by alert7 < alert7@xfocus.org >
主页: http://www.xfocus.org/
发布：2005年8月23日

0 - 前言
1 - 测试格式化溢出相关函数
2 - 缓冲区溢出相关函数
3 - 测试堆溢出相关函数
4 - glibc 2.3.5上的堆溢出真的没戏了吗?

★★ 0: 前言

glibc 软件又有一些新的安全特性了,挖个坑,抛个砖 .希望有玉咂过来 :) .

在features.h中有说明
_FORTIFY_SOURCE If set to numeric value > 0 additional security
measures are defined, according to level.

★★ 1: 测试格式化溢出相关函数

[alert7@FC4 glibc]$ cat test_format1.c
#define _FORTIFY_SOURCE 2

#include <stdio.h>
int main(int argc, char *argv[])
{

printf(argv[1]);
printf("\n");

return 0;
}
[alert7@FC4 glibc]$ gcc -o test_format1 test_format1.c -O2
这里编译一定要加 -O2 优化选项

[alert7@FC4 glibc]$ ./test_format1 %n
*** %n in writable segment detected ***
Aborted (core dumped)

[alert7@FC4 glibc]$ ./test_format1 %1000$
*** invalid %N$ use detected ***
Aborted (core dumped)

/******************************************************/
[alert7@FC4 glibc]$ ./test_format1 %10$n%n
%n
[alert7@FC4 glibc]$ ./test_format1 %10$n%n%n
*** %n in writable segment detected ***
%nAborted (core dumped)
这里有点奇怪，%10$n%n好象等价于 %%n

/******************************************************/

在定义_FORTIFY_SOURCE为2的情况下
以下printf函数可以实现无缝的替换为__xxxprintf_check这些安全函数

sprintf
vsprintf
snprintf
vsnprintf
printf
fprintf
vprintf
vfprintf

gets是否会被替换为安全函数取决于编译gets(p)时候该P是否能得到object大小
#define gets(__str) \
((__bos (__str) == (size_t) -1) \
? (gets) (__str) : __gets_chk (__str, __bos (__str)))

★★ 2: 缓冲区溢出相关函数

由于strcpy、strcat等函数的一些特性，没有办法做到无缝的替换为安全函数，glibc 2.3.5提供了一套
更加安全的缓冲区操作参数。但是，假如程序员注意到了需要安全编程的话，strcpy等不安全的函数就
不应该会用错了。

extern void *__memcpy_chk (void *__restrict __dest,
const void *__restrict __src, size_t __len,
size_t __destlen) __THROW;
extern void *__memmove_chk (void *__dest, const void *__src, size_t __len,
size_t __destlen) __THROW;
extern void *__mempcpy_chk (void *__restrict __dest,
const void *__restrict __src, size_t __len,
size_t __destlen) __THROW;
extern void *__memset_chk (void *__dest, int __ch, size_t __len,
size_t __destlen) __THROW;
extern char *__strcpy_chk (char *__restrict __dest,
const char *__restrict __src,
size_t __destlen) __THROW;
extern char *__stpcpy_chk (char *__restrict __dest,
const char *__restrict __src,
size_t __destlen) __THROW;
extern char *__strncpy_chk (char *__restrict __dest,
const char *__restrict __src,
size_t __len, size_t __destlen) __THROW;
extern char *__strcat_chk (char *__restrict __dest,
const char *__restrict __src,
size_t __destlen) __THROW;
extern char *__strncat_chk (char *__restrict __dest,
const char *__restrict __src,
size_t __len, size_t __destlen) __THROW;

[alert7@FC4 glibc]$ cat test_strcpy.c
#define _FORTIFY_SOURCE 2
#include <stdio.h>

int main(int argc, char *argv[])
{

char buf[10];
char *p=buf;
strcpy(p,argv[1]);

return 0;
}

[alert7@FC4 glibc]$ gcc -O2 -o test_strcpy test_strcpy.c
[alert7@FC4 glibc]$ ./test_strcpy AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Segmentation fault (core dumped)

缓冲区溢出相关函数是不能无缝替换的.

