Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 20:53:37 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/binary-exploitation/libc-heap/bins-and-memory-allocations.md

615 lines
36 KiB
Markdown
Raw Normal View History

Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
# Bins & Aloakcije memorije
<details>
<summary><strong>Naučite hakovanje AWS-a od nule do heroja sa</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
Drugi načini podrške HackTricks-u:
* Ako želite da vidite svoju **kompaniju reklamiranu na HackTricks-u** ili da **preuzmete HackTricks u PDF formatu** proverite [**PLANOVE ZA PRIJAVU**](https://github.com/sponsors/carlospolop)!
* Nabavite [**zvanični PEASS & HackTricks swag**](https://peass.creator-spring.com)
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
* Otkrijte [**Porodičnu PEASS**](https://opensea.io/collection/the-peass-family), našu kolekciju ekskluzivnih [**NFT-ova**](https://opensea.io/collection/the-peass-family)
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
* **Pridružite se** 💬 [**Discord grupi**](https://discord.gg/hRep4RUj7f) ili [**telegram grupi**](https://t.me/peass) ili nas **pratite** na **Twitteru** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Podelite svoje hakovanje trikove slanjem PR-ova na** [**HackTricks**](https://github.com/carlospolop/hacktricks) i [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repozitorijume.
</details>
## Osnovne informacije
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Da bi se poboljšala efikasnost načina na koji su čunjevi smešteni, svaki čunj nije samo u jednoj povezanoj listi, već postoji nekoliko tipova. To su čunjevi i postoji 5 vrsta čunjeva: [62](https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=blob;f=malloc/malloc.c;h=6e766d11bc85b6480fa5c9f2a76559f8acf9deb5;hb=HEAD#l1407) mali čunjevi, 63 velika čunja, 1 nesortirani čunj, 10 brzih čunjeva i 64 tcache čunja po niti.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Početna adresa za svaki nesortirani, mali i veliki čunj je unutar istog niza. Indeks 0 nije korišćen, 1 je nesortirani čunj, čunjevi 2-64 su mali čunjevi, a čunjevi 65-127 su veliki čunjevi.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
### Tcache (Keš po niti) Čunjevi
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Iako niti pokušavaju da imaju svoj sopstveni hip (videti [Arenas](bins-and-memory-allocations.md#arenas) i [Subheaps](bins-and-memory-allocations.md#subheaps)), postoji mogućnost da će proces sa puno niti (kao što je veb server) **završiti deljenjem hipa sa drugim nitima**. U ovom slučaju, glavno rešenje je korišćenje **brava**, koje mogu **znatno usporiti niti**.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Stoga, tcache je sličan brzom čunju po niti na način da je to **jednostruko povezana lista** koja ne spaja čunjeve. Svaka nit ima **64 jednostruko povezana tcache čunja**. Svaki čunj može imati maksimalno [7 čunjeva iste veličine](https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;h=2527e2504761744df2bdb1abdc02d936ff907ad2;hb=d5c3fafc4307c9b7a4c7d5cb381fcdbfad340bcc#l323) u rasponu od [24 do 1032B na 64-bitnim sistemima i 12 do 516B na 32-bitnim sistemima](https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;h=2527e2504761744df2bdb1abdc02d936ff907ad2;hb=d5c3fafc4307c9b7a4c7d5cb381fcdbfad340bcc#l315).
