House of Force

Reading time: 4 minutes

tip

AWS ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ:HackTricks Training AWS Red Team Expert (ARTE)
GCP ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training GCP Red Team Expert (GRTE)

HackTricks ์ง€์›ํ•˜๊ธฐ

Basic Information

Code

  • ์ด ๊ธฐ์ˆ ์€ ํŒจ์น˜๋˜์—ˆ์Šต๋‹ˆ๋‹ค (์—ฌ๊ธฐ) ๊ทธ๋ฆฌ๊ณ  ์ด ์˜ค๋ฅ˜๋ฅผ ๋ฐœ์ƒ์‹œํ‚ต๋‹ˆ๋‹ค: malloc(): corrupted top size
  • ์›ํ•˜์‹ ๋‹ค๋ฉด ์—ฌ๊ธฐ์„œ ์ฝ”๋“œ๋ฅผ ์‹œ๋„ํ•ด ๋ณด์‹ค ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

Goal

  • ์ด ๊ณต๊ฒฉ์˜ ๋ชฉํ‘œ๋Š” ํŠน์ • ์ฃผ์†Œ์— ์ฒญํฌ๋ฅผ ํ• ๋‹นํ•  ์ˆ˜ ์žˆ๋Š” ๊ฒƒ์ž…๋‹ˆ๋‹ค.

Requirements

  • ์ƒ๋‹จ ์ฒญํฌ ํ—ค๋”์˜ ํฌ๊ธฐ๋ฅผ ๋ฎ์–ด์“ธ ์ˆ˜ ์žˆ๋Š” ์˜ค๋ฒ„ํ”Œ๋กœ์šฐ (์˜ˆ: -1).
  • ํž™ ํ• ๋‹น์˜ ํฌ๊ธฐ๋ฅผ ์ œ์–ดํ•  ์ˆ˜ ์žˆ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

Attack

๊ณต๊ฒฉ์ž๊ฐ€ ์ฃผ์†Œ P์— ์ฒญํฌ๋ฅผ ํ• ๋‹นํ•˜์—ฌ ์—ฌ๊ธฐ์˜ ๊ฐ’์„ ๋ฎ์–ด์“ฐ๊ณ ์ž ํ•œ๋‹ค๋ฉด, ๊ทธ๋Š” ์ƒ๋‹จ ์ฒญํฌ ํฌ๊ธฐ๋ฅผ -1๋กœ ๋ฎ์–ด์“ฐ๋Š” ๊ฒƒ์œผ๋กœ ์‹œ์ž‘ํ•ฉ๋‹ˆ๋‹ค (์•„๋งˆ๋„ ์˜ค๋ฒ„ํ”Œ๋กœ์šฐ๋ฅผ ํ†ตํ•ด). ์ด๋Š” malloc์ด ์–ด๋–ค ํ• ๋‹น์„ ์œ„ํ•ด mmap์„ ์‚ฌ์šฉํ•˜์ง€ ์•Š๋„๋ก ๋ณด์žฅํ•ฉ๋‹ˆ๋‹ค. ์ƒ๋‹จ ์ฒญํฌ๋Š” ํ•ญ์ƒ ์ถฉ๋ถ„ํ•œ ๊ณต๊ฐ„์„ ๊ฐ€์งˆ ๊ฒƒ์ž…๋‹ˆ๋‹ค.

๊ทธ๋Ÿฐ ๋‹ค์Œ, ์ƒ๋‹จ ์ฒญํฌ์˜ ์ฃผ์†Œ์™€ ํ• ๋‹นํ•  ๋Œ€์ƒ ๊ณต๊ฐ„ ์‚ฌ์ด์˜ ๊ฑฐ๋ฆฌ๋ฅผ ๊ณ„์‚ฐํ•ฉ๋‹ˆ๋‹ค. ์ด๋Š” ํ•ด๋‹น ํฌ๊ธฐ๋กœ malloc์ด ์ˆ˜ํ–‰๋˜์–ด ์ƒ๋‹จ ์ฒญํฌ๋ฅผ ๊ทธ ์œ„์น˜๋กœ ์ด๋™์‹œํ‚ค๊ธฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค. ์ด๋ ‡๊ฒŒ ํ•˜๋ฉด ์ฐจ์ด/ํฌ๊ธฐ๋ฅผ ์‰ฝ๊ฒŒ ๊ณ„์‚ฐํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค:

