shellphish / how2heap

A repository for learning various heap exploitation techniques.
MIT License
7.12k stars 1.13k forks source link

Script for the preparation of binary files for execution with non-system glibc #152

Closed fr0ster closed 2 years ago

fr0ster commented 2 years ago

Hi everybody I try used how2heap but got troubles with building old libc on my system. Before I just download needed version of libc and set rpath and interpreter by patchelf, so I wrote script that download glibc, extract into folder and set rpath/interpreter for target binary. As additional ability I added keys for execution over gdb/radare2.

I hope it will be useful as additional features of yours project :)

Kyle-Kyle commented 2 years ago

I appreciate the help in extending how2heap. The goal of this patch is to allow users to debug old/new heap mechanisms by building another glibc. And I believe this is an important feature. There is one thing I don't understand though: what's the difference between this patch and existing glibc_build.sh and glibc_run.sh scripts? I think both build the target libc version and run programs with the libc.

fr0ster commented 2 years ago

Sometime glibc_build works uncorrect and cant build needed version glibc. This patch just give ability download glibc from internet. Script glibc_run work after successful execution glib_build only.

Kyle-Kyle commented 2 years ago

I think currently the pull request is bloated. It even has compiled binaries in it. Can you please clean up the pull request?

Sometime glibc_build works uncorrect and cant build needed version glibc.

Can you please give an example here? Maybe we can fix it in glibc_build. If it cannot be fixed, then we can replace it with the pull request.

fr0ster commented 2 years ago

I try build glibc for 2.34 and

$ uname -a
Linux homebox 5.10.0-14-amd64 #1 SMP Debian 5.10.113-1 (2022-04-29) x86_64 GNU/Linux
$ uname -m
x86_64
$ ./glibc_build.sh 2.34 &> log.txt
$ tail log.txt 
gcc   -shared -static-libgcc -Wl,-O1  -Wl,-z,defs -Wl,-dynamic-linker=/home/alex/prj/zero/heaplabb0x/how2heap/glibc_versions/2.34/x64_tcache/lib/ld-linux-x86-64.so.2  -B/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/csu/  -Wl,--version-script=/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/libm.map -Wl,-soname=libm.so.6 -Wl,-z,combreloc -Wl,-z,relro -Wl,--hash-style=both   -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/elf -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/dlfcn -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nss -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nis -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/rt -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/resolv -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/mathvec -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/support -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/crypt -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nptl -Wl,-rpath-link=/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/elf:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/dlfcn:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nss:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nis:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/rt:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/resolv:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/mathvec:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/support:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/crypt:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nptl -o /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so -T /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/shlib.lds /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/csu/abi-note.o -Wl,--whole-archive /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm_pic.a -Wl,--no-whole-archive   -Wl,--start-group /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/libc.so /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/libc_nonshared.a -Wl,--as-needed /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/elf/ld.so -Wl,--no-as-needed -Wl,--end-group
rm -f /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6.new
/bin/sh ../scripts/rellns-sh /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6.new
mv -f /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6.new /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6
make[2]: *** No rule to make target '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/mathvec/libmvec.so.1', needed by '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_versions/2.34/x64_tcache/lib/libm.so'.  Stop.
make[2]: Leaving directory '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_src/math'
make[1]: *** [Makefile:478: math/subdir_install] Error 2
make[1]: Leaving directory '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_src'
make: *** [Makefile:12: install] Ошибка 2

It's log for glibc 2.23

$ ./glibc_build.sh 2.23 &> log23.txt
$ tail log23.txt                   
../sysdeps/generic/ldsodefs.h:385:7: note: while referencing 'slotinfo'
385 |     } slotinfo[0];
|       ^~~~~~~~
cc1: all warnings being treated as errors
make[2]: *** [../o-iterator.mk:9: /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/csu/libc-tls.o] Error 1
make[2]: Leaving directory '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_src/csu'
make[1]: *** [Makefile:214: csu/subdir_lib] Error 2
make[1]: Leaving directory '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_src'
make: *** [Makefile:12: install] Ошибка 2

I think about using docker for building and debugging binaties with non-system glibc.

Kyle-Kyle commented 2 years ago

I just fixed the glibc_build/glibc_run scripts. The branch is here: https://github.com/shellphish/how2heap/commit/20feb34b16fbe870253ec3f403ec2365dbd1cdd8

Can you please check whether it works?

fr0ster commented 2 years ago

I just fixed the glibc_build/glibc_run scripts. The branch is here: 20feb34

Can you please check whether it works?