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Kada nit oslobodi čunj, ako nije prevelik da bi bio alociran u tcache i odgovarajući tcache čunj **nije pun** (već 7 čunjeva), **biće alociran tamo**. Ako ne može ići u tcache, moraće da sačeka da se hip zaključa kako bi mogao da izvrši globalnu operaciju oslobađanja.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Kada se **čunj alocira**, ako postoji slobodan čunj potrebne veličine u **Tcache-u, koristiće ga**, ako ne, moraće da sačeka da se hip zaključa kako bi mogao da pronađe jedan u globalnim čunjevima ili da napravi novi.\
Postoji i optimizacija, u ovom slučaju, dok ima zaključan hip, nit **će popuniti svoj Tcache hip čunjevima (7) tražene veličine**, tako da u slučaju potrebe za više njih, moći će da ih pronađe u Tcache-u.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
<details>
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
<summary>Dodaj primer tcache čunja</summary>
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
```c
#include <stdlib.h>
#include <stdio.h>
int main(void)
{
char *chunk;
chunk = malloc(24);
printf("Address of the chunk: %p\n", (void *)chunk);
gets(chunk);
free(chunk);
return 0;
}
```
Kompajlirajte ga i debagujte sa prekidnom tačkom u ret opcode-u iz glavne funkcije. Zatim, pomoću gef-a možete videti tcache bin u upotrebi:
```bash
gef➤ heap bins
──────────────────────────────────────────────────────────────────────────────── Tcachebins for thread 1 ────────────────────────────────────────────────────────────────────────────────
Tcachebins[idx=0, size=0x20, count=1] ← Chunk(addr=0xaaaaaaac12a0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
```
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
#### Strukture i funkcije Tcache
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
U sledećem kodu je moguće videti **maksimalne binove** i **delove po indeksu**, **`tcache_entry`** strukturu kreiranu da bi se izbeglo duplo oslobađanje i **`tcache_perthread_struct`**, strukturu koju svaka nit koristi da bi sačuvala adrese za svaki indeks bin-a.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
```c
// From https://github.com/bminor/glibc/blob/f942a732d37a96217ef828116ebe64a644db18d7/malloc/malloc.c
/* We want 64 entries. This is an arbitrary limit, which tunables can reduce. */
# define TCACHE_MAX_BINS 64
# define MAX_TCACHE_SIZE tidx2usize (TCACHE_MAX_BINS-1)
/* Only used to pre-fill the tunables. */
# define tidx2usize(idx) (((size_t) idx) * MALLOC_ALIGNMENT + MINSIZE - SIZE_SZ)
/* When "x" is from chunksize(). */
# define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)
/* When "x" is a user-provided size. */
# define usize2tidx(x) csize2tidx (request2size (x))
/* With rounding and alignment, the bins are...
idx 0 bytes 0..24 (64-bit) or 0..12 (32-bit)
idx 1 bytes 25..40 or 13..20
idx 2 bytes 41..56 or 21..28
etc. */
/* This is another arbitrary limit, which tunables can change. Each
tcache bin will hold at most this number of chunks. */
# define TCACHE_FILL_COUNT 7
/* Maximum chunks in tcache bins for tunables. This value must fit the range
of tcache->counts[] entries, else they may overflow. */
# define MAX_TCACHE_COUNT UINT16_MAX
[...]
typedef struct tcache_entry
{
struct tcache_entry *next;
/* This field exists to detect double frees. */
uintptr_t key;
} tcache_entry;
/* There is one of these for each thread, which contains the
per-thread cache (hence "tcache_perthread_struct"). Keeping
overall size low is mildly important. Note that COUNTS and ENTRIES
are redundant (we could have just counted the linked list each
time), this is for performance reasons. */
typedef struct tcache_perthread_struct
{
uint16_t counts[TCACHE_MAX_BINS];
tcache_entry *entries[TCACHE_MAX_BINS];
} tcache_perthread_struct;
```
</details>
Funkcija `__tcache_init` je funkcija koja kreira i alocira prostor za objekat `tcache_perthread_struct`
```c
// From https://github.com/bminor/glibc/blob/f942a732d37a96217ef828116ebe64a644db18d7/malloc/malloc.c#L3241C1-L3274C2
static void
tcache_init(void)
{
mstate ar_ptr;
void *victim = 0;
const size_t bytes = sizeof (tcache_perthread_struct);
if (tcache_shutting_down)
return;
arena_get (ar_ptr, bytes);
victim = _int_malloc (ar_ptr, bytes);
if (!victim && ar_ptr != NULL)
{
ar_ptr = arena_get_retry (ar_ptr, bytes);
victim = _int_malloc (ar_ptr, bytes);
}
if (ar_ptr != NULL)
__libc_lock_unlock (ar_ptr->mutex);
/* In a low memory situation, we may not be able to allocate memory
- in which case, we just keep trying later. However, we
typically do this very early, so either there is sufficient
memory, or there isn't enough memory to do non-trivial
allocations anyway. */
if (victim)
{
tcache = (tcache_perthread_struct *) victim;
memset (tcache, 0, sizeof (tcache_perthread_struct));
}
}
```
</details>
#### Tcache Indeksi
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Tcache ima nekoliko binova u zavisnosti od veličine, a početni pokazivači na **prvi blok svakog indeksa i količina blokova po indeksu se nalaze unutar bloka**. To znači da je moguće pronaći sve početne tačke tcache-a i količinu Tcache blokova lociranjem bloka sa ovim informacijama (obično prvi).
