hacktricks/binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc_hook.md

# WWW2Exec - \_\_malloc\_hook & \_\_free\_hook

{% hint style="success" %}
Jifunze na zoezi la Kuvamia AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Jifunze na zoezi la Kuvamia GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>unga mkono HackTricks</summary>

* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

## **Malloc Hook**

Kama unavyoweza [Tovuti Rasmi ya GNU](https://www.gnu.org/software/libc/manual/html\_node/Hooks-for-Malloc.html), kipengele **`__malloc_hook`** ni kipande kinachoelekeza kwenye **anwani ya kazi itakayoitwa** wakati wowote `malloc()` inaitwa **imehifadhiwa kwenye sehemu ya data ya maktaba ya libc**. Kwa hivyo, ikiwa anwani hii itabadilishwa na **One Gadget** kwa mfano na `malloc` inaitwa, **One Gadget itaitwa**.

Kuita malloc inawezekana kusubiri programu iite au kwa **kuita `printf("%10000$c")`** ambayo inaendelea kuchukua nafasi nyingi kufanya `libc` iite malloc kuzitenga kwenye rundo.

Maelezo zaidi kuhusu One Gadget katika:

{% content-ref url="../rop-return-oriented-programing/ret2lib/one-gadget.md" %}
[one-gadget.md](../rop-return-oriented-programing/ret2lib/one-gadget.md)
{% endcontent-ref %}

{% hint style="warning" %}
Tafadhali elewa kwamba vitanzi vime **lemazwa kwa GLIBC >= 2.34**. Kuna njia nyingine ambazo zinaweza kutumika kwenye toleo za kisasa za GLIBC. Angalia: [https://github.com/nobodyisnobody/docs/blob/main/code.execution.on.last.libc/README.md](https://github.com/nobodyisnobody/docs/blob/main/code.execution.on.last.libc/README.md).
{% endhint %}

## Free Hook

Hii ilidhulumiwa katika moja ya mfano kutoka kwenye ukurasa ukidhulumu shambulio la rundo la haraka baada ya kudhulumiwa shambulio la rundo lisilo na mpangilio:

{% content-ref url="../libc-heap/unsorted-bin-attack.md" %}
[unsorted-bin-attack.md](../libc-heap/unsorted-bin-attack.md)
{% endcontent-ref %}

Inawezekana kupata anwani ya `__free_hook` ikiwa binary ina alama na amri ifuatayo:
```bash
gef➤  p &__free_hook
```
[Katika chapisho](https://guyinatuxedo.github.io/41-house\_of\_force/bkp16\_cookbook/index.html) unaweza kupata mwongozo wa hatua kwa hatua juu ya jinsi ya kutambua anwani ya kitanzi cha bure bila alama. Kwa muhtasari, katika kazi ya bure:

<pre class="language-armasm"><code class="lang-armasm">gef➤  x/20i free
0xf75dedc0 &#x3C;free>: push   ebx
0xf75dedc1 &#x3C;free+1>: call   0xf768f625
0xf75dedc6 &#x3C;free+6>: add    ebx,0x14323a
0xf75dedcc &#x3C;free+12>:  sub    esp,0x8
0xf75dedcf &#x3C;free+15>:  mov    eax,DWORD PTR [ebx-0x98]
0xf75dedd5 &#x3C;free+21>:  mov    ecx,DWORD PTR [esp+0x10]
<strong>0xf75dedd9 &#x3C;free+25>:  mov    eax,DWORD PTR [eax]--- VUNJA HAPA
</strong>0xf75deddb &#x3C;free+27>:  test   eax,eax ;&#x3C;
0xf75deddd &#x3C;free+29>:  jne    0xf75dee50 &#x3C;free+144>
</code></pre>

Katika kuvunja iliyotajwa katika msimbo uliopita katika `$eax` kutakuwa na anwani ya kitanzi cha bure.

Sasa shambulio la **bendi ya haraka** linatekelezwa:

* Kwanza kabisa inagundulika kuwa ni rahisi kufanya kazi na vipande vya haraka vya **ukubwa wa 200** katika eneo la **`__free_hook`**:
* <pre class="language-c"><code class="lang-c">gef➤  p &#x26;__free_hook
$1 = (void (**)(void *, const void *)) 0x7ff1e9e607a8 &#x3C;__free_hook>
gef➤  x/60gx 0x7ff1e9e607a8 - 0x59
<strong>0x7ff1e9e6074f: 0x0000000000000000      0x0000000000000200
</strong>0x7ff1e9e6075f: 0x0000000000000000      0x0000000000000000
0x7ff1e9e6076f &#x3C;list_all_lock+15>:      0x0000000000000000      0x0000000000000000
0x7ff1e9e6077f &#x3C;_IO_stdfile_2_lock+15>: 0x0000000000000000      0x0000000000000000
</code></pre>
* Ikiwa tunaweza kupata kipande cha haraka cha ukubwa wa 0x200 katika eneo hili, itawezekana kubadilisha kidole cha kazi ambacho kitatekelezwa
* Kwa hili, kipande kipya cha ukubwa wa `0xfc` kinajengwa na kuitwa kazi iliyochanganywa mara mbili na kidole hicho, njia hii tunapata kidole kwa kipande kilichofutwa cha ukubwa wa `0xfc*2 = 0x1f8` katika bendi ya haraka.
* Kisha, kazi ya hariri inaitwa kwenye kipande hiki kurekebisha anwani ya **`fd`** ya bendi hii ya haraka ili ielekee kwenye kazi ya awali ya **`__free_hook`**.
* Kisha, kipande cha ukubwa wa `0x1f8` kinajengwa ili kurejesha kutoka kwa bendi ya haraka kipande kisichofaa cha awali hivyo kipande kingine cha ukubwa wa `0x1f8` kinajengwa ili kupata kipande cha bendi ya haraka katika **`__free_hook`** ambayo inabadilishwa na anwani ya kazi ya **`system`**.
* Na mwishowe kipande kinachohifadhi string `/bin/sh\x00` kinawekwa huru kwa kuita kazi ya kufuta, kuzindua kazi ya **`__free_hook`** ambayo inaelekeza kwa mfumo na `/bin/sh\x00` kama parameter.

## Marejeo

* [https://ir0nstone.gitbook.io/notes/types/stack/one-gadgets-and-malloc-hook](https://ir0nstone.gitbook.io/notes/types/stack/one-gadgets-and-malloc-hook)
* [https://github.com/nobodyisnobody/docs/blob/main/code.execution.on.last.libc/README.md](https://github.com/nobodyisnobody/docs/blob/main/code.execution.on.last.libc/README.md).