★★ 3: 测试堆溢出相关函数

calloc, malloc, free, realloc - Allocate and free dynamic memory
在glibc 2.3.5上作了更多的安全检查,默认就会检测
1:double free
2:invalid pointer
3:memory corruption

malloc_printerr (check_action, "corrupted double-linked list", P);
malloc_printerr (check_action, "realloc(): invalid pointer", oldmem);
malloc_printerr (check_action, "malloc(): memory corruption (fast)"
malloc_printerr (check_action, "malloc(): memory corruption",
malloc_printerr (check_action, "free(): invalid pointer", mem);

导致堆溢出在glibc 2.3.5上将会变得更加难.

下面的演示程序来自backend < ptmalloc2的堆溢出利用初探 >
https://www.xfocus.net/bbs/index.php?act=ST&f=2&t=28202&page=all#entry94342

[alert7@redhat9 alert7]$gcc -o ex2 ex2.c -lbfd -liberty
[alert7@redhat9 alert7]$ ./ex2
input:D3"h`?·T????D3"????
END.
sh-2.05b$ id
uid=500(alert7) gid=500(alert7) groups=500(alert7)
在 redhat9上测试没有问题

[alert7@FC4 glibc]$ ./ex2
input:D3"ü_?·è????D3"????
*** glibc detected *** ./heapvul: free(): invalid next size (fast): 0x0962a008 ***
======= Backtrace: =========
/lib/libc.so.6[0x786424]
/lib/libc.so.6(__libc_free+0x77)[0x78695f]
./heapvul[0x80485e0]
/lib/libc.so.6(__libc_start_main+0xc6)[0x737de6]
./heapvul[0x8048431]
======= Memory map: ========
00705000-0071f000 r-xp 00000000 fd:00 715286 /lib/ld-2.3.5.so
0071f000-00720000 r-xp 00019000 fd:00 715286 /lib/ld-2.3.5.so
00720000-00721000 rwxp 0001a000 fd:00 715286 /lib/ld-2.3.5.so
00723000-00847000 r-xp 00000000 fd:00 715287 /lib/libc-2.3.5.so
00847000-00849000 r-xp 00124000 fd:00 715287 /lib/libc-2.3.5.so
00849000-0084b000 rwxp 00126000 fd:00 715287 /lib/libc-2.3.5.so
0084b000-0084d000 rwxp 0084b000 00:00 0
0090b000-00914000 r-xp 00000000 fd:00 162706 /lib/libgcc_s-4.0.0-20050520.so.1
00914000-00915000 rwxp 00009000 fd:00 162706 /lib/libgcc_s-4.0.0-20050520.so.1
00e4d000-00e4e000 r-xp 00e4d000 00:00 0
08048000-08049000 r-xp 00000000 fd:00 552827 /home/alert7/glibc/heapvul
08049000-0804a000 rw-p 00000000 fd:00 552827 /home/alert7/glibc/heapvul
0962a000-0964b000 rw-p 0962a000 00:00 0 [heap]
b7e00000-b7e21000 rw-p b7e00000 00:00 0
b7e21000-b7f00000 ---p b7e21000 00:00 0
b7fa6000-b7fa8000 rw-p b7fa6000 00:00 0
b7faf000-b7fb0000 rw-p b7faf000 00:00 0
bfc9b000-bfcb0000 rw-p bfc9b000 00:00 0 [stack]
Aborted (core dumped)
在FC4(glibc 2.3.5)上就成功不了了

★★ 4: glibc 2.3.5上的堆溢出真的没戏了吗?

期待您的大作. ^_^

也欢迎到 xfocus 的技术研究版 探讨
https://www.xfocus.net/bbs/index.php?act=SF&f=2

★★ 5: 参考
glibc 2.3.5 src