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
### Brzi binovi
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Brzi binovi su dizajnirani da **ubrzaju dodelu memorije za male blokove** čuvanjem nedavno oslobođenih blokova u strukturi sa brzim pristupom. Ovi binovi koriste pristup poslednji unutra, prvi napolje (LIFO) pristup, što znači da je **najskorije oslobođeni blok prvi** koji će biti ponovo korišćen kada postoji nova zahtev za alokacijom. Ovo ponašanje je korisno za brzinu, jer je brže ubaciti i ukloniti sa vrha steka (LIFO) u poređenju sa redom (FIFO).
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Dodatno, **brzi binovi koriste jednostruko povezane liste**, a ne dvostruko povezane, što dodatno poboljšava brzinu. Pošto se blokovi u brzim binovima ne spajaju sa susedima, nema potrebe za složenom strukturom koja omogućava uklanjanje iz sredine. Jednostruko povezana lista je jednostavnija i brža za ove operacije.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
U osnovi, ono što se dešava ovde je da je zaglavlje (pokazivač na prvi blok koji treba proveriti) uvek usmereno ka poslednjem oslobođenom bloku te veličine. Dakle:
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
* Kada se alocira novi blok te veličine, zaglavlje pokazuje na slobodan blok za korišćenje. Pošto ovaj slobodan blok pokazuje na sledeći koji treba koristiti, ova adresa je sačuvana u zaglavlju tako da sledeća alokacija zna gde da dobije dostupan blok
* Kada se blok oslobodi, slobodan blok će sačuvati adresu trenutno dostupnog bloka i adresa ovog novootvorenog bloka će biti stavljena u zaglavlje
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Maksimalna veličina povezane liste je `0x80` i organizovane su tako da će blok veličine `0x20` biti u indeksu `0`, blok veličine `0x30` biće u indeksu `1`...
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
{% hint style="danger" %}
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Blokovi u brzim binovima nisu označeni kao dostupni tako da se čuvaju kao blokovi brzih binova neko vreme umesto što bi mogli da se spoje sa drugim slobodnim blokovima koji ih okružuju.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
{% endhint %}
```c
// From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711
/*
Fastbins
An array of lists holding recently freed small chunks. Fastbins
are not doubly linked. It is faster to single-link them, and
since chunks are never removed from the middles of these lists,
double linking is not necessary. Also, unlike regular bins, they
are not even processed in FIFO order (they use faster LIFO) since
ordering doesn't much matter in the transient contexts in which
fastbins are normally used.
Chunks in fastbins keep their inuse bit set, so they cannot
be consolidated with other free chunks. malloc_consolidate
releases all chunks in fastbins and consolidates them with
other free chunks.
*/
typedef struct malloc_chunk *mfastbinptr;
#define fastbin(ar_ptr, idx) ((ar_ptr)->fastbinsY[idx])
/* offset 2 to use otherwise unindexable first 2 bins */
#define fastbin_index(sz) \
((((unsigned int) (sz)) >> (SIZE_SZ == 8 ? 4 : 3)) - 2)
/* The maximum fastbin request size we support */
#define MAX_FAST_SIZE (80 * SIZE_SZ / 4)
#define NFASTBINS (fastbin_index (request2size (MAX_FAST_SIZE)) + 1)
```
<detalji>
<sumiraj>Dodajte primer brze binarne čestice</sumiraj>
```c
#include <stdlib.h>
#include <stdio.h>
int main(void)
{
char *chunks[8];
int i;
// Loop to allocate memory 8 times
for (i = 0; i < 8; i++) {
chunks[i] = malloc(24);
if (chunks[i] == NULL) { // Check if malloc failed
fprintf(stderr, "Memory allocation failed at iteration %d\n", i);
return 1;
}
printf("Address of chunk %d: %p\n", i, (void *)chunks[i]);
}
// Loop to free the allocated memory
for (i = 0; i < 8; i++) {
free(chunks[i]);
}
return 0;
}
```
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Primetite kako alociramo i oslobađamo 8 blokova iste veličine tako da popunjavaju tcache, a osmi je smešten u brzom bloku.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Kompajlirajte i debagujte sa prekidnom tačkom u `ret` opcode-u iz `main` funkcije. Zatim, pomoću `gef` alata možete videti da je tcache bin pun i da je jedan blok u brzom binu:
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
```bash
gef➤ heap bins
──────────────────────────────────────────────────────────────────────────────── Tcachebins for thread 1 ────────────────────────────────────────────────────────────────────────────────
Tcachebins[idx=0, size=0x20, count=7] ← Chunk(addr=0xaaaaaaac1770, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac1750, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac1730, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac1710, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac16f0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac16d0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac12a0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
