[原创]house of cat详细原理分析+2022强网杯对应题目分析

适用版本：glibc2.34+利用条件：能触发 __malloc_assert + 有一个任意地址写原语特攻题目：无 exit 函数所以最终需要我们手动触发__malloc_assert进入该调用链__malloc_assert -> __fxprintf -> __vfxprintf -> __locked_vfxprintf -> __vfwprintf_internal -> _IO_wfile_seekoff -> _IO_switch_to_wget_modefake_IO_addr 偏移payload 偏移写入值FILE 视角fake _wide_data视角作用0x00不可直接写不可写入固定为该chunk prev_size_flags--0x08不可直接写不可写入固定为该chunk size_IO_read_ptr--0x100x000_IO_read_end--0x180x080_IO_read_base--0x200x100_IO_write_base--0x280x180_IO_write_ptr--0x300x200_IO_write_end_wide_data->_IO_read_ptrfake _wide_data起点0x380x280_IO_buf_base_wide_data->_IO_read_end次重要[1]0x400x301_IO_buf_end_wide_data->_IO_read_base次重要[1]0x480x380_IO_save_base_wide_data->_IO_write_base重要[2]0x500x40fp + 0xb0_IO_bakcup_base_wide_data->_IO_write_ptr重要[2][3]0x580x48setcontext+61_IO_save_end_wide_data->_IO_write_end重要[4]0x600x500_markers_wide_data->_IO_buf_base-0x680x580_chain_wide_data->_IO_buf_end-0x700x600 + 0_fileno + _flags2_wide_data->_IO_save_base两个都是 int0x780x680_old_offset_wide_data->_IO_backup_base_old_offset底层类型__off_t，占8字节0x800x700_cur_column_vtable_offset_shortbuf_wide_data->_IO_save_end_cur_column unsigned short_vtable_offset signed char_shortbuf char[1]还有 4 字节的padding0x880x78heap_base + 0x200_lockwide+0x58重要[5]0x900x800_offsetwide+0x60-0x980x880_codecvtwide+0x68-0xa00x90fp + 0x30_wide_datawide+0x70重要[6]0xa80x980

登录后可查看完整内容

---
来源: 看雪论坛
原文链接: https://bbs.kanxue.com/thread-290379.htm