c
// From https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_force.c#L59C2-L67C5 /* * The evil_size is calulcated as (nb is the number of bytes requested + space for metadata): * new_top = old_top + nb * nb = new_top - old_top * req + 2sizeof(long) = new_top - old_top * req = new_top - old_top - 2sizeof(long) * req = target - 2sizeof(long) - old_top - 2sizeof(long) * req = target - old_top - 4*sizeof(long) */

๋”ฐ๋ผ์„œ target - old_top - 4*sizeof(long)์˜ ํฌ๊ธฐ๋ฅผ ํ• ๋‹นํ•˜๋ฉด(4๊ฐœ์˜ long์€ ์ƒ๋‹จ ์ฒญํฌ์˜ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ์™€ ํ• ๋‹น๋œ ์ƒˆ ์ฒญํฌ์˜ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ ๋•Œ๋ฌธ์ž…๋‹ˆ๋‹ค) ์ƒ๋‹จ ์ฒญํฌ๊ฐ€ ์šฐ๋ฆฌ๊ฐ€ ๋ฎ์–ด์“ฐ๊ณ ์ž ํ•˜๋Š” ์ฃผ์†Œ๋กœ ์ด๋™ํ•ฉ๋‹ˆ๋‹ค.
๊ทธ๋Ÿฐ ๋‹ค์Œ, ๋Œ€์ƒ ์ฃผ์†Œ์—์„œ ์ฒญํฌ๋ฅผ ์–ป๊ธฐ ์œ„ํ•ด ๋˜ ๋‹ค๋ฅธ malloc์„ ์ˆ˜ํ–‰ํ•ฉ๋‹ˆ๋‹ค.