───────────────────────────────────────────────────────────────────────── Fastbins for arena at 0xfffff7f90b00 ─────────────────────────────────────────────────────────────────────────
Fastbins[idx=0, size=0x20] ← Chunk(addr=0xaaaaaaac1790, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
Fastbins[idx=1, size=0x30] 0x00
```
### Neuređena kanta
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Neuređena kanta je **keš** koji koristi menadžer hipa kako bi ubrzao dodelu memorije. Evo kako funkcioniše: Kada program oslobodi komad, i ako taj komad ne može biti dodeljen u tcache ili brzoj kanti i ne sudara se sa vršnom kantom, menadžer hipa ga ne stavlja odmah u određenu malu ili veliku kantu. Umesto toga, prvo pokušava da ga **spoji sa bilo kojim susednim slobodnim komadima** kako bi stvorio veći blok slobodne memorije. Zatim, smešta ovaj novi komad u opštu kantu nazvanu "neuređena kanta."
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Kada program **zatraži memoriju**, menadžer hipa **proverava neuređenu kantu** da vidi da li postoji dovoljno veliki komad. Ako pronađe jedan, odmah ga koristi. Ako ne pronađe odgovarajući komad u neuređenoj kanti, premestiće sve komade sa ove liste u njihove odgovarajuće kante, bilo male ili velike, na osnovu njihove veličine.
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Imajte na umu da ako se veći komad podeli na 2 polovine i ako je preostali deo veći od MINSIZE, biće vraćen nazad u neuređenu kantu.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Dakle, neuređena kanta je način da se ubrza dodela memorije brzim ponovnim korišćenjem nedavno oslobođene memorije i smanjenjem potrebe za dugotrajnim pretragama i spajanjima.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
{% hint style="danger" %}
Imajte na umu da čak i ako su komadi različitih kategorija, ako dostupan komad sudara sa drugim dostupnim komadom (čak i ako su originalno pripadali različitim kantama), biće spojeni.
{% endhint %}
<details>
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
<summary>Dodajte primer neuređenog komada</summary>
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
```c
#include <stdlib.h>
#include <stdio.h>
int main(void)
{
char *chunks[9];
int i;
// Loop to allocate memory 8 times
for (i = 0; i < 9; i++) {
chunks[i] = malloc(0x100);
if (chunks[i] == NULL) { // Check if malloc failed
fprintf(stderr, "Memory allocation failed at iteration %d\n", i);
return 1;
}
printf("Address of chunk %d: %p\n", i, (void *)chunks[i]);
}
// Loop to free the allocated memory
for (i = 0; i < 8; i++) {
free(chunks[i]);
}
return 0;
}
```
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Primetite kako alociramo i oslobađamo 9 blokova iste veličine tako da **popunimo tcache** i osmi je smešten u unsorted bin jer je **prevelik za fastbin**, a deveti nije oslobođen tako da deveti i osmi **neće biti spojeni sa vršnim blokom**.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Kompajlirajte i debagujte sa prekidnom tačkom u `ret` opcode-u iz `main` funkcije. Zatim pomoću `gef` možete videti da je tcache bin pun i da je jedan blok u unsorted binu:
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
```bash
gef➤ heap bins
──────────────────────────────────────────────────────────────────────────────── Tcachebins for thread 1 ────────────────────────────────────────────────────────────────────────────────
Tcachebins[idx=15, size=0x110, count=7] ← Chunk(addr=0xaaaaaaac1d10, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac1c00, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac1af0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac19e0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac18d0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac17c0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac12a0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
───────────────────────────────────────────────────────────────────────── Fastbins for arena at 0xfffff7f90b00 ─────────────────────────────────────────────────────────────────────────
Fastbins[idx=0, size=0x20] 0x00
Fastbins[idx=1, size=0x30] 0x00
Fastbins[idx=2, size=0x40] 0x00
Fastbins[idx=3, size=0x50] 0x00
Fastbins[idx=4, size=0x60] 0x00
Fastbins[idx=5, size=0x70] 0x00
Fastbins[idx=6, size=0x80] 0x00
─────────────────────────────────────────────────────────────────────── Unsorted Bin for arena at 0xfffff7f90b00 ───────────────────────────────────────────────────────────────────────
[+] unsorted_bins[0]: fw=0xaaaaaaac1e10, bk=0xaaaaaaac1e10
→ Chunk(addr=0xaaaaaaac1e20, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[+] Found 1 chunks in unsorted bin.
