HackTricks Press
Search K

Appearance

Off by one overflow ​

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

Basic Information ​

Having just access to a 1B overflow allows an attacker to modify the pre_in_use bit from the next chunk and as the current chunk won't be in use, the end of the chunk becomes the previous chunk size metadata information.
This allows to tamper which chunks are actually freed, potentially generating a chunk that contains another legit chunk.

There are 2 types of off by one vulnerabilities:

  • Arbitrary byte: This kind allows to overwrite that byte with any value
  • Null off by one: This kind allows to overwrite that byte only with 0x00
    • A common example of this vulnerability can be seen in the following code where the behavior of strlen and strcpy is inconsistent, which allows set a 0x00 byte in the beginning of the next chunk.
Null off by one
c
// From https://ctf-wiki.mahaloz.re/pwn/linux/glibc-heap/off_by_one/
int main(void)
{
    char buffer[40]="";
    void *chunk1;
    chunk1 = malloc(24);
    puts("Get Input");
    gets(buffer);
    if(strlen(buffer)==24)
    {
        strcpy(chunk1,buffer);
    }
    return 0;
}

Among other checks, now whenever a chunk is free the previous size is compared with the size configured in the metadata's chunk, making this attack fairly complex from version 2.28.

Code Example: ​

Goal ​

  • Make a chunk be contained inside another chunk so writing access over that second chunk allows to overwrite the contained one

Requirements ​

  • Off by one overflow to modify the previous size metadata information

Attack ​

  • 3 chunks of memory (a, b, c) are reserved one after the other. Then the middle one is freed. The first one contains an off by one overflow vulnerability and the attacker abuses it with a 0x00 (if the previous byte was 0x10 it would make he middle chunk indicate that it’s 0x10 smaller than it really is).
  • Then, 2 more smaller chunks are allocated in the middle freed chunk (b), however, as b + b->size never updates the c chunk because the pointed address is smaller than it should.
  • Then, b1 and c gets freed. As c - c->prev_size still points to b (b1 now), both are consolidated in one chunk. However, b2 is still inside in between b1 and c.
  • Finally, a new malloc is performed reclaiming this memory area which is actually going to contain b2, allowing the owner of the new malloc to control the content of b2.

This image explains perfectly the attack:

https://heap-exploitation.dhavalkapil.com/attacks/shrinking_free_chunks

Other Examples & References ​

  • https://heap-exploitation.dhavalkapil.com/attacks/shrinking_free_chunks
  • Asis CTF 2016 b00ks
    • It's possible to abuse an off by one to leak an address from the heap because the byte 0x00 of the end of a string being overwritten by the next field.
    • Arbitrary write is obtained by abusing the off by one write to make the pointer point to another place were a fake struct with fake pointers will be built. Then, it's possible to follow the pointer of this struct to obtain arbitrary write.
    • The libc address is leaked because if the heap is extended using mmap, the memory allocated by mmap has a fixed offset from libc.
    • Finally the arbitrary write is abused to write into the address of __free_hook with a one gadget.
  • plaidctf 2015 plaiddb
    • There is a NULL off by one vulnerability in the getline function that reads user input lines. This function is used to read the "key" of the content and not the content.
    • In the writeup 5 initial chunks are created:
      • chunk1 (0x200)
      • chunk2 (0x50)
      • chunk5 (0x68)
      • chunk3 (0x1f8)
      • chunk4 (0xf0)
      • chunk defense (0x400) to avoid consolidating with top chunk
    • Then chunk 1, 5 and 3 are freed, so:
      • python
        [ 0x200 Chunk 1 (free) ] [ 0x50 Chunk 2 ] [ 0x68 Chunk 5 (free) ] [ 0x1f8 Chunk 3 (free) ] [ 0xf0 Chunk 4 ] [ 0x400 Chunk defense ]
    • Then abusing chunk3 (0x1f8) the null off-by-one is abused writing the prev_size to 0x4e0.
      • Note how the sizes of the initially allocated chunks1, 2, 5 and 3 plus the headers of 4 of those chunks equals to 0x4e0: hex(0x1f8 + 0x10 + 0x68 + 0x10 + 0x50 + 0x10 + 0x200) = 0x4e0
    • Then, chunk 4 is freed, generating a chunk that consumes all the chunks till the beginning:
      • python
        [ 0x4e0 Chunk 1-2-5-3 (free) ] [ 0xf0 Chunk 4 (corrupted) ] [ 0x400 Chunk defense ]
      • python
        [ 0x200 Chunk 1 (free) ] [ 0x50 Chunk 2 ] [ 0x68 Chunk 5 (free) ] [ 0x1f8 Chunk 3 (free) ] [ 0xf0 Chunk 4 ] [ 0x400 Chunk defense ]
    • Then, 0x200 bytes are allocated filling the original chunk 1
      • And another 0x200 bytes are allocated and chunk2 is destroyed and therefore there isn't no fucking leak and this doesn't work? Maybe this shouldn't be done
    • Then, it allocates another chunk with 0x58 "a"s (overwriting chunk2 and reaching chunk5) and modifies the fd of the fast bin chunk of chunk5 pointing it to __malloc_hook
    • Then, a chunk of 0x68 is allocated so the fake fast bin chunk in __malloc_hook is the following fast bin chunk
    • Finally, a new fast bin chunk of 0x68 is allocated and __malloc_hook is overwritten with a one_gadget address
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: