House of Force
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
This technique was patched (here) and produces this error: malloc(): corrupted top size
You can try the code from here to test it if you want.
The goal of this attack is to be able to allocate a chunk in a specific address.
An overflow that allows to overwrite the size of the top chunk header (e.g. -1).
Be able to control the size of the heap allocation
If an attacker wants to allocate a chunk in the address P to overwrite a value here. He starts by overwriting the top chunk size with -1 (maybe with an overflow). This ensures that malloc won't be using mmap for any allocation as the Top chunk will always have enough space.
Then, calculate the distance between the address of the top chunk and the target space to allocate. This is because a malloc with that size will be performed in order to move the top chunk to that position. This is how the difference/size can be easily calculated:
Therefore, allocating a size of target - old_top - 4*sizeof(long) (the 4 longs are because of the metadata of the top chunk and of the new chunk when allocated) will move the top chunk to the address we want to overwrite.
Then, do another malloc to get a chunk at the target address.
https://ctf-wiki.mahaloz.re/pwn/linux/glibc-heap/house_of_force/#hitcon-training-lab-11
The goal of this scenario is a ret2win where we need to modify the address of a function that is going to be called by the address of the ret2win function
The binary has an overflow that can be abused to modify the top chunk size, which is modified to -1 or p64(0xffffffffffffffff)
Then, it's calculated the address to the place where the pointer to overwrite exists, and the difference from the current position of the top chunk to there is alloced with malloc
Finally a new chunk is alloced which will contain this desired target inside which is overwritten by the ret2win function
In the Input your name: there is an initial vulnerability that allows to leak an address from the heap
Then in the Org: and Host: functionality its possible to fill the 64B of the s pointer when asked for the org name, which in the stack is followed by the address of v2, which is then followed by the indicated host name. As then, strcpy is going to be copying the contents of s to a chunk of size 64B, it's possible to overwrite the size of the top chunk with the data put inside the host name.
Now that arbitrary write it possible, the atoi's GOT was overwritten to the address of printf. the it as possible to leak the address of IO_2_1_stderr with %24$p. And with this libc leak it was possible to overwrite atoi's GOT again with the address to system and call it passing as param /bin/sh
An alternative method proposed in this other writeup, is to overwrite free with puts, and then add the address of atoi@got, in the pointer that will be later freed so it's leaked and with this leak overwrite again atoi@got with system and call it with /bin/sh.
https://guyinatuxedo.github.io/41-house_of_force/bkp16_cookbook/index.html
There is a UAF allowing to reuse a chunk that was freed without clearing the pointer. Because there are some read methods, it's possible to leak a libc address writing a pointer to the free function in the GOT here and then calling the read function.
Then, House of force was used (abusing the UAF) to overwrite the size of the left space with a -1, allocate a chunk big enough to get tot he free hook, and then allocate another chunk which will contain the free hook. Then, write in the hook the address of system, write in a chunk "/bin/sh" and finally free the chunk with that string content.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