Tried new branch but any result

$ ./glibc_build.sh 2.23 &> log23.txt
$ tail log23.txt
gcc   -shared -static-libgcc -Wl,-O1  -Wl,-z,defs -Wl,-dynamic-linker=/home/alex/prj/zero/heaplabb0x/how2heap/glibc_versions/2.23/x64_tcache/lib/ld-linux-x86-64.so.2  -B/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/csu/  -Wl,--version-script=/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/libm.map -Wl,-soname=libm.so.6 -Wl,-z,combreloc -Wl,-z,relro -Wl,--hash-style=both  -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/elf -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/dlfcn -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nss -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nis -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/rt -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/resolv -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/crypt -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/mathvec -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nptl -Wl,-rpath-link=/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/elf:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/dlfcn:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nss:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nis:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/rt:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/resolv:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/crypt:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/mathvec:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nptl -o /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so  /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/csu/abi-note.o -Wl,--whole-archive /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm_pic.a -Wl,--no-whole-archive  -Wl,--start-group /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/libc.so /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/libc_nonshared.a -Wl,--as-needed /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/elf/ld.so -Wl,--no-as-needed -Wl,--end-group
rm -f /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6.new
/bin/sh ../scripts/rellns-sh /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6.new
mv -f /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6.new /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6
make[2]: *** No rule to make target '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/mathvec/libmvec.so.1', needed by '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_versions/2.23/x64_tcache/lib/libm.so'.  Stop.
make[2]: Leaving directory '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_src/math'
make[1]: *** [Makefile:214: math/subdir_install] Error 2
make[1]: Leaving directory '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_src'
make: *** [Makefile:12: install] Ошибка 2
$/glibc_build.sh 2.34 &> log34.txt
$ tail log34.txt
gcc   -shared -static-libgcc -Wl,-O1  -Wl,-z,defs -Wl,-dynamic-linker=/home/alex/prj/zero/heaplabb0x/how2heap/glibc_versions/2.34/x64_tcache/lib/ld-linux-x86-64.so.2  -B/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/csu/  -Wl,--version-script=/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/libm.map -Wl,-soname=libm.so.6 -Wl,-z,combreloc -Wl,-z,relro -Wl,--hash-style=both   -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/elf -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/dlfcn -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nss -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nis -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/rt -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/resolv -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/mathvec -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/support -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/crypt -L/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nptl -Wl,-rpath-link=/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/elf:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/dlfcn:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nss:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nis:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/rt:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/resolv:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/mathvec:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/support:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/crypt:/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/nptl -o /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so -T /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/shlib.lds /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/csu/abi-note.o -Wl,--whole-archive /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm_pic.a -Wl,--no-whole-archive   -Wl,--start-group /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/libc.so /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/libc_nonshared.a -Wl,--as-needed /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/elf/ld.so -Wl,--no-as-needed -Wl,--end-group
rm -f /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6.new
/bin/sh ../scripts/rellns-sh /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6.new
mv -f /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6.new /home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/math/libm.so.6
make[2]: *** No rule to make target '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_build/mathvec/libmvec.so.1', needed by '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_versions/2.34/x64_tcache/lib/libm.so'.  Stop.
make[2]: Leaving directory '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_src/math'
make[1]: *** [Makefile:478: math/subdir_install] Error 2
make[1]: Leaving directory '/home/alex/prj/zero/heaplabb0x/how2heap/glibc_src'
make: *** [Makefile:12: install] Ошибка 2
Kyle-Kyle commented 2 years ago

After playing with both glibc_build and the PR. I believe this PR is better than the existing framework. Since glibc_build/glibc_run has the same purpose as this PR and they are broken. I think it is better to just replace them with this PR (basically, mv prepared_binary.sh glibc_run.sh). And please try to initialize the submodule in the beginning of the script as well. Thanks!

fr0ster commented 2 years ago

After playing with both glibc_build and the PR. I believe this PR is better than the existing framework. Since glibc_build/glibc_run has the same purpose as this PR and they are broken. I think it is better to just replace them with this PR (basically, mv prepared_binary.sh glibc_run.sh). And please try to initialize the submodule in the beginning of the script as well. Thanks!

Should I make new PR or I cat just add new commit in this PR?

fr0ster commented 2 years ago

I renamed prepared_binary.sh to glibc_run.sh and renabe option for GDB debugging from -g to -gdb

Kyle-Kyle commented 2 years ago

the PR looks awesome now! Thanks!