```
</details>
### Mali Bins
Mali binovi su brži od velikih binova, ali sporiji od brzih binova.
Svaki bin od 62 će imati **blokove iste veličine**: 16, 24, ... (sa maksimalnom veličinom od 504 bajta u 32 bitnom i 1024 u 64 bitnom režimu). Ovo pomaže u brzini pronalaženja binova gde treba alocirati prostor i ubacivanju i uklanjanju unosa sa ovih lista.
Ovako se računa veličina malog bina prema indeksu bina:
* Najmanja veličina: 2\*4\*indeks (npr. indeks 5 -> 40)
* Najveća veličina: 2\*8\*indeks (npr. indeks 5 -> 80)
```c
// From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711
#define NSMALLBINS 64
#define SMALLBIN_WIDTH MALLOC_ALIGNMENT
#define SMALLBIN_CORRECTION (MALLOC_ALIGNMENT > CHUNK_HDR_SZ)
#define MIN_LARGE_SIZE ((NSMALLBINS - SMALLBIN_CORRECTION) * SMALLBIN_WIDTH)
#define in_smallbin_range(sz) \
((unsigned long) (sz) < (unsigned long) MIN_LARGE_SIZE)
#define smallbin_index(sz) \
((SMALLBIN_WIDTH == 16 ? (((unsigned) (sz)) >> 4) : (((unsigned) (sz)) >> 3))\
+ SMALLBIN_CORRECTION)
```
Funkcija za izbor između malih i velikih binova:
```c
#define bin_index(sz) \
((in_smallbin_range (sz)) ? smallbin_index (sz) : largebin_index (sz))
```
<detalji>
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
<sumiraj>Dodajte primer malog bloka</sumiraj>
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
```c
#include <stdlib.h>
#include <stdio.h>
int main(void)
{
char *chunks[10];
int i;
// Loop to allocate memory 8 times
for (i = 0; i < 9; i++) {
chunks[i] = malloc(0x100);
if (chunks[i] == NULL) { // Check if malloc failed
fprintf(stderr, "Memory allocation failed at iteration %d\n", i);
return 1;
}
printf("Address of chunk %d: %p\n", i, (void *)chunks[i]);
}
// Loop to free the allocated memory
for (i = 0; i < 8; i++) {
free(chunks[i]);
}
chunks[9] = malloc(0x110);
return 0;
}
```
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Primetite kako alociramo i oslobađamo 9 blokova iste veličine tako da **popunjavaju tcache**, a osmi je smešten u unsorted bin jer je **prevelik za fastbin**, dok deveti nije oslobođen pa deveti i osmi **nisu spojeni sa vršnim blokom**. Zatim alociramo veći blok od 0x110 što dovodi do toga da **blok u unsorted binu pređe u small bin**.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Kompajlirajte i debagujte sa prekidnom tačkom u `ret` opcode-u iz `main` funkcije. Zatim, pomoću `gef` alata možete videti da je tcache bin pun i da je jedan blok u small binu:
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
```bash
gef➤ heap bins
──────────────────────────────────────────────────────────────────────────────── Tcachebins for thread 1 ────────────────────────────────────────────────────────────────────────────────
Tcachebins[idx=15, size=0x110, count=7] ← Chunk(addr=0xaaaaaaac1d10, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac1c00, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac1af0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac19e0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac18d0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac17c0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← Chunk(addr=0xaaaaaaac12a0, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
───────────────────────────────────────────────────────────────────────── Fastbins for arena at 0xfffff7f90b00 ─────────────────────────────────────────────────────────────────────────
Fastbins[idx=0, size=0x20] 0x00
Fastbins[idx=1, size=0x30] 0x00
Fastbins[idx=2, size=0x40] 0x00
Fastbins[idx=3, size=0x50] 0x00
Fastbins[idx=4, size=0x60] 0x00
Fastbins[idx=5, size=0x70] 0x00
Fastbins[idx=6, size=0x80] 0x00
─────────────────────────────────────────────────────────────────────── Unsorted Bin for arena at 0xfffff7f90b00 ───────────────────────────────────────────────────────────────────────
[+] Found 0 chunks in unsorted bin.
