使用 Glibc 2.12.1 进行堆利用
我一直在寻找没有好的结果。
我想知道文本中解释的 Malloc Maleficarum 或 Malloc Des-Malleficarum 技术在 glibc 版本 2.12.1 中是否有效。
在第二个提到的文本中，据说这些技术在 glibc 版本 2.7 和 2.8 中进行了测试，所以我真的不知道它们是否适用于我的 glibc 版本。当然我可以测试它们，但是，首先，只有他们自己的技术确实很困难，另一方面，如果它们不起作用，我不知道是因为 glibc 版本还是我的错。
此外，我还没有发现任何实际的堆利用。而且，我也找不到通过这些 glibc 版本实现的更改。
提前致谢。
I've been searching with no good results.
I wonder if the techniques explained in texts as Malloc Maleficarum or Malloc Des-Malleficarum are effective in glibc version 2.12.1.
In the second mentioned text is said that the techniques are tested in glibc version 2.7 and 2.8, so I don't really know if they will work with my glibc version. Of course I could test them, but, first, only by their own the techniques are really difficult and, on the other hand, if they don't work I wouldn't know if it would be because of the glibc version or my fault.
Moreover, I haven't found any actual heap exploit. And, also, I couldn't find the changes implemented through these glibc versions.
Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
与我关于这个主题的其他问题一样，鉴于没有人回答，我会回答它，以防万一它对某人有用。
首先要说的是，现在 Malloc Maleficarum 的技术已经被修补了。例如，House of Mind 在 glibc 2.11 中打了补丁，所以现在它们没有用了。
但最重要的是，MM中的大部分技术都需要在堆中放置一个缓冲区的地址，因此这些技术在激活了aslr的系统中完全没有用处（全部？），除非你能找到一个内存泄漏。但更重要的是，如果您能够知道该缓冲区地址，则不需要任何 MM 技术，您可以使用旧的取消链接技术（带有一些技巧）。
另一方面，我只发现了一个使用 MM（心灵之家）中解释的技术之一的漏洞。我还没有测试过，所以请自己尝试一下[1]。
另外要说的是，在做了一些研究后，我认为 MM 是一份令人兴奋的文档，但在实践中，其中解释的技术很难应用于实际案例。它们有太多的必要条件，如果您满足了其中一些要求，您就可以返回到取消链接技术并忘记所有让 MM 头疼的问题。
PS：当我将自己的答案设置为正确时，我感觉很肮脏......
[1] https ://sites.google.com/site/felipeandresmanzano/popplerPOC.tar.bz2
As with my other questions about this topic, given that nobody have answered, I will answer it just in case it will be useful for someone.
The first thing to say is that nowadays there are techniques of the Malloc Maleficarum that are already patched. For example, the House of Mind was patched in the glibc 2.11 so nowadays they are of no use.
But the most important thing is that in the majority of the techniques in the MM, you need the address of one buffer placed in the heap, therefore those techniques are completely useless in systems with aslr activated (all?), unless you can find a memory leak. But much more important is that if you are able to know that buffer address, you don't need any of the MM techniques, you can use the oldy unlink technique (with some tricks).
On the other hand, I've only found one exploit using one of the techniques explained in the MM (the house of mind). I haven't tested it, so try it at your own [1].
Another thing to be said, as my opinion after doing some research, MM was a mind blowing document, but in practice, the techniques explained on it a really difficult to apply in a real case. They have too many requisites and if you fulfill some of them, you can return to the unlink technique and forget about all the MM headaches.
P.S.: I feel dirty when setting my own answers as correct...
[1] https://sites.google.com/site/felipeandresmanzano/popplerPOC.tar.bz2