References & Other Examples

  • https://github.com/shellphish/how2heap/tree/master
  • https://ctf-wiki.mahaloz.re/pwn/linux/glibc-heap/house_of_force/
  • https://heap-exploitation.dhavalkapil.com/attacks/house_of_force
  • https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_force.c
  • https://guyinatuxedo.github.io/41-house_of_force/house_force_exp/index.html
  • https://ctf-wiki.mahaloz.re/pwn/linux/glibc-heap/house_of_force/#hitcon-training-lab-11
  • ์ด ์‹œ๋‚˜๋ฆฌ์˜ค์˜ ๋ชฉํ‘œ๋Š” ret2win์œผ๋กœ, ret2win ํ•จ์ˆ˜์˜ ์ฃผ์†Œ์— ์˜ํ•ด ํ˜ธ์ถœ๋  ํ•จ์ˆ˜์˜ ์ฃผ์†Œ๋ฅผ ์ˆ˜์ •ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.
  • ์ด ๋ฐ”์ด๋„ˆ๋ฆฌ๋Š” ์ƒ๋‹จ ์ฒญํฌ ํฌ๊ธฐ๋ฅผ ์ˆ˜์ •ํ•  ์ˆ˜ ์žˆ๋Š” ์˜ค๋ฒ„ํ”Œ๋กœ์šฐ๊ฐ€ ์žˆ์œผ๋ฉฐ, ์ด๋Š” -1 ๋˜๋Š” p64(0xffffffffffffffff)๋กœ ์ˆ˜์ •๋ฉ๋‹ˆ๋‹ค.
  • ๊ทธ๋Ÿฐ ๋‹ค์Œ, ๋ฎ์–ด์“ธ ํฌ์ธํ„ฐ๊ฐ€ ์กด์žฌํ•˜๋Š” ์œ„์น˜์˜ ์ฃผ์†Œ๋ฅผ ๊ณ„์‚ฐํ•˜๊ณ , ํ˜„์žฌ ์ƒ๋‹จ ์ฒญํฌ์˜ ์œ„์น˜์—์„œ ๊ทธ๊ณณ๊นŒ์ง€์˜ ์ฐจ์ด๋ฅผ malloc์œผ๋กœ ํ• ๋‹นํ•ฉ๋‹ˆ๋‹ค.
  • ๋งˆ์ง€๋ง‰์œผ๋กœ, ์ด ์›ํ•˜๋Š” ๋Œ€์ƒ์„ ํฌํ•จํ•  ์ƒˆ ์ฒญํฌ๊ฐ€ ํ• ๋‹น๋˜๋ฉฐ, ์ด๋Š” ret2win ํ•จ์ˆ˜์— ์˜ํ•ด ๋ฎ์–ด์”Œ์›Œ์ง‘๋‹ˆ๋‹ค.
  • https://shift--crops-hatenablog-com.translate.goog/entry/2016/03/21/171249?_x_tr_sl=es&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp
  • Input your name:์—๋Š” ํž™์—์„œ ์ฃผ์†Œ๋ฅผ ๋ˆ„์ถœํ•  ์ˆ˜ ์žˆ๋Š” ์ดˆ๊ธฐ ์ทจ์•ฝ์ ์ด ์žˆ์Šต๋‹ˆ๋‹ค.
  • ๊ทธ๋Ÿฐ ๋‹ค์Œ Org: ๋ฐ Host: ๊ธฐ๋Šฅ์—์„œ org name์„ ์š”์ฒญํ•  ๋•Œ s ํฌ์ธํ„ฐ์˜ 64B๋ฅผ ์ฑ„์šธ ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์Šคํƒ์—์„œ ์ด๋Š” v2์˜ ์ฃผ์†Œ ๋’ค์— ์œ„์น˜ํ•˜๊ณ , ๊ทธ ๋’ค์—๋Š” ์ง€์ •๋œ host name์ด ์˜ต๋‹ˆ๋‹ค. ๊ทธ๋Ÿฐ ๋‹ค์Œ, strcpy๊ฐ€ s์˜ ๋‚ด์šฉ์„ 64B ํฌ๊ธฐ์˜ ์ฒญํฌ์— ๋ณต์‚ฌํ•˜๋ฏ€๋กœ, host name์— ๋„ฃ์€ ๋ฐ์ดํ„ฐ๋กœ ์ƒ๋‹จ ์ฒญํฌ์˜ ํฌ๊ธฐ๋ฅผ ๋ฎ์–ด์“ธ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.