──────────────────────────────────────────────────────────────────────── Small Bins for arena at 0xfffff7f90b00 ────────────────────────────────────────────────────────────────────────
[+] small_bins[16]: fw=0xaaaaaaac1e10, bk=0xaaaaaaac1e10
→ Chunk(addr=0xaaaaaaac1e20, size=0x110, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[+] Found 1 chunks in 1 small non-empty bins.
```
</details>
### Velike kante
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Za razliku od malih kanti, koje upravljaju komadićima fiksnih veličina, **svaka velika kanta obrađuje opseg veličina komadića**. Ovo je fleksibilnije, omogućavajući sistemu da se prilagodi **različitim veličinama** bez potrebe za posebnom kantom za svaku veličinu.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
U alokatoru memorije, velike kante počinju tamo gde se završavaju male kante. Opsezi za velike kante postaju sve veći, što znači da prva kanta može obuhvatiti komadiće od 512 do 576 bajtova, dok sledeća obuhvata 576 do 640 bajtova. Ovaj obrazac se nastavlja, pri čemu najveća kanta sadrži sve komadiće iznad 1MB.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Velike kante sporije rade u poređenju sa malim kantama jer moraju **sortirati i pretraživati listu različitih veličina komadića kako bi pronašle najbolje odgovarajuće** za alokaciju. Kada se komadić ubaci u veliku kantu, mora biti sortiran, a prilikom alokacije memorije, sistem mora pronaći odgovarajući komadić. Ovaj dodatni rad ih čini **sporijim**, ali budući da su velike alokacije manje uobičajene od malih, to je prihvatljiva trgovina.
Postoje:
* 32 kante opsega 64B (sudaraju se sa malim kantama)
* 16 kanti opsega 512B (sudaraju se sa malim kantama)
* 8 kanti opsega 4096B (delimično se sudaraju sa malim kantama)
* 4 kante opsega 32768B
* 2 kante opsega 262144B
* 1 kanta za preostale veličine
<details>
<summary>Kod veličina velikih kanti</summary>
```c
// From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711
#define largebin_index_32(sz) \
(((((unsigned long) (sz)) >> 6) <= 38) ? 56 + (((unsigned long) (sz)) >> 6) :\
((((unsigned long) (sz)) >> 9) <= 20) ? 91 + (((unsigned long) (sz)) >> 9) :\
((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :\
((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :\
((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :\
126)
#define largebin_index_32_big(sz) \
(((((unsigned long) (sz)) >> 6) <= 45) ? 49 + (((unsigned long) (sz)) >> 6) :\
((((unsigned long) (sz)) >> 9) <= 20) ? 91 + (((unsigned long) (sz)) >> 9) :\
((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :\
((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :\
((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :\
126)
// XXX It remains to be seen whether it is good to keep the widths of
// XXX the buckets the same or whether it should be scaled by a factor
// XXX of two as well.
#define largebin_index_64(sz) \
(((((unsigned long) (sz)) >> 6) <= 48) ? 48 + (((unsigned long) (sz)) >> 6) :\
((((unsigned long) (sz)) >> 9) <= 20) ? 91 + (((unsigned long) (sz)) >> 9) :\
((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :\
((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :\
((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :\
126)
#define largebin_index(sz) \
(SIZE_SZ == 8 ? largebin_index_64 (sz) \
: MALLOC_ALIGNMENT == 16 ? largebin_index_32_big (sz) \
: largebin_index_32 (sz))
```
</details>
<details>
<summary>Dodajte primer velikog bloka</summary>
```c
#include <stdlib.h>
#include <stdio.h>
int main(void)
{
char *chunks[2];
chunks[0] = malloc(0x1500);
chunks[1] = malloc(0x1500);
free(chunks[0]);
chunks[0] = malloc(0x2000);
return 0;
}
```
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Izvrše se 2 velike alokacije, zatim se jedna oslobađa (stavlja u nesortirani bin) i vrši se veća alokacija (premeštanje oslobođene u nesortirani bin u veliki bin).
