WWW2Exec - __malloc_hook & __free_hook
Malloc Hook
As you can Official GNU site, the variable __malloc_hook
is a pointer pointing to the address of a function that will be called whenever malloc()
is called stored in the data section of the libc library. Therefore, if this address is overwritten with a One Gadget for example and malloc
is called, the One Gadget will be called.
To call malloc it's possible to wait for the program to call it or by calling printf("%10000$c")
which allocates too bytes many making libc
calling malloc to allocate them in the heap.
More info about One Gadget in:
Note that hooks are disabled for GLIBC >= 2.34. There are other techniques that can be used on modern GLIBC versions. See: https://github.com/nobodyisnobody/docs/blob/main/code.execution.on.last.libc/README.md.
Free Hook
This was abused in one of the example from the page abusing a fast bin attack after having abused an unsorted bin attack:
It's posisble to find the address of __free_hook
if the binary has symbols with the following command:
In the post you can find a step by step guide on how to locate the address of the free hook without symbols. As summary, in the free function:
In the mentioned break in the previous code in $eax
will be located the address of the free hook.
Now a fast bin attack is performed:
First of all it's discovered that it's possible to work with fast chunks of size 200 in the
__free_hook
location:If we manage to get a fast chunk of size 0x200 in this location, it'll be possible to overwrite a function pointer that will be executed
For this, a new chunk of size
0xfc
is created and the merged function is called with that pointer twice, this way we obtain a pointer to a freed chunk of size0xfc*2 = 0x1f8
in the fast bin.Then, the edit function is called in this chunk to modify the
fd
address of this fast bin to point to the previous__free_hook
function.Then, a chunk with size
0x1f8
is created to retrieve from the fast bin the previous useless chunk so another chunk of size0x1f8
is created to get a fast bin chunk in the__free_hook
which is overwritten with the address ofsystem
function.And finally a chunk containing the string
/bin/sh\x00
is freed calling the delete function, triggering the__free_hook
function which points to system with/bin/sh\x00
as parameter.
References
Last updated