  • ์ด์ œ ์ž„์˜์˜ ์“ฐ๊ธฐ๊ฐ€ ๊ฐ€๋Šฅํ•ด์ง€๋ฉด, atoi์˜ GOT๊ฐ€ printf์˜ ์ฃผ์†Œ๋กœ ๋ฎ์–ด์”Œ์›Œ์กŒ์Šต๋‹ˆ๋‹ค. ๊ทธ ํ›„ %24$p๋กœ IO_2_1_stderr์˜ ์ฃผ์†Œ๋ฅผ ๋ˆ„์ถœํ•  ์ˆ˜ ์žˆ์—ˆ์Šต๋‹ˆ๋‹ค. ์ด libc ๋ˆ„์ถœ๋กœ ์ธํ•ด ๋‹ค์‹œ atoi์˜ GOT๋ฅผ system์˜ ์ฃผ์†Œ๋กœ ๋ฎ์–ด์“ฐ๊ณ  /bin/sh๋ฅผ ๋งค๊ฐœ๋ณ€์ˆ˜๋กœ ์ „๋‹ฌํ•˜์—ฌ ํ˜ธ์ถœํ•  ์ˆ˜ ์žˆ์—ˆ์Šต๋‹ˆ๋‹ค.
  • ์ด ๋‹ค๋ฅธ ๊ธ€์—์„œ ์ œ์•ˆ๋œ ๋Œ€์•ˆ ๋ฐฉ๋ฒ•์€ free๋ฅผ puts๋กœ ๋ฎ์–ด์“ฐ๊ณ , ๋‚˜์ค‘์— ํ•ด์ œ๋  ํฌ์ธํ„ฐ์— atoi@got์˜ ์ฃผ์†Œ๋ฅผ ์ถ”๊ฐ€ํ•˜์—ฌ ๋ˆ„์ถœ๋˜๋„๋ก ํ•œ ๋‹ค์Œ, ์ด ๋ˆ„์ถœ๋กœ ๋‹ค์‹œ atoi@got๋ฅผ system์œผ๋กœ ๋ฎ์–ด์“ฐ๊ณ  /bin/sh๋กœ ํ˜ธ์ถœํ•˜๋Š” ๊ฒƒ์ž…๋‹ˆ๋‹ค.
  • https://guyinatuxedo.github.io/41-house_of_force/bkp16_cookbook/index.html
  • ํฌ์ธํ„ฐ๋ฅผ ์ง€์šฐ์ง€ ์•Š๊ณ  ํ•ด์ œ๋œ ์ฒญํฌ๋ฅผ ์žฌ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š” UAF๊ฐ€ ์žˆ์Šต๋‹ˆ๋‹ค. ์ผ๋ถ€ ์ฝ๊ธฐ ๋ฉ”์„œ๋“œ๊ฐ€ ์žˆ๊ธฐ ๋•Œ๋ฌธ์—, ์—ฌ๊ธฐ์—์„œ GOT์— free ํ•จ์ˆ˜์— ๋Œ€ํ•œ ํฌ์ธํ„ฐ๋ฅผ ์ž‘์„ฑํ•˜์—ฌ libc ์ฃผ์†Œ๋ฅผ ๋ˆ„์ถœํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๊ทธ๋Ÿฐ ๋‹ค์Œ ์ฝ๊ธฐ ํ•จ์ˆ˜๋ฅผ ํ˜ธ์ถœํ•ฉ๋‹ˆ๋‹ค.
  • ๊ทธ๋Ÿฐ ๋‹ค์Œ, House of force๊ฐ€ ์‚ฌ์šฉ๋˜์–ด(UAF๋ฅผ ์•…์šฉํ•˜์—ฌ) ๋‚จ์€ ๊ณต๊ฐ„์˜ ํฌ๊ธฐ๋ฅผ -1๋กœ ๋ฎ์–ด์“ฐ๊ณ , free hook์— ๋„๋‹ฌํ•  ์ˆ˜ ์žˆ์„ ๋งŒํผ ํฐ ์ฒญํฌ๋ฅผ ํ• ๋‹นํ•œ ๋‹ค์Œ, free hook์„ ํฌํ•จํ•  ๋˜ ๋‹ค๋ฅธ ์ฒญํฌ๋ฅผ ํ• ๋‹นํ•ฉ๋‹ˆ๋‹ค. ๊ทธ๋Ÿฐ ๋‹ค์Œ, hook์— system์˜ ์ฃผ์†Œ๋ฅผ ์ž‘์„ฑํ•˜๊ณ , ์ฒญํฌ์— "/bin/sh"๋ฅผ ์ž‘์„ฑํ•œ ํ›„, ํ•ด๋‹น ๋ฌธ์ž์—ด ๋‚ด์šฉ์„ ๊ฐ€์ง„ ์ฒญํฌ๋ฅผ ํ•ด์ œํ•ฉ๋‹ˆ๋‹ค.

tip

AWS ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ:HackTricks Training AWS Red Team Expert (ARTE)
GCP ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training GCP Red Team Expert (GRTE)

HackTricks ์ง€์›ํ•˜๊ธฐ