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Kompajlirajte to i debagujte sa prekidnom tačkom u `ret` opkodu iz `main` funkcije. Zatim, pomoću `gef` alata možete videti da je tcache bin pun i da je jedan blok u velikom binu:
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
```bash
gef➤ heap bin
──────────────────────────────────────────────────────────────────────────────── Tcachebins for thread 1 ────────────────────────────────────────────────────────────────────────────────
All tcachebins are empty
───────────────────────────────────────────────────────────────────────── Fastbins for arena at 0xfffff7f90b00 ─────────────────────────────────────────────────────────────────────────
Fastbins[idx=0, size=0x20] 0x00
Fastbins[idx=1, size=0x30] 0x00
Fastbins[idx=2, size=0x40] 0x00
Fastbins[idx=3, size=0x50] 0x00
Fastbins[idx=4, size=0x60] 0x00
Fastbins[idx=5, size=0x70] 0x00
Fastbins[idx=6, size=0x80] 0x00
─────────────────────────────────────────────────────────────────────── Unsorted Bin for arena at 0xfffff7f90b00 ───────────────────────────────────────────────────────────────────────
[+] Found 0 chunks in unsorted bin.
──────────────────────────────────────────────────────────────────────── Small Bins for arena at 0xfffff7f90b00 ────────────────────────────────────────────────────────────────────────
[+] Found 0 chunks in 0 small non-empty bins.
──────────────────────────────────────────────────────────────────────── Large Bins for arena at 0xfffff7f90b00 ────────────────────────────────────────────────────────────────────────
[+] large_bins[100]: fw=0xaaaaaaac1290, bk=0xaaaaaaac1290
→ Chunk(addr=0xaaaaaaac12a0, size=0x1510, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[+] Found 1 chunks in 1 large non-empty bins.
```
</details>
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
### Vrhunski komad
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
```c
// From https://github.com/bminor/glibc/blob/a07e000e82cb71238259e674529c37c12dc7d423/malloc/malloc.c#L1711
/*
Top
The top-most available chunk (i.e., the one bordering the end of
available memory) is treated specially. It is never included in
any bin, is used only if no other chunk is available, and is
released back to the system if it is very large (see
M_TRIM_THRESHOLD). Because top initially
points to its own bin with initial zero size, thus forcing
extension on the first malloc request, we avoid having any special
code in malloc to check whether it even exists yet. But we still
need to do so when getting memory from system, so we make
initial_top treat the bin as a legal but unusable chunk during the
interval between initialization and the first call to
sysmalloc. (This is somewhat delicate, since it relies on
the 2 preceding words to be zero during this interval as well.)
*/
/* Conveniently, the unsorted bin can be used as dummy top on first call */
#define initial_top(M) (unsorted_chunks (M))
```
Osnovno, ovo je deo koji sadrži sav trenutno dostupan heap. Kada se izvrši malloc, ako nema dostupnog slobodnog chunk-a za korišćenje, ovaj top chunk će smanjiti svoju veličinu pružajući potreban prostor.\
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Pokazivač na Top Chunk je smešten u strukturi `malloc_state`.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Osim toga, na početku je moguće koristiti nesortirani chunk kao top chunk.
<details>
<summary>Posmatrajte primer Top Chunk-a</summary>
```c
#include <stdlib.h>
#include <stdio.h>
int main(void)
{
char *chunk;
chunk = malloc(24);
printf("Address of the chunk: %p\n", (void *)chunk);
gets(chunk);
return 0;
}
```
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Nakon kompajliranja i debagovanja sa prekidnom tačkom u `ret` opkodu `main` funkcije, primetio sam da je malloc vratio adresu `0xaaaaaaac12a0` i ovo su blokovi:
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
```bash
gef➤ heap chunks
Chunk(addr=0xaaaaaaac1010, size=0x290, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac1010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................]
Chunk(addr=0xaaaaaaac12a0, size=0x20, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac12a0 41 41 41 41 41 41 41 00 00 00 00 00 00 00 00 00 AAAAAAA.........]
