overwrite the value of free_hook to one gadget rce
- UAF
- leak heap address
- leak libc address
Challenge
Description
result of file command
- Arch : x86-64
- Library : Dynamically linked
- Symbol : Stripped
result of checksec
- RELRO : FullRELRO
- Canary : Enable
- NX : Enable
- PIE : Enable
libc version: 2.27 (in given dockerfile)
Exploit
In this binary, We can choose 3 commands,
- alloc
- giving three parameters, index, size and data
- call malloc() and read() into allocated chunk
- free
- free allocated chunk
- freed ptr is not cleared (use after free)
- show
- print the value of allocated chunk
We can do these commands only 15 times.
It makes this challenge more difficult.
My exploit flow is shown below.
- Trigger tcache double free and show heap base.
- Get a chunk which is overlapped tcache_perthred_sturut by using tcache poisoning.
- Overwrite array count[] in tcache_perthred_sturut in order to next freed chunk is connected unsorted bin.
- Leak libc address by show command
- Get a chunk which is overlapped free_hook and overwrite free_hook to one gadget rce.
My exploit code is solve.py.
Reference
twitter: @kam1tsur3
