Descrption#

This is the reference material for me to learn about File Structure Exploitation, As I am new here , there may not be advanced explanation here but I hope it can be of some help in understanding the File Structure and Its attack premitive here, ’-’ -

File Structure Internals#

_IO_FILE#

1
struct _IO_FILE
2
{
3
  int _flags;    /* High-order word is _IO_MAGIC; rest is flags. */
4

5
  /* The following pointers correspond to the C++ streambuf protocol. */
6
  char *_IO_read_ptr;  /* Current read pointer */
7
  char *_IO_read_end;  /* End of get area. */
8
  char *_IO_read_base;  /* Start of putback+get area. */
9
  char *_IO_write_base;  /* Start of put area. */
10
  char *_IO_write_ptr;  /* Current put pointer. */
11
  char *_IO_write_end;  /* End of put area. */
12
  char *_IO_buf_base;  /* Start of reserve area. */
13
  char *_IO_buf_end;  /* End of reserve area. */
14

15
  /* The following fields are used to support backing up and undo. */
16
  char *_IO_save_base; /* Pointer to start of non-current get area. */
17
  char *_IO_backup_base;  /* Pointer to first valid character of backup area */
18
  char *_IO_save_end; /* Pointer to end of non-current get area. */
19

20
  struct _IO_marker *_markers;
21

22
  struct _IO_FILE *_chain;
23

24
  int _fileno;
25
  int _flags2;
26
  __off_t _old_offset; /* This used to be _offset but it's too small.  */
27

28
  /* 1+column number of pbase(); 0 is unknown. */
29
  unsigned short _cur_column;
30
  signed char _vtable_offset;
31
  char _shortbuf[1];
32

33
  _IO_lock_t *_lock;
34
#ifdef _IO_USE_OLD_IO_FILE
35
};

To Get a better understanding of this file struct refer [here].
So getting good understanding on these internals helps us in exploitation part.

Leak & Write a memory#

_IO_new_file_xsputn - This function internally calls the write function, which does write syscall to fd and by corroupting the FileStructure like stdout, we can get a arbitary memory leak.
Trigger function : puts, fwrite etc…
_IO_new_file_underflow - This function internally calls read syscall , Which does read to a arbitary memory , by corroupting the FileStructure.
Trigger function : scanf, fread etc..

Vtable hijacking#

In the Phase of Exploiting the File Structure, The most important thing is vable , cause it has pointer that points to a jump table (like _IO_file_jumps or _IO_wfile_jumps), So by faking a prt, we can trick the libc to jump/call arbitary controlled address.

Here we cannot directly control the vtable to point the abitary address because, there is a check _IO_vtable_check, that check if the call address is inside a specic location inside the libc , if not then it aborts , but it can be bypassed by making the vtable to jump to wide vtable, which is used when there is a wide char set in the file operations. As wide vtable is inside the protected area and the wide vtable does not have that _IO_vtable_check check , we can make this wide vtable to point to a arbitary location to jump/call our controlled memory.

pwn tool#

1
from pwn import FileStructure
2

3
fp = FileStructure()
4
{ flags: 0x0
5
 _IO_read_ptr: 0x0
6
 _IO_read_end: 0x0
7
 _IO_read_base: 0x0
8
 _IO_write_base: 0x0
9
 _IO_write_ptr: 0x0
10
 _IO_write_end: 0x0
11
 _IO_buf_base: 0x0
12
 _IO_buf_end: 0x0
13
 _IO_save_base: 0x0
14
 _IO_backup_base: 0x0
15
 _IO_save_end: 0x0
16
 markers: 0x0
17
 chain: 0x0
18
 fileno: 0x0
19
 _flags2: 0x0
20
 _old_offset: 0xffffffff
21
 _cur_column: 0x0
22
 _vtable_offset: 0x0
23
 _shortbuf: 0x0
24
 unknown1: 0x0
25
 _lock: 0x0
26
 _offset: 0xffffffffffffffff
27
 _codecvt: 0x0
28
 _wide_data: 0x0
29
 unknown2: 0x0
30
 vtable: 0x0}