Chunk(addr=0xaaaaaaac12c0, size=0x410, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac12c0 41 64 64 72 65 73 73 20 6f 66 20 74 68 65 20 63 Address of the c]
Chunk(addr=0xaaaaaaac16d0, size=0x410, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)
[0x0000aaaaaaac16d0 41 41 41 41 41 41 41 0a 00 00 00 00 00 00 00 00 AAAAAAA.........]
Chunk(addr=0xaaaaaaac1ae0, size=0x20530, flags=PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA) ← top chunk
```
Gde se može videti da je vrhunski blok na adresi `0xaaaaaaac1ae0`. To nije iznenađenje jer je poslednji alocirani blok bio na `0xaaaaaaac12a0` sa veličinom `0x410` i `0xaaaaaaac12a0 + 0x410 = 0xaaaaaaac1ae0`.\
Takođe je moguće videti dužinu vrhunskog bloka na njegovom zaglavlju bloka:
```bash
gef➤ x/8wx 0xaaaaaaac1ae0 - 16
0xaaaaaaac1ad0: 0x00000000 0x00000000 0x00020531 0x00000000
0xaaaaaaac1ae0: 0x00000000 0x00000000 0x00000000 0x00000000
```
</details>
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
### Poslednji Ostatatak
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Kada se koristi malloc i deo je podeljen (na primer iz nesortirane kante ili iz vršnog bloka), deo koji je kreiran od preostalog dela podeljenog bloka naziva se Poslednji Ostatatak i njegov pokazivač se čuva u strukturi `malloc_state`.
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
## Tok Dodele
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Pogledajte:
{% content-ref url="heap-memory-functions/malloc-and-sysmalloc.md" %}
[malloc-and-sysmalloc.md](heap-memory-functions/malloc-and-sysmalloc.md)
{% endcontent-ref %}
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
## Tok Oslobađanja
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Pogledajte:
{% content-ref url="heap-memory-functions/free.md" %}
[free.md](heap-memory-functions/free.md)
{% endcontent-ref %}
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
## Provere Bezbednosti Funkcija Heap-a
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
Proverite provere bezbednosti koje se vrše od strane često korišćenih funkcija u heap-u u:
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
{% content-ref url="heap-memory-functions/heap-functions-security-checks.md" %}
[heap-functions-security-checks.md](heap-memory-functions/heap-functions-security-checks.md)
{% endcontent-ref %}
## Reference
* [https://azeria-labs.com/heap-exploitation-part-1-understanding-the-glibc-heap-implementation/](https://azeria-labs.com/heap-exploitation-part-1-understanding-the-glibc-heap-implementation/)
* [https://azeria-labs.com/heap-exploitation-part-2-glibc-heap-free-bins/](https://azeria-labs.com/heap-exploitation-part-2-glibc-heap-free-bins/)
* [https://heap-exploitation.dhavalkapil.com/diving\_into\_glibc\_heap/core\_functions](https://heap-exploitation.dhavalkapil.com/diving\_into\_glibc\_heap/core\_functions)
* [https://ctf-wiki.mahaloz.re/pwn/linux/glibc-heap/implementation/tcache/](https://ctf-wiki.mahaloz.re/pwn/linux/glibc-heap/implementation/tcache/)
<details>
<summary><strong>Naučite hakovanje AWS-a od nule do heroja sa</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
Drugi načini podrške HackTricks-u:
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
* Ako želite da vidite svoju **kompaniju reklamiranu na HackTricks-u** ili da **preuzmete HackTricks u PDF formatu** proverite [**PLANOVE ZA PRIJAVU**](https://github.com/sponsors/carlospolop)!
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
* Nabavite [**zvanični PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Otkrijte [**The PEASS Family**](https://opensea.io/collection/the-peass-family), našu kolekciju ekskluzivnih [**NFT-ova**](https://opensea.io/collection/the-peass-family)
Translated ['binary-exploitation/libc-heap/bins-and-memory-allocations.m
2024-07-17 18:07:32 +00:00
* **Pridružite se** 💬 [**Discord grupi**](https://discord.gg/hRep4RUj7f) ili **telegram grupi**](https://t.me/peass) ili nas **pratite** na **Twitteru** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
Translated ['binary-exploitation/arbitrary-write-2-exec/aw2exec-__malloc
2024-06-16 09:03:27 +00:00
* **Podelite svoje hakovanje trikove slanjem PR-ova na** [**HackTricks**](https://github.com/carlospolop/hacktricks) i [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repozitorijume.
</details>
Reference in a new